Which of the following is an example of a risk mitigation measure?

Implementing multi-factor authentication to reduce the likelihood of unauthorized access

Purchasing an insurance policy to cover potential financial losses

Documenting that the risk is within the organization's risk appetite

Discontinuing a service that poses an unacceptable risk

A retail chain is implementing a new multi-factor authentication (MFA) system to mitigate the risk of account takeover. The security manager needs to ensure the controls are effectively integrated into daily operations. Which action is most important for successful implementation?

Communicate the change to all employees and provide training on the new MFA process

Document the MFA configuration in the risk register only

Disable all legacy authentication methods immediately

Purchase cyber insurance to cover potential account takeover losses

A mid-sized e-commerce company lacks in-house expertise to manage its web application firewall (WAF) and DDoS protection. A managed security service provider (MSSP) offers 24/7 monitoring and incident response for a fixed monthly fee. The company's risk appetite is moderate, and the board wants to reduce operational burden while maintaining security. Which risk treatment option is the company applying by contracting with the MSSP?

Risk avoidance, because the company no longer manages the WAF internally

Risk mitigation, because the MSSP reduces the likelihood of attacks

Risk transfer, because the MSSP assumes responsibility for managing certain security risks

Risk acceptance, because the company accepts the MSSP's level of service

Certified Information Security Manager

Domain 2Objective 4

Risk Treatment / Risk Response Options CISM Practice Questions (Page 6)

Part of the Domain 2: Information Security Risk Management domain, which accounts for 20% of the CISM exam.

35questions here

7free pages

10concepts

20%of the exam

Questions 26–30

26foundation · easy
Which of the following is an example of a risk mitigation measure?
Select an answer first
27application · medium
A retail chain is implementing a new multi-factor authentication (MFA) system to mitigate the risk of account takeover. The security manager needs to ensure the controls are effectively integrated into daily operations. Which action is most important for successful implementation?
Select an answer first
28foundation · easy
A company outsources its payment processing to a third-party provider. The contract specifies that the provider is liable for any security breach in the payment system. Which risk treatment option is the company applying?
Select an answer first
29application · medium
A mid-sized e-commerce company lacks in-house expertise to manage its web application firewall (WAF) and DDoS protection. A managed security service provider (MSSP) offers 24/7 monitoring and incident response for a fixed monthly fee. The company's risk appetite is moderate, and the board wants to reduce operational burden while maintaining security. Which risk treatment option is the company applying by contracting with the MSSP?
Select an answer first
30foundation · easy
A risk has a potential financial impact of $50,000. The cost to implement a mitigation control is $80,000. The organization's risk appetite is low. Which risk treatment option is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CISM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISACA. “CISM” is a trademark of its owner, used for identification only.

Risk Treatment / Risk Response Options CISM Practice Questions (Page 6)

Questions 26–30

Which of the following is an example of a risk mitigation measure?

A retail chain is implementing a new multi-factor authentication (MFA) system to mitigate the risk of account takeover. The security manager needs to ensure the controls are effectively integrated into daily operations. Which action is most important for successful implementation?

A company outsources its payment processing to a third-party provider. The contract specifies that the provider is liable for any security breach in the payment system. Which risk treatment option is the company applying?

A risk has a potential financial impact of $50,000. The cost to implement a mitigation control is $80,000. The organization's risk appetite is low. Which risk treatment option is most appropriate?

Keep studying — Domain 2: Information Security Risk Management