I85PREP
⌘ K
CISRM study materials
CISRM study resources

CISRM practice questions

One question at a time. Build your CISRM understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Risk Management Fundamentals and Governance

Which statement best describes the primary purpose of an IT risk register?

  1. To document the technical configuration baseline of every production server
  2. To list all security incidents that occurred during the past fiscal year
  3. To serve as the authoritative inventory of software licenses held by the organization
  4. To record identified risks with owners, ratings, and treatment status so they can be monitored and reported Correct answer.

Explanation

A risk register is the central log that captures each identified risk together with its owner, assessed rating, treatment decision, and current status. It exists to support ongoing monitoring, prioritization, and reporting to governance bodies, not to hold asset inventories or incident histories.

Question 2Risk Management Fundamentals and Governance

In risk terminology, what does 'risk appetite' express?

  1. The amount and type of risk an organization is willing to pursue or retain in order to meet its objectives Correct answer.
  2. The schedule that defines when risk assessments must be repeated
  3. The complete set of risks that have been identified but not yet assessed
  4. The maximum financial loss a single business unit can absorb before insolvency

Explanation

Risk appetite is a governance-level statement of how much risk the organization is willing to accept in pursuit of its objectives. It guides decision-making and is operationalized through risk tolerance thresholds and limits.

Question 3Risk Management Fundamentals and Governance

A risk practitioner is calculating an inherent risk score. Which pair of factors is conventionally multiplied to produce it?

  1. Likelihood and impact Correct answer.
  2. Threat intelligence feeds and patch latency
  3. Control cost and residual loss
  4. Asset value and depreciation

Explanation

Inherent risk is normally expressed as the combination of the likelihood that an event occurs and the impact if it does, before controls are considered. Multiplying or otherwise combining these two dimensions yields the score used for prioritization.

Question 4Risk Management Fundamentals and Governance

Which of the following is the clearest example of a risk treatment option classified as 'avoidance'?

  1. Adding multi-factor authentication to reduce the likelihood of credential compromise
  2. Accepting the risk because the cost of controls exceeds the expected loss
  3. Discontinuing an online payment feature because the residual fraud risk exceeds appetite Correct answer.
  4. Purchasing a cyber insurance policy to transfer part of the loss exposure

Explanation

Avoidance eliminates the activity that gives rise to the risk, so the exposure no longer exists. The other listed responses illustrate transfer, mitigation, and acceptance respectively.

Question 5Risk Management Fundamentals and Governance

What distinguishes residual risk from inherent risk?

  1. Residual risk is recorded before controls while inherent risk is recorded after
  2. Residual risk applies only to third parties while inherent risk applies internally
  3. Residual risk is the exposure remaining after existing controls are applied Correct answer.
  4. Residual risk is measured only in monetary terms while inherent risk is qualitative

Explanation

Inherent risk reflects exposure before controls, whereas residual risk reflects what remains once current controls are taken into account. Comparing the two indicates how much risk the control environment actually reduces.

Question 6Risk Management Fundamentals and Governance

Which body typically holds ultimate accountability for the organization's enterprise risk management program?

  1. The data center facilities manager
  2. The external audit firm engaged for the annual opinion
  3. The help desk supervisor
  4. The board of directors or a board-level risk committee Correct answer.

Explanation

Ultimate accountability for enterprise risk management rests with the board, often exercised through a dedicated risk committee. Management executes the program, and external auditors provide independent assurance rather than ownership.

Question 7Risk Management Fundamentals and Governance

A 'three lines model' places the risk management function and compliance function in which position?

  1. The second line, providing oversight and challenge to the first line Correct answer.
  2. Outside the model entirely, as an external party
  3. The first line, owning and managing risk directly
  4. The third line, providing independent assurance to the board

Explanation

In the three lines model, operational management owns risk in the first line, while risk and compliance functions form the second line providing oversight, frameworks, and challenge. Internal audit constitutes the third line of independent assurance.

Question 8Risk Management Fundamentals and Governance

Which metric is most appropriate for expressing risk tolerance in a way that can trigger escalation?

  1. A narrative describing the security team's mission
  2. A list of all controls deployed across the estate
  3. A statement that the organization values security highly
  4. A defined threshold, such as no more than two critical vulnerabilities open beyond 30 days Correct answer.

Explanation

Tolerance must be measurable to be enforceable, so it is expressed as a threshold that triggers escalation when breached. Statements of values, control inventories, and mission narratives do not provide measurable limits.

Question 9Risk Management Fundamentals and Governance

An organization classifies a vendor as critical and requires an annual assessment. Which governance artifact most directly documents this requirement?

  1. The disaster recovery test report
  2. The privileged access matrix
  3. The third-party risk management policy Correct answer.
  4. The network architecture diagram

Explanation

Policies establish mandatory requirements such as assessment frequency for critical vendors. Architecture diagrams, test reports, and access matrices are supporting records rather than sources of obligation.

Question 10Risk Management Fundamentals and Governance

A risk owner is accountable for a risk but lacks the authority to approve the budget needed for treatment. What is the most appropriate governance response?

  1. Defer the treatment indefinitely until the next annual assessment cycle
  2. Reduce the impact rating so the risk falls below the escalation threshold
  3. Escalate the decision to the level that holds budget authority and record the outcome in the register Correct answer.
  4. Reassign the risk to the control owner and close the register entry

Explanation

Accountability must be matched with authority, so decisions requiring funding escalate to the level that controls the budget, and the outcome is documented. Manipulating ratings or closing entries to avoid escalation undermines the integrity of the risk process.

Question 11Risk Management Fundamentals and Governance

Which statement correctly distinguishes a risk from an issue in governance reporting?

  1. A risk is always financial, while an issue is always technical
  2. A risk is a potential future event, while an issue is a condition already affecting objectives Correct answer.
  3. A risk is recorded after an incident, while an issue is recorded before
  4. A risk is owned by the board, while an issue is owned by the vendor

Explanation

Risks concern uncertain future events that may affect objectives, whereas issues are realized conditions requiring immediate management attention. Keeping the two separate prevents the register from being flooded with current operational problems.

Question 12Risk Management Fundamentals and Governance

A team applies a qualitative 5x5 matrix and rates a risk as likelihood 4, impact 5. A second team using a quantitative model estimates annualized loss exposure of $2 million. What is the best governance use of these two outputs?

  1. Use the qualitative rating for prioritization and the quantitative estimate to inform treatment cost justification Correct answer.
  2. Average the numeric score 20 with the dollar figure to produce a single index
  3. Report only the qualitative rating to the board to avoid confusion
  4. Discard the qualitative rating because quantitative results always supersede it

Explanation

Qualitative and quantitative assessments serve complementary purposes: the matrix enables consistent prioritization, while loss exposure supports cost-benefit reasoning about controls. They should be used together rather than merged into an artificial composite.

Question 13Risk Management Fundamentals and Governance

Which control type is a security awareness training program for all staff?

  1. Compensating
  2. Detective
  3. Corrective
  4. Preventive Correct answer.

Explanation

Awareness training aims to stop incidents from occurring by shaping behavior, which makes it preventive. Detective controls identify events after the fact, corrective controls restore conditions, and compensating controls substitute for a primary control.

Question 14Risk Management Fundamentals and Governance

An organization adopts a risk framework that separates governance, risk identification, risk analysis, and risk treatment into defined stages. What is the main governance benefit of this structure?

  1. It removes the need for management judgment in scoring
  2. It creates repeatable, auditable steps with clear responsibilities at each stage Correct answer.
  3. It guarantees that no risk will ever exceed tolerance
  4. It eliminates the requirement for independent assurance

Explanation

A structured lifecycle makes the process repeatable and auditable, with defined responsibilities and outputs at each stage. It cannot guarantee outcomes, replace judgment, or remove the need for assurance.

Question 15Risk Management Fundamentals and Governance

Which is the most appropriate key risk indicator for a risk of unauthorized access to sensitive records?

  1. Total number of employees in the organization
  2. Average duration of the monthly board meeting
  3. Count of servers purchased during the year
  4. Number of accounts with excessive privileges identified per quarter Correct answer.

Explanation

A key risk indicator should be measurable, linked to the risk driver, and capable of signaling changing exposure. Excessive privilege counts directly reflect conditions that enable unauthorized access.

Question 16Risk Management Fundamentals and Governance

A business unit wants to accept a risk rated above the enterprise tolerance threshold. Under sound governance, who should make that acceptance decision?

  1. The individual analyst who performed the assessment
  2. The executive or committee with authority above the threshold, documented with rationale and expiry Correct answer.
  3. The vendor whose service introduced the risk
  4. The internal auditor who reviewed the control

Explanation

Acceptance of risk beyond tolerance must be authorized at a level with the authority to accept it, and the decision should be documented with rationale and a review date. Analysts, vendors, and auditors do not hold that authority.

Question 17Risk Management Fundamentals and Governance

Which statement best captures the relationship between risk capacity and risk tolerance?

  1. Capacity is set by regulators; tolerance is set by customers
  2. Capacity is the maximum risk the organization can bear; tolerance is the level it chooses to operate within Correct answer.
  3. Capacity applies only to financial risk; tolerance applies only to operational risk
  4. Capacity is qualitative; tolerance is always expressed in currency

Explanation

Risk capacity describes the absolute limit the organization can absorb before objectives or solvency are threatened. Tolerance is the narrower, chosen operating range within that capacity, expressed through thresholds and limits.

Question 18Risk Management Fundamentals and Governance

During a risk assessment workshop, participants disagree on the likelihood of a supply chain disruption. What is the most defensible facilitation approach?

  1. Adopt the lowest estimate to avoid unnecessary spending
  2. Defer the risk to the register without any likelihood value
  3. Document the range of estimates, agree on explicit assumptions, and record the rationale for the selected value Correct answer.
  4. Adopt the highest estimate without discussion to be conservative

Explanation

Transparent assumptions and documented rationale make the assessment defensible and revisable as evidence changes. Automatically choosing the extreme estimate or leaving the field blank conceals the disagreement rather than resolving it.

Question 19Risk Management Fundamentals and Governance

Which activity best demonstrates that risk governance is operating effectively rather than merely documented?

  1. The risk policy was approved five years ago and has not been revisited
  2. Risk reports are distributed to staff but never discussed
  3. The register contains several thousand entries with no assigned owners
  4. Risk committee minutes show challenges to management assessments and resulting decisions with owners and dates Correct answer.

Explanation

Effective governance is evidenced by active challenge, decisions, and tracked actions, not by the existence of documents. Stale policies, unowned entries, and undiscussed reports indicate form without substance.

Question 20Risk Management Fundamentals and Governance

A risk assessment identifies that a legacy application cannot be patched. The team implements network segmentation and enhanced monitoring. How should these be classified?

  1. Compensating controls addressing a known limitation in the primary control Correct answer.
  2. Risk avoidance because the application remains in service
  3. Transfer of risk to the network vendor
  4. Corrective controls restoring the application to a patched state

Explanation

Segmentation and monitoring substitute for the unavailable patching control, which makes them compensating controls. They do not restore the patched state, eliminate the activity, or shift risk to a third party.

Question 21Risk Management Fundamentals and Governance

Which scenario best illustrates concentration risk in a third-party governance context?

  1. A vendor's contract includes a right-to-audit clause
  2. A vendor's service level agreement specifies a 99.9 percent uptime target
  3. Eighty percent of critical business processes depend on a single cloud provider with no tested exit plan Correct answer.
  4. A vendor provides annual independent assurance reports

Explanation

Concentration risk arises when critical dependencies cluster on a single provider without viable alternatives, amplifying the impact of failure. Audit rights, assurance reports, and uptime targets are mitigating contractual provisions rather than concentration risk itself.

Question 22Risk Management Fundamentals and Governance

A board wants assurance that risk treatment plans are actually reducing exposure. Which reporting approach provides the strongest evidence?

  1. A count of treatment plans opened during the year
  2. A list of policy documents approved by the board
  3. Trending of residual risk ratings against treatment milestones and control effectiveness testing results Correct answer.
  4. A summary of the number of risk workshops held

Explanation

Evidence of reduction requires comparing residual ratings over time against planned milestones and validating control effectiveness. Activity counts and document inventories measure effort, not whether exposure actually declined.

Question 23Risk Management Fundamentals and Governance

An organization uses a risk taxonomy that separates strategic, operational, financial, and compliance categories. A ransomware event that halts production and triggers regulatory notification should be recorded how?

  1. Primarily as operational risk, with linked compliance and financial consequences captured through the taxonomy's cross-references Correct answer.
  2. As strategic risk, because it affects the long-term plan
  3. Only as financial risk, because recovery costs are incurred
  4. Only as compliance risk, because a regulator must be notified

Explanation

Taxonomies classify by primary driver while allowing linked consequences to be recorded, preventing duplicate or lost entries. Ransomware disrupting production is fundamentally operational, with compliance and financial effects tracked as linked impacts.

Question 24Risk Management Fundamentals and Governance

A risk practitioner argues that because a control has operated without failure for three years, the residual risk rating should be lowered to the minimum. Which critique is most sound?

  1. Three years is always too short a period to evaluate any control
  2. Residual risk should never be adjusted after initial assessment
  3. Control effectiveness is irrelevant to residual risk ratings
  4. Absence of observed incidents is weak evidence of control effectiveness without testing and should not by itself justify a minimum rating Correct answer.

Explanation

No incidents may reflect luck, low event frequency, or undetected failures rather than effective control. Ratings should be supported by control testing and threat intelligence, not by the mere absence of reported events.

Question 25Risk Management Fundamentals and Governance

Which decision best reflects a risk-based approach to allocating limited remediation budget across two findings of equal technical severity?

  1. Prioritize the finding on the system supporting the most critical business process and highest potential impact Correct answer.
  2. Prioritize the finding reported by the loudest business unit
  3. Prioritize the finding with the earliest discovery date regardless of context
  4. Split the budget evenly to avoid making a judgment

Explanation

Risk-based prioritization weighs business criticality and potential impact alongside technical severity. Discovery date, escalation volume, and mechanical equal splits ignore the context that determines actual exposure.

Question 26Risk Management Fundamentals and Governance

An organization defines its risk appetite as 'low tolerance for regulatory non-compliance.' Which statement best describes how that appetite statement should be used in governance?

  1. It is a communications statement for external stakeholders and carries no operational decision weight.
  2. It sets the boundary within which business units define measurable tolerance thresholds and escalation triggers. Correct answer.
  3. It should be revised quarterly to match the risk scores produced by the enterprise risk assessment.
  4. It replaces the need for a formal risk register because appetite statements already capture all exposures.

Explanation

Risk appetite is the broad amount and type of risk an organization is willing to pursue or retain, and it must be translated into measurable tolerance thresholds and escalation triggers that guide decisions at lower levels. It constrains rather than replaces risk registers, and it is not merely external messaging. Appetite is set by leadership and reviewed periodically, but it is not mechanically rewritten to fit whatever scores an assessment produces.

Question 27Risk Management Fundamentals and Governance

A newly appointed chief risk officer wants to establish clear ownership for a set of enterprise risks. Which assignment best reflects sound risk governance?

  1. Each risk is assigned to the external auditor who reviews the annual financial statements.
  2. Each risk is assigned to the risk committee collectively so that accountability is shared across the group.
  3. Each risk is assigned to a named accountable individual with authority over the relevant processes and budget. Correct answer.
  4. Each risk is assigned to the internal audit team so that ownership stays independent of business operations.

Explanation

A risk owner should be a named individual with the authority and resources to influence the risk, so accountability is personal and actionable. Assigning risks to audit or external parties breaks the separation between oversight and management. Collective ownership without a named accountable person diffuses responsibility and weakens treatment follow-through.

Question 28Risk Management Fundamentals and Governance

A risk committee reviews a heat map showing that operational losses cluster in one business unit while the enterprise-level residual risk rating remains unchanged. Which governance conclusion is most defensible?

  1. The enterprise rating is reliable because aggregation smooths unit-level volatility by design.
  2. The business unit should self-certify that its losses are within appetite without further review.
  3. Aggregation may be masking a concentration of exposure that warrants escalation and targeted treatment. Correct answer.
  4. The heat map should be discarded because qualitative scales cannot support governance decisions.

Explanation

Enterprise-level aggregation can obscure concentrations of exposure sitting in a single unit, so a stable top-level rating alongside clustered losses signals a need for escalation and targeted analysis. Qualitative scales remain valid governance tools when used consistently. Self-certification by the affected unit does not provide the independent challenge that governance requires.

Question 29Risk Management Fundamentals and Governance

An organization is defining escalation criteria for its risk register. Which design choice best supports consistent escalation across business units?

  1. Escalation is triggered annually when the register is refreshed for the board risk report.
  2. Escalation is triggered when a residual risk exceeds defined thresholds tied to the approved appetite. Correct answer.
  3. Escalation is triggered whenever any risk owner personally feels the exposure is uncomfortable.
  4. Escalation is triggered only after a loss event has been recorded in the incident management system.

Explanation

Escalation criteria should be objective and linked to approved appetite so that different units apply the same standard. Personal discomfort is subjective and produces inconsistent outcomes, while loss-triggered escalation is reactive and occurs after harm. Annual refresh cycles are too slow for risks that breach tolerance during the year.

Question 30Risk Management Fundamentals and Governance

A board delegates risk oversight to its audit and risk committee but retains ultimate accountability. A material risk breach is reported to the committee and resolved without board awareness. Which governance weakness does this most directly illustrate?

  1. A delegation gap in which escalation thresholds do not require material breaches to reach the full board. Correct answer.
  2. Inadequate risk taxonomy coverage of the business processes affected by the breach.
  3. Excessive board involvement in operational risk decisions that should sit with management.
  4. Insufficient independence of the risk function from the first line of defense.

Explanation

Delegation is sound only when the terms of reference specify which matters must be escalated to the board regardless of committee resolution. A material breach resolved entirely inside the committee indicates that escalation thresholds and reporting lines are underspecified. The scenario shows no evidence of board overreach, independence failure, or taxonomy gaps.

Question 31Risk Identification and Asset Inventory

An organization is building its risk register and wants a complete picture of the assets that support a critical payment service. Which asset-inventory practice best ensures that supporting infrastructure is captured alongside the application itself?

  1. Listing the payment service in the business impact analysis with a recovery time objective
  2. Documenting only the application servers that host the payment code
  3. Mapping each business service to its dependent hardware, software, data, and third-party components Correct answer.
  4. Recording the payment application in the configuration management database without dependency links

Explanation

Effective asset inventory for risk identification links business services to every supporting component so that risks in infrastructure, data, and suppliers are visible. A service-to-asset dependency map prevents blind spots where a supporting system is unmanaged.

Question 32Risk Identification and Asset Inventory

Which characteristic most distinguishes a risk from an issue in a risk register?

  1. A risk applies to technology assets, whereas an issue applies to business processes
  2. A risk has a documented owner, whereas an issue does not
  3. A risk is a potential future event, whereas an issue is a condition that has already materialized Correct answer.
  4. A risk is always rated high, whereas an issue is always rated low

Explanation

A risk describes a possible future event that may affect objectives if it occurs. An issue is a problem that has already occurred and requires management action now.

Question 33Risk Identification and Asset Inventory

A risk analyst is classifying an organization's information assets. Which classification approach most directly supports risk identification by tying protection requirements to business value?

  1. Grouping assets by the department that purchased them
  2. Classifying assets by data sensitivity and business criticality Correct answer.
  3. Sorting assets alphabetically by system name
  4. Classifying assets by the vendor that supplied the hardware

Explanation

Classification by sensitivity and criticality connects each asset to the impact of its loss, which is the basis for prioritizing risk. Purchasing department, name order, and vendor do not reflect business value or protection needs.

Question 34Risk Identification and Asset Inventory

What is the primary purpose of assigning a risk owner in a risk register?

  1. To eliminate the need for periodic risk reassessment
  2. To ensure accountability for monitoring and treating the risk Correct answer.
  3. To document the technical control that mitigates the risk
  4. To transfer the financial loss to a third party

Explanation

A risk owner is accountable for managing the risk, including monitoring it and ensuring treatment is carried out. Ownership does not itself transfer loss, remove the need for reassessment, or describe controls.

Question 35Risk Identification and Asset Inventory

Which statement best describes the role of a threat catalog in the risk identification process?

  1. It records the residual risk remaining after controls are applied
  2. It provides a structured set of threat sources and events to consider against identified assets Correct answer.
  3. It defines the recovery time objectives for critical systems
  4. It lists the monetary value of each organizational asset

Explanation

A threat catalog gives analysts a structured, reusable list of threat sources and event types so that identification is systematic rather than ad hoc. It does not hold asset valuations, residual risk figures, or recovery objectives.

Question 36Risk Identification and Asset Inventory

An organization wants to identify risks arising from its reliance on external service providers. Which inventory element is most important to maintain for this purpose?

  1. The software license expiration dates for internal applications
  2. A register of third-party vendors mapped to the services and data they support Correct answer.
  3. The network bandwidth allocated to each internal department
  4. The physical location of each employee workstation

Explanation

Supply chain risk identification depends on knowing which vendors support which services and handle which data, so that dependencies and exposure can be assessed. Workstation locations, license dates, and bandwidth allocations do not reveal third-party dependency risk.

Question 37Risk Identification and Asset Inventory

Which of the following best defines an asset in the context of risk identification?

  1. Any control that reduces the likelihood of a threat event
  2. Any regulatory requirement the organization must satisfy
  3. Any threat actor with the capability to exploit a weakness
  4. Any resource that has value to the organization and could be affected by a risk event Correct answer.

Explanation

An asset is anything of value to the organization, such as information, systems, people, or facilities, that a risk event could affect. Controls, threat actors, and regulations are distinct concepts in the risk model.

Question 38Risk Identification and Asset Inventory

During risk identification, an analyst finds that a legacy database has no documented owner and is not in the asset inventory. What is the most appropriate immediate action?

  1. Exclude it from the register because it is undocumented
  2. Decommission the database without further review
  3. Classify it as low risk because no incidents have occurred
  4. Add the database to the inventory and assign an accountable owner before assessing its risk Correct answer.

Explanation

An unmanaged asset is a governance gap; it should be inventoried and assigned an accountable owner so its risk can be assessed and treated. Decommissioning, excluding, or downgrading it without assessment leaves unknown exposure.

Question 39Risk Identification and Asset Inventory

A team uses a qualitative risk assessment to prioritize identified risks. Which approach is consistent with qualitative methods?

  1. Assigning likelihood and impact ratings using a defined scale and criteria Correct answer.
  2. Measuring the exact probability distribution of loss events
  3. Calculating annualized loss expectancy from historical incident data
  4. Simulating attacker behavior against production systems

Explanation

Qualitative assessment uses defined scales and criteria to rate likelihood and impact, producing relative priorities. Quantitative methods rely on numeric loss data, probability distributions, and simulation.

Question 40Risk Identification and Asset Inventory

An organization is scoping a risk assessment for a new cloud-hosted customer portal. Which scoping decision best supports comprehensive risk identification?

  1. Limit scope to the portal's user interface code
  2. Restrict scope to assets owned by the IT department
  3. Include the portal, its data flows, integrated identity services, and the cloud provider dependency Correct answer.
  4. Exclude third-party services because they are outside organizational control

Explanation

Comprehensive scoping includes the system, its data flows, integrated services, and external dependencies so that risks across the boundary are identified. Narrowing scope to code, owned assets, or excluding providers creates blind spots.

Question 41Risk Identification and Asset Inventory

What is the purpose of a risk taxonomy during risk identification?

  1. To certify that controls meet regulatory requirements
  2. To record the acceptance decision for each residual risk
  3. To calculate the financial impact of each identified risk
  4. To provide a consistent structure of risk categories so that identified risks are organized and comparable Correct answer.

Explanation

A risk taxonomy supplies consistent categories and terminology so risks can be organized, compared, and aggregated across the organization. Impact calculation, control certification, and acceptance decisions are separate activities.

Question 42Risk Identification and Asset Inventory

An analyst is identifying risks for a system and considers both internal and external threat sources. Which pair correctly represents an external threat source and an internal threat source?

  1. A careless employee and a hardware failure
  2. A careless employee and a malicious external actor
  3. A malicious external actor and a careless employee Correct answer.
  4. A lightning strike and a malicious external actor

Explanation

External threat sources originate outside the organization, such as malicious actors, while internal sources include employees whose errors create risk. Grouping careless employees as external or environmental events as internal misclassifies the sources.

Question 43Risk Identification and Asset Inventory

An organization maintains an asset inventory but never links assets to the business processes they support. Which risk identification weakness does this create?

  1. It prevents the organization from calculating asset depreciation
  2. It makes it difficult to assess the business impact of an asset's compromise Correct answer.
  3. It eliminates the need for a configuration management database
  4. It guarantees that all assets will be classified as low risk

Explanation

Without process linkage, analysts cannot determine which business functions depend on an asset, so impact assessment becomes speculative. Depreciation, CMDB necessity, and uniform low-risk classification are unrelated consequences.

Question 44Risk Identification and Asset Inventory

A risk assessment identifies a vulnerability in an internet-facing web server. Which element completes the risk statement by describing how a threat could exploit the vulnerability?

  1. The asset owner's name
  2. The threat event, such as an attacker exploiting the flaw to gain unauthorized access Correct answer.
  3. The residual risk rating
  4. The control's implementation date

Explanation

A complete risk statement combines an asset, a threat, a vulnerability, and a potential impact; the threat event describes how the vulnerability could be exploited. Owner names, control dates, and residual ratings are metadata, not the threat event.

Question 45Risk Identification and Asset Inventory

Which scenario best illustrates a risk that arises from an asset inventory being incomplete?

  1. An unrecorded database containing customer data is breached because no one applied security controls Correct answer.
  2. A documented server receives a scheduled patch
  3. A business continuity plan is tested on schedule
  4. A vendor contract is renewed before expiration

Explanation

Assets missing from inventory are not subject to controls, monitoring, or patching, so they become hidden exposures. The other scenarios describe routine managed activities that do not stem from inventory gaps.

Question 46Risk Identification and Asset Inventory

An organization wants to identify risks that could affect a specific business process. Which starting point is most effective?

  1. Beginning with the list of known malware families and working backward
  2. Beginning with the annual budget and identifying cost overruns
  3. Beginning with the process's supporting assets, data, people, and dependencies and then identifying threats to each Correct answer.
  4. Beginning with the list of accepted risks from prior years

Explanation

Process-centric risk identification starts from what the process relies on and then examines threats and vulnerabilities for each element, producing coverage of the process's real exposure. Malware lists, budgets, and prior accepted risks do not systematically cover the process.

Question 47Risk Identification and Asset Inventory

What distinguishes inherent risk from residual risk in a risk register?

  1. Inherent risk applies only to IT assets, while residual risk applies only to business assets
  2. Inherent risk is recorded only after an incident, while residual risk is recorded before
  3. Inherent risk is always lower than residual risk
  4. Inherent risk is assessed before controls, while residual risk is assessed after controls are applied Correct answer.

Explanation

Inherent risk is the exposure that exists before considering controls, and residual risk is what remains after controls are applied. Asset type and incident timing do not define the distinction, and residual risk is normally lower, not higher.

Question 48Risk Identification and Asset Inventory

An analyst is reviewing a supplier that processes payment card data. Which inventory attribute is most relevant for identifying the associated compliance and data exposure risk?

  1. The supplier's office floor plan
  2. The supplier's marketing budget
  3. The number of employees at the supplier's headquarters
  4. The categories and volume of data the supplier stores, processes, or transmits Correct answer.

Explanation

Knowing what data categories and volumes a supplier handles determines the compliance obligations and potential exposure if the supplier fails. Physical layout, marketing spend, and headcount do not describe data risk.

Question 49Risk Identification and Asset Inventory

An organization is deciding how frequently to refresh its asset inventory. Which factor most appropriately drives the refresh frequency?

  1. The rate of change in the environment and the criticality of the assets Correct answer.
  2. The color scheme used in the inventory dashboard
  3. The number of pages in the inventory document
  4. The seniority of the analyst performing the review

Explanation

Inventory accuracy depends on how quickly the environment changes and how critical the assets are, so high-change, high-criticality environments need more frequent updates. Document length, analyst seniority, and presentation choices do not affect accuracy needs.

Question 50Risk Identification and Asset Inventory

A risk analyst must decide whether a newly identified risk should be escalated to senior management. Which criterion is most appropriate for that decision?

  1. The risk relates to a system built more than five years ago
  2. The risk has a corresponding entry in the threat catalog
  3. The risk exceeds the organization's defined risk appetite or tolerance threshold Correct answer.
  4. The risk was identified by an external auditor

Explanation

Escalation criteria should be tied to the organization's risk appetite and tolerance so that risks beyond acceptable levels reach decision-makers. The source of identification, system age, or catalog presence does not by itself indicate a need to escalate.