Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
ISACA Certified Information Security Manager · Isaca
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
CISA Risk Management Flowchart 1. Identify Assets & Vulnerabilities • Catalog assets, systems, and associated vulnerabilities. 2. Perform Risk Analysis • Assess likelihood and impact of threats to each asset. 3. Quantify Aggregated Risk ✅ • Even low-impact vulnerabilities can pose significant combined risk. • Calculate total exposure to understand overall organizational risk. 4. Determine Appropriate Countermeasures • Mitigate, transfer, accept, or avoid risks based on priority and resources. 5. Implement Controls • Apply preventive, detective, or corrective controls as planned. 6. Monitor & Measure Effectiveness • Track key risk indicators (KRIs) and security incidents. • Adjust controls as needed. 7. Report to Management & Stakeholders • Provide clear metrics, dashboards, and insights for informed decision-making.
If you read the question risk analysis is already done and found low-impact vulnerabilities. So the next step is to determine appropriate countermeasures.
If you read the question risk analysis is already done and found low-impact vulnerabilities. So the next step is to determine appropriate countermeasures.
D . quantify the aggregated risk. When an organization identifies a large number of assets with low-impact vulnerabilities, the next step for the information security manager should be to quantify the aggregated risk. This involves analyzing the collective impact of these low-impact vulnerabilities on the organization's overall security posture. While individually these vulnerabilities may seem minor, their cumulative effect could pose a significant risk to the organization's operations, confidentiality, integrity, or availability of data. Quantifying the aggregated risk enables the information security manager to: Understand the broader implications of multiple low-impact vulnerabilities. Make informed decisions about prioritizing remediation efforts based on the collective risk. Allocate resources efficiently to address vulnerabilities that, when combined, could have a substantial impact.