Risk Treatment / Risk Response Options CISM Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A multinational corporation is assessing the risk of a data breach in its cloud infrastructure. The risk appetite is low, but the board is concerned about the cost of controls. The security manager has identified three options: implement advanced threat detection (cost: $1M/year), purchase cyber insurance (premium: $500K/year), or accept the risk. The expected annual loss is $800K. The board wants to minimize residual risk while being cost-conscious. Which option should the security manager recommend?

   • APurchase cyber insurance because it transfers the financial risk at a lower cost than the expected loss
   • BCombine insurance with a limited set of threat detection controls
   • CImplement advanced threat detection because it reduces both likelihood and impact
   • DAccept the risk because the expected loss is less than the cost of controls
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A pharmaceutical company is considering a partnership with a contract research organization (CRO) to conduct clinical trials. The risk assessment identifies a high risk of intellectual property (IP) theft. The company's risk appetite is low, and the board wants to protect IP while still benefiting from the partnership. Which risk treatment approach is most appropriate?

   • AAvoid the risk by not entering the partnership
   • BCombine mitigation and transfer by implementing data controls and contractual penalties for IP breach
   • CMitigate the risk by implementing strict access controls and monitoring on shared data
   • DTransfer the risk by requiring the CRO to sign a confidentiality agreement
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Why is ongoing monitoring of risk treatment effectiveness important?

   • ATo transfer all risks to insurance
   • BTo ensure risks remain within acceptable levels over time
   • CTo eliminate the need for periodic risk assessments
   • DTo reduce the number of security controls
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A manufacturing company decided to mitigate the risk of intellectual property theft by implementing data loss prevention (DLP) and access controls. The security manager must now develop a risk treatment plan. Which element is essential to include in the plan?

   • AThe name of the vendor that will supply the DLP software
   • BA detailed vulnerability scan report for all systems
   • CA list of all employees who will be trained on DLP
   • DThe residual risk level after mitigation and the risk owner
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   An organization decides to stop a business activity because the associated risk exceeds its risk appetite and no cost-effective controls can reduce it. Which risk treatment option is being applied?

   • AAccept
   • BMitigate
   • CAvoid
   • DTransfer
   Reveal Solution Discussion Select an answer first