Which of the following is typically included in the scope of an organizational risk program?

All business processes and supporting assets across all locations

Only the risks that are covered by insurance policies

Only the IT department's hardware and software

Only the risks that have caused incidents in the past

What is risk transfer?

Eliminating the risk by discontinuing the activity

Reducing the likelihood of a risk through controls

Accepting the risk because it is within the organization's risk appetite

Shifting the financial impact of a risk to a third party, such as an insurance company

Why is it important to define risk management objectives collaboratively with risk owners and other stakeholders?

To satisfy regulatory requirements that mandate stakeholder involvement in all decisions

To eliminate the need for formal risk assessments

To ensure that objectives are aligned with stakeholder expectations and gain buy-in

To transfer responsibility for risk decisions to stakeholders

What is the purpose of a cost-benefit analysis of risk treatment options?

To assign a financial value to all organizational assets

To compare the costs of controls against the expected reduction in risk

To determine the exact likelihood of a risk occurring

To ensure that all risks are transferred to insurance

A government agency is developing its risk management program. The program manager wants to ensure that the risk objectives are aligned with the agency's mission and that risk owners are committed to the program. What is the most effective approach?

Set risk objectives based on the risk manager's professional judgment.

Conduct workshops with risk owners and key stakeholders to define risk objectives collaboratively.

Use a standard risk framework and adopt its objectives without modification.

Have the legal department define the risk objectives to ensure compliance.

Information Systems Security Management Professional

Domain 3Objective 1

3.1 Develop and Manage a Risk Management Program ISSMP Practice Questions (Page 7)

Part of the Risk Management domain, which accounts for 20% of the ISSMP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~14–24 in this domain), expect 4–6 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

12concepts

20%of the exam

12 Concepts in This Objective

Risk Management Program Objectives
Stakeholder Engagement in Risk Objectives
Organizational Risk Program Scope
Risk Tolerance and Appetite
Asset Inventory Verification
Organizational Risk Analysis
Countermeasures and Mitigating Controls
Risk Treatment Options
Cost-Benefit Analysis of Risk Treatments
Risk Treatment Recommendations
Documenting Risk and Issue Treatments
Risk Monitoring and Reporting

Questions 31–35

31foundation · easy
Which of the following is typically included in the scope of an organizational risk program?
Select an answer first
32foundation · easy
What is risk transfer?
Select an answer first
33foundation · easy
Why is it important to define risk management objectives collaboratively with risk owners and other stakeholders?
Select an answer first
34foundation · easy
What is the purpose of a cost-benefit analysis of risk treatment options?
Select an answer first
35application · medium
A government agency is developing its risk management program. The program manager wants to ensure that the risk objectives are aligned with the agency's mission and that risk owners are committed to the program. What is the most effective approach?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ISSMP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “ISSMP” is a trademark of its owner, used for identification only.