SaveMyCert
Log in
5 of 5 free questions left today·for 10 a day
CISM · Domain 2

Information Security Risk Management practice questions

Information Security Risk Management is worth 20% of the CISM exam — the 3rd-heaviest of the 4 domains. Identifying and assessing information security risk (the threat landscape, vulnerabilities and control deficiencies) and responding to it: treatment options, ownership, monitoring and reporting. Official weighting 20%. 6 fully worked examples are further down this page, answers included.

Exam weight
20%
the 3rd-heaviest of the 4 domains
Questions
96
across 2 topics
Free, no account
5/day
a free account allows 10 a day
Explanations
Every option
right and wrong

Build a practice session

5 free questions left today.

Domains

How many?

Mode

Ready when you are

10 fresh questions drawn across 1 of 4 domains, in Learn mode.

Review what you missed

Every question you answer incorrectly, and every question you flag while practising, is saved here automatically. Finish a session and you can come back to re-drill just those.

6 sample Information Security Risk Management questions, fully explained

Questions from the CISM bank mapped to domain 2, with the answer key and the reasoning behind every option. None of them repeat the examples on the main CISM practice page.

Question 1Information Security Risk Management

Which combination of factors BEST determines the level of an information security risk?

Choose one.

  • a
    The likelihood of a threat event and the size of its impact on the business Correct

    Risk is the combination of how likely a threat is to exploit a vulnerability and the consequence if it does.

  • b
    The number of vulnerabilities and the severity score of each one

    Vulnerabilities and their scores describe weakness, not risk. A severe flaw no threat can reach, on an asset of little value, is low risk.

  • c
    The value of the asset and the cost of the controls protecting it

    Asset value feeds impact and control cost matters for treatment, but neither says how likely a loss event is.

  • d
    The capability of the threat actor and the age of the affected systems

    Threat capability is one input to likelihood and system age may indicate weakness, but together they still omit business impact.

The concept

Risk level is a function of likelihood (a threat exploiting a vulnerability) and impact (the consequence to the business).

Why that’s the answer

Threats, vulnerabilities, asset values and control strength are all inputs, but they resolve into two dimensions: likelihood and impact. The tempting option counts vulnerabilities and their scores, which measures technical weakness rather than business risk.

How to reason it out
  1. Recall the two dimensions every risk rating combines.
  2. Check which option covers both likelihood and impact.
  3. Reject options that list only inputs to one dimension.

Exam tip: Risk = likelihood x impact; vulnerabilities and threats are inputs, not the risk.

CISM Information Security Risk Assessment: Identification, Analysis and Threats — the lesson that teaches this.

Question 2Information Security Risk Management

A scan finds a critical-rated vulnerability on an isolated test server that holds no production data and has no network path to production. What should the information security manager conclude?

Choose one.

  • a
    The risk is critical because it follows the vulnerability's severity rating

    A severity score rates the flaw in general. Business risk also depends on exposure and on what the affected asset holds, both minimal here.

  • b
    The risk is low because the business impact of exploitation is limited Correct

    With no sensitive data and no path to production, a successful exploit would have little consequence, so the business risk is low even though the flaw itself is severe.

  • c
    The risk is moderate until a penetration test confirms it is exploitable

    Exploitability affects likelihood, but even a confirmed exploit here would reach nothing of value; a test would not change the low impact.

  • d
    The risk is high because test servers are often poorly monitored

    Weak monitoring can raise likelihood of undetected compromise, but it does not create impact where there is no data or onward path.

The concept

Severity of a vulnerability is not the same as the risk it poses; impact depends on the asset and exposure.

Why that’s the answer

Risk needs both likelihood and impact. The stem removes impact: no production data and no route to production. A critical CVSS rating describes the flaw, not the organization's exposure, so translating it directly into a critical risk is the classic mistake.

How to reason it out
  1. Note what the server holds and what it can reach.
  2. Estimate the consequence of a successful exploit.
  3. Combine low impact with any likelihood to reach the overall risk.

Exam tip: A critical flaw on an asset that matters to no one is a low risk.

CISM Information Security Risk Assessment: Identification, Analysis and Threats — the lesson that teaches this.

Question 3Information Security Risk Management

On the organization's 5x5 risk matrix, Risk 1 has likelihood 5 and impact 1, and Risk 2 has likelihood 1 and impact 5. Both score 5. How should the information security manager present them to senior management?

Choose one.

  • a
    As equal priorities, because both carry the same combined risk score

    The identical score hides very different profiles. Treating them as equal ignores that one could cause a loss the organization cannot absorb.

  • b
    As separate profiles, because a rare severe loss may exceed risk tolerance Correct

    A multiplied score flattens a frequent trivial loss and a rare catastrophic one into the same number; management needs to see that Risk 2 could breach tolerance.

  • c
    With Risk 1 first, because frequent events add up to the greatest total loss

    Frequency matters, but an impact rating of 1 means each event is minor; frequent small losses are usually absorbed, unlike a single severe one.

  • d
    As low priorities, because neither score reaches the matrix's high band

    Relying on the band alone repeats the scoring weakness; a top-impact event deserves attention even when its combined score is moderate.

The concept

Qualitative risk scores can mask very different likelihood and impact profiles, so high-impact, low-likelihood risks must be shown explicitly against tolerance.

Why that’s the answer

Multiplying likelihood by impact on an ordinal scale gives both risks a 5, but they are not equivalent. Risk 2 is a rare event with the maximum consequence and may exceed what the organization can tolerate even once. The manager's job is to give decision makers the information they need, not just the score. Treating the scores as equal or relying on the band both repeat the flaw.

How to reason it out
  1. Notice that the scores are identical but the profiles are mirror images.
  2. Ask which profile could cause a loss beyond tolerance.
  3. Choose the presentation that keeps likelihood and impact visible to decision makers.

Exam tip: Same score, different risk: always show impact for rare, severe events.

CISM Information Security Risk Assessment: Identification, Analysis and Threats — the lesson that teaches this.

Question 4Information Security Risk Management

Which is the MAIN advantage of a qualitative risk analysis over a quantitative one?

Choose one.

  • a
    It produces monetary results that support a cost-benefit decision

    Monetary results are the strength of quantitative analysis, not qualitative analysis, which uses ratings such as high, medium and low.

  • b
    It removes the influence of individual judgement from the ratings

    Qualitative analysis depends on judgement; its subjectivity is its main weakness, not an advantage.

  • c
    It gives results that are directly comparable across different organizations

    Rating scales and criteria differ between organizations, so qualitative results are rarely comparable across them.

  • d
    It can be completed quickly without reliable loss and frequency data Correct

    Qualitative analysis relies on informed judgement and rating scales, so it can be done when good historical loss and frequency data does not exist.

The concept

Qualitative analysis trades precision for speed and needs little hard data; quantitative analysis gives monetary values but needs reliable data.

Why that’s the answer

Most organizations lack dependable figures for loss frequency and magnitude, which is why qualitative ratings are common. The tempting option, monetary results for cost-benefit decisions, describes the quantitative approach.

How to reason it out
  1. Recall what each approach needs as input.
  2. Match each option to the approach it really describes.
  3. Pick the advantage that belongs to the qualitative method.

Exam tip: Qualitative: fast, little data, subjective. Quantitative: monetary, data-hungry.

CISM Information Security Risk Assessment: Identification, Analysis and Threats — the lesson that teaches this.

Question 5Information Security Risk Management

Senior management asks whether a proposed USD 400,000 data loss prevention investment is justified. Which analysis would BEST support the decision?

Choose one.

  • a
    A qualitative heat map of the data loss risk before and after the control

    A heat map shows the risk moving, but it cannot be weighed against a dollar figure, which is what the decision requires.

  • b
    A vulnerability assessment of the endpoints that lack data protection

    This shows where weaknesses are, but not what they are likely to cost the business, so it cannot justify a spend.

  • c
    A maturity assessment of data protection against an industry framework

    Maturity comparisons inform strategy, but a maturity gap is not a financial justification for a specific investment.

  • d
    A quantitative estimate of the annualized loss the control would reduce Correct

    Expressing the expected loss reduction in money lets management compare it directly with the cost of the investment.

The concept

A cost-justification decision is best supported by quantitative analysis that expresses risk reduction in the same units as the cost.

Why that’s the answer

Management has framed the question in money. Only a quantitative estimate (for example, the reduction in annualized loss expectancy) can be set against a USD 400,000 cost. The heat map is tempting because it shows the control's effect, but ordinal ratings cannot be compared with a dollar amount.

How to reason it out
  1. Identify the unit the decision is framed in.
  2. Choose the analysis that produces results in that unit.
  3. Discard options that describe exposure or maturity rather than loss.

Exam tip: When the question is 'is it worth the money?', answer in money.

CISM Information Security Risk Assessment: Identification, Analysis and Threats — the lesson that teaches this.

Question 6Information Security Risk Management

A customer database is valued at USD 2,000,000. A breach would destroy 30% of its value and is expected once every five years. A USD 70,000-a-year control would reduce that to once every 20 years. What is the control's annual net benefit?

Choose one.

  • a
    USD 50,000

    This subtracts the control cost from the original ALE of USD 120,000 and ignores the USD 30,000 loss expectancy that remains with the control in place.

  • b
    USD 90,000

    USD 90,000 is the reduction in ALE, but it ignores the USD 70,000 annual cost of the control.

  • c
    USD 20,000 Correct

    SLE is USD 600,000. ALE falls from USD 120,000 (once in 5 years) to USD 30,000 (once in 20 years), a USD 90,000 reduction, minus the USD 70,000 cost.

  • d
    USD 40,000

    This compares the control cost with the residual ALE of USD 30,000, which is not the benefit of the control.

The concept

Annual net benefit of a control = ALE before - ALE after - annual cost of the control.

Why that’s the answer

Single loss expectancy is asset value x exposure factor: USD 2,000,000 x 0.30 = USD 600,000. ALE before = 600,000 x 0.2 = USD 120,000; ALE after = 600,000 x 0.05 = USD 30,000. The reduction is USD 90,000; subtracting the USD 70,000 annual cost leaves USD 20,000. The tempting answers stop one step early or drop the residual ALE.

How to reason it out
  1. Compute SLE = asset value x exposure factor.
  2. Compute ALE before and after from the two annual rates of occurrence.
  3. Subtract ALE after and the control's annual cost from ALE before.

Exam tip: Net benefit = ALE before - ALE after - control cost.

CISM Information Security Risk Assessment: Identification, Analysis and Threats — the lesson that teaches this.

What CISM domain 2 tests, topic by topic

The official exam guide breaks Information Security Risk Management into 2 topics. The question bank follows the same split, so a weak topic shows up as a cluster of misses you can go back and read.

Published CISM practice questions per topic in Information Security Risk Management
TopicWhat it coversQuestions
Information security risk identification and assessmentOfficial CISM 2026 outline, section 2A Information Security Risk Identification and Assessment: Emerging Risk and Threat Landscape; Vulnerability and Control Deficiency Analysis; Risk Assessment and Analysis.48
Information security risk responseOfficial CISM 2026 outline, section 2B Information Security Risk Response: Risk Treatment/Risk Response Options; Risk and Control Ownership; Risk Monitoring and Reporting.48
Total96

Revise Information Security Risk Management before you drill it

CISM Information Security Risk Assessment: Identification, Analysis and ThreatsQuestions in this area are written from the information security manager's point of view and usually ask what to do FIRST, what is BEST or what should MOST concern you. Several options are typically sound practices; the item turns on order (identify and value assets before testing, assess the risk before fixing or escalating, reassess before a change goes ahead), on role (business owners judge impact, the security manager guides the method) and on the difference between a technical finding and a business risk. Expect short scenarios about vulnerability scan results, audit findings on controls, new threat intelligence, new regulations, acquisitions and outsourcing, and emerging technology such as generative AI and AI agents, plus definition items on residual risk, threat modeling and gap analysis. Calculation items use asset value, exposure factor and annual rate of occurrence to find SLE, ALE or a control's net benefit, so practise converting frequencies and working the arithmetic in order.CISM Information Security Risk Response: Treatment Options, Ownership and MonitoringQuestions on risk response are written from the information security manager's point of view and usually ask what is BEST, what to do FIRST or NEXT, or what is the GREATEST concern. Several options are typically sound practices, so items turn on the target (residual risk within appetite rather than zero), on role (the business risk owner decides and accepts, control owners operate, the security manager advises and escalates) and on order (get the rating accurate and inform the owner before funding, extending or escalating). Expect scenarios about insurance and outsourcing, expired or conditional acceptances, policy exceptions and their trends, compensating controls for legacy systems, unfunded or partly complete treatment plans, controls that run but do not reduce risk, KRIs nobody acts on and conflicted reporting lines, plus definition items on appetite versus tolerance and on risk versus control ownership. Calculation items compare control options by expected loss removed, annual cost and the residual left against an appetite figure, so check both the net benefit and whether the residual meets the target.

Other CISM domains

Domain 1: Information Security Governance18% of the exam · 85 questionsDomain 3: Information Security Program33% of the exam · 160 questionsDomain 4: Incident Management29% of the exam · 140 questionsAll CISM practice questionsMixed sessions across all 4 domains — the way the real exam interleaves them.

Information Security Risk Management: your questions

Information Security Risk Management is domain 2 of the CISM exam guide and carries 20% of the scored content — the 3rd-heaviest of the 4 domains. On a 150-question paper that works out to roughly 30 questions, though ISACA does not publish an exact per-domain count and individual exam forms vary.

Source

The domain weight and topic list on this page come from the official CISM exam guide.