Free CISM Exam Braindumps
Certified Information Security Manager Questions 416–420 (page: 85)

Updated On: 10-Feb-2026

Quantitative risk analysis is MOST appropriate when assessment data:

  1. include customer perceptions.
  2. contain percentage estimates.
  3. do not contain specific details.
  4. contain subjective information.

Answer(s): B

Explanation:

Percentage estimates are characteristic of quantitative risk analysis. Customer perceptions, lack of specific details or subjective information lend themselves more to qualitative risk analysis.



Which of the following is the MOST appropriate use of gap analysis?

  1. Evaluating a business impact analysis (BIA)
  2. Developing a balanced business scorecard
  3. Demonstrating the relationship between controls
  4. Measuring current state vs. desired future state

Answer(s): D

Explanation:

A gap analysis is most useful in addressing the differences between the current state and an ideal future state. It is not as appropriate for evaluating a business impact analysis (BIA), developing a balanced business scorecard or demonstrating the relationship between variables.



Identification and prioritization of business risk enables project managers to:

  1. establish implementation milestones.
  2. reduce the overall amount of slack time.
  3. address areas with most significance.
  4. accelerate completion of critical paths.

Answer(s): C

Explanation:

Identification and prioritization of risk allows project managers to focus more attention on areas of greater importance and impact. It will not reduce the overall amount of slack time, facilitate establishing implementation milestones or allow a critical path to be completed any sooner.



A risk analysis should:

  1. include a benchmark of similar companies in its scope.
  2. assume an equal degree of protection for all assets.
  3. address the potential size and likelihood of loss.
  4. give more weight to the likelihood vs. the size of the loss.

Answer(s): C

Explanation:

A risk analysis should take into account the potential size and likelihood of a loss. It could include comparisons with a group of companies of similar size. It should not assume an equal degree of protection for all assets since assets may have different risk factors. The likelihood of the loss should not receive greater emphasis than the size of the loss; a risk analysis should always address both equally.



The recovery point objective (RPO) requires which of the following?

  1. Disaster declaration
  2. Before-image restoration
  3. System restoration
  4. After-image processing

Answer(s): B

Explanation:

The recovery point objective (RPO) is the point in the processing flow at which system recovery should occur. This is the predetermined state of the application processing and data used to restore the system and to continue the processing flow. Disaster declaration is independent of this processing checkpoint. Restoration of the system can occur at a later date, as does the return to normal, after-image processing.



Viewing page 85 of 345
Viewing questions 421 - 425 out of 1716 questions


Post your Comments and Discuss ISACA CISM exam prep with other Community members:

AI Tutor AI Tutor 👋 I’m here to help!