Certified Information Security Manager CISM · Free Practice Question Easy
Question 39
-
A
Consider only one risk mitigation option or decide to accept the risk.
-
B
Perform risk analysis to understand all treatment options.
-
C
Select a risk treatment option after a 30-day cooling off period.
-
D
Decide on a risk treatment option and then perform risk analysis.
Reveal correct answer
Correct answer: B
Explanation
Correct Answer:
"Perform risk analysis to understand all treatment options." is correct. The best approach is to perform risk analysis to understand the costs and benefits of each risk treatment option, including multiple options for mitigation.
Incorrect Answers:
"Decide on a risk treatment option and then perform risk analysis." is incorrect because risk analysis is required to decide on risk treatment.
"Consider only one risk mitigation option or decide to accept the risk." is incorrect because several risk treatment options should be considered.
"Select a risk treatment option after a 30-day cooling off period." is incorrect because there is rarely any valid reason for delaying a risk treatment decision.
Discussion
Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.
