Risk Treatment / Risk Response Options CISM Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A software development company identified a risk that a critical vulnerability in a third-party library could be exploited. The company cannot replace the library because it is essential to the product. The security manager must reduce the risk to an acceptable level. Which action best represents risk mitigation?

   • APurchase a cybersecurity insurance policy to cover potential breach costs
   • BStop using the third-party library entirely
   • CImplement a web application firewall and strict input validation to reduce exploitability
   • DDocument the risk as accepted in the risk register
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A university decided to mitigate the risk of unauthorized access to student records by implementing role-based access control (RBAC). The security manager is developing the risk treatment plan. Which element should be included to ensure the plan is actionable?

   • AA summary of the risk assessment methodology used
   • BA list of all student records that will be protected
   • CThe vendor's product brochure for the RBAC software
   • DA timeline for implementation and the name of the responsible department
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which of the following is a key step in implementing risk treatment measures?

   • ADeleting the risk from the risk register
   • BCommunicating the changes to relevant stakeholders
   • CIgnoring feedback from employees
   • DImplementing all measures without testing
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which of the following lists the four primary risk treatment options as defined in information security risk management?

   • AIdentify, analyze, evaluate, treat
   • BAvoid, mitigate, transfer, accept
   • CPrevent, detect, correct, recover
   • DReduce, retain, reject, insure
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A small nonprofit organization identified a risk of phishing attacks. The likelihood is low and the impact is limited to minor disruption. The cost to implement advanced email filtering exceeds the potential loss. The board has a moderate risk appetite and has formally decided to accept the risk. What must the security manager do to ensure this decision is valid?

   • AImplement the email filtering anyway to be safe
   • BDocument the acceptance decision, including the risk level and the rationale, and obtain sign-off from the board
   • CTransfer the risk to an insurance company without board approval
   • DRemove the risk from the risk register because it is accepted
   Reveal Solution Discussion Select an answer first