Which of the following should be included in a comprehensive asset inventory?

Hardware, software, data, and personnel

Only assets that are connected to the network

Only tangible assets such as buildings and equipment

A multinational retail company is launching a risk management program. The program sponsor wants to ensure that the program covers all critical business processes, including those in overseas branches, but also wants to avoid overwhelming the team with low-priority assets. What should the program manager do to define the scope effectively?

Include all assets, processes, and locations in the scope, and then prioritize them based on criticality to business objectives.

Exclude any assets that are not currently connected to the corporate network.

Define the scope based on the availability of the risk management team's time and resources.

Limit the scope to the headquarters and main data center, as they contain the most critical assets.

A risk manager has documented a risk treatment plan for a critical vulnerability. The plan assigns the remediation to the IT team with a deadline of three months. After two months, the IT team reports that the remediation is only 50% complete and will likely miss the deadline. What is the most appropriate action for the risk manager?

Accept the risk without further action because the deadline is flexible.

Immediately implement a different control without consulting the IT team.

Close the risk because the IT team is working on it.

Update the risk register with the new status and escalate the issue to senior management to discuss options, such as extending the deadline or implementing compensating controls.

A company has implemented a security information and event management (SIEM) system as a risk treatment for detecting intrusions. The risk manager needs to determine if the SIEM is effective. Which of the following is the most reliable indicator of effectiveness?

The percentage of endpoints covered by the SIEM.

The number of alerts generated by the SIEM per day.

The mean time to detect (MTTD) and mean time to respond (MTTR) to security incidents.

The cost of the SIEM compared to the budget.

A software company has identified a risk of a critical vulnerability in a legacy application that is no longer supported by the vendor. The application is used by a small number of internal users for a non-critical function. The risk owner is considering treatment options. Which treatment option is most appropriate under these circumstances?

Avoid the risk by decommissioning the application immediately.

Mitigate the risk by purchasing extended support from the vendor.

Transfer the risk by purchasing cyber insurance.

Accept the risk because the application is non-critical and the user base is small.

Information Systems Security Management Professional

Domain 3Objective 1

3.1 Develop and Manage a Risk Management Program ISSMP Practice Questions (Page 1)

Part of the Risk Management domain, which accounts for 20% of the ISSMP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~14–24 in this domain), expect 4–6 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

12concepts

20%of the exam

12 Concepts in This Objective

Risk Management Program Objectives
Stakeholder Engagement in Risk Objectives
Organizational Risk Program Scope
Risk Tolerance and Appetite
Asset Inventory Verification
Organizational Risk Analysis
Countermeasures and Mitigating Controls
Risk Treatment Options
Cost-Benefit Analysis of Risk Treatments
Risk Treatment Recommendations
Documenting Risk and Issue Treatments
Risk Monitoring and Reporting

Questions 1–5

1foundation · easy
Which of the following should be included in a comprehensive asset inventory?
Select an answer first
2application · medium
A multinational retail company is launching a risk management program. The program sponsor wants to ensure that the program covers all critical business processes, including those in overseas branches, but also wants to avoid overwhelming the team with low-priority assets. What should the program manager do to define the scope effectively?
Select an answer first
3expert · medium
A risk manager has documented a risk treatment plan for a critical vulnerability. The plan assigns the remediation to the IT team with a deadline of three months. After two months, the IT team reports that the remediation is only 50% complete and will likely miss the deadline. What is the most appropriate action for the risk manager?
Select an answer first
4expert · medium
A company has implemented a security information and event management (SIEM) system as a risk treatment for detecting intrusions. The risk manager needs to determine if the SIEM is effective. Which of the following is the most reliable indicator of effectiveness?
Select an answer first
5application · medium
A software company has identified a risk of a critical vulnerability in a legacy application that is no longer supported by the vendor. The application is used by a small number of internal users for a non-critical function. The risk owner is considering treatment options. Which treatment option is most appropriate under these circumstances?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ISSMP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “ISSMP” is a trademark of its owner, used for identification only.

3.1 Develop and Manage a Risk Management Program ISSMP Practice Questions (Page 1)

Questions 1–5

Which of the following should be included in a comprehensive asset inventory?

A company has implemented a security information and event management (SIEM) system as a risk treatment for detecting intrusions. The risk manager needs to determine if the SIEM is effective. Which of the following is the most reliable indicator of effectiveness?

Keep studying — Risk Management