ISACA · CISM
Vulnerabilities and risk assessment
CISM · Lesson 6 of 20 · 42:08
YouTube loads only after you press play. This chapter opens at its timestamp in the full course. Watch on YouTube ↗
In this lesson
Prepare for the ISACA CISM exam, on the 2026 exam content outline. In this lesson: vulnerabilities and control deficiencies, vulnerability management, risk assessment and analysis with likelihood and impact, qualitative and quantitative methods, and how to check that controls are effective. Includes three original practice questions, with Stonebridge Energy, a fictional energy supplier, as the example.
Preview the topics
- A scan finds a critical vulnerability on a test server that holds no data, and a medium one on the internet-facing billing portal, which attackers are actively exploiting elsewhere. Which should be fixed first?
- A data breach at Stonebridge would cost $200,000, and is expected once every four years. What is the annualized loss expectancy?
- Stonebridge’s policy requires quarterly access reviews, but an audit finds that half of them were never done. What does this finding show?