ISACA Certified Information Security Manager Practice Mode

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose B1

  Threat and vulnerability assessments matter primarily because they are needed to estimate risk. Without them you are guessing.

• Chose B1

  B. needed to estimate risk.

• Chose B5

  Threat and vulnerability assessments provide essential information to estimate and understand the level of risk facing an organization. By identifying potential threats and vulnerabilities, organizations can assess the likelihood and potential impact of various security incidents. This risk estimation forms the basis for making informed decisions about security controls, investments, and setting control objectives. While threat and vulnerability assessments contribute to elements of the organization's security posture (option D) and may influence control objectives (option C), the primary purpose is to assess and estimate the level of risk.