Risk Monitoring and Reporting CISM Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   What is the purpose of maintaining and updating the risk register?

   • ATo serve as a static record of risks identified at the start of a project
   • BTo reflect changes in risk assessments, treatment plans, and residual risk
   • CTo replace the need for risk assessments
   • DTo store all historical incident reports
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which situation would typically trigger risk escalation?

   • AA risk level exceeding the organization's risk tolerance threshold
   • BA minor change in a low-priority risk
   • CA routine update to the risk register
   • DA scheduled meeting with the security team
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   Why is it important to tailor risk communication to different audiences?

   • ATo avoid sharing any risk information with anyone
   • BTo satisfy the preferences of the security team
   • CTo make the communication process more complex
   • DTo ensure each audience understands the information relevant to their role
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A security team needs to report a critical vulnerability to the IT operations team, which will be responsible for patching. The IT team is not familiar with security risk terminology. What is the best way to communicate the urgency?

   • AEscalate the issue to senior management and let them decide.
   • BProvide the CVSS score and a detailed technical description of the vulnerability.
   • CExplain the potential business impact and the required action in non-technical terms.
   • DSend an email with the vulnerability scan report and ask them to review it.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A manufacturing company has implemented a new production system that introduces several new risks. The CISO wants to ensure that these risks are continuously monitored to keep them within the organization's risk appetite. Which approach is most effective?

   • AConduct a one-time risk assessment and document the findings.
   • BWait until the next audit to identify any issues with the new system.
   • CAdd the new risks to the risk register and review them annually.
   • DEstablish KRIs for the new system and integrate them into the existing risk monitoring process.
   Reveal Solution Discussion Select an answer first