Risk Monitoring and Reporting CISM Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   After a major security incident, the CISO conducts a post-incident review. The review reveals that the risk register did not include a specific risk that contributed to the incident. What is the most important follow-up action?

   • AAdd the missing risk to the risk register and update the risk assessment process to identify similar risks.
   • BReport the incident to the board and close the matter.
   • CBlame the risk owner for not identifying the risk.
   • DIncrease the frequency of risk assessments to monthly.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A multinational corporation has a board of directors that meets quarterly. The CISO needs to provide a concise overview of the organization's top risks, trends, and the effectiveness of risk treatment. Which reporting approach is most appropriate for this audience?

   • AA verbal update during the board meeting without any written documentation.
   • BA dashboard with key risk indicators, trend lines, and a summary of risk treatment status.
   • CAn email to the board members containing the full risk register with all residual risk ratings.
   • DA detailed technical report listing every vulnerability and its CVSS score.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A key risk indicator for data breach exposure has exceeded its warning threshold and is now above the risk appetite. The risk owner has been notified but has not taken action. What should the CISO do next?

   • AUpdate the risk register to reflect the new risk level and continue monitoring.
   • BRevise the risk appetite to align with the current risk level.
   • CWait for the next scheduled risk committee meeting to discuss the issue.
   • DEscalate the issue to senior management with a recommended action plan.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   How can monitoring and reporting results be used to improve the risk management process?

   • ABy eliminating the need for future risk assessments
   • BBy identifying areas for improvement in risk assessment and treatment
   • CBy ignoring lessons learned from past incidents
   • DBy reducing the frequency of all risk reporting
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A risk owner has completed a risk treatment plan that reduces the likelihood of a key risk from 'likely' to 'unlikely'. What is the most important action for the risk manager to take to maintain an accurate risk register?

   • AClose the risk entry in the register since the treatment is complete.
   • BWait until the next quarterly review to update the register.
   • CUpdate the risk register with the new likelihood rating and the residual risk level.
   • DNotify the board of directors about the change immediately.
   Reveal Solution Discussion Select an answer first