CISM Exam Questions and Answers | Exam-Dumps (Page: 62)

QUESTION: 306

Which of the following is the MOST effective way to treat a risk such as a natural disaster that has a low probability and a high impact level?

Implement countermeasures.
Eliminate the risk.
Transfer the risk.
Accept the risk.

Answer(s): C

Explanation:

Risks are typically transferred to insurance companies when the probability of an incident is low but the impact is high. Examples include: hurricanes, tornados and earthquakes. Implementing countermeasures may not be the most cost-effective approach to security management. Eliminating the risk may not be possible. Accepting the risk would leave the organization vulnerable to a catastrophic disaster which may cripple or ruin the organization. It would be more cost effective to pay recurring insurance costs than to be affected by a disaster from which the organization cannot financially recover.

Reveal Solution Next Question

QUESTION: 307

To ensure that payroll systems continue on in an event of a hurricane hitting a data center, what would be the FIRS T crucial step an information security manager would take in ensuring business continuity planning?

Conducting a qualitative and quantitative risk analysis.
Assigning value to the assets.
Weighing the cost of implementing the plan vs. financial loss.
Conducting a business impact analysis (BIA).

Answer(s): D

Explanation:

BIA is an essential component of an organization's business continuity plan; it includes an exploratory component to reveal any vulnerabilities and a planning component to develop strategies for minimizing risk. It is the first crucial step in business continuity planning. Qualitative and quantitative risk analysis will have been completed to define the dangers to individuals, businesses and government agencies posed by potential natural and human-caused adverse events. Assigning value to assets is part of the BIA process. Weighing the cost of implementing the plan vs. financial loss is another part of the BIA.

Reveal Solution Next Question

QUESTION: 308

An information security organization should PRIMARILY:

support the business objectives of the company by providing security-related support services.
be responsible for setting up and documenting the information security responsibilities of the information security team members.
ensure that the information security policies of the company are in line with global best practices and standards.
ensure that the information security expectations are conveyed to employees.

Answer(s): A

Explanation:

The information security organization is responsible for options B and D within an organization, but they are not its primary mission. Reviewing and adopting appropriate standards (option C) is a requirement. The primary objective of an information security organization is to ensure that security supports the overall business objectives of the company.

Reveal Solution Next Question

QUESTION: 309

When implementing security controls, an information security manager must PRIMARILY focus on:

minimizing operational impacts.
eliminating all vulnerabilities.
usage by similar organizations.
certification from a third party.

Answer(s): A

Explanation:

Security controls must be compatible with business needs. It is not feasible to eliminate all vulnerabilities. Usage by similar organizations does not guarantee that controls are adequate. Certification by a third party is important, but not a primary concern.

Reveal Solution Next Question

QUESTION: 310

All risk management activities are PRIMARILY designed to reduce impacts to:

a level defined by the security manager.
an acceptable level based on organizational risk tolerance.
a minimum level consistent with regulatory requirements.
the minimum level possible.

Answer(s): B

Explanation:

The aim of risk management is to reduce impacts to an acceptable level. "Acceptable" or "reasonable" are relative terms that can vary based on environment and circumstances. A minimum level that is consistent with regulatory requirements may not be consistent with business objectives, and regulators typically do not assign risk levels. The minimum level possible may not be aligned with business requirements.

Reveal Solution Next Question

ISACA CISM Exam (page: 62) ISACA Certified Information Security Manager Updated on: 02-Jan-2026

QUESTION: 306

Explanation:

QUESTION: 307

Explanation:

QUESTION: 308

Explanation:

QUESTION: 309

Explanation:

QUESTION: 310

Explanation:

ISACA CISM Exam (page: 62)
ISACA Certified Information Security Manager
Updated on: 02-Jan-2026