Risk Treatment / Risk Response Options CISM Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   An organization has identified a risk of data loss due to hardware failure. Which of the following is a risk mitigation measure?

   • AImplementing regular backups and testing restoration procedures
   • BSigning a contract with a cloud provider that guarantees uptime
   • CRemoving the hardware that stores the data
   • DDeciding to accept the risk because the data is not critical
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   An organization has implemented controls to reduce a risk's likelihood from high to medium. The remaining risk is still above the organization's risk tolerance. What should the organization do?

   • AImplement additional risk treatment measures
   • BTransfer the risk to an insurer
   • CAccept the risk without further action
   • DIgnore the risk because controls were implemented
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is the primary purpose of a risk treatment plan?

   • ATo document how selected risk responses will be implemented
   • BTo eliminate all risks from the organization
   • CTo provide a list of all potential risks
   • DTo replace the need for ongoing risk monitoring
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A financial institution is implementing a new security awareness training program to mitigate the risk of social engineering. The security manager needs to ensure the training is effective and integrated into the organization's culture. Which action is most important during the implementation phase?

   • APurchase cyber insurance to cover losses from social engineering
   • BConduct a phishing simulation to measure the training's effectiveness
   • CRemove the risk from the risk register because training is implemented
   • DSend a one-time email to all employees about the training
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A hospital's risk assessment identified a ransomware risk with an inherent likelihood of 4 (on a 5-point scale) and impact of 5. After implementing endpoint detection, offline backups, and staff training, the security manager estimates likelihood drops to 2 and impact to 4. The hospital's risk tolerance threshold is a risk score of 10 (likelihood × impact). What should the security manager do next?

   • AReassess the inherent risk because the controls are not fully effective
   • BAccept the residual risk because the score is within the tolerance threshold
   • CTransfer the residual risk to the cyber insurance provider
   • DImplement additional controls to reduce the residual risk score to zero
   Reveal Solution Discussion Select an answer first