The board asks for cyber risk to be expressed in financial terms to compare it with other enterprise risks. Which approach is MOST appropriate?

A quantitative model, such as FAIR, estimating loss ranges

The board asks why an annual penetration test is funded when monthly vulnerability scans already run. Which explanation is BEST?

A scan finds potential weaknesses, while a penetration test exploits them to show impact

When defining responsibilities for a significant risk, a working group proposes that three business managers be jointly accountable for it. What is the PRIMARY concern with this approach?

Shared accountability diffuses responsibility, so risk decisions and follow-up actions may be delayed or missed

The information security manager is setting how often each risk in the register should be reviewed. Which factor should MOST influence the monitoring frequency?

How critical the risk is and how quickly its likelihood or impact can change

The organization is expanding into a country with significant geopolitical instability. Which risk factor should the information security manager specifically assess?

State-linked threats, local data-access laws and infrastructure reliability

What is the PRIMARY responsibility of a control owner?

Keeping the control effectively designed, operated and monitored

The organization has launched a customer-facing AI chatbot that can query internal order systems. Security researchers warn that crafted user inputs can manipulate such chatbots into ignoring their instructions. Which risk should the information security manager assess MOST closely?

Unauthorized data access or unintended actions performed through the chatbot's connections to back-end order systems

While reviewing the risk register, the information security manager notices that formally accepted risks have no defined end date. Which addition to the acceptance record is MOST important?

A review or expiry date with triggers for re-evaluation by the owner

Free CISM Domain 2 Practice Questions with Answers

2026-10-19

These five CISM Domain 2 questions are drawn from Auditor Path's bank. Each follows ISACA's item-writing style: a scenario, four plausible options and one BEST answer. Read the explanation even when you get it right — it names the judgment the exam is testing.

Domain 2, Information Security Risk Management, is 20% of the CISM exam.

Question 1: Risk Assessment and Analysis

An asset is valued at 100,000. A threat is expected to occur once every four years and would destroy 40% of the asset's value. What is the annualized loss expectancy (ALE)?

A. 160,000
B. 25,000
C. 10,000
D. 40,000

Answer: C. SLE = asset value × exposure factor = 100,000 × 0.4 = 40,000. ARO = 0.25. ALE = SLE × ARO = 10,000.

Exam mindset: Know the arithmetic of quantitative risk.

Question 2: Risk Monitoring and Reporting

The board has set a low risk appetite for customer data exposure. How is risk tolerance BEST described in this context?

A. The ability of critical systems to keep running during component failures
B. The acceptable deviation from appetite before escalation or action is needed
C. The total amount of risk the organization is willing to take to meet objectives
D. The level of risk remaining after the planned controls have been applied

Answer: B. Tolerance sets the thresholds around the appetite that trigger escalation, which is why KRIs are calibrated to it.

Exam mindset: Appetite sets the target; tolerance sets the limits.

Question 3: Vulnerability and Control Deficiency Analysis

A zero-day vulnerability with no available patch affects a critical internet-facing application. What should the information security manager do?

A. Commission an urgent penetration test to confirm whether the vulnerability is exploitable
B. Monitor the vendor's security advisories closely and apply the patch as soon as it is released
C. Take the application offline until the vendor releases and the team tests a patch
D. Apply compensating controls such as filtering, increase monitoring and inform the risk owner

Answer: D. When no fix exists, risk is reduced by compensating controls and detection while the owner decides on further action.

Exam mindset: No patch does not mean no action.

Question 4: Emerging Risk and Threat Landscape

Ransomware groups increasingly steal data before encrypting it and threaten to publish it if the ransom is unpaid. How should the information security manager update the organization's ransomware risk assessment?

A. Increase backup frequency so systems can be restored faster
B. Lower the likelihood rating because tested offline backups are already in place for key systems
C. Recommend paying ransoms to prevent publication of stolen data
D. Reassess impact to include data disclosure, which backups alone cannot limit

Answer: D. Data theft before encryption changes the impact profile from an availability event to a confidentiality and regulatory event. The assessment must reflect that recovery capability no longer caps the damage.

Exam mindset: New attacker tactics change impact, not just likelihood.

Question 5: Risk Treatment / Risk Response Options

A new data loss prevention control has just been implemented as part of a risk treatment plan. What should be done BEFORE the residual risk rating is lowered in the register?

A. Wait for the next external audit to review the control and confirm its operation
B. Lower the rating immediately, because the control has been implemented and is in place
C. Obtain the supplier's written statement that the control is configured correctly
D. Verify that the control operates as intended and has the expected effect

Answer: D. Residual risk reflects controls as they actually perform. Testing effectiveness first prevents an overstated sense of protection.

Exam mindset: Verify, then credit the control.

Keep practising

The quiz below draws more questions from every CISM Domain 2 subtopic. Sign in to practise the full bank, take timed 150-question mocks and see your readiness by domain.