CISM Question 21

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose B1

  since this is a risk related question the crititicality of the service to the organization is the only option that makes sense , this doesnt mean all the other options are not important but when you categorize the importance, option 1 comes first then all the other options will be secondary.

• Chose B1

  berhububngan dengan proses bisnis perushaaan dapat berjalan atau tidak

• Chose B3

  I couldn't understand this question at first, i thought its asking after risk assessment how to determine which vendor has the highest risk associated with it and i chose compensating controls implemented on vendor which will show the degree of risk with the vendor. However I stand corrected after looking at this explanation which helped me understand the que. -The information security manager is performing risk assessments on multiple third-party vendors, which indicates that the vendors have access to the organization's sensitive data and systems. Out of the options given, the most helpful criterion in determining the associated level of risk applied to each vendor would be the criticality of the service to the organization. The criticality of a service refers to its importance in supporting the organization's business objectives and functions.