Isaca CISM Exam - Topic 6 Question 78 Discussion

Actual exam question for Isaca's CISM exam

Question #: 78
Topic #: 6

Which of the following would be of GREATEST assistance in determining whether to accept residual risk of a critical security system?

AAvailable annual budget

BCost-benefit analysis of mitigating controls

CRecovery time objective (RTO)

DMaximum tolerable outage (MTO)

Show Suggested Answer

Suggested Answer: A

Influencing human behavior is the primary benefit of an information security awareness training program because it helps to reduce the human errors and vulnerabilities that can compromise the security of data and systems. An information security awareness training program is a process or a program that informs and empowers users to protect data and computing assets from security risks and cyberattacks. It includes educational offerings that cover regulatory requirements, compliance policies, and safe computing practices. An information security awareness training program helps to influence human behavior by raising awareness of the security threats and challenges, enhancing knowledge and skills of the security best practices and controls, and fostering a positive security culture and attitude among the users. By influencing human behavior, an information security awareness training program can improve the security posture and performance of the organization, as well as prevent or mitigate the impact of security incidents. Therefore, influencing human behavior is the correct answer.

https://www.isms.online/iso-27002/control-6-3-information-security-awareness-education-and-training/

https://www.isaca.org/resources/isaca-journal/issues/2019/volume-1/the-benefits-of-information-security-and-privacy-awareness-training-programs

https://threatcop.com/blog/benefits-and-purpose-of-security-awareness-training/.

by Kristel at Jul 07, 2024, 01:38 PM

Limited Time Offer

25%

Off

Get Premium CISM Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Kristin

6 months ago

Not sure if budget alone helps in this scenario.

upvoted 0 times

...

Filiberto

6 months ago

Totally agree with the cost-benefit approach!

upvoted 0 times

...

Kathryn

6 months ago

Wait, isn't MTO more relevant for this?

upvoted 0 times

...

Selma

7 months ago

I think RTO is super important too.

upvoted 0 times

...

Lynda

7 months ago

Cost-benefit analysis of mitigating controls is key!

upvoted 0 times

...

My

7 months ago

I’m torn between the cost-benefit analysis and the maximum tolerable outage. I think MTO gives a clearer picture of how long we can afford to be down, but I’m not completely confident.

upvoted 0 times

...

Lauran

7 months ago

I feel like the available annual budget could influence the decision, but it doesn't directly address the risk itself. I might lean towards the cost-benefit analysis.

upvoted 0 times

...

Tomoko

7 months ago

I remember a practice question that focused on RTO and MTO, but I can't recall which one was more relevant for accepting residual risk. They both seem important in different contexts.

upvoted 0 times

...

Ula

8 months ago

I think the cost-benefit analysis of mitigating controls might be the best choice here, but I'm not entirely sure. It seems like it would help weigh the risks against the costs involved.

upvoted 0 times

...

William

8 months ago

I think the cost-benefit analysis of mitigating controls is the way to go here. That will give us a clear picture of the potential risks and the effectiveness of any security measures we could take. The other options just don't seem as directly relevant to assessing the residual risk of a critical security system.

upvoted 0 times

...

Percy

8 months ago

Okay, I've got this. The cost-benefit analysis of mitigating controls is definitely the most important factor here. That will help us weigh the potential risks and the effectiveness of any security measures we could implement.

upvoted 0 times

...

Kimberely

8 months ago

Hmm, I'm a little unsure about this one. I know we need to consider the risk, but I'm not sure if the available budget or recovery time objective would be the most relevant factors. I'll have to think this through carefully.

upvoted 0 times

...

Sharee

8 months ago

This seems like a pretty straightforward question. I think the key is to focus on the "critical security system" part and determine what factors would be most important in assessing the residual risk.

upvoted 0 times

...

Wava

8 months ago

I'm a bit confused by this question. I'm not sure if the maximum tolerable outage or the recovery time objective would be the most relevant factors. I'll have to review my notes and see if I can figure this out.

upvoted 0 times

...

Verdell

8 months ago

Okay, let's see. If the issue is with the network, I'd want to look at something like drop out frequency or health state to see if there are any connection issues.

upvoted 0 times

...

Van

8 months ago

I recall data analytics and mining being more about using records, not disposing of them. This is tough!

upvoted 0 times

...

Temeka

8 months ago

I remember we discussed the order-fill rate as being crucial for assessing customer satisfaction, but I'm not entirely sure if it's the only measure that matters.

upvoted 0 times

...

Nichelle

1 year ago

B) Cost-benefit analysis all the way! Gotta make sure we're not spending more on mitigation than the risk is worth. Penny-pinching is an art form, folks.

upvoted 0 times