I85PREP
⌘ K
ISO 27005 RM study materials
ISO 27005 RM study resources

ISO 27005 RM practice questions

One question at a time. Build your ISO 27005 RM understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Fundamental principles and concepts of information security risk management

In ISO/IEC 27005, what does the term "information security risk" fundamentally describe?

  1. The total financial value of an organization's information assets
  2. The legal penalties an organization faces after a confirmed data breach
  3. The potential for loss or harm expressed as a combination of the likelihood of a threat event and its consequences Correct answer.
  4. The set of controls an organization has already implemented to protect its assets

Explanation

ISO/IEC 27005 treats information security risk as the effect of uncertainty on objectives, expressed through the likelihood of a threat exploiting a vulnerability and the resulting consequences for the organization. It is a forward-looking combination of likelihood and impact, not a record of controls or realized penalties.

Question 2Fundamental principles and concepts of information security risk management

Which statement best distinguishes a "threat" from a "vulnerability" in ISO/IEC 27005 terminology?

  1. A threat is a weakness in a control, while a vulnerability is the asset being protected
  2. A threat is always internal to the organization, while a vulnerability is always external
  3. A threat is a potential cause of an unwanted incident, while a vulnerability is a weakness that can be exploited by a threat Correct answer.
  4. A threat is measured only in monetary terms, while a vulnerability is measured only in time

Explanation

In the ISO/IEC 27005 model, a threat is a potential cause of an unwanted incident, such as a malicious actor or a natural event. A vulnerability is a weakness in an asset or control that a threat could exploit, and the two combine to create risk.

Question 3Fundamental principles and concepts of information security risk management

Which statement accurately describes the relationship between risk and uncertainty in ISO/IEC 27005?

  1. Risk reflects the effect of uncertainty on objectives, so reducing uncertainty through better information can change the assessed risk Correct answer.
  2. Uncertainty has no bearing on risk because risk is purely a count of incidents
  3. Uncertainty applies only to financial risks and not to information security risks
  4. Risk exists only when uncertainty has been completely eliminated

Explanation

ISO/IEC 27005 aligns with the ISO definition of risk as the effect of uncertainty on objectives. Because assessments rely on estimates of likelihood and consequence, gathering better information reduces uncertainty and can shift the assessed risk level.

Question 4Fundamental principles and concepts of information security risk management

Within the ISO/IEC 27005 process, what is the primary purpose of establishing the risk context?

  1. To define the scope, criteria, and boundaries against which risks will be identified, analysed, and evaluated Correct answer.
  2. To obtain management approval for the residual risk statement
  3. To select and implement the final set of security controls
  4. To calculate the exact annualized loss expectancy for every asset

Explanation

Context establishment sets the scope, risk criteria, and boundaries so that subsequent identification, analysis, and evaluation are consistent and relevant to the organization's objectives. It frames the risk management process rather than performing treatment or approval.

Question 5Fundamental principles and concepts of information security risk management

An organization defines its risk criteria so that any risk rated "high" must be treated before the next quarter. What role does this rule play in the ISO/IEC 27005 process?

  1. It is part of communication and consultation, because it informs stakeholders of decisions
  2. It is part of risk identification, because it lists the assets in scope
  3. It is part of risk evaluation, because it provides the criteria for comparing analysed risk against acceptable thresholds Correct answer.
  4. It is part of monitoring and review, because it tracks control performance over time

Explanation

Risk evaluation compares the results of risk analysis against risk criteria to decide whether risk is acceptable and what action is needed. A rule requiring treatment of high risks is exactly such an evaluation criterion.

Question 6Fundamental principles and concepts of information security risk management

Which pairing correctly matches an ISO/IEC 27005 risk treatment option with its description?

  1. Risk retention: transferring the financial impact to a third party
  2. Risk sharing: removing the asset so the risk no longer exists
  3. Risk modification: accepting the risk without any further action
  4. Risk avoidance: eliminating the activity or condition that gives rise to the risk Correct answer.

Explanation

Risk avoidance means deciding not to start or to discontinue the activity that produces the risk. The other options mislabel retention, modification, and sharing, each of which has a distinct meaning in the treatment step.

Question 7Fundamental principles and concepts of information security risk management

After controls are applied, some risk always remains. What does ISO/IEC 27005 call this remaining risk?

  1. Inherent risk
  2. Residual risk Correct answer.
  3. Absolute risk
  4. Gross risk

Explanation

Residual risk is the risk that remains after risk treatment measures have been implemented. It must be compared against risk acceptance criteria and, if still unacceptable, subjected to further treatment.

Question 8Fundamental principles and concepts of information security risk management

An analyst rates a risk by combining a likelihood score and a consequence score into a single value. Which activity of the ISO/IEC 27005 risk assessment is being performed?

  1. Risk evaluation
  2. Risk communication
  3. Risk identification
  4. Risk analysis Correct answer.

Explanation

Risk analysis develops an understanding of risk by determining consequences and likelihood and combining them to produce a risk level. Identification only finds the risk, while evaluation compares the analysed level against criteria.

Question 9Fundamental principles and concepts of information security risk management

Which statement best captures the ISO/IEC 27005 principle that risk management should be iterative?

  1. Risk management is repeated as assets, threats, and the business environment change, feeding results back into the process Correct answer.
  2. Only the risk treatment step is repeated, while identification and analysis remain fixed
  3. Iteration is required only when an external auditor requests it
  4. Risk assessment is performed once at project initiation and then archived

Explanation

ISO/IEC 27005 describes risk management as a continual process in which monitoring and review feed changes back into context, assessment, and treatment. Because threats and business conditions evolve, a one-time assessment quickly becomes stale.

Question 10Fundamental principles and concepts of information security risk management

Which of the following is the clearest example of a vulnerability in ISO/IEC 27005 terms?

  1. A decision by management to accept a low risk
  2. An unpatched web server that allows remote code execution Correct answer.
  3. A group of attackers targeting the organization's industry sector
  4. The financial loss expected if customer records are leaked

Explanation

A vulnerability is a weakness in an asset or control that a threat could exploit, such as an unpatched server. The targeting attackers are a threat, the expected loss is a consequence, and the acceptance decision is a treatment outcome.

Question 11Fundamental principles and concepts of information security risk management

What is the primary function of the risk register within an ISO/IEC 27005-aligned process?

  1. To replace the need for a formal risk assessment methodology
  2. To store only the cryptographic keys used to protect sensitive data
  3. To document the organization's network topology in detail
  4. To serve as the authoritative record of identified risks, their owners, assessments, and treatment status Correct answer.

Explanation

A risk register is the central log where identified risks, their owners, analysis results, treatment decisions, and status are recorded and tracked. It supports communication and monitoring but does not substitute for the methodology itself.

Question 12Fundamental principles and concepts of information security risk management

An organization uses a qualitative scale of "low, medium, high" for both likelihood and consequence. Which statement about this approach is most consistent with ISO/IEC 27005?

  1. Qualitative scales remove the need for any risk criteria
  2. Qualitative analysis can be useful when numerical data is scarce, but the scales must be clearly defined to keep ratings consistent Correct answer.
  3. Qualitative analysis always produces more precise results than quantitative analysis
  4. Qualitative analysis is not permitted under ISO/IEC 27005

Explanation

ISO/IEC 27005 permits both qualitative and quantitative analysis. Qualitative approaches are practical when data is limited, provided the meaning of each scale level is explicitly defined so different assessors reach consistent ratings.

Question 13Fundamental principles and concepts of information security risk management

Which of the following best describes the concept of "risk appetite" as used alongside ISO/IEC 27005?

  1. The amount and type of risk an organization is willing to pursue or retain Correct answer.
  2. The total number of vulnerabilities found in a penetration test
  3. The list of threats recorded during risk identification
  4. The technical severity score assigned by a vulnerability scanner

Explanation

Risk appetite expresses how much risk an organization is willing to pursue or retain in pursuit of its objectives. It informs risk criteria and acceptance decisions, distinguishing it from raw counts or scanner scores.

Question 14Fundamental principles and concepts of information security risk management

During risk identification, an analyst maps how a phishing email could lead to credential theft and then to unauthorized access to customer data. Which technique is being applied?

  1. Scenario-based analysis of threat events and their consequences Correct answer.
  2. Residual risk acceptance
  3. Quantitative annualized loss expectancy calculation
  4. Control effectiveness testing

Explanation

Tracing a threat event through intermediate steps to consequences is scenario-based identification, a recognized ISO/IEC 27005 technique. It helps reveal the chain linking threats, vulnerabilities, and business impact.

Question 15Fundamental principles and concepts of information security risk management

Which statement correctly describes the relationship between risk assessment and risk treatment in ISO/IEC 27005?

  1. Risk treatment eliminates the need for any subsequent monitoring
  2. Risk assessment and risk treatment are the same activity under different names
  3. Risk assessment produces the analysed and evaluated risk that informs the selection of treatment options Correct answer.
  4. Risk treatment is performed first so that assessment can be skipped

Explanation

Risk assessment (identification, analysis, evaluation) establishes which risks matter and how they compare to criteria, and this output drives the choice of treatment options. Treatment follows assessment and does not remove the need for monitoring.

Question 16Fundamental principles and concepts of information security risk management

What does ISO/IEC 27005 mean by "risk communication and consultation"?

  1. The continual exchange of risk information with stakeholders to support understanding and decision-making Correct answer.
  2. Sending a single email at the end of the year summarizing incidents
  3. A technical scan that identifies open network ports
  4. Publishing the full risk register on the public internet

Explanation

Communication and consultation is an ongoing dialogue that ensures stakeholders understand risk and that decisions reflect their concerns. It is continuous and two-way, not a one-off broadcast or a technical scan.

Question 17Fundamental principles and concepts of information security risk management

A risk assessment team estimates likelihood using historical incident data and expert judgement because precise statistics are unavailable. Which statement best reflects ISO/IEC 27005 guidance?

  1. Expert judgement is invalid and only actuarial data may be used
  2. Likelihood should be omitted entirely when data is incomplete
  3. Likelihood must always be set to the maximum value to be conservative
  4. Combining available data with structured expert judgement is acceptable when its assumptions and limitations are documented Correct answer.

Explanation

ISO/IEC 27005 accepts expert judgement as a legitimate input to likelihood estimation, particularly where data is sparse. Transparency about assumptions and limitations keeps the analysis defensible and repeatable.

Question 18Fundamental principles and concepts of information security risk management

Which of the following best explains why ISO/IEC 27005 emphasizes linking information security risk to organizational objectives?

  1. Because only financial objectives can be affected by information security risk
  2. Because technical vulnerabilities are irrelevant to business outcomes
  3. Because risk decisions should be prioritized according to their potential effect on the organization's mission and goals Correct answer.
  4. Because objectives replace the need for risk criteria

Explanation

Tying risk to objectives lets organizations prioritize treatment where consequences most affect mission and goals. Risk is meaningful in terms of business impact, not as an isolated technical measure.

Question 19Fundamental principles and concepts of information security risk management

An organization decides to purchase cyber insurance to cover part of the financial impact of a data breach. Which risk treatment option does this represent?

  1. Risk avoidance
  2. Risk retention
  3. Risk sharing Correct answer.
  4. Risk modification through technical controls

Explanation

Insurance transfers part of the financial consequence to another party, which ISO/IEC 27005 treats as risk sharing. The risk event can still occur, but its financial burden is partly borne by the insurer.

Question 20Fundamental principles and concepts of information security risk management

Which statement best describes the role of monitoring and review in the ISO/IEC 27005 risk management process?

  1. It permanently freezes the risk register once treatment is complete
  2. It replaces the need for risk identification in future cycles
  3. It verifies that controls remain effective and detects changes in context, threats, and risk levels over time Correct answer.
  4. It is performed only by external auditors during certification

Explanation

Monitoring and review confirms that controls work as intended and that the assumptions behind the assessment still hold. It detects changes that require the risk process to be repeated, keeping the assessment current.

Question 21Fundamental principles and concepts of information security risk management

In an ISO/IEC 27005 risk matrix, what does moving from a cell of "medium" to an adjacent cell of "high" typically indicate?

  1. A higher combination of likelihood and consequence that may exceed the acceptance threshold Correct answer.
  2. A confirmation that residual risk has been eliminated
  3. A change in the organization's legal jurisdiction
  4. A reduction in the number of identified assets

Explanation

A risk matrix plots likelihood against consequence, so a higher cell reflects a more severe combination of the two. Such a rating is then compared with criteria to decide whether treatment is needed.

Question 22Fundamental principles and concepts of information security risk management

Why does ISO/IEC 27005 recommend documenting the risk assessment methodology before performing the assessment?

  1. To satisfy a requirement that all methods be quantitative
  2. To guarantee that no risk will ever be identified
  3. To avoid the need to define risk criteria
  4. To ensure consistency, repeatability, and comparability of results across assessments and assessors Correct answer.

Explanation

A documented methodology makes assessments repeatable and comparable over time and between teams, supporting defensible decisions. It does not remove the need for criteria, nor does it mandate quantitative methods.

Question 23Fundamental principles and concepts of information security risk management

An organization finds that a newly deployed cloud service introduces threats not covered in its existing assessment. According to ISO/IEC 27005 principles, what is the most appropriate response?

  1. Immediately purchase insurance without any further analysis
  2. Re-enter the risk identification and analysis steps for the changed context and update the risk register Correct answer.
  3. Reduce the likelihood scores of all existing risks to compensate
  4. Ignore the new threats because the original assessment was approved

Explanation

Because risk management is iterative, a material change in context such as a new cloud service requires revisiting identification and analysis. The register is updated so decisions reflect the current environment.

Question 24Fundamental principles and concepts of information security risk management

Two analysts assess the same risk and reach different ratings. Which factor most directly undermines the comparability of their results under an ISO/IEC 27005-aligned process?

  1. Both analysts recorded their assumptions in the risk register
  2. Both analysts consulted the same asset inventory
  3. Both analysts used the same documented likelihood and consequence scales
  4. The scales lack explicit definitions, so each analyst interprets "high" differently Correct answer.

Explanation

Comparable ratings depend on clearly defined scales so that terms like "high" mean the same thing to every assessor. Ambiguous definitions introduce subjective variation that undermines consistency, whereas shared scales and documented assumptions support it.

Question 25Fundamental principles and concepts of information security risk management

An organization sets its risk acceptance criteria so that any risk whose consequence could halt a critical business process must be treated regardless of its estimated likelihood. Which concept does this illustrate?

  1. Risk acceptance criteria must always be purely financial
  2. Consequence is irrelevant once likelihood is low
  3. Likelihood is the only factor permitted in ISO/IEC 27005 evaluation
  4. Criteria can reflect consequence thresholds that override pure likelihood-based scoring Correct answer.

Explanation

ISO/IEC 27005 allows risk criteria to include thresholds based on consequence, legal, or business-continuity concerns that apply irrespective of likelihood. This reflects organizational priorities rather than a rigid likelihood-only rule.

Question 26Fundamental principles and concepts of information security risk management

In ISO/IEC 27005, what does the term 'risk' fundamentally express?

  1. The potential for loss or harm expressed as a combination of the consequences of an event and its likelihood Correct answer.
  2. The monetary value assigned to a hardware asset in the asset inventory
  3. The set of controls currently deployed to protect an information asset
  4. The probability that an auditor will find a nonconformity during certification

Explanation

ISO/IEC 27005 builds on ISO/IEC 27000 vocabulary, where risk is the effect of uncertainty on objectives, expressed for information security as a combination of consequences and their likelihood. Loss or harm is therefore described through both dimensions, not one alone.

Question 27Fundamental principles and concepts of information security risk management

Which element of the ISO/IEC 27005 conceptual model describes a weakness that can be exploited by a threat?

  1. Impact
  2. Likelihood
  3. Vulnerability Correct answer.
  4. Consequence

Explanation

A vulnerability is an intrinsic property of an asset or control environment that a threat can exploit. Impact, likelihood and consequence are measures used to size risk, not weaknesses themselves.

Question 28Fundamental principles and concepts of information security risk management

In the ISO/IEC 27005 risk components model, what does a threat exploit to produce an information security event?

  1. A control objective
  2. A residual risk
  3. A risk owner
  4. A vulnerability Correct answer.

Explanation

The model links threats to vulnerabilities: a threat actor or source exploits a vulnerability, which can lead to an event with consequences for the organization. Controls and owners modify but do not replace that relationship.

Question 29Fundamental principles and concepts of information security risk management

Which statement reflects the ISO/IEC 27005 position on how information security risk management relates to the organization's overall risk management?

  1. It should be integrated into the organization's overall risk management and governance arrangements Correct answer.
  2. It should be performed only once, at the start of a major project
  3. It should replace enterprise risk management whenever information assets are involved
  4. It should be conducted as an isolated technical exercise owned solely by the IT department

Explanation

ISO/IEC 27005 is designed to support an organization-wide risk management framework rather than stand apart from it. Integration ensures information security risks are considered alongside other business risks and reported through the same governance channels.

Question 30Fundamental principles and concepts of information security risk management

Which term does ISO/IEC 27005 use for the amount and type of risk an organization is willing to pursue or retain?

  1. Risk capacity
  2. Risk exposure
  3. Risk tolerance
  4. Risk appetite Correct answer.

Explanation

Risk appetite expresses the amount and type of risk an organization is willing to pursue or retain in pursuit of objectives. It guides whether identified risks are acceptable or require treatment.

Question 31Fundamental principles and concepts of information security risk management

What is the purpose of establishing the 'context' at the start of an ISO/IEC 27005 risk assessment?

  1. To define the scope, boundaries and criteria against which risks will be assessed Correct answer.
  2. To certify the organization against ISO/IEC 27001
  3. To calculate the exact annualized loss expectancy for each asset
  4. To select the antivirus product that will be deployed across the estate

Explanation

Establishing context sets the scope, assumptions, constraints and risk criteria so that the assessment is relevant and consistent. It precedes identification and estimation, and it determines what will be considered acceptable.

Question 32Fundamental principles and concepts of information security risk management

Which activity immediately follows risk identification within the ISO/IEC 27005 risk assessment sequence?

  1. Risk treatment
  2. Risk estimation Correct answer.
  3. Risk communication
  4. Risk acceptance

Explanation

Risk assessment comprises risk identification, risk estimation and risk evaluation. Estimation follows identification and produces values used to prioritize risks.

Question 33Fundamental principles and concepts of information security risk management

Which expression best captures the relationship among the components used to describe an information security risk scenario?

  1. Control cost minus control benefit equals the risk
  2. Threat, vulnerability and consequence combine to characterize the risk associated with an asset Correct answer.
  3. Audit findings multiplied by asset count equals the risk
  4. Asset value alone determines the risk rating

Explanation

A risk scenario is described by linking a threat that exploits a vulnerability of an asset, producing consequences whose significance depends on likelihood. This combination is what makes the scenario assessable.

Question 34Fundamental principles and concepts of information security risk management

An organization defines likelihood as 'the probability that a threat exploits a vulnerability, given the effectiveness of existing controls'. Which aspect of ISO/IEC 27005 does this definition most directly support?

  1. Selecting the certification body for the ISMS
  2. Deciding the organization's risk appetite
  3. Estimating likelihood in a way that accounts for the current control environment Correct answer.
  4. Determining the audit scope for suppliers

Explanation

ISO/IEC 27005 recognizes that likelihood depends on how well existing controls reduce the chance of a threat succeeding. Defining likelihood in terms of control effectiveness makes estimates reflect the real environment.

Question 35Fundamental principles and concepts of information security risk management

A team classifies each identified risk as 'acceptable' or 'not acceptable' by comparing its estimated level with pre-defined criteria. Which ISO/IEC 27005 activity are they performing?

  1. Risk treatment
  2. Risk identification
  3. Risk monitoring
  4. Risk evaluation Correct answer.

Explanation

Risk evaluation compares estimated risk levels against the risk criteria established in the context to decide whether treatment is needed. It sits between estimation and treatment.

Question 36Fundamental principles and concepts of information security risk management

Which statement best describes how ISO/IEC 27005 treats the relationship between an asset and its supporting infrastructure, such as a database server hosting a customer records application?

  1. Infrastructure is excluded because it belongs to the facilities management domain
  2. Only the application matters because users interact with it directly
  3. Only the server matters because it holds the data
  4. Both the application and the supporting infrastructure may need to be considered when identifying assets and their dependencies Correct answer.

Explanation

ISO/IEC 27005 recognizes that assets include information, processes, systems and supporting infrastructure, and that dependencies affect risk. A failure in supporting infrastructure can create consequences for the application and its data.

Question 37Fundamental principles and concepts of information security risk management

An analyst records a risk scenario as: threat source 'external attacker', threat 'exploitation of unpatched web server', vulnerability 'missing security patches', asset 'public web portal'. What is missing to complete a meaningful consequence description?

  1. The patch management tool vendor
  2. The potential business or information impact if the exploitation succeeds Correct answer.
  3. The name of the attacker
  4. The number of employees in the IT team

Explanation

A risk scenario needs a consequence dimension describing what harm would result, such as data disclosure, service outage or regulatory penalty. Without that, the scenario cannot be meaningfully estimated or evaluated.

Question 38Fundamental principles and concepts of information security risk management

Which statement correctly distinguishes risk criteria from risk appetite in ISO/IEC 27005 usage?

  1. Risk criteria define the terms of reference for evaluating significance, while risk appetite expresses how much risk the organization is willing to accept Correct answer.
  2. Risk appetite defines the scope of the asset inventory, while risk criteria define treatment options
  3. Risk criteria and risk appetite are identical and may be used interchangeably
  4. Risk criteria apply only to suppliers, while risk appetite applies only to employees

Explanation

Risk criteria are the terms of reference against which the significance of risk is evaluated, including scales and thresholds. Risk appetite is the broader statement of willingness to bear risk that those criteria should reflect.

Question 39Fundamental principles and concepts of information security risk management

An organization chooses to avoid a risk by discontinuing an online service that cannot be secured cost-effectively. Which statement about this decision is most consistent with ISO/IEC 27005?

  1. Avoidance may introduce new risks, such as loss of revenue or customer dissatisfaction, that should also be assessed Correct answer.
  2. Avoidance eliminates all risk without introducing any new risk
  3. Avoidance requires transferring the risk to a third party
  4. Avoidance is not a recognized risk treatment option

Explanation

ISO/IEC 27005 notes that treatment decisions, including avoidance, can create new risks or shift risk elsewhere. These secondary risks should be identified and assessed as part of the treatment decision.

Question 40Fundamental principles and concepts of information security risk management

Which characteristic most clearly indicates that an organization's risk assessment approach is repeatable and comparable over time?

  1. Assessments are performed only when a serious incident occurs
  2. Each assessor chooses a personal scoring scale for convenience
  3. The methodology, scales and criteria are documented and consistently applied Correct answer.
  4. Results are kept confidential from risk owners

Explanation

Consistency and comparability depend on documented methods, defined scales and agreed criteria applied the same way each time. This allows results to be tracked and compared across periods and business units.

Question 41Fundamental principles and concepts of information security risk management

A risk owner decides to retain a risk that exceeds the organization's stated criteria because the cost of treatment is disproportionate. What does ISO/IEC 27005 suggest about this situation?

  1. The decision should be formally accepted and documented by someone with the authority to do so Correct answer.
  2. The risk should be silently ignored because treatment is too expensive
  3. The risk should automatically be transferred to an insurer
  4. The risk assessment should be repeated until the risk falls within criteria

Explanation

Where a risk outside criteria is retained, ISO/IEC 27005 expects an explicit, documented acceptance by an accountable authority. This preserves transparency and supports later monitoring and review.

Question 42Fundamental principles and concepts of information security risk management

Which statement best explains why ISO/IEC 27005 treats risk communication as a two-way activity rather than a one-way report?

  1. Because regulators require quarterly written reports
  2. Because consultation with stakeholders improves the quality of decisions and builds shared understanding of risks Correct answer.
  3. Because only senior managers are allowed to speak about risk
  4. Because communication replaces the need for risk estimation

Explanation

Communication and consultation involve exchanging information and views with stakeholders so that decisions reflect diverse perspectives and are understood. It is not merely broadcasting results.

Question 43Fundamental principles and concepts of information security risk management

An organization maintains a register entry showing the risk description, affected asset, current controls, estimated level, treatment decision and owner. Which additional element is most important to make the entry support ongoing risk management?

  1. The name of the software vendor used to build the risk register
  2. A review date and status so that the entry is monitored and updated Correct answer.
  3. The salary band of the risk owner
  4. The floor plan of the building where the asset is located

Explanation

Risk management is continual, so each entry needs review dates and status to trigger re-assessment and confirm treatment progress. Without this, the register becomes a static snapshot.

Question 44Fundamental principles and concepts of information security risk management

Which statement best describes the role of 'risk owner' in an ISO/IEC 27005-aligned process?

  1. The supplier who provides the affected software
  2. The person who performs the technical vulnerability scan
  3. The external auditor who certifies the ISMS
  4. The individual or entity accountable for managing a particular risk and its treatment Correct answer.

Explanation

A risk owner is accountable for a specific risk, including decisions on treatment and acceptance and confirming that monitoring occurs. Accountability is distinct from performing technical tasks.

Question 45Fundamental principles and concepts of information security risk management

An organization applies a consequence scale where 'major' is defined as breach of legal or regulatory obligations. During evaluation, a risk scored 'major' consequence and 'possible' likelihood is judged unacceptable even though another risk with 'minor' consequence and 'likely' likelihood is accepted. Which feature of ISO/IEC 27005 does this illustrate?

  1. That risk evaluation can apply rules giving certain consequence levels precedence over likelihood Correct answer.
  2. That all risks with the same likelihood must be treated identically
  3. That likelihood is always more important than consequence
  4. That qualitative scales cannot support evaluation

Explanation

Risk criteria may include rules, such as treating any risk above a defined consequence level as unacceptable regardless of likelihood. ISO/IEC 27005 allows criteria to reflect organizational priorities in this way.

Question 46Fundamental principles and concepts of information security risk management

A team estimates risk using a five-point likelihood scale but defines only points 1 and 5, leaving 2 to 4 undefined. What is the most significant consequence for the ISO/IEC 27005 process?

  1. The asset inventory will be incomplete
  2. Risk treatment options will be unavailable
  3. The organization will automatically fail certification
  4. Likelihood estimates become inconsistent and the resulting risk levels cannot be reliably compared or aggregated Correct answer.

Explanation

Undefined intermediate points leave assessors to improvise, producing inconsistent estimates and undermining comparability and aggregation. ISO/IEC 27005 expects scales to be clearly defined so that results are meaningful.

Question 47Fundamental principles and concepts of information security risk management

Two business units assess the same shared payment platform. Unit A treats the platform as a single asset, while Unit B decomposes it into application, database and interface assets. What is the most likely effect on the comparability of their results?

  1. No effect, because the platform is identical
  2. Unit A's results are invalid because aggregation is not permitted
  3. Results may differ in granularity and level, so aggregation requires reconciling the differing asset decomposition Correct answer.
  4. Unit B's results are invalid because decomposition is not permitted

Explanation

Different levels of asset decomposition change how threats, vulnerabilities and consequences are described, so risk levels may not be directly comparable. Reconciling the decomposition is needed before aggregating results.

Question 48Fundamental principles and concepts of information security risk management

An organization's risk criteria state that any risk capable of causing a regulatory fine above a defined threshold is unacceptable regardless of estimated likelihood. A risk owner argues the likelihood is very low and requests retention. What is the most defensible ISO/IEC 27005-aligned response?

  1. Re-estimate likelihood until it falls below the threshold
  2. Accept the retention because low likelihood always justifies it
  3. Change the criteria retroactively so the risk becomes acceptable
  4. Apply the stated criteria, so the risk is unacceptable and requires treatment or formal exception at the appropriate authority Correct answer.

Explanation

Risk evaluation applies the established criteria; where a rule makes a risk unacceptable, the owner cannot override it on likelihood alone. Any deviation should follow a formal exception process with appropriate authority.

Question 49Fundamental principles and concepts of information security risk management

An organization identifies a risk whose consequence is uncertain because the affected process is new and has no incident history. Which approach is most consistent with ISO/IEC 27005 when estimating this risk?

  1. Use expert judgement and clearly document the assumptions and uncertainty behind the estimate Correct answer.
  2. Assign the highest possible consequence to be conservative
  3. Exclude the risk from the register until incidents occur
  4. Assign the lowest possible consequence because no incidents have occurred

Explanation

ISO/IEC 27005 accepts expert judgement where data are scarce, provided assumptions and uncertainty are documented. This keeps estimates transparent and allows them to be revisited as evidence accumulates.

Question 50Fundamental principles and concepts of information security risk management

A risk assessment concludes that a risk is acceptable. Which statement best reflects ISO/IEC 27005 expectations for what should happen next?

  1. The risk is closed permanently and removed from all records
  2. The risk assessment must be repeated daily until the project ends
  3. The risk must immediately be transferred to a third party
  4. The risk and its acceptance rationale remain subject to monitoring and review so that changes are detected Correct answer.

Explanation

Acceptance is a point-in-time decision based on current information; ISO/IEC 27005 requires monitoring and review so that changes in threats, vulnerabilities or context trigger reassessment.