Information Security Risk Management (Domain 2) makes up 27% of your CISM score, tying it with Domain 1 as the largest and most critical section of the exam. Most candidates who fail this section make the same error: they treat it like a vocabulary test. They memorize the formula for Annualized Loss Expectancy (ALE) but freeze when a question asks if calculating it is even the best use of company resources. The CISM exam doesn't just test if you know the rule; it tests your judgment as a manager.
To pass CISM Domain 2, you must shift from memorizing terms to applying business-focused judgment. These 10 practice questions train that skill by forcing you to weigh costs, align with business goals, and choose the most effective managerial action, not just the most technically correct one.
Key facts
- Domain Weighting: 27% of the total CISM exam score (tied for largest domain).
- Passing Score: 450 on a scaled score of 200 to 800.
- Key Frameworks: NIST SP 800-30, NIST SP 800-37, ISO 27005, and COBIT.
- Core Topics: Risk Identification, Risk Assessment, Risk Response and Mitigation, Risk and Control Monitoring and Reporting.
- Exam Body: ISACA (Information Systems Audit and Control Association).
- Official Source: The CISM Exam Content Outline from ISACA is the definitive blueprint (ISACA).
ISACA's reported CISM pass rate hovers around 55-60%, highlighting the exam's difficulty and the need for judgment-based preparation.
How to Use These CISM Practice Questions
I designed these questions to mirror the scenarios and judgment calls you will face on the actual CISM exam. They are aligned with the 2026 ISACA Job Practice areas for Domain 2: Information Security Risk Management.
Studying for CISM? Benchmark your score in 5 minutes.
Get an instant weak-spot assessment and a custom 12-week study plan PDF generated for your exam window.
You will find a mix of difficulties. Some questions test foundational concepts, while others require you to analyze a complex situation and choose the most appropriate action from several plausible options. This is the core challenge of the CISM exam.
The goal isn't just to get the right answer. It's to understand why it's right from the perspective of an information security manager whose primary responsibility is to the business. After you attempt the questions, read the explanations carefully, especially the analysis of the tempting wrong answers. That’s where the real learning happens. To continue honing this skill, you can build your judgment with VoraPrep's adaptive CISM question bank.
Information Security Risk Management Practice Questions
Answer the following 10 questions. For each one, think about the business context first. What is the manager's ultimate goal in this scenario?
Question 1
An organization has identified a critical vulnerability in its customer relationship management (CRM) software. The vendor has released a patch, but applying it requires taking the system offline for four hours during peak business operations. A quantitative risk analysis determined the Annualized Loss Expectancy (ALE) from an exploit of the vulnerability is $90,000. The cost of downtime for patching is estimated at $120,000. What is the BEST course of action for the information security manager?
View Answer & Explanation
Tempting Wrong Answer: B) Formally accept the risk. This is tempting because the numbers seem to support it directly: the cost to mitigate ($120,000) is greater than the annualized loss ($90,000). Many candidates stop here, thinking it's a simple math problem.C) Recommend implementing compensating controls until the patch can be applied during a scheduled maintenance window.
Explanation: The CISM exam tests your management judgment, not just your ability to compare two numbers. While accepting the risk (B) is a valid risk response, it's not the best initial action when other options exist. The ALE of $90,000 represents a significant business risk that management is unlikely to ignore. Applying the patch immediately (A) is financially irresponsible based on the data provided. Transferring the risk (D) doesn't fix the underlying vulnerability and is usually part of a broader strategy, not a response to a specific, patchable flaw.Option (C) represents a sound managerial approach. It balances the need for security with the needs of the business. By implementing compensating controls (like enhanced monitoring or stricter access rules), you reduce the immediate risk. This buys time to apply the permanent fix (the patch) in a way that minimizes business disruption. This demonstrates a mature, business-aligned approach to risk management.
Question 2
During a risk assessment workshop, the team is struggling to assign a specific dollar value to the potential loss of customer goodwill following a data breach. This is preventing them from calculating the Single Loss Expectancy (SLE). Which risk assessment approach should be used in this situation?
View Answer & Explanation
Tempting Wrong Answer: A) Quantitative analysis. Candidates often believe that quantitative analysis is always superior because it's "data-driven." They might think the team just needs to try harder to find a number.B) Qualitative analysis.
Explanation: The key phrase here is "struggling to assign a specific dollar value." This is the classic trigger for using a qualitative approach. Qualitative risk analysis uses descriptive scales (like High, Medium, Low) to rate the likelihood and impact of a risk. It's perfectly suited for intangible assets like reputation, customer goodwill, or employee morale, where precise financial data is unavailable or unreliable.While quantitative analysis (A) is powerful, it requires credible financial data. Forcing a number where one doesn't exist leads to a false sense of precision and bad decision-making. Vulnerability analysis (C) and threat modeling (D) are techniques used to identify risks, but they are not the assessment approaches themselves for categorizing impact and likelihood.
Question 3
A new cloud-based file-sharing service is being considered to improve collaboration. The information security manager's PRIMARY objective during the risk assessment of this service should be to:
View Answer & Explanation
Tempting Wrong Answer: A) ensure the service has obtained a SOC 2 Type II certification. This is a very common trap. A SOC 2 report is an excellent piece of evidence, but it is not the goal itself. It's a tool, not the objective.B) determine if the service provider's controls meet the organization's security requirements.
Explanation: The primary objective of any third-party risk assessment is to ensure the vendor meets your specific, defined security requirements. Your organization has its own risk appetite and regulatory obligations. A SOC 2 report (A) provides valuable information about a vendor's controls, but it doesn't automatically mean those controls are sufficient for your specific use case or data classification levels. You must map their controls to your requirements.Blocking the service (C) is an extreme measure and not business-friendly. Calculating the total cost (D) is a financial consideration, which is important but secondary to the security risk assessment. The CISM mindset is always about aligning security with the organization's needs and risk tolerance.
Question 4
An organization has implemented a new firewall with advanced intrusion prevention capabilities. Which of the following metrics would BEST measure the effectiveness of this risk mitigation effort?
View Answer & Explanation
Tempting Wrong Answer: A) The number of security alerts generated by the firewall. More alerts can feel like the system is working, but it can also indicate a poorly configured system or a massive attack. It's an activity metric, not an effectiveness metric.C) A reduction in the number of successful unauthorized access attempts.
Explanation: The purpose of a security control is to reduce risk. To measure a control's effectiveness, you must measure the impact it has on the risk it was designed to mitigate. The firewall was implemented to prevent unauthorized access. Therefore, the best metric of its success is a measurable decrease in successful unauthorized access events.Metrics like uptime (B) measure operational status, not security effectiveness. The number of alerts (A) can be misleading; a quiet firewall could be very effective, or it could be misconfigured and blind. The number of rules (D) is a measure of complexity or activity, not of a successful security outcome. Always tie the metric back to the original risk.
Question 5
Who is ultimately responsible for formally accepting a residual risk on behalf of the organization?
View Answer & Explanation
Tempting Wrong Answer: B) The Chief Information Security Officer (CISO). Many believe the CISO is the ultimate authority on all security matters. While the CISO leads the security function, they do not own the business risk.C) The business process or asset owner.
Explanation: This is a core governance principle tested heavily on the CISM exam. The information security function (led by the manager or CISO) is responsible for identifying, assessing, and recommending treatments for risk. However, the person who owns the business process, system, or data is the one who owns the associated risk. They are the only ones with the authority to accept any remaining (residual) risk, as their department will bear the consequences if that risk is realized.The security manager's job is to ensure the business owner has all the information needed to make an informed decision. The security manager advises; the business owner decides. The IT department (D) implements and maintains controls but does not own the business risk.
Worked Example: Calculating Annualized Loss Expectancy (ALE)
A company's primary e-commerce server holds customer data valued at $500,000 (this is the Asset Value or AV). There is a known vulnerability that, if exploited, could result in the loss of 20% of the data. Historical data suggests a similar event is likely to occur once every two years.
Step 1: Calculate Single Loss Expectancy (SLE)
The SLE is the expected monetary loss from a single occurrence of the risk.- Formula: SLE = Asset Value (AV) × Exposure Factor (EF)
- AV: $500,000
- EF: 20% or 0.20 (the percentage of the asset lost)
- Calculation: SLE = $500,000 × 0.20 = $100,000
So, each time this event happens, the company expects to lose $100,000.
Step 2: Calculate Annualized Rate of Occurrence (ARO)
The ARO is how many times the event is expected to happen in one year.- Information: The event occurs once every two years.
- Calculation: ARO = 1 event / 2 years = 0.5
Step 3: Calculate Annualized Loss Expectancy (ALE)
The ALE is the total expected loss from this risk over a one-year period.- Formula: ALE = Single Loss Expectancy (SLE) × Annualized Rate of Occurrence (ARO)
- SLE: $100,000
- ARO: 0.5
- Calculation: ALE = $100,000 × 0.5 = $50,000
Question 6
The technique of mapping potential adversary actions against an application's features and architecture to identify security flaws is known as:
View Answer & Explanation
Tempting Wrong Answer: D) Vulnerability scanning. This is a common action, but it's an automated process that looks for known vulnerabilities. It's a different activity from the one described.B) Threat modeling.
Explanation: Threat modeling is a proactive, structured process. It involves thinking like an attacker to understand how a system could be compromised. You identify threats (potential attackers), analyze vulnerabilities based on the system's design, and then propose mitigations. It answers the questions: "What are we building?", "What can go wrong?", and "What are we going to do about it?".A BIA (A) focuses on the impact of a disruption on business operations, not on identifying security flaws. RCA (C) is a reactive process used after an incident to find the underlying cause. Vulnerability scanning (D) is an automated tool-based approach to find known weaknesses, whereas threat modeling is a broader, more creative, and often manual analytical process.
Question 7
An organization decides to purchase cybersecurity insurance to cover potential losses from a ransomware attack. This is an example of which risk response strategy?
View Answer & Explanation
Tempting Wrong Answer: B) Risk mitigation. People often think insurance "reduces" their risk. It doesn't. It only reduces the financial impact of the risk. The likelihood of the attack can remain the same.D) Risk transference.
Explanation: This is a straightforward definition question, but one that's crucial for the CISM exam. The four primary risk responses are:- Mitigation: Applying controls to reduce the likelihood or impact of a risk (e.g., installing antivirus).
- Transference (or Sharing): Shifting the financial impact of a risk to a third party (e.g., buying insurance).
- Acceptance: Knowingly and formally deciding to do nothing about a risk.
- Avoidance: Ceasing the activity that creates the risk (e.g., deciding not to launch a new online service).
Purchasing insurance does not stop the ransomware attack from happening. It simply transfers the resulting financial loss to the insurance company.
Question 8
What is the PRIMARY purpose of a risk register?
View Answer & Explanation
Tempting Wrong Answer: B) To satisfy audit and compliance requirements for documentation. While a risk register does help with audits, that is a secondary benefit, not its primary purpose. The CISM exam wants you to think about the core function, not the side benefits.A) To provide a central repository for all identified risks and their characteristics.
Explanation: The risk register is the single source of truth for the entire risk management process. It's a living document that should contain, at a minimum: a description of the risk, its impact and likelihood, the risk owner, the current response plan, and the level of residual risk. Its purpose is to facilitate the management, monitoring, and reporting of risks throughout their lifecycle.Satisfying auditors (B) is a result of having a good risk management process, which includes a risk register. The register should never be used to assign blame (C). It is a management tool for proactive improvement. While it may inform budget decisions, it is not a budget tracking tool (D).
Question 9
A security control is found to have a high cost of implementation but only provides a small reduction in risk. This control has a low:
View Answer & Explanation
Tempting Wrong Answer: B) Annualized loss expectancy (ALE). The ALE is a measure of the risk itself, not the value of the control designed to address it. A candidate might confuse the risk value with the control value.A) Return on investment (ROI).
Explanation: This question is about evaluating the value of a security control. The return on security investment is a key concept for managers. If a control costs a lot but doesn't reduce the risk by much, it is a poor investment. The formula for security ROI is often expressed as the reduction in ALE minus the cost of the control, all divided by the cost of the control. In this scenario, the "return" (risk reduction) is small and the "investment" (cost) is high, leading to a low or even negative ROI.ALE (B) is what you are trying to reduce. The EF (C) is a component of the risk calculation, not an evaluation of the control. "Safeguard value" (D) is a generic term, while ROI is the specific business metric used for this type of evaluation.
Question 10
Which of the following is the BEST way to communicate risk management program effectiveness to senior leadership?
View Answer & Explanation
Tempting Wrong Answer: A) A detailed report of all vulnerabilities. This is too tactical and technical. Senior leaders don't have the time or context to interpret a raw list of vulnerabilities. They need to know what it means for the business.B) A dashboard with key risk indicators (KRIs) trended over time and mapped to business objectives.
Explanation: Communication with senior leadership must be in their language: the language of business objectives, trends, and key performance indicators. A dashboard with KRIs (e.g., "percentage of critical assets compliant with policy," "time to patch critical vulnerabilities") shows progress and status at a strategic level. Crucially, mapping these KRIs to business objectives (e.g., "protecting customer data to maintain market trust") makes the information relevant and actionable for them.Detailed vulnerability lists (A), incident lists (C), and technical specifications (D) are all operational details. They are important for the security team but are not effective for strategic communication with the board or C-suite. The CISM must be able to translate technical data into business-relevant insights.
Calculate Your CISM Score & Study Hours by Domain
Adjust your practice scores across official CISM blueprint domains to predict your pass probability and generate a domain-weighted study schedule.
How Did You Score?
Count up your correct answers. Don't worry if you didn't get a perfect score. The goal of these questions is to expose gaps and train your judgment, not to test your existing knowledge perfectly.
Here’s how to interpret your results and what to do next.
| Your Score | What It Means | Your Next Step This Week |
|---|---|---|
| 0-4 Correct | You may have gaps in foundational risk management concepts. You might be thinking too technically and not enough like a manager. | Go back to the source. Review the ISACA CISM Exam Content Outline for Domain 2. Focus on the definitions of risk, threat, and vulnerability. Then, read our Free CISM Information Security Governance Practice Questions (2026) to solidify the business context. |
| 5-7 Correct | You have a solid grasp of core principles but might be getting caught by the "best" vs. "correct" nature of the CISM questions. | Focus on the "why." For each question you got wrong, write one sentence explaining why the business owner would prefer the correct answer. Begin using an adaptive question bank, like VoraPrep's, to target these specific areas of weakness. |
| 8-10 Correct | Excellent. You are already thinking like an information security manager. Your challenge is maintaining this mindset under exam pressure. | Move to volume and variety. Your goal is to see as many scenarios as possible so that nothing on exam day surprises you. Try a full-length, timed exam simulation to test your pacing. Challenge yourself with our complete Free CISM Practice Questions (2026 Exam Simulator Sampler). |
Get More CISM Practice on VoraPrep
A short quiz is a great start, but passing the CISM requires consistent, targeted practice. The real exam has 150 questions, and you need the mental stamina and ingrained judgment to get through them.
This is where a complete prep system makes the difference. While legacy providers sell you overpriced, passive video lectures, VoraPrep offers a modern, interactive course built on 6 complete pillars:
- Textbook-Grade Lessons: Step-by-step guides and cheat sheets covering every topic in the ISACA blueprint.
- Adaptive Practice Banks: Over 1,800 exam-calibrated questions that automatically focus on your weak spots. The explanations for every answer choice train you to spot the traps.
- 1:1 Exam Simulators: Full-length, timed mock exams that replicate the Pearson VUE testing center experience.
- Spaced-Repetition Flashcards: Memory-scheduled flashcards to lock in key terms, formulas, and frameworks.
- Personalized Study Plan: A dynamic calendar built around your exam date that tells you exactly what to study each day.
- Vory, Your 24/7 Personal Tutor: If you're stuck on a concept in any lesson or question, you can ask Vory for a step-by-step explanation, instantly.
Instead of paying $1,500+ for a course, you get the entire VoraPrep CISM system for just $25 a month. You can see how our platform works and compare it to others in our guide to the Best CISM Review Courses (2026).