Exam CISM topic 1 question 29 discussion

At 1st i thought A. After re-reading the question, which "should" be given vs "will" be given. "Should be given" will be determined by Risk Analysis. "Will be given" will be risk appetite. So B for me.

A risk analysis includes the analysis of applicable threats by determining its applicability to the organization, its likelihood of impact and the severity of impact thereby deriving to a risk. Answer A is wrong, because the decision how to treat the risk is PARTIALLY determined by the organizations risk appetite. The risk treatment (including factors like an organizations risk appetite) is PART of a comprehensive risk analysis. Therefore, answer B is correct.

Level of protection an asset should receive depends on the asset value and risk associated with the asset. So the answer is B

SO/IEC 27005:2018 – Defines risk analysis as a core activity in deciding what protection is needed. NIST SP 800-30 Rev. 1 – Guide for Conducting Risk Assessments, stresses that protection decisions should be driven by formal risk analysis. Why not the others? A. The corporate risk appetite → Important for accepting or rejecting risk, but it doesn't determine asset-specific protection needs. C. A threat assessment → Identifies potential threats, but does not factor in impact or vulnerability, so it lacks full context. D. A vulnerability assessment → Identifies system weaknesses, but not their impact or the likelihood of exploitation — which are key to deciding protection levels.

Asset value

risk analysis provides the most detailed and relevant information for deciding the level of protection needed for a specific asset, as it integrates considerations of threats, vulnerabilities, impacts, and likelihoods.

Risk analysis could be a contributing factor to the corporate risk appetite.

Ι think B is correct

B seems like the correct answer. My justification is that risk analysis is required to determine the risk level.

The question is asking a bout a specific asset and specific here is a key work. risk appetite is more generic

Risk appetite

Risk analysis can be performed to determine the level of protection required to be provided to an asset.

Conducting a risk analysis allows for a comprehensive evaluation of the threats, vulnerabilities, and potential impacts associated with specific assets. By analyzing these factors, organizations can make informed decisions about the level of protection required for each asset. Explanation of why other options are not correct: A. The corporate risk appetite: While the corporate risk appetite influences overall risk management decisions, including the allocation of resources and the establishment of risk tolerance levels, it does not directly determine the level of protection for individual assets. Risk appetite provides a high-level framework for decision-making but must be translated into specific risk analysis for each asset.

Risk appetite

Risk analysis gives the level of risk, not level of protection. After a risk analysis, the business then evaluates the level of (inherent/existing) risk against acceptable risk levels (RISK APETITE) to decide the level of protection to be provided, in a manner that the residual risk is within acceptable risk levels.

The Corporate Risk Appetite: it is a broad guideline and does not provide specific details on the level of protection for individual assets.

Majority are wrong. Should be risk appetite