ISACA Certified Information Security Manager Practice Mode

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose B1

  Why B is correct A risk analysis evaluates the risks associated with a particular asset, considering factors such as threats, vulnerabilities, likelihood, and potential business impact. The results help determine how much protection the asset needs. Why A is a close contender Corporate risk appetite establishes how much risk the organization is willing to accept. It helps guide decisions about whether the residual risk associated with an asset is acceptable. But risk appetite alone doesn't tell you the specific level of protection that asset requires. A. Corporate risk appetite: Defines the amount and type of risk the organization is willing to accept in pursuit of its objectives. B. Risk analysis: Evaluates risk by considering factors such as likelihood and impact, helping determine the appropriate response and level of protection.

• Chose B2

  Risk appetite = organizational tolerance Risk analysis = evaluation of a specific asset's risk "Deciding the level of protection a PARTICULAR asset should be given..."

• Chose B1

  Determining the level of protection an asset should receive depends on understanding the risk to that asset i.e., how likely it is to be compromised and how severe the impact would be if it were