Risk Treatment / Risk Response Options CISM Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which of the following best describes the risk treatment option of risk avoidance?

   • AReducing the likelihood or impact of the risk through controls
   • BEliminating the activity or condition that creates the risk
   • CShifting the risk to another party through contracts or insurance
   • DFormally acknowledging the risk without taking action
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   An organization has implemented a risk treatment measure. What should be done periodically to ensure the measure remains effective?

   • AWait for an incident to occur before reviewing
   • BReview and test the control's effectiveness
   • CRemove the control once implemented
   • DAssume the control works without checking
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A hospital is evaluating the risk of a ransomware attack. The inherent risk is likelihood 4 and impact 5. After implementing backups and staff training, the residual risk is assessed as likelihood 2 and impact 4. The hospital's risk tolerance is a score of 10. However, the board is concerned that the impact of a successful attack could be higher than estimated due to potential regulatory fines. What should the security manager do?

   • ATransfer the risk by purchasing cyber insurance to cover regulatory fines
   • BImplement additional technical controls to reduce likelihood to 1
   • CAccept the residual risk because the score is within the tolerance threshold
   • DReassess the impact rating to account for regulatory fines and recalculate residual risk
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   When implementing a new security control as part of risk treatment, which of the following should be done?

   • AImplement the control without updating policies
   • BKeep the control a secret to avoid resistance
   • CRemove the control after a short period
   • DProvide training to employees on the new control
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A company implemented a new access control system to mitigate the risk of insider threats. A year later, the security manager is reviewing the risk treatment plan. Which finding would indicate that the treatment is no longer effective?

   • AThe risk owner has changed due to reorganization
   • BThe company has not updated the access control policies since implementation
   • CThe access control system is functioning as designed, but no insider incidents have occurred
   • DThe residual risk score has increased because new insider threat vectors have emerged
   Reveal Solution Discussion Select an answer first