CISM Question 273

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose A3

  RA to identify potential threats

• 2

  A risk assessment includes the assessment of the applicability of threats (in other words: a risk assessment includes the scenario analysis). Hence, to me its A.

• Chose C2

  C. Scenario analysis involves creating hypothetical scenarios or situations in which a threat event occurs and then evaluating the potential impact on the organization's IT operations. This method allows you to assess the real-world consequences of various threat events and helps you understand how they could affect your organization's systems, data, and overall operations. It also enables you to identify vulnerabilities and weaknesses in your current security measures and develop appropriate mitigation strategies. While risk assessment, penetration testing, and controls review are valuable security practices, they focus on different aspects of security