100 Free CISM Practice Questions and Answers

Why C is right

Embedding security responsibilities into job descriptions is important primarily because it strengthens employee accountability. When security duties are formally documented as part of an employee's role, it creates clear expectations and establishes accountability for security-related actions and compliance. This makes employees responsible for security outcomes in their respective positions and provides a basis for performance evaluation.

Why B is right

Risk assessment is the most helpful tool for determining which information security policies should be implemented because it systematically identifies threats, vulnerabilities, and their potential impact on the organization. This data-driven approach ensures policies directly address the organization's actual security risks and priorities. While BIA, vulnerability assessments, and best practices all play supporting roles, risk assessment provides the foundational understanding needed to prioritize and tailor policy implementation to the organization's specific risk profile.

Why B is right

When residual risk is lower than the acceptable risk level, the controls are working better than required. The BEST action is to monitor the effectiveness of controls to ensure they continue performing at this level and to maintain the achieved risk position. You don't need to update frameworks, re-review probability/impact, or revisit inherent risk, the situation is acceptable, so ongoing monitoring and maintenance of effective controls is appropriate.

Why A is right

Security awareness training is the best way to reduce social engineering risk targeting help desk staff because it directly addresses the human vulnerability being exploited. Training teaches staff to recognize social engineering tactics, verify identities, follow proper procedures, and resist manipulation. This directly mitigates the attack vector by making staff resistant to deception and manipulation.

Why D is right

When updating information security policy to accommodate new regulation, the information security manager should FIRST perform a gap analysis. A gap analysis identifies the differences between current policy/controls and the new regulatory requirements, providing the foundation for all subsequent actions. Only after understanding the gaps can the manager consult with process owners about implementation, or measure effectiveness through KRIs and KPIs.

Why C is right

Tabletop exercises are the most effective method for testing an incident response plan because they simulate realistic scenarios in a controlled environment, allowing teams to walk through procedures, identify gaps, coordinate response activities, and practice decision-making without disrupting operations. This enables comprehensive evaluation of the plan's effectiveness and team preparedness.

Why C is right

The primary reason to periodically review existing controls is to align with emerging risks. The threat landscape continuously evolves, and controls that were adequate six months ago may no longer address current threats and vulnerabilities. Regular reviews ensure the control framework remains relevant and effective against new and changing risks, which is the foundation of maintaining an effective security posture.

Why C is right

Assigning each process to a responsible party ensures clear accountability and prevents gaps in execution during incidents. Without defined ownership, escalation procedures may break down under pressure. While contact lists, regulatory compliance, and approvals are important, defining responsible parties is the most critical element for ensuring escalation procedures actually function effectively.

Why C is right

Data classification is the foundational first step before implementing DLP technology. Without understanding what data exists, where it resides, and how sensitive it is, an organization cannot effectively configure DLP policies or determine which controls are needed. Business cases, vendor due diligence, and cost-benefit analyses all depend on having classified data first.

Why C is right

Before performing risk analysis, conducting data encryption, or determining asset value, an organization must first identify and inventory all information assets. Without knowing what assets exist, their locations, and their characteristics, a meaningful risk analysis cannot be performed. Asset inventory is the foundational step that enables all subsequent security decisions.

Why D is right

Threat intelligence is most helpful for protecting against APTs because these sophisticated attacks require understanding attacker tactics, techniques, and procedures (TTPs) to detect and defend against them. While updated policies, antivirus, and standards are all valuable defensive layers, threat intelligence specifically provides actionable knowledge about the threats themselves, enabling proactive detection and response to APTs which often evade traditional signature-based defenses.

Why C is right

Establishment of security governance creates the framework, policies, standards, and oversight structures needed to ensure consistent security practices across all international branches. Governance provides the centralized direction and accountability mechanisms necessary for consistency in a decentralized multinational environment.

Why A is right

The main benefit of assessing existing incident response processes is validation of current capabilities, confirming what is already working, identifying gaps, and establishing a baseline of the organization's readiness. This assessment provides the foundation for all subsequent improvement activities. While assessments may inform benchmarking, prioritization, and threat identification, validation of actual capabilities is the primary benefit and purpose of conducting the assessment.

Why C is right

Information security governance is MOST important to ensure an organization's cybersecurity program meets business needs because governance provides the structure, oversight, and decision-making framework that aligns security initiatives with business objectives. Governance establishes accountability, prioritization, and strategic alignment. While awareness training, risk assessments, and metrics are all valuable, governance serves as the foundational mechanism that ensures security decisions support business goals.

Why B is right

An email digital signature verifies to recipients the integrity of an email message. Digital signatures use cryptographic hashing and asymmetric encryption to ensure that the message has not been modified and to authenticate the sender's identity. This provides integrity verification and non-repudiation.

Why A is right

Members representing functions across the organization is the most important consideration because governance effectiveness depends on diverse perspectives, stakeholder buy-in, and understanding how security impacts different business areas. Representation across functions ensures comprehensive decision-making, accountability distribution, and that security aligns with business objectives throughout the organization.

Why A is right

Multifactor authentication (MFA) is the best technical defense against social engineering because it requires multiple independent verification methods. Even if an attacker successfully manipulates a user into revealing their password through social engineering, they cannot access the network without the second authentication factor. This directly mitigates the human vulnerability exploited by social engineering.

Why D is right

Risk appetite defines the organization's tolerance for risk and therefore should have the most influence on determining how to respond to new regulations. While risk management frameworks, control objectives, and baselines are all important, they are tools that should be calibrated according to the organization's risk appetite. The risk appetite statement establishes the overall threshold and direction for regulatory compliance responses.

Why C is right

Escalating to senior management should be done FIRST when a mandatory security standard hinders business objectives because this is a governance decision requiring executive-level involvement. Security and business objectives must be balanced at the appropriate authority level. Senior management can decide whether to adjust the standard, accept the risk, modify the business objective, or pursue alternative solutions. This escalation is the appropriate first step before any technical or analytical actions.

Why D is right

Human Resources (HR) is the PRIMARY function that initiates the removal of system access for terminated employees because HR is responsible for notifying all departments that an employee has been terminated. HR triggers the formal termination workflow and communicates the employee's departure date, which then prompts IT and security to revoke access. HR's notification is the authoritative starting point for the deprovisioning process.

Why A is right

A digital signature is the most effective mechanism for protecting data authenticity in transit because it provides both authentication (proves who sent it) and non-repudiation (sender cannot deny sending it). Digital signatures use private keys to sign data, allowing recipients to verify authenticity with the public key. Hash values alone don't prove authenticity without signing, and keys alone don't authenticate data.

Why D is right

A SIEM system is a detective control because it monitors, analyzes, and detects security events and anomalies in real-time. It identifies threats and suspicious activities after they occur. Detective controls work to discover unauthorized activities or policy violations. While SIEM may inform corrective actions and support other control types, its primary function is detection and alerting on security incidents.

Why D is right

A right-to-audit clause is most critical for ensuring alignment with the organization's security program because it provides the enforcement mechanism to verify the service provider actually maintains required security standards. Without audit rights, the organization cannot validate compliance. Escalation paths (A) address communication; termination language (B) addresses exit; and KPIs (C) define metrics, but none enable verification of actual security alignment as effectively as audit rights.

Why B is right

Reviewing system access logs is the first critical step in investigating suspected inappropriate data downloads because it provides objective, contemporaneous evidence of what actually occurred on the system. This preserves the chain of custody and establishes facts before any confrontation. While an NDA check is relevant to liability, forensics may alter evidence, and discussing with the employee could compromise the investigation, accessing logs is the foundational investigative step that should precede all others.

Why B is right

Eradication is the phase where malware is removed from all affected systems and the organization verifies that no traces of the infection remain. Only after eradication is complete can the security manager be confident the malware has not continued to spread. Containment stops the spread but doesn't remove the threat, and recovery restores systems after the threat is already gone.

Why C is right

Organizational tolerance to service interruption (the maximum acceptable downtime) is the most important consideration when defining a recovery strategy because it directly determines the required Recovery Time Objective (RTO) and Recovery Point Objective (RPO). These metrics shape all other recovery decisions including technology choices, backup frequency, and resource allocation. Without understanding how long the organization can tolerate being down, recovery strategies will either be over-engineered (wasting resources) or inadequate (failing to meet business needs).

Why B is right

The first step in developing any business case must be to clearly define the issues and problems that need to be addressed. Without understanding what problems the IDS solution is meant to solve, TCO calculations, cost-benefit analyses, and feasibility studies lack proper context and justification. Problem definition provides the foundation for all subsequent analytical steps.

Why D is right

When making risk treatment decisions, the residual risk (the risk remaining after treatment) must be compared against the organization's risk appetite to determine if the treatment is sufficient. Risk appetite defines the organization's tolerance for risk, making it the appropriate baseline for comparison. Gap analysis results (A) relate to current state vs. target state, configuration parameters (C) are implementation details, and treatment level (B) is the decision outcome, not the comparison point.

Why B is right

The MOST important reason for an information security manager to be involved in change management is to ensure that risks have been evaluated before changes are implemented. Risk evaluation is the primary security contribution to change management, it ensures that changes don't introduce new vulnerabilities or compromise existing controls. While controls may need updating and vulnerabilities identified, evaluating risks is the fundamental reason for security involvement.

Why D is right

The primary reason to regularly update business continuity and disaster recovery documents is to ensure the availability of business operations. Outdated BC/DR plans become ineffective during actual incidents, potentially leading to extended downtime and operational failure. Regular updates ensure that plans reflect current systems, assets, contacts, procedures, and organizational structure, directly supporting the goal of maintaining availability.

Why D is right

The greatest threat posed by a DDoS attack is the prevention of authorized access (availability compromise), which is the fundamental objective of denial-of-service attacks. By overwhelming the server with traffic, DDoS attacks make legitimate users unable to access the service, causing business disruption. While other threats like unauthorized access or defacement are security concerns, they are not the primary threat model of DDoS; the attack's core purpose is to deny availability.

Why C is right

Signature-based anti-malware is most effective against known threats because it identifies malware by matching file hashes, code patterns, or behavioral signatures against a database of previously identified malicious code. This approach works only when the threat has been discovered, analyzed, and added to the signature database, making it inherently ineffective against new or modified variants.

Why A is right

Once a cybersecurity attack is confirmed, the immediate priority is to isolate the affected system to prevent lateral movement, further data exfiltration, or spread of malware to other systems. This containment step is a fundamental principle of incident response and must happen before other actions. Isolation limits the scope of damage and preserves evidence, making it the logical first action.

Why B is right

System criticalities are the MOST important consideration when determining acceptable risk levels because the organization's tolerance for risk must be directly proportional to the business impact if that system fails or is compromised. Critical systems that support core business functions require lower acceptable risk levels, while less critical systems may have higher tolerance. This drives prioritization more fundamentally than scores, matrices, or threat profiles.

Why A is right

User awareness training BEST reduces the likelihood of private information leakage via email because it addresses the human element, the primary cause of data loss. Training educates users on recognizing sensitive data, proper handling procedures, and company policies, creating lasting behavioral change across the organization.

Why A is right

A communication plan is the most important element to include during the preparation phase because effective communication is critical during an incident. Without a well- established communication plan that identifies who needs to be notified, how they will be contacted, and what information will be shared, the incident response will be hampered by confusion and delays. This foundational element enables all other response activities.

Why A is right

The document creator is best suited to determine classification because they understand the content, context, sensitivity, and business purpose of the document. They possess the knowledge to accurately assess what information the document contains and how it should be protected. While information owners have ultimate accountability and custodians implement controls, the creator's detailed knowledge of the document content makes them best positioned for initial classification determination.

Why B is right

Threat and vulnerability assessments are primarily conducted to estimate and understand risk. Risk is defined as the combination of threat and vulnerability; without assessing these elements, an organization cannot quantify or estimate its risk exposure. While assessments may inform investments, control objectives, and posture, their PRIMARY purpose is risk estimation, this is the foundational reason they are performed.

Why C is right

The PRIMARY responsibility of a security steering committee is to prioritize security initiatives. As a strategic governance body, the committee allocates resources, sets organizational direction, and makes decisions about which security projects receive funding and attention. This is a high-level strategic function distinct from tactical implementation details.

Why C is right

After publishing updated security policies and standards, the most critical next step is to communicate these changes to all relevant stakeholders. Without proper communication, employees and business units won't understand the new requirements, making implementation ineffective. Communication ensures awareness, understanding, and compliance across the organization. While risk assessment, exception processes, and risk register updates are important follow-up activities, they are secondary to ensuring stakeholders know about and understand the policy changes.

Why D is right

Key Performance Indicators (KPIs) are the MOST helpful metric for measuring whether a security program is achieving its intended benefits and objectives. KPIs track outcomes and business value delivery (e.g., incident reduction, compliance achievement, mean time to detection improvement). KRIs measure risk exposure, BIAs assess criticality, and vulnerability assessments identify weaknesses, none directly measure benefits realization like KPIs do.

Why D is right

The data owner is best suited to determine how information should be classified because they have the business context to understand the sensitivity, criticality, and regulatory requirements of their data. They understand the business impact of unauthorized access or disclosure. Database analysts and DBAs handle technical aspects, while security analysts provide guidance on classification frameworks.

Why C is right

Maintaining chain-of-custody of evidence is the most critical consideration for supporting legal action because it establishes the integrity and admissibility of evidence in court. Without proper chain-of-custody documentation, evidence can be challenged as unreliable or inadmissible, undermining any legal proceedings. All other actions are secondary to preserving evidence integrity.

Why B is right

An information security manager must establish accountability for security functions first because this creates the organizational framework and responsibility structure necessary for all subsequent monitoring activities. Without clear accountability, there is no ownership of security tasks, making regular reviews, assessments, and audits ineffective or poorly executed.

Why C is right

Examples of help desk requests are the best source because help desk interactions directly reflect the security mistakes users frequently encounter in daily operations. These real, recurring issues represent actual user behavior patterns and common vulnerabilities in the workforce, making them highly relevant and impactful for tailoring awareness training to address the most prevalent problems.

Why A is right

When malware is detected on a server, the immediate priority is containment to prevent spread. Isolating the server from the network is the first critical step to stop lateral movement, data exfiltration, and further compromise. While identification, backup location, and source investigation are all important subsequent steps, containment must occur first to limit damage.

Why D is right

A Business Impact Analysis (BIA) is specifically designed to systematically identify and prioritize an organization's critical business functions based on their impact to operations, revenue, and compliance if interrupted. The BIA directly determines criticality by analyzing dependencies, recovery time objectives, and business impact factors. While DRP and BCP use BIA results, and SAR addresses security risks, only the BIA is specifically focused on determining business function criticality.

Why C is right

The primary benefit of an information security awareness training program is influencing human behavior. Awareness training is designed to change how employees think about and interact with security, encouraging safer practices and decision-making. This behavioral change is the core objective, it makes people security-conscious and motivates them to follow policies and procedures. While training may contribute to evaluating culture, it's not primarily an evaluation tool.

Why C is right

The PRIMARY reason for defining information security roles and responsibilities is to enforce individual accountability by making clear who is responsible for specific security tasks and decisions. This establishes clear ownership, enables performance measurement, and ensures security obligations are not ambiguous. While compliance (A) is a consequence, increasing accountability (B) is broader than enforcing it, and training (D) is a supporting activity, individual accountability is the foundational purpose that drives all other benefits.

Why C is right

Recovery Time Objectives (RTOs) are the most critical factor in determining which failover site type to use because they define how quickly systems must be restored to operational status. Different failover site types (hot, warm, cold) have different recovery capabilities and timelines. RTOs directly determine whether an organization needs an immediately available hot site or can accept the delay of a cold site. Test results, agreements, and data retention are considerations but secondary to matching site capability with recovery time requirements.

Why D is right

After a third-party audit identifies critical risks, the next logical step in the risk management process is to prioritize them based on impact and likelihood. This prioritization determines which risks require immediate attention and resource allocation. While reporting, assigning ownership, and identifying controls are all important subsequent steps, prioritization must occur first to guide decision-making and resource allocation effectively.

Why C is right

Risk reevaluation is most critical when the threat landscape changes because threats are external factors that directly impact the likelihood and consequence of risk events. While management requests, resistance to controls, and policy changes may prompt updates, a shift in the threat landscape fundamentally alters the risk profile and necessitates immediate reassessment of existing risk analyses.

Why D is right

When confronted with cross-border data transfer, the organization must first assess local and regional regulations applicable to both the source and destination jurisdictions. Different countries and regions (GDPR, CCPA, national privacy laws) have varying requirements for data transfers. This regulatory assessment establishes the legal framework and constraints within which all subsequent actions must operate. Without understanding the applicable regulations first, policies, privacy principles, and insurance would be developed without proper legal context, potentially resulting in non-compliance.

Why D is right

Risk identification is performed during the project planning stage of business continuity planning. This stage establishes the foundational understanding of what risks could disrupt operations before moving into impact analysis and developing specific recovery strategies. Project planning sets the scope and framework within which risks are identified.

Why D is right

A red team exercise provides the most accurate and comprehensive indication of actual cyber attack response capability because it simulates a full adversarial attack with independent thinking and adaptive techniques, testing the entire detection, response, and recovery process in realistic conditions. Walk-throughs (A) are paper exercises lacking real-world pressure, penetration tests (B) focus on technical vulnerabilities rather than response processes, and phishing exercises (C) test only awareness and email security. Red team exercises validate the complete operational response capability.

Why D is right

An information security manager MUST understand an information security program through obtaining stakeholder input. This encompasses understanding requirements, constraints, and expectations from all parties. While the other options are important activities within a security program, stakeholder input is the foundational requirement for comprehensive program understanding.

Why D is right

Extended Detection and Response (XDR) is the best control for detecting targeted zero- day attacks because it correlates data across multiple security layers (endpoints, network, cloud) and uses behavioral analytics and threat intelligence to identify suspicious patterns even without known signatures. EDR is endpoint-focused, IPS relies on signatures (ineffective for zero-days), and vulnerability scanning cannot detect unknown vulnerabilities. XDR's broader correlation and behavioral analysis capabilities make it most effective against zero-day exploits.

Why D is right

A BIA must be conducted FIRST before developing a DRP because it identifies which business functions are critical, their recovery time objectives (RTOs), and recovery point objectives (RPOs). Without this foundational analysis, the DRP cannot prioritize recovery efforts or allocate resources effectively. The BIA provides the data-driven basis for all subsequent DRP decisions.

Why A is right

Demonstrating return on investment (ROI) is the best way to maintain senior management support because executives prioritize business value and cost-effectiveness. ROI directly speaks to management's concerns about resource allocation and business impact, making it more compelling than operational reports or risk discussions.

Why C is right

A right-to-audit clause in the contract provides the best assurance because it grants the organization direct authority to verify the provider's compliance with security requirements through independent audits. This contractual right enables ongoing verification and corrective action enforcement. While continuous monitoring and due diligence questionnaires are useful, they lack the enforcement mechanism of contractual audit rights. Performance metrics measure outcomes but don't provide verification authority.

Why A is right

Conducting awareness training across the organization is the best way to reduce risk from targeted email attacks because most targeted attacks succeed through social engineering and human error. Training employees to recognize phishing attempts, suspicious links, and social engineering tactics directly addresses the primary attack vector. While technical controls are valuable, the human element remains the weakest link in targeted email attack prevention.

Why D is right

The primary purpose of information security metrics is to provide information needed to make decisions. Metrics serve as the foundation for informed decision-making at all organizational levels, from operational adjustments to strategic investments. While metrics can support budget justification and program evaluation, their fundamental purpose is to deliver data that enables effective decision-making about security posture, resource allocation, and risk management.

Why B is right

Testing response scenarios (tabletop exercises, simulations, drills) is the most effective way to increase responder effectiveness by allowing teams to practice, identify gaps, refine procedures, and build muscle memory before real incidents occur. This directly develops capability and confidence. Regular reviews are helpful, but hands-on testing through scenarios has greater impact on actual response effectiveness.

Why D is right

Reverse DNS lookups (IP-to-hostname resolution) can validate that IP addresses match expected sources and help identify spoofed IP addresses where the reverse lookup doesn't correspond to legitimate sources. This is a primary defense mechanism against IP spoofing attacks. While reverse lookups provide some logging and validation that could theoretically help with other attacks, their direct preventive capability is most effective against IP spoofing.

Why A is right

A balanced scorecard is the most effective tool for demonstrating alignment of information security strategy with business objectives because it translates strategic goals into measurable performance indicators across multiple perspectives (financial, customer, internal process, learning), showing both how security initiatives support business outcomes and enabling tracking of alignment.

Why C is right

Lessons learned analysis is the most direct method for improving incident response processes. After incidents occur, conducting thorough post-incident reviews captures what worked well and what failed, identifies root causes, and documents specific improvements to procedures and processes. This retrospective analysis directly feeds back into incident response plan refinement, making it the best mechanism for continuous improvement.

Why A is right

A Business Impact Analysis (BIA) identifies which business processes are critical, their recovery time objectives (RTOs), and recovery point objectives (RPOs). This information is essential for determining the appropriate continuity strategy, resource allocation, and priorities for data center recovery.

Why A is right

Implementing the principle of least privilege requires identifying job duties to determine the minimum permissions and access rights each user needs to perform their role. By understanding specific job functions, administrators can grant only the access necessary to fulfill those duties. Risk factors, authentication controls, and data owners are all relevant to security but do not directly drive the core requirement of identifying what access each job function requires.

Why D is right

A cold site has the lowest periodic cost because it requires only basic infrastructure (space, power, cooling) without maintaining active systems, data synchronization, or operational readiness. Shared contingency centers and redundant sites involve significant ongoing costs; reciprocal agreements have minimal periodic costs but higher activation costs and dependency risks. Among the standard options, cold sites represent the most economical ongoing investment.

Why C is right

Business continuity plan triggers must be based on a business impact analysis (BIA) because the BIA identifies which business functions are critical, their dependencies, and the impacts of disruption. This provides objective data for determining at what point an incident warrants BCP activation. The BIA establishes recovery time objectives (RTOs) and recovery point objectives (RPOs) that define specific thresholds for BCP activation. Threat and risk assessments inform overall security strategy but don't specifically define when business continuity procedures should activate.

Why D is right

Organizational culture is the most influential driver of information security program effectiveness because it determines whether employees actually follow policies, report incidents, practice security awareness, and support security initiatives. Without a strong security culture, even excellent policies and metrics will fail to drive effective behavior. Policies provide structure, metrics measure results, and risk appetite guides decisions, but culture determines execution and commitment.

Why B is right

Reduction of organizational risk is the BEST desired outcome to support investment in a new security initiative because risk reduction directly protects the organization's assets, operations, and reputation. This outcome provides clear, quantifiable business justification for security spending. While enhanced monitoring, reduced complexity, and improved detection are all valuable, they are means to achieve the ultimate goal of risk reduction. Risk reduction is the overarching outcome that provides the strongest business case for security investment.

Why A is right

A Business Impact Analysis (BIA) specifically identifies dependencies and relationships between critical systems, determining which systems support which business processes and how failures cascade. BIA directly maps these interdependencies and their impact on business operations. While system classification (B) categorizes systems, KPIs (C) measure performance, and RTOs (D) define recovery timeframes, none of these tools directly reveal system relationships and dependencies like BIA does.

Why B is right

The BEST course of action when a potential breach is discovered is to inform affected stakeholders. This includes customers, regulators, and other parties who may be impacted, which is both a legal requirement and an ethical responsibility. While mitigating actions matter, stakeholder notification is the critical FIRST priority for a security manager upon discovery.

Why D is right

An information security framework provides comprehensive, structured guidance for establishing and implementing a security program. Frameworks (such as NIST CSF, ISO 27001, CIS Controls) define domains, controls, processes, and best practices that serve as the foundational blueprint for building a security program from the ground up.

Why C is right

Alignment to an industry security framework (such as NIST, ISO 27001, or CIS) provides the comprehensive structure and systematic approach needed to maintain an appropriate control environment across an organization. A framework establishes standards, controls, governance, and continuous improvement mechanisms that collectively maintain a strong security posture more effectively than any single element.

Why B is right

Reduction in residual risk is the best justification for continued security investment because it directly demonstrates the value and effectiveness of the program in protecting organizational assets. Risk reduction is measurable, tangible, and shows clear return on investment by reducing the organization's exposure to threats. This metric is universally understood by stakeholders and decision-makers as proof that security spending is justified and producing results.

Why A is right

A skilled information security team is BEST positioned to manage APTs because they possess the expertise to detect sophisticated attacks, respond effectively, understand threat landscapes, and adapt defenses. While budget (B) enables resources, multiple vendors (C) adds complexity, and detection tools (D) provide capabilities, none of these substitute for skilled personnel who can orchestrate comprehensive defense, interpret indicators, and make strategic decisions. APTs specifically require human expertise to counter.

Why A is right

An increase in false negatives is the greatest concern when reviewing IDS performance. False negatives mean actual intrusions are going undetected and unalerted, which defeats the primary purpose of an IDS. This represents a failure in security detection and leaves the organization vulnerable. While false positives create operational noise, false negatives create actual security blind spots.

Why B is right

When civil unrest begins, the organization must first understand how the situation changes the risk landscape before taking action. Assessing changes in the risk profile provides the situational awareness needed to determine whether incident response, disaster recovery, or other measures are appropriate. This assessment informs all subsequent decisions.

Why C is right

A risk assessment provides the best input for a business case because it quantifies both the vulnerabilities and their business impact, likelihood, and consequence. This enables cost-benefit analysis by comparing the cost of the technical solution against the risk reduction achieved. A risk assessment bridges the gap between technical findings and business justification needed for executive decision-making.

Why C is right

Quantitative loss communicates risk treatment options in terms of financial impact and business value, which directly resonates with senior management decision-making. Expressing risks and treatment benefits in monetary terms (potential losses prevented, ROI on controls) provides the business case that executives need to allocate resources. This is more persuasive than technical analyses or benchmarks.