ISACA Certified Information Security Manager Practice Mode

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose B1

  The only activity that directly measures current risk vs. previous risk is a risk assessment.

• Chose B4

  A risk assessment is a systematic process of evaluating potential risks, vulnerabilities, and threats to an organization's information assets. By conducting a risk assessment, the information security manager can identify, analyze, and evaluate the effectiveness of the implemented controls in mitigating the identified risks. This provides valuable information for determining whether the risk has been reduced to an acceptable level. While other activities, such as initiating a cost-benefit analysis of the implemented controls (option A), reviewing the risk register (option C), and conducting a business impact analysis (BIA) (option D) are important components of an overall risk management process, performing a risk assessment is specifically focused on evaluating the effectiveness of the security controls in addressing identified risks.

• Chose B1

  A risk assessment, on the other hand, provides a comprehensive evaluation of the organization's information security posture, taking into account the current threat landscape, vulnerabilities, and implemented controls. By comparing the risk assessment results before and after the initiative, the information security manager can determine whether the initiative has successfully reduced risk to an acceptable level.