Risk Treatment / Risk Response Options CISM Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   When selecting a risk treatment option, which of the following should be considered?

   • AThe number of risks identified
   • BThe age of the risk assessment
   • CCost-benefit analysis, risk appetite, and organizational objectives
   • DThe size of the IT department
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A bank implemented a new fraud detection system to mitigate the risk of fraudulent transactions. Six months later, the security manager wants to verify that the control is still effective and that residual risk remains within the bank's tolerance. Which activity should the security manager perform?

   • ARemove the risk from the risk register because the control is implemented
   • BReclassify the risk as accepted because the system is in place
   • CTransfer the risk to the fraud detection vendor
   • DReview fraud detection logs and incident reports to assess the control's performance
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A government agency is considering a new online service that would allow citizens to file tax returns. A risk assessment reveals that the service would require storing highly sensitive personal data, and the agency lacks the resources to implement adequate security controls. The agency's risk appetite is very low, and the project is not mandated by law. Which risk treatment option is most appropriate?

   • AAvoid the risk by not implementing the online service
   • BTransfer the risk by outsourcing the service to a cloud provider
   • CMitigate the risk by hiring temporary security staff
   • DAccept the risk because the service would benefit citizens
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   A company is considering a new data analytics project that would require collecting sensitive customer data. The risk assessment shows that the risk of a data breach is high and cannot be reduced to an acceptable level within the project's budget. Which action best exemplifies risk avoidance?

   • AImplementing encryption and access controls
   • BPurchasing cyber liability insurance
   • CDeciding not to proceed with the project
   • DAccepting the risk and proceeding with the project
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   An organization decides to accept a risk because the cost of mitigation exceeds the potential loss. Which of the following must be documented for this acceptance to be formal?

   • AThe residual risk level and the rationale for acceptance
   • BThe list of controls that were implemented
   • CThe plan to eliminate the risk in the future
   • DThe insurance policy details
   Reveal Solution Discussion Select an answer first