I85PREP
⌘ K
Information Security Management Examination study materials
Information Security Management Examination study resources

Information Security Management Examination practice questions

One question at a time. Build your Information Security Management Examination understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Information Security Governance and Strategy

An organization's information security program is being established. Which document is created by executive management to state the organization's overall intent and direction for protecting information?

  1. The vulnerability scan report
  2. The business continuity plan
  3. The asset register
  4. The information security policy Correct answer.

Explanation

An information security policy is a high-level statement issued by executive management that sets direction, intent, and principles for protecting information across the organization. Lower-level standards, procedures, and operational artifacts derive their authority from it.

Question 2Information Security Governance and Strategy

A newly appointed CISO reports that the organization has no clear lines of accountability for information security decisions. Which governance structure element most directly addresses this gap?

  1. A firewall rule review schedule
  2. A monthly phishing simulation campaign
  3. An encryption standard for data at rest
  4. A steering committee with defined roles and decision rights Correct answer.

Explanation

Governance is about directing and controlling the security program, which requires defined roles, responsibilities, and decision rights. A steering committee with explicit accountabilities establishes who decides and who is answerable. The other options are operational controls rather than governance mechanisms.

Question 3Information Security Governance and Strategy

In information security governance, what is the primary purpose of segregating the roles of policy-setting from operational execution?

  1. To allow the operations team to approve its own exceptions for speed
  2. To ensure the security team has authority to bypass change management when urgent
  3. To reduce the risk that those running controls also judge their own effectiveness without independent oversight Correct answer.
  4. To minimize the number of staff required to administer security tools

Explanation

Separation between those who set requirements and those who operate controls provides independent oversight and reduces the chance that operational convenience overrides security objectives. It is a governance principle about checks and balances, not a staffing efficiency measure.

Question 4Information Security Governance and Strategy

An organization adopts ISO/IEC 27001 as the basis for its information security management system. Which element is a mandatory requirement of that standard's management system?

  1. A documented risk assessment and risk treatment process Correct answer.
  2. A named cloud service provider
  3. A specific commercial vulnerability scanner
  4. A minimum of five full-time security staff

Explanation

ISO/IEC 27001 requires a risk-based management system, including establishing, maintaining, and continually improving risk assessment and risk treatment processes. It is technology-neutral and does not mandate particular products, vendors, or headcount.

Question 5Information Security Governance and Strategy

Senior leadership asks how the security program's performance will be judged against business objectives. Which governance artifact best answers this by defining measurable security objectives and the metrics used to track them?

  1. A disaster recovery runbook
  2. A security objectives and metrics framework aligned to business goals Correct answer.
  3. A penetration test scope document
  4. A software bill of materials

Explanation

Governance requires that security objectives be aligned with business goals and measured. A framework that defines measurable objectives and associated metrics enables leadership to evaluate performance and direct improvement. The other artifacts support operations but do not provide program-level performance measurement.

Question 6Information Security Governance and Strategy

A board member asks who ultimately owns information risk in the organization. Under sound governance principles, where does accountability for information risk reside?

  1. With the end users who handle data daily
  2. With executive management, who are accountable to the board Correct answer.
  3. With the external audit firm engaged for assurance
  4. With the individual system administrators who operate the servers

Explanation

Ultimate accountability for information risk sits with executive management, who answer to the board and set the organization's risk appetite. Operational staff and auditors contribute to managing or assuring risk but do not own it at the top level.

Question 7Information Security Governance and Strategy

An organization defines its risk appetite as low for customer data protection but higher for internal collaboration tools. How should this statement best be used in governance?

  1. As a decision criterion that constrains risk treatment choices and exception approvals Correct answer.
  2. As a one-time statement filed for audit and never revisited
  3. As a substitute for performing risk assessments
  4. As a technical setting applied to firewalls

Explanation

Risk appetite expresses how much risk the organization is willing to accept in pursuit of objectives and should guide treatment decisions and exception approvals. It is a living governance input, not a filing artifact or a technical configuration.

Question 8Information Security Governance and Strategy

A regulator issues new requirements for protecting personal data. Which governance action should occur first to integrate these obligations into the security program?

  1. Identify the applicable obligations and map them to existing policies and controls Correct answer.
  2. Immediately purchase a new security product recommended by a vendor
  3. Suspend all processing of personal data indefinitely
  4. Delegate the matter to the help desk

Explanation

Compliance integration begins with identifying obligations and mapping them to current policies and controls, which reveals gaps and informs treatment. Buying products or halting processing before understanding the requirements is premature and disproportionate.

Question 9Information Security Governance and Strategy

Which statement best distinguishes a policy from a standard within an information security governance framework?

  1. A policy is optional guidance, while a standard is a recommendation
  2. A policy is technical configuration, while a standard is a business goal
  3. A policy applies only to contractors, while a standard applies only to employees
  4. A policy states management intent and principles, while a standard specifies mandatory, more detailed requirements Correct answer.

Explanation

Policies articulate management's intent and high-level principles, and standards translate that intent into specific, mandatory requirements. Both are normative documents, but they operate at different levels of detail and abstraction.

Question 10Information Security Governance and Strategy

An organization wants assurance that its information security management system conforms to requirements. Which activity provides independent, objective evaluation against the standard?

  1. A tabletop exercise
  2. An internal awareness survey
  3. A third-party certification audit Correct answer.
  4. A code review of the payment application

Explanation

Independent conformity assessment against a management system standard is performed through a certification or external audit by a qualified third party. Internal surveys, exercises, and code reviews provide useful evidence but are not independent conformity evaluations.

Question 11Information Security Governance and Strategy

A CISO proposes a security strategy. Which characteristic most indicates that the strategy is genuinely aligned with the business rather than technology-driven?

  1. It lists the maximum number of security tools the budget can support
  2. It links security outcomes to specific business objectives and their risk tolerances Correct answer.
  3. It prioritizes controls based on vendor popularity
  4. It is written entirely by the infrastructure team without executive input

Explanation

Business-aligned strategy connects security outcomes to business objectives and the organization's tolerance for risk, enabling prioritization that supports value creation. Tool counts, vendor popularity, and isolated authorship indicate technology-driven rather than business-driven planning.

Question 12Information Security Governance and Strategy

Which governance body is typically responsible for approving the organization's overall information security strategy and risk appetite?

  1. The external penetration testing vendor
  2. The board of directors or a board-level risk committee Correct answer.
  3. The service desk team
  4. The database administration group

Explanation

Approval of strategy and risk appetite is a top-level governance responsibility, normally held by the board or a delegated board committee. Operational teams and external vendors execute or advise but do not set enterprise direction.

Question 13Information Security Governance and Strategy

An organization's security policy has not been reviewed in five years despite major changes in its cloud footprint. Which governance weakness does this most directly represent?

  1. Failure to maintain policy relevance through periodic review Correct answer.
  2. Insufficient penetration testing frequency
  3. Excessive separation of duties
  4. Overinvestment in incident response

Explanation

Policies must be reviewed at planned intervals and when significant changes occur to remain relevant and effective. A stale policy in a transformed environment signals a breakdown in the review and maintenance process.

Question 14Information Security Governance and Strategy

What is the primary governance benefit of an information security steering committee that includes business unit leaders?

  1. It transfers all security risk to the business units
  2. It enables cross-functional prioritization and shared ownership of security decisions Correct answer.
  3. It eliminates the need for a documented security policy
  4. It removes the requirement for independent audit

Explanation

Including business leaders in a steering committee allows security decisions to be prioritized across functions and fosters shared ownership aligned with business needs. It complements, rather than replaces, policy, risk ownership, and independent assurance.

Question 15Information Security Governance and Strategy

An organization is deciding whether to accept, mitigate, transfer, or avoid a risk identified in its risk assessment. Which governance factor most directly determines whether acceptance is appropriate?

  1. Whether the risk was identified by an automated scanner
  2. Whether the affected system runs on a public cloud
  3. Whether the residual risk falls within the approved risk appetite Correct answer.
  4. Whether the risk owner is a senior manager

Explanation

Risk acceptance is appropriate when the residual risk, after treatment, lies within the organization's approved risk appetite and is formally accepted by the accountable owner. The detection method, hosting model, and job title of the owner do not by themselves justify acceptance.

Question 16Information Security Governance and Strategy

Which of the following best describes the concept of a three-lines model as applied to information security governance?

  1. Three separate vendors each provide a security tool
  2. Three departments share a single risk register without defined roles
  3. Operational management owns and manages risk, an independent risk function oversees it, and internal audit provides independent assurance Correct answer.
  4. Three passwords are required for administrative access

Explanation

The three-lines model separates risk ownership and management in the first line, independent oversight and challenge in the second, and independent assurance in the third. This structure clarifies accountability and strengthens governance over risk.

Question 17Information Security Governance and Strategy

A business unit wants to adopt a new SaaS tool that will store regulated data. Under governance, what should happen before approval?

  1. Immediate deployment followed by a retrospective review
  2. Removal of the data classification label to simplify handling
  3. A decision by the vendor's sales team
  4. A risk assessment that evaluates the tool against policy and regulatory requirements Correct answer.

Explanation

Introducing a system that handles regulated data requires a risk assessment against policy and legal obligations so that treatment decisions are informed and documented. Vendor sales input, after-the-fact review, and removing classification undermine governance.

Question 18Information Security Governance and Strategy

Which metric best reflects the maturity of governance over security exceptions?

  1. The total number of security tools deployed
  2. The proportion of exceptions with documented justification, owner, and expiry date Correct answer.
  3. The average length of a firewall rule
  4. The number of employees who completed awareness training

Explanation

Effective exception governance requires that each exception be justified, assigned an accountable owner, time-bound, and reviewed. Tracking the proportion meeting these criteria measures control over accepted deviations. The other metrics do not address exception management.

Question 19Information Security Governance and Strategy

What is the role of an information security charter in governance?

  1. It replaces the need for risk assessments
  2. It formally establishes the security function's mandate, authority, and reporting lines Correct answer.
  3. It defines the organization's marketing strategy
  4. It lists every known software vulnerability

Explanation

A charter authorizes the security function by defining its mandate, scope, authority, and reporting relationships. It provides legitimacy for decisions and escalation but does not substitute for operational artifacts or risk assessment.

Question 20Information Security Governance and Strategy

An organization wants to ensure that security requirements are considered at the earliest stage of new projects. Which governance mechanism most directly achieves this?

  1. A post-incident review process
  2. A quarterly newsletter on security tips
  3. An annual firewall audit
  4. A gated project lifecycle that requires security review at defined checkpoints Correct answer.

Explanation

Embedding security review as mandatory gates in the project lifecycle ensures requirements are addressed early and before deployment. Awareness newsletters, incident reviews, and firewall audits occur at other points and do not systematically front-load security into projects.

Question 21Information Security Governance and Strategy

A board asks for assurance that security investments deliver value. Which governance practice most directly supports this?

  1. Reporting security performance against agreed objectives and risk reduction targets Correct answer.
  2. Listing the certifications held by security staff
  3. Documenting the age of the server fleet
  4. Counting the number of security policies published

Explanation

Value demonstration requires measuring security performance against agreed objectives and showing risk reduction attributable to investments. Policy counts, staff certifications, and asset age are inputs or context but do not demonstrate value delivered.

Question 22Information Security Governance and Strategy

Which statement correctly describes the relationship between governance and management in information security?

  1. Governance sets direction and oversight, while management executes day-to-day activities to achieve that direction Correct answer.
  2. Governance and management are identical and interchangeable terms
  3. Governance concerns only external auditors, while management concerns only vendors
  4. Governance performs daily operations, while management sets strategic direction

Explanation

Governance provides direction, oversight, and accountability, whereas management plans and executes activities to achieve the stated direction. Confusing the two leads to weak oversight or misallocated accountability.

Question 23Information Security Governance and Strategy

An organization discovers that a critical supplier does not meet its security requirements. Which governance response best reflects sound third-party risk management?

  1. Assess the risk, require remediation or contractual safeguards, and monitor the supplier over time Correct answer.
  2. Ignore the finding because the supplier is external
  3. Rely solely on the supplier's self-declaration of compliance
  4. Terminate the relationship immediately without assessing business impact

Explanation

Third-party risk governance involves assessing the risk, requiring remediation or contractual controls, and ongoing monitoring proportionate to criticality. Immediate termination without impact analysis, ignoring the issue, or relying only on self-declaration are inadequate responses.

Question 24Information Security Governance and Strategy

Which of the following is the strongest indicator that information security governance is embedded rather than merely documented?

  1. Security considerations consistently influence business decisions and resource allocation Correct answer.
  2. The policy manual is comprehensive and well formatted
  3. The organization holds a current certification certificate
  4. The security team has a large budget

Explanation

Embedded governance is demonstrated when security considerations actually shape decisions and resource allocation across the business. Certificates, documentation quality, and budget size are supporting indicators but do not prove that governance influences behavior.

Question 25Information Security Governance and Strategy

An organization is establishing an information security governance framework. Which sequence best reflects a logical governance cycle?

  1. Set direction and objectives, assess risk, plan treatment, implement, monitor, and improve Correct answer.
  2. Implement tools, then write policy, then identify objectives
  3. Delegate all decisions to a vendor, then document the outcome
  4. Monitor performance, then set objectives only if problems arise

Explanation

A sound governance cycle establishes direction and objectives, assesses risk against them, plans and implements treatment, then monitors and improves. This mirrors the continual improvement logic used in management system standards.

Question 26Information Security Governance and Strategy

An organization is drafting its top-level information security policy. Which characteristic makes this document most effective as a governance instrument rather than an operational manual?

  1. It is written by the security operations team and kept confidential to that team to avoid misinterpretation
  2. It lists the exact configuration settings for every server and endpoint so that administrators have a single reference
  3. It states mandatory principles and control expectations approved at executive level, leaving detailed implementation to lower-level standards and procedures Correct answer.
  4. It is revised whenever a new technology is deployed so that it always reflects the current toolset

Explanation

A governing policy sets direction: it expresses management intent, mandatory principles, and control expectations at a level approved by executive leadership, and is supported by standards, procedures, and guidelines that carry the technical detail. Documents that embed configuration specifics or change with every new tool are operational artifacts, and a policy owned only by one team lacks the authority and breadth expected of governance.

Question 27Information Security Governance and Strategy

A newly appointed CISO reports to the CIO, who also owns the delivery of major IT programs. A board committee is concerned that this reporting line weakens independence. Which governance change best addresses the concern while preserving operational effectiveness?

  1. Ask the CIO to self-certify annually that security risks have been reported without bias to executive management
  2. Move the CISO under the chief financial officer so that security spending is controlled by the budget owner
  3. Transfer all security operations duties to the internal audit function so that findings are produced independently
  4. Require the CISO to present risk acceptance decisions and residual risk status directly to the board risk committee, with escalation rights and a defined reporting line outside program delivery Correct answer.

Explanation

Independence is strengthened by giving the security function a channel to a governing body that is not accountable for the same delivery outcomes, together with explicit escalation rights and board-level visibility of residual risk. This preserves the CISO's working relationship with IT while removing the structural conflict created when the same executive both delivers programs and judges their risk.

Question 28Information Security Governance and Strategy

An enterprise risk register shows that a legacy payment system carries high inherent risk. Management has documented compensating controls and accepted the residual risk, but no one has revisited the entry in three years. Which governance weakness does this most directly illustrate?

  1. Control testing is performed by the second line rather than the first line
  2. The organization has not adopted a formal risk quantification methodology
  3. The risk appetite statement has not been communicated to business units
  4. Risk acceptance decisions lack periodic review and expiry, so accepted exposure can persist beyond its justification Correct answer.

Explanation

A risk acceptance is a time-bound management decision that should be revalidated as threats, controls, and business context change; without scheduled review or an expiry date, the justification for tolerating exposure silently ages. The scenario describes an unreviewed acceptance, not a communication failure, a line-of-defense assignment issue, or a missing quantification method.

Question 29Information Security Governance and Strategy

Which outcome most clearly demonstrates that information security governance is operating as intended rather than existing only on paper?

  1. A comprehensive set of security policies is published on the intranet and acknowledged by all staff annually
  2. The security team completes more vulnerability scans per quarter than in the previous year
  3. An external auditor issues an unqualified opinion on the financial statements
  4. Security risk considerations appear in project approval decisions, and decisions that exceed appetite are escalated and documented Correct answer.

Explanation

Governance is evidenced when security risk actually shapes business decision-making: project gates incorporate it, and exceptions above appetite travel to the right authority with a recorded decision. Policy publication, scanning volume, and financial audit opinions are inputs or unrelated assurances and do not show that risk information influences decisions.

Question 30Information Security Governance and Strategy

A multinational firm operates under a group security policy, but local regulators in one region require breach notification timelines and data localization that conflict with group-wide cloud arrangements. Which governance approach best reconciles the group strategy with local obligations?

  1. Define group-level mandatory outcomes and risk appetite, then authorize documented regional control profiles that meet stricter local law while remaining traceable to group objectives Correct answer.
  2. Permit each regional business unit to draft its own independent security policy and report only to local management
  3. Apply the group policy unchanged everywhere and handle regional objections case by case through the exception process after deployment
  4. Suspend the group policy in the affected region until regulators approve the global cloud architecture

Explanation

Effective global governance sets non-negotiable outcomes and appetite centrally while allowing subordinate, documented profiles that satisfy stricter local requirements, so both consistency and legal compliance are preserved and traceability to group objectives remains intact. This is the standard application of policy hierarchy and subsidiarity in multinational governance.

Question 31Risk Management

An organization defines risk appetite as the amount and type of risk it is willing to accept in pursuit of its objectives. Which statement best describes how risk appetite should be used in an information security risk management program?

  1. It is a fixed value that must remain unchanged for the life of the organization.
  2. It sets thresholds against which identified risks are evaluated and treatment decisions are justified. Correct answer.
  3. It replaces the need for a formal risk assessment because acceptable risk is already defined.
  4. It applies only to financial risk and is unrelated to information security decisions.

Explanation

Risk appetite expresses the level of risk the organization is willing to pursue or retain, so it provides the criteria against which assessed risks are compared and treatment options are selected. Without such thresholds, risk evaluation becomes subjective and treatment prioritization cannot be defended. Risk appetite is reviewed periodically as business context changes.

Question 32Risk Management

During risk identification, a team lists threats, vulnerabilities, and potential consequences. Which element is a vulnerability rather than a threat?

  1. A power failure affecting the data center
  2. A criminal group that targets retail payment systems
  3. An unpatched web server exposed to the internet Correct answer.
  4. A ransomware campaign observed in the sector

Explanation

A vulnerability is a weakness in an asset, control, or process that a threat can exploit; an unpatched, internet-facing server is exactly such a weakness. Threats are the actors or events with potential to cause harm, such as criminal groups, malware campaigns, or power failures. Keeping these categories distinct prevents double counting and supports targeted treatment.

Question 33Risk Management

A risk register entry records likelihood as 'high' and impact as 'high'. Which subsequent action is most consistent with sound risk management practice?

  1. Escalate to the board and take no further action until the next annual review.
  2. Close the entry because high ratings are too vague to act on.
  3. Delete the likelihood rating and keep only the impact rating.
  4. Assign an owner, select a treatment option, and record residual risk after treatment. Correct answer.

Explanation

A rated risk requires an accountable owner and a documented treatment decision, plus an assessment of residual risk once controls are applied. The register then supports monitoring and reporting over time. Simply rating a risk without ownership or treatment leaves the process incomplete.

Question 34Risk Management

Which statement correctly distinguishes qualitative from quantitative risk assessment?

  1. Qualitative assessment always produces more precise results than quantitative assessment.
  2. Qualitative assessment requires calibrated loss data, while quantitative assessment relies on opinion.
  3. Quantitative assessment cannot incorporate expert judgment at any stage.
  4. Qualitative assessment uses descriptive scales, while quantitative assessment expresses risk in numeric terms such as monetary loss. Correct answer.

Explanation

Qualitative methods rate risk using descriptive scales such as low, medium, and high, whereas quantitative methods estimate risk in numeric units, often annualized loss expectancy. Qualitative approaches are faster and useful when data are scarce; quantitative approaches offer comparability and support cost-benefit analysis of controls. Many programs combine both.

Question 35Risk Management

An organization chooses to purchase cyber insurance to transfer part of its information security risk. Which risk treatment option does this represent?

  1. Risk retention
  2. Risk transfer Correct answer.
  3. Risk avoidance
  4. Risk mitigation

Explanation

Insurance shifts some financial consequences of a risk to a third party, which is the classic definition of risk transfer. The organization still retains responsibility for the risk itself and for the uninsured portion. Transferring risk does not eliminate the underlying threat or vulnerability.

Question 36Risk Management

Which metric represents the expected monetary loss from a risk over one year, calculated as single loss expectancy multiplied by annualized rate of occurrence?

  1. Risk appetite
  2. Residual risk
  3. Return on security investment
  4. Annualized loss expectancy Correct answer.

Explanation

Annualized loss expectancy is the product of single loss expectancy and annualized rate of occurrence, giving an expected yearly loss figure. It supports comparison of risks and justification of control spending. Return on security investment is a derived measure comparing control benefits to cost.

Question 37Risk Management

In a business impact analysis, which pair of parameters is used to characterize the consequences of disrupting a business process?

  1. Threat actor capability and motive
  2. Recovery time objective and recovery point objective Correct answer.
  3. Control maturity and audit findings
  4. Likelihood and vulnerability score

Explanation

A business impact analysis determines how quickly a process must be restored and how much data loss is tolerable, expressed as recovery time objective and recovery point objective. These outputs drive continuity and recovery strategy. Threat and control attributes inform risk assessment but are not the BIA's defining consequence parameters.

Question 38Risk Management

Which principle applies when selecting risk treatment controls for an identified information security risk?

  1. Controls should be applied uniformly regardless of the assessed risk level.
  2. Controls should always be the most expensive option available to show due diligence.
  3. Controls should be proportionate to the risk and justified by cost-benefit reasoning. Correct answer.
  4. Controls should be selected only after an incident has occurred.

Explanation

Control selection should be proportionate to the assessed risk, considering cost, effectiveness, and feasibility, so that spending is justified. Over-controlling low risks wastes resources, while under-controlling high risks leaves exposure. Treatment decisions should be documented and approved by the risk owner.

Question 39Risk Management

A risk assessment team estimates that a server outage would cost 200,000 in lost revenue per event and expects two such events per year. What is the annualized loss expectancy?

  1. 200,000
  2. 100,000
  3. 400,000 Correct answer.
  4. 800,000

Explanation

Annualized loss expectancy equals single loss expectancy multiplied by annualized rate of occurrence, so 200,000 times two gives 400,000. This figure represents the expected yearly loss if current conditions persist. It is used to compare risks and evaluate whether a proposed control is economically justified.

Question 40Risk Management

After implementing a new access control, a team reassesses a risk and finds the likelihood has dropped. What does the remaining exposure represent?

  1. Inherent risk
  2. Residual risk Correct answer.
  3. Risk appetite
  4. Risk transfer

Explanation

Residual risk is the risk that remains after controls have been applied. Inherent risk is the level before any treatment. Recording residual risk allows the organization to confirm that exposure now falls within its risk appetite.

Question 41Risk Management

A risk owner decides to retain a risk that exceeds the organization's stated risk appetite. What is the most appropriate governance response?

  1. The risk appetite should be changed to match the risk without further review.
  2. The risk owner may retain it silently because ownership implies authority.
  3. The exception must be formally documented, justified, and approved at the appropriate authority level. Correct answer.
  4. The risk should be deleted from the register to avoid audit findings.

Explanation

When a retained risk exceeds appetite, governance requires a documented exception with justification and approval by someone with sufficient authority. This preserves accountability and visibility for senior management. Silently accepting or hiding the risk undermines the entire risk management process.

Question 42Risk Management

Which scenario best illustrates risk avoidance as a treatment option?

  1. Buying insurance to cover breach costs
  2. Accepting the risk and monitoring it over time
  3. Discontinuing an online service that cannot be secured to an acceptable level Correct answer.
  4. Adding a web application firewall in front of a service

Explanation

Avoidance eliminates the risk by ceasing the activity that creates it, such as shutting down a service that cannot be secured. Adding a firewall is mitigation, insurance is transfer, and monitoring is retention. Avoidance is appropriate when the risk cannot be reduced to within appetite at acceptable cost.

Question 43Risk Management

In a risk matrix, which practice most improves consistency when different assessors rate the same risk?

  1. Using a different scale for each business unit
  2. Allowing each assessor to use personal judgment without calibration
  3. Rating only impact and ignoring likelihood
  4. Defining explicit criteria for each likelihood and impact level with concrete examples Correct answer.

Explanation

Explicit, documented criteria with concrete examples calibrate assessors so that the same conditions receive comparable ratings. This improves repeatability and comparability across the register. Without defined scales, ratings reflect individual interpretation rather than organizational criteria.

Question 44Risk Management

Which activity is performed during risk monitoring and review rather than during initial risk assessment?

  1. Establishing the organization's risk criteria
  2. Identifying assets and their owners for the first time
  3. Tracking changes in risk levels and confirming that controls remain effective over time Correct answer.
  4. Defining the scope of the risk management framework

Explanation

Monitoring and review is the ongoing process of tracking risk levels, control effectiveness, and changes in context after treatment. Identifying assets, setting criteria, and defining scope belong to establishing the framework and initial assessment. Continuous monitoring ensures the register stays current.

Question 45Risk Management

A control costs 50,000 per year and is expected to reduce annualized loss expectancy from 300,000 to 100,000. What is the expected net benefit of the control per year?

  1. 100,000
  2. 150,000 Correct answer.
  3. 50,000
  4. 200,000

Explanation

The control reduces expected loss by 200,000, and after subtracting the 50,000 annual cost the net benefit is 150,000. This calculation supports a cost-benefit justification for the investment. If the reduction did not exceed the cost, the control would not be economically justified on this basis alone.

Question 46Risk Management

Which statement best describes the relationship between a threat, a vulnerability, and risk?

  1. A threat alone defines risk without considering vulnerabilities or asset value.
  2. A vulnerability alone defines risk without considering threats or impact.
  3. Risk arises from the combination of a threat exploiting a vulnerability, producing impact on an asset. Correct answer.
  4. Risk exists only when a threat is present, regardless of any vulnerability.

Explanation

Risk emerges when a threat can exploit a vulnerability to affect an asset with consequential impact. Threat alone or vulnerability alone does not fully characterize risk. This relationship underpins structured identification and assessment.

Question 47Risk Management

An organization applies the ISO 31000 process. Which sequence reflects the standard risk management process?

  1. Treat risk, assess risk, establish context, then communicate results
  2. Assess risk, treat risk, monitor, then establish context
  3. Establish context, assess risk, treat risk, then monitor and review with communication throughout Correct answer.
  4. Monitor risk, establish context, treat risk, then assess risk

Explanation

The process begins with establishing context and scope, then risk assessment (identification, analysis, evaluation), followed by risk treatment, with communication and consultation and monitoring and review occurring throughout. This ordering ensures decisions are grounded in context and criteria. Monitoring is continuous rather than a final step.

Question 48Risk Management

A third-party vendor hosts a critical application. Which risk management action best addresses the associated supply chain risk?

  1. Include the vendor in risk assessment and require contractual security and assurance obligations Correct answer.
  2. Assume the vendor's security posture is adequate because the vendor is well known
  3. Exclude vendor-related risks from the register because they are external
  4. Rely solely on the vendor's marketing materials for assurance

Explanation

Supply chain risk must be assessed and managed through due diligence, contractual security requirements, and ongoing assurance such as audits or certifications. Vendor risks belong in the organization's risk register because the organization retains accountability for the service. Reputation alone is not evidence of control effectiveness.

Question 49Risk Management

Which statement correctly describes the role of likelihood in risk evaluation?

  1. Likelihood measures the financial value of the asset at risk.
  2. Likelihood estimates how probable it is that a threat will exploit a vulnerability within a defined period. Correct answer.
  3. Likelihood is identical to impact and can be used interchangeably.
  4. Likelihood is fixed and cannot change when controls are implemented.

Explanation

Likelihood expresses the probability that a threat event will occur and exploit a vulnerability within a given timeframe. It is distinct from impact, which describes the consequence if the event occurs. Effective controls can reduce likelihood, which is why it is reassessed after treatment.

Question 50Risk Management

A risk assessment identifies a risk that falls within the organization's risk appetite. Which action is most appropriate?

  1. Transfer the risk regardless of cost
  2. Escalate to regulators as a mandatory report
  3. Retain the risk with documented acceptance and periodic monitoring Correct answer.
  4. Immediately implement the most costly available control

Explanation

Risks within appetite can be retained with documented acceptance and ongoing monitoring. This avoids unnecessary spending while keeping the risk visible. Treatment is warranted when exposure exceeds appetite or when cost-effective reduction is justified.