Free CISM Exam Braindumps
Certified Information Security Manager Questions 356–360 (page: 73)

Updated On: 10-Feb-2026

A risk management program will be MOST effective when:

  1. risk appetite is sustained for a long period
  2. risk assessments are repeated periodically
  3. risk assessments are conducted by a third party
  4. business units are involved in risk assessments

Answer(s): D



The objective of risk management is to reduce risk to the minimum level that is:

  1. compliant with security policies
  2. practical given industry and regulatory environments.
  3. achievable from technical and financial perspectives.
  4. acceptable given the preference of the organization.

Answer(s): A



The MOST important objective of monitoring key risk indicators (KRIs) related to information security is to:

  1. identify change in security exposures.
  2. reduce risk management costs.
  3. meet regulatory compliance requirements.
  4. minimize the loss from security incidents.

Answer(s): A



Which of the following would be MOST helpful in determining an organization’s current capacity to mitigate risk?

  1. Capability maturity model
  2. Business impact analysis
  3. IT security risk and exposure
  4. Vulnerability assessment

Answer(s): A



Several significant risks have been identified after a centralized risk register was compiled and prioritized. The information security manager’s most important action is to:

  1. provide senior management with risk treatment options.
  2. design and implement controls to reduce the risk.
  3. consult external third parties on how to treat the risk.
  4. ensure that employees are aware of the risk.

Answer(s): A



Viewing page 73 of 345
Viewing questions 361 - 365 out of 1716 questions


Post your Comments and Discuss ISACA CISM exam prep with other Community members:

AI Tutor AI Tutor 👋 I’m here to help!