CISM Information Security Risk Management Quiz

1. Which element is essential for an effective information security governance program?

Clear roles, responsibilities, and accountability

Annual risk assessments only

Expensive security technology

Minimal stakeholder involvement

2. What is the ultimate goal of information security risk management?

To protect organizational assets and enable business objectives

To eliminate all security risks

To maximize security spending

To satisfy external auditors only

3. Which approach is most effective for managing risks in third-party relationships?

Conducting vendor assessments and defining contractual security requirements

Trusting vendors without verification

Avoiding all third-party relationships

Implementing identical controls for all vendors

4. In CISM frameworks, what does 'materiality' refer to?

The significance or importance of a risk to the organization

The cost of implementing controls

The number of affected users

The duration of a security incident

5. What is the primary benefit of conducting regular risk assessments?

Identifying emerging threats and changing risk landscapes

Reducing the need for security controls

Eliminating all compliance requirements

Decreasing security awareness training

6. Which stakeholder group is primarily responsible for approving risk mitigation strategies?

Senior management and the board

IT security staff only

External auditors

Compliance officers alone

7. What is the role of risk tolerance in organizational decision-making?

It guides acceptance or mitigation of identified risks

It determines the security budget

It eliminates the need for controls

It replaces risk assessments

8. Which metric is commonly used to measure the effectiveness of security controls?

Reduction in risk exposure over time

Number of controls implemented

Security budget percentage

Frequency of security training

9. In risk management, what is the primary purpose of a risk register?

To document and track identified risks throughout their lifecycle

To eliminate all organizational risks

To justify security spending

To comply with external audits only

10. What does 'defense in depth' mean in information security risk management?

Multiple layers of security controls to protect assets

Using only the most expensive security solutions

Focusing controls only on critical systems

Implementing controls at the network level only

11. What is the primary purpose of conducting a risk assessment in information security?

To identify, analyze, and evaluate potential threats and vulnerabilities

To eliminate all security risks completely

To implement expensive security controls

To comply with audit requirements only

12. What is the key difference between quantitative and qualitative risk analysis?

Quantitative uses numerical values; qualitative uses descriptive ratings

Quantitative is more accurate than qualitative

Qualitative requires more resources

Quantitative eliminates bias

13. Which control type is designed to prevent a security incident from occurring?

Preventive control

Detective control

Corrective control

Compensating control

14. In the context of CISM, what does 'risk appetite' represent?

The amount of risk an organization is willing to accept

The total number of identified risks

The cost of implementing controls

The frequency of risk assessments

15. What is the primary objective of risk monitoring and reporting?

To track risk status and communicate findings to stakeholders

To eliminate all identified risks

To avoid audit findings

To reduce insurance premiums

16. Which of the following is an example of risk transfer?

Implementing encryption on sensitive data

Purchasing cyber insurance

Avoiding a risky business process

Accepting potential losses from a threat

17. What is the relationship between threat, vulnerability, and risk in security assessment?

Risk = Threat × Vulnerability × Asset Value

Risk = Threat + Vulnerability

Risk = Vulnerability only

Risk = Asset Value only

18. Which framework provides a comprehensive approach to information security governance and risk management?

COBIT

ISO/IEC 27001

NIST Cybersecurity Framework

All of the above

19. In risk management, what does the term 'residual risk' refer to?

Risk that remains after controls are implemented

Risk transferred to a third party

Risk identified but not yet assessed

Risk that exceeds organizational tolerance

20. Which risk management strategy involves reducing the likelihood or impact of a risk through controls?

Risk mitigation

Risk acceptance

Risk avoidance

Risk transfer