CISM Reviews Questions

The correct answer is B because a vulnerability scanning tool helps identify technical weaknesses in network-connected devices, systems, applications, and configurations. These weaknesses represent potential risks because they may be exploited by threats to compromise confidentiality, integrity, or availability. Vulnerability scanning does not usually identify vulnerabilities within organizational processes; that is more commonly done through process reviews, audits, risk assessments, or control assessments. It also does not automate the entire information security risk analysis program because risk analysis requires business impact, likelihood, threat context, asset value, control effectiveness, and management judgment. Finally, vulnerability scanning cannot ensure that complex vulnerabilities are not missed, since some weaknesses require manual testing, penetration testing, code review, or specialized analysis. In CISM terms, vulnerability scanning is an input into risk assessment and risk treatment. Its primary benefit is identifying potential technical exposures associated with systems and devices so they can be prioritized and remediated based on risk.

Comprehensive and Detailed Step-by-Step Explanation:

Determining downtime costs requires understanding the financial and operational impact on the business.

A. Fault tree analysis: Primarily used for identifying the root causes of failures, not for assessing downtime costs.

B. Cost-benefit analysis: Compares the costs and benefits of implementing controls but does not specifically address downtime.

C. Return on investment (ROI) analysis: Evaluates the financial return of an investment rather than the cost of an outage.

D. Business impact analysis (BIA): This is the BEST answer because a BIA identifies the effects of a disruption on critical business functions and quantifies the financial impact, including downtime costs.