Information Security Risk Management

CISM · 60 questions

• The security operations team subscribes to several commercial and open-source threat intelligence feeds and now receives thousands of indicators a day. Analysts say they cannot act on most of it. What would MOST improve the value of the threat intelligence program?
• The information security manager learns that employees in several departments are pasting customer and internal data into public generative AI tools to speed up their work. Senior management has not yet taken a position on these tools. What should the information security manager do FIRST?
• Threat intelligence reports that a ransomware group has begun targeting organizations in the company's industry sector, using techniques not considered in the last annual risk assessment. What should the information security manager do FIRST?
• Several recent high-profile breaches in the company's sector entered through updates from trusted software suppliers. The organization's risk assessment currently covers only internally developed and hosted systems. What is the MOST appropriate response?
• A board member asks how the organization is addressing the long-term threat that quantum computing poses to current public-key encryption. No practical attack exists today, but some customer data must remain confidential for many years. What should the information security manager recommend?
• The company has announced significant layoffs that will take place over the next six months. Morale is low, and many affected staff have privileged access to sensitive systems. What should the information security manager do FIRST?
• The business is designing a new customer-facing payment service. The information security manager wants the security requirements to reflect who is realistically likely to attack the service and how. Which activity BEST supports this goal?
• A risk workshop notes that a phishing group is targeting the sector, that an internet-facing server is missing a security patch, and that customer records could be exposed if the server were compromised. Which statement correctly classifies these elements?
• A regional bank's security team usually learns of relevant attack campaigns from news reports, often after peer institutions have already been hit. The information security manager is considering joining the sector's information sharing and analysis center. What is the PRIMARY benefit of membership?
• A geopolitical conflict has sharply increased state-sponsored cyberattacks against companies in the organization's country and sector. The related scenarios in the risk register carry likelihood ratings assessed eighteen months ago. What should the information security manager do?
• A quarterly vulnerability scan returns thousands of findings across servers, workstations and network devices. The remediation team can address only a fraction of them each month. How should the information security manager prioritize remediation?
• Senior management has received a vulnerability scan report and asks whether an external attacker could actually chain the reported findings together to reach customer data. Which activity would BEST answer this question?
• An internal audit finds that a required control is not implemented on a payments system. The system team says a different control already in place compensates for it. What should the information security manager do FIRST?
• A policy requires monthly review of privileged access, and the procedure is well documented and appropriate. Sample testing shows that no reviews have been performed for the last five months. How should this deficiency be classified?
• A critical manufacturing control system runs on an unsupported operating system that cannot be patched without the vendor recertifying the whole production line, which will take two years. What is the BEST course of action?
• Every quarter, vulnerability scans find the same insecure configuration setting on newly built servers, and the operations team corrects each server by hand. What should the information security manager recommend?
• A zero-day vulnerability with no available patch is publicly announced for a widely used file-transfer product. What should the information security manager do FIRST?
• After adopting a control framework, the information security manager wants to know where the controls actually in place fall short of the control objectives that management has set. Which technique BEST meets this need?
• The information security manager must report to senior management whether the vulnerability management process is effective at reducing exposure. Which metric BEST demonstrates this?
• The remediation team reports that most of its time is spent investigating vulnerability scan findings that turn out not to be real, while confirmed critical issues wait in the queue. What should the information security manager do?
• The information security manager is assessing risk for a new line of business. There is little reliable historical loss data and no industry benchmarks for the scenarios involved. Which approach is MOST appropriate?
• A data breach scenario has a single loss expectancy of $200,000 and an annual rate of occurrence of 0.25. A proposed control costs $30,000 a year and would reduce the annual rate of occurrence to 0.05. What is the annualized loss expectancy before the control, and is the control cost-justified?
• A risk assessment rates a data leakage scenario as high before any controls are considered and as medium after encryption and access controls are taken into account. What do these two ratings represent, in order?
• A business unit is about to perform its first information security risk assessment, and the scope has been agreed with management. Which step should come FIRST?
• The security team completed a risk assessment in which it assigned business impact values to each application on its own, without consulting anyone outside IT. Business leaders now dispute the results. What should have been done differently?
• Senior management wants risk scenarios that show how information security events could prevent the company from achieving its strategic objectives, so they can be discussed at the executive level. Which approach to scenario development BEST fits this purpose?
• Each of twelve business units has a minor data-handling risk that is individually within the tolerance set for that unit. All twelve units depend on the same shared file-transfer platform. What should concern the information security manager MOST?
• An organization performs its information security risk assessment annually. Four months after the last one, the core customer database is migrated to a public cloud service. What should the information security manager do?
• A project team has completed a business impact analysis for its systems and proposes to use it as the systems' security risk assessment to save time. Why is this insufficient?
• Business units submit risk assessments using their own scoring scales, ranging from three-point to ten-point ratings with different definitions. The information security manager must present an enterprise view of the top risks. What is the BEST action?
• A proposed control would cost $250,000 a year to reduce a risk whose expected annual loss is $40,000. The current level of risk is within the organization's risk appetite. What is the MOST appropriate risk response?
• After the company purchases a cyber insurance policy that covers data breach costs, a business executive proposes cutting the security budget because the breach risk now belongs to the insurer. How should the information security manager respond?
• After a risk assessment, management decides to discontinue an online service that handled sensitive customer data because the cost of securing it would exceed the revenue it earns. Which risk response does this represent?
• Planned controls for a new trading platform have been implemented, but the residual risk is still above the organization's risk appetite. The business wants to launch next week. What should the information security manager do?
• A business unit head asks the information security manager to sign the risk acceptance for an unpatched vulnerability in the unit's sales system, saying security is the expert on the risk. What should the information security manager do?
• A review of the risk register shows dozens of risk acceptances recorded several years ago with no expiry or review dates. Some of the underlying systems have changed significantly since then. What should the information security manager recommend?
• An online payments business wants to reduce fraud losses, but it will not accept any control that blocks or delays legitimate customer transactions. Which type of control is MOST appropriate?
• The board has stated that the company will accept only a low level of risk to customer data. A business unit asks how far a specific key risk indicator may deviate from its target before escalation is required. Which concept answers the business unit's question?
• Business leaders want to move a customer-facing application to a cloud provider and state that the move will transfer all security risk for the application to the provider. How should the information security manager respond?
• Five risk treatment plans compete for a limited security budget that cannot fund all of them this year. How should the information security manager recommend which plans to fund?
• The risk register lists an IT database administrator as both the owner of the risk 'loss of customer order data' and the owner of the backup control that treats it. What change should the information security manager recommend?
• A significant risk to the company's online ordering capability has sat in the risk register for months without an owner, and no treatment decision has been made. What should the information security manager do?
• A quarterly user access review stopped being performed after the employee who ran it left the company, and nobody noticed for three quarters. Which measure would BEST prevent this from happening again?
• The head of IT insists on owning the risk for the company's claims-processing application because IT built and runs it. The claims department relies on the application for its core business process. Who should own this risk?
• Several recent outages and data exposures were traced to changes that went into production without anyone considering their security impact. What should the information security manager recommend?
• A project manager wants to skip the security risk assessment for a new customer portal so the project can meet its launch date. What is the BEST way to prevent this situation in future projects?
• A centrally run quarterly access-review control covers applications used by three business units. An audit finds that no reviews were completed for two quarters, and each unit's manager states that another unit or IT was responsible. What should the information security manager do to BEST prevent a recurrence?
• Annual control self-assessment results show that every control owner rated all of their controls as effective, although two significant incidents last year involved controls on the list. What is the MOST appropriate next step for the information security manager?
• A business unit head who owns a customer portal declines to fund remediation of a vulnerability that the risk assessment rated high, above the organization's documented risk appetite. The unit head says the business will simply accept the risk. What should the information security manager do?
• A vendor that processes customer data was onboarded and paid for months before the security team learned of the contract, because purchasing signs agreements without any information risk step. What should the information security manager do to BEST address the root cause?
• Management wants an indicator that will warn of increasing exposure to account-compromise risk before any loss occurs. Which metric BEST meets this need?
• A key risk indicator tracking critical systems with overdue patches has exceeded its approved threshold for the second consecutive month. The risk management procedure defines an escalation path for each threshold level. What should the information security manager do FIRST?
• The information security manager is preparing the quarterly information risk report for the board of directors. Which content would BEST serve the board?
• During a review, the information security manager finds that no entry in the information risk register has been updated in two years, although the business has since launched two online services and moved its payroll to a cloud provider. What should be done to BEST correct this?
• A compliance review shows that several business units are not following the organization's laptop encryption standard, citing performance concerns. What should the information security manager do NEXT?
• Executives review information risk using only a red-amber-green heat map. In the last meeting they treated two amber risks as equivalent, although one could cause a loss many times larger than the other. What should the information security manager do?
• The organization has just completed the acquisition of a smaller company whose systems will be connected to the corporate network over the next six months. What should the information security manager do to BEST support senior management's integration decisions?
• Continuous monitoring tools generate a large volume of technical alerts, and executives say the resulting security reports do not help them make decisions. What should the information security manager do?
• The information security manager is defining how often each risk in the register should be monitored. Which approach is MOST appropriate?
• The information risk dashboard has shown every key risk indicator as green for three quarters, yet the number of security incidents has risen in each of those quarters. What should the information security manager conclude and do?