CISM Exam Questions and Answers | Exam-Dumps (Page: 59)

QUESTION: 291

Risk assessment is MOST effective when performed:

at the beginning of security program development.
on a continuous basis.
while developing the business case for the security program.
during the business change process.

Answer(s): B

Explanation:

Risk assessment needs to be performed on a continuous basis because of organizational and technical changes. Risk assessment must take into account all significant changes in order to be effective.

Reveal Solution Next Question

QUESTION: 292

Which of the following is the MAIN reason for performing risk assessment on a continuous basis'?

Justification of the security budget must be continually made.
New vulnerabilities are discovered every day.
The risk environment is constantly changing.
Management needs to be continually informed about emerging risks.

Answer(s): C

Explanation:

The risk environment is impacted by factors such as changes in technology, and business strategy. These changes introduce new threats and vulnerabilities to the organization. As a result, risk assessment should be performed continuously. Justification of a budget should never be the main reason for performing a risk assessment. New vulnerabilities should be managed through a patch management process. Informing management about emerging risks is important, but is not the main driver for determining when a risk assessment should be performed.

Reveal Solution Next Question

QUESTION: 293

There is a time lag between the time when a security vulnerability is first published, and the time when a patch is delivered. Which of the following should be carried out FIRST to mitigate the risk during this time period?

Identify the vulnerable systems and apply compensating controls
Minimize the use of vulnerable systems
Communicate the vulnerability to system users
Update the signatures database of the intrusion detection system (IDS)

Answer(s): A

Explanation:

The best protection is to identify the vulnerable systems and apply compensating controls until a patch is installed. Minimizing the use of vulnerable systems and communicating the vulnerability to system users could be compensating controls but would not be the first course of action. Choice D does not make clear the timing of when the intrusion detection system (IDS) signature list would be updated to accommodate the vulnerabilities that are not yet publicly known. Therefore, this approach should not always be considered as the first option.

Reveal Solution Next Question

QUESTION: 294

Which of the following security activities should be implemented in the change management process to identify key vulnerabilities introduced by changes?

Business impact analysis (BIA)
Penetration testing
Audit and review
Threat analysis

Answer(s): B

Explanation:

Penetration testing focuses on identifying vulnerabilities. None of the other choices would identify vulnerabilities introduced by changes.

Reveal Solution Next Question

QUESTION: 295

Which of the following techniques MOST clearly indicates whether specific risk-reduction controls should be implemented?

Countermeasure cost-benefit analysis
Penetration testing
Frequent risk assessment programs
Annual loss expectancy (ALE) calculation

Answer(s): A

Explanation:

In a countermeasure cost-benefit analysis, the annual cost of safeguards is compared with the expected cost of loss. This can then be used to justify a specific control measure. Penetration testing may indicate the extent of a weakness but, by itself, will not establish the cost/benefit of a control. Frequent risk assessment programs will certainly establish what risk exists but will not determine the maximum cost of controls. Annual loss expectancy (ALE) is a measure which will contribute to the value of the risk but. alone, will not justify a control.

Reveal Solution Next Question

ISACA CISM Exam (page: 59) ISACA Certified Information Security Manager Updated on: 02-Jan-2026

QUESTION: 291

Explanation:

QUESTION: 292

Explanation:

QUESTION: 293

Explanation:

QUESTION: 294

Explanation:

QUESTION: 295

Explanation:

ISACA CISM Exam (page: 59)
ISACA Certified Information Security Manager
Updated on: 02-Jan-2026