IsacaIsaca
CISM · Question #487
CISM Question #487: Real Exam Question with Answer & Explanation
Sign in or unlock CISM to reveal the answer and full explanation for question #487. The question stem and answer options stay visible for context.
Submitted by sofia.br· Apr 18, 2026Information Security Risk Management
Question
An application system audit revealed the same security weakness identified in a previous audit with risk acceptance due to expire. From a risk management perspective, which of the following is the information security manager's BEST course of action?
Options
- AUpdate the existing finding in the risk register with the risk acceptance period extended.
- BCreate a new entry in the risk register and close the previous risk finding.
- CTransfer the risk to an insurance policy and close the risk finding.
- DRaise the observation to the business risk owner to discuss risk treatment options.
Unlock CISM to see the answer
You've previewed enough free CISM questions. Unlock CISM for full answers, explanations, the timed quiz mode, progress tracking, and the master PDF. Question stem and options stay visible so you can still see what's on the exam.
Topics
#Risk Management Process#Risk Acceptance#Risk Owner#Information Security Manager Responsibilities