What should be documented for each agreed risk treatment?

Ownership, timelines, and status

The exact likelihood of the risk occurring

The names of all stakeholders involved in the risk assessment

What is the purpose of recommending risk treatment options to stakeholders?

To assign blame for risks that were not treated

To eliminate the need for stakeholder involvement in risk decisions

To document risks for audit purposes only

To present the analysis and rationale to support decision-making

What is a key benefit of engaging risk owners when setting risk management objectives?

It transfers accountability for risk management to external auditors

It ensures that the objectives are realistic and reflect the actual risk environment

It guarantees that all risks will be eliminated

It removes the need for ongoing risk monitoring

Which of the following is a key activity in risk monitoring?

Testing the effectiveness of implemented controls

Conducting a cost-benefit analysis

Developing a risk appetite statement

Assigning a risk owner for each risk

A global financial institution is establishing a risk management program. The program must cover all subsidiaries, but some subsidiaries operate in countries with different data protection regulations. The program manager needs to define the scope of the program. What is the most important consideration?

Limit the scope to the headquarters and major subsidiaries to reduce costs.

Exclude subsidiaries in countries with strict data protection laws to avoid complexity.

Include all subsidiaries and adapt the risk assessment to account for local regulatory requirements.

Apply a single global risk assessment methodology without considering local regulations.

Information Systems Security Management Professional

Domain 3Objective 1

3.1 Develop and Manage a Risk Management Program ISSMP Practice Questions (Page 3)

Part of the Risk Management domain, which accounts for 20% of the ISSMP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~14–24 in this domain), expect 4–6 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

12concepts

20%of the exam

12 Concepts in This Objective

Risk Management Program Objectives
Stakeholder Engagement in Risk Objectives
Organizational Risk Program Scope
Risk Tolerance and Appetite
Asset Inventory Verification
Organizational Risk Analysis
Countermeasures and Mitigating Controls
Risk Treatment Options
Cost-Benefit Analysis of Risk Treatments
Risk Treatment Recommendations
Documenting Risk and Issue Treatments
Risk Monitoring and Reporting

Questions 11–15

11foundation · easy
What should be documented for each agreed risk treatment?
Select an answer first
12foundation · easy
What is the purpose of recommending risk treatment options to stakeholders?
Select an answer first
13foundation · easy
What is a key benefit of engaging risk owners when setting risk management objectives?
Select an answer first
14foundation · easy
Which of the following is a key activity in risk monitoring?
Select an answer first
15expert · medium
A global financial institution is establishing a risk management program. The program must cover all subsidiaries, but some subsidiaries operate in countries with different data protection regulations. The program manager needs to define the scope of the program. What is the most important consideration?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ISSMP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “ISSMP” is a trademark of its owner, used for identification only.