What does the scope of an organizational risk program define?

The list of risk treatment options available to the organization

The exact number of risks that must be identified each year

The boundaries of the program, including which assets, processes, and locations are covered

The budget allocated for risk mitigation activities

A retail company has implemented a new endpoint detection and response (EDR) solution as a risk treatment for malware. Six months later, the risk manager needs to verify that the treatment is effective. What is the most appropriate action?

Conduct a full risk assessment from scratch to see if the risk level has changed.

Ask the IT team to confirm that the EDR is installed on all endpoints.

Review EDR detection and response metrics, such as the number of alerts, time to respond, and any successful malware infections.

Wait for the next annual risk review to evaluate the treatment.

What is the purpose of risk monitoring and reporting?

To transfer all risks to insurance providers

To assign blame for failed risk treatments

To eliminate the need for risk assessments in the future

To test and monitor the effectiveness of risk treatments and communicate status to stakeholders

In a cost-benefit analysis of a risk treatment, the 'benefit' is typically measured as:

The time required to implement the treatment

The reduction in expected loss due to the treatment

The total cost of the treatment

Why is it important to document risk and issue treatments?

To transfer responsibility for the risk to the documentation team

To satisfy regulatory requirements for all risk decisions

To eliminate the need for ongoing risk monitoring

To ensure that treatments are managed and tracked effectively

Information Systems Security Management Professional

Domain 3Objective 1

3.1 Develop and Manage a Risk Management Program ISSMP Practice Questions (Page 5)

Part of the Risk Management domain, which accounts for 20% of the ISSMP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~14–24 in this domain), expect 4–6 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

12concepts

20%of the exam

12 Concepts in This Objective

Risk Management Program Objectives
Stakeholder Engagement in Risk Objectives
Organizational Risk Program Scope
Risk Tolerance and Appetite
Asset Inventory Verification
Organizational Risk Analysis
Countermeasures and Mitigating Controls
Risk Treatment Options
Cost-Benefit Analysis of Risk Treatments
Risk Treatment Recommendations
Documenting Risk and Issue Treatments
Risk Monitoring and Reporting

Questions 21–25

21foundation · easy
What does the scope of an organizational risk program define?
Select an answer first
22application · medium
A retail company has implemented a new endpoint detection and response (EDR) solution as a risk treatment for malware. Six months later, the risk manager needs to verify that the treatment is effective. What is the most appropriate action?
Select an answer first
23foundation · easy
What is the purpose of risk monitoring and reporting?
Select an answer first
24foundation · easy
In a cost-benefit analysis of a risk treatment, the 'benefit' is typically measured as:
Select an answer first
25foundation · easy
Why is it important to document risk and issue treatments?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ISSMP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “ISSMP” is a trademark of its owner, used for identification only.