A company is using a 4x4 qualitative risk matrix with likelihood ratings of 1-4 and impact ratings of 1-4. The risk of a phishing attack is rated as likelihood 3 and impact 2. The risk of a power outage is rated as likelihood 2 and impact 4. If the risk score is calculated as likelihood × impact, which risk has the higher score?

The phishing attack, because it has a higher likelihood.

Both have the same score, because the product of likelihood and impact is equal.

The power outage, because its score is 8, which is higher than the phishing attack's score of 6.

The risk with the higher impact should always be prioritized, regardless of the score.

A government agency must conduct a risk assessment for a new public-facing system. The agency has limited historical data on cyber incidents but has detailed cost estimates for potential system failures. The assessment must produce results that can be used to justify budget requests to the legislature. Which approach is most appropriate?

Qualitative, because it is faster and does not require historical data.

Quantitative, because it provides monetary values that can support budget requests.

Hybrid, using qualitative analysis for likelihood and quantitative analysis for impact.

A purely qualitative approach, because it is the only method accepted by government agencies.

A company is identifying risk factors for its new mobile banking app. Which of the following is an example of an internal vulnerability?

A competitor launching a similar app with better features.

A lack of encryption on the app's data transmission.

The app's user base of 10,000 customers.

A new regulation requiring stronger customer authentication.

A risk assessment team has completed a qualitative analysis and produced a risk register. The team is now preparing to communicate the results to different stakeholders. Which of the following is the most appropriate communication strategy?

Tailor the communication to each audience: a high-level summary for executives and a detailed register for IT and operational teams.

Provide the same detailed risk register to all stakeholders to ensure transparency.

Wait for the next annual meeting to present the results.

Communicate only the top five risks to all stakeholders to avoid overwhelming them.

What is the primary purpose of using a risk matrix in qualitative risk analysis?

To prioritize risks by combining likelihood and impact ratings

To eliminate all risks that are rated as low likelihood

To calculate the exact monetary loss for each risk

To assign a numerical probability percentage to each risk

Information Systems Security Management Professional

Domain 3Objective 3

3.3 Conduct Risk Assessments ISSMP Practice Questions (Page 2)

Part of the Risk Management domain, which accounts for 20% of the ISSMP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~14–24 in this domain), expect 4–6 from this objective — we provide 26 practice questions to prepare you well beyond it. (estimate)

26questions here

6free pages

5concepts

20%of the exam

Questions 6–10

6application · medium
A company is using a 4x4 qualitative risk matrix with likelihood ratings of 1-4 and impact ratings of 1-4. The risk of a phishing attack is rated as likelihood 3 and impact 2. The risk of a power outage is rated as likelihood 2 and impact 4. If the risk score is calculated as likelihood × impact, which risk has the higher score?
Select an answer first
7expert · hard
A government agency must conduct a risk assessment for a new public-facing system. The agency has limited historical data on cyber incidents but has detailed cost estimates for potential system failures. The assessment must produce results that can be used to justify budget requests to the legislature. Which approach is most appropriate?
Select an answer first
8application · medium
A company is identifying risk factors for its new mobile banking app. Which of the following is an example of an internal vulnerability?
Select an answer first
9expert · hard
A risk assessment team has completed a qualitative analysis and produced a risk register. The team is now preparing to communicate the results to different stakeholders. Which of the following is the most appropriate communication strategy?
Select an answer first
10foundation · easy
What is the primary purpose of using a risk matrix in qualitative risk analysis?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ISSMP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “ISSMP” is a trademark of its owner, used for identification only.

3.3 Conduct Risk Assessments ISSMP Practice Questions (Page 2)

Questions 6–10

A company is identifying risk factors for its new mobile banking app. Which of the following is an example of an internal vulnerability?

A risk assessment team has completed a qualitative analysis and produced a risk register. The team is now preparing to communicate the results to different stakeholders. Which of the following is the most appropriate communication strategy?

What is the primary purpose of using a risk matrix in qualitative risk analysis?

Keep studying — Risk Management