I85PREP
⌘ K
ISO/IEC 27005 Foundation study materials
ISO/IEC 27005 Foundation study resources

ISO/IEC 27005 Foundation practice questions

One question at a time. Build your ISO/IEC 27005 Foundation understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Fundamental concepts of information security risk management

In ISO/IEC 27005, what is the primary purpose of information security risk management?

  1. To identify, assess, treat and monitor risks to information in a systematic, iterative way Correct answer.
  2. To certify that an organization's controls fully comply with ISO/IEC 27001
  3. To eliminate every identified information security risk before systems go live
  4. To replace the organization's business continuity planning process

Explanation

Risk management in the ISO/IEC 27005 sense is a continuous cycle that identifies risks to information, assesses their likelihood and consequence, treats them, and monitors and reviews them. It supports decision-making and is iterative rather than a one-off elimination exercise. Certification and business continuity are related activities but not its purpose.

Question 2Fundamental concepts of information security risk management

Which relationship best describes how ISO/IEC 27005 relates to ISO/IEC 27001?

  1. 27005 provides guidance on the information security risk management that 27001 requires Correct answer.
  2. 27005 is a certification scheme that audits 27001 implementations
  3. 27005 and 27001 are unrelated standards covering different topics
  4. 27005 supersedes 27001 for organizations that handle personal data

Explanation

ISO/IEC 27001 specifies requirements for an information security management system, including a risk assessment and treatment process. ISO/IEC 27005 supplies detailed guidance on how to perform that risk management. It is advisory guidance, not a certification scheme, and does not replace 27001.

Question 3Fundamental concepts of information security risk management

In the risk management terminology of ISO/IEC 27005, what is the correct definition of 'risk'?

  1. Any weakness in a control that could be exploited by an attacker
  2. The total financial loss an organization accepts in its risk treatment plan
  3. The probability that an asset will fail during its operational lifetime
  4. The effect of uncertainty on objectives, expressed as a combination of consequences and their likelihood Correct answer.

Explanation

Risk is defined in terms of the effect of uncertainty on objectives, characterized by potential consequences and their likelihood of occurrence. This aligns with the general ISO risk vocabulary used throughout the 27000 family. A weakness describes a vulnerability, not the risk itself.

Question 4Fundamental concepts of information security risk management

Which term describes anything that has value to the organization and therefore may be subject to risk?

  1. Vulnerability
  2. Control
  3. Threat
  4. Asset Correct answer.

Explanation

An asset is anything that has value to the organization, such as information, systems, people or facilities. Threats act upon assets by exploiting vulnerabilities, and controls are implemented to reduce that exposure. Identifying assets is a foundational step in risk assessment.

Question 5Fundamental concepts of information security risk management

A potential cause of an unwanted incident that may result in harm to a system or organization is called what?

  1. A threat Correct answer.
  2. A risk owner
  3. A residual risk
  4. An impact

Explanation

A threat is a potential cause of an unwanted incident that could harm assets. Threats may be natural, accidental or deliberate, and they exploit vulnerabilities to produce consequences. Risk arises from the interaction of threats, vulnerabilities and asset value.

Question 6Fundamental concepts of information security risk management

What does the term 'residual risk' mean in information security risk management?

  1. The risk that is automatically excluded from the scope of the ISMS
  2. The portion of risk transferred to an insurer under a contract
  3. The risk that remains after risk treatment has been applied Correct answer.
  4. The risk that exists before any controls are considered

Explanation

Residual risk is the risk that remains after risk treatment options have been applied, and it should be compared against risk acceptance criteria. Organizations decide whether to accept, further treat or reject it. It is distinguished from the initial or inherent risk assessed before treatment.

Question 7Fundamental concepts of information security risk management

Which statement best describes the 'risk owner' role in ISO/IEC 27005?

  1. The person or entity with accountability for managing a particular risk Correct answer.
  2. The person who performs the technical penetration tests
  3. The software vendor that supplies a vulnerable product
  4. The external auditor who verifies the risk assessment results

Explanation

The risk owner is the person or entity with accountability and authority for managing a specific risk, including approving its treatment. Accountability cannot be delegated to a tool or an external party. This role is central to effective governance of the risk management process.

Question 8Fundamental concepts of information security risk management

In ISO/IEC 27005, which set of criteria is used to determine whether a risk is tolerable?

  1. Risk acceptance criteria Correct answer.
  2. Incident response criteria
  3. Business continuity criteria
  4. Asset valuation criteria

Explanation

Risk acceptance criteria define the level of risk an organization is willing to accept, and assessed risks are compared against them. Risks above the criteria generally require treatment. These criteria should be established before risk evaluation to keep decisions consistent.

Question 9Fundamental concepts of information security risk management

An organization identifies that a web server is exposed to a known software vulnerability and assesses that the resulting risk exceeds its acceptance criteria. According to ISO/IEC 27005, what should happen next?

  1. The risk should be removed from the risk register to avoid duplication
  2. The risk should be recorded as accepted because the server is business critical
  3. The risk should be treated, for example by patching or adding a compensating control Correct answer.
  4. The vulnerability should be reclassified as a threat to simplify reporting

Explanation

When an assessed risk exceeds the acceptance criteria, risk treatment is required to modify it, for example through patching or compensating controls. The treated risk is then re-evaluated and residual risk compared against the criteria. Acceptance is only appropriate when risk is within the defined criteria.

Question 10Fundamental concepts of information security risk management

Which risk treatment option involves sharing the financial consequences of a risk with another party?

  1. Risk modification
  2. Risk transfer Correct answer.
  3. Risk retention
  4. Risk avoidance

Explanation

Risk transfer, for example through insurance or contractual arrangements, shares or shifts the financial consequence of a risk to another party. Accountability usually remains with the organization. Modification reduces the risk itself, while retention accepts it.

Question 11Fundamental concepts of information security risk management

What is the main difference between a risk assessment and a risk analysis in ISO/IEC 27005 terminology?

  1. Risk analysis is performed only by external parties and risk assessment only by internal staff
  2. Risk assessment is qualitative and risk analysis is always quantitative
  3. Risk analysis is the broader process that includes risk assessment as one step
  4. Risk assessment includes risk analysis and risk evaluation, while analysis determines consequences and likelihood Correct answer.

Explanation

Risk assessment comprises risk identification, risk analysis and risk evaluation. Risk analysis is the step that determines the consequences and likelihood of identified risks. The relationship is hierarchical rather than one of method or performer.

Question 12Fundamental concepts of information security risk management

During risk identification, which of the following is the most appropriate first focus?

  1. Selecting the encryption algorithm for the database
  2. Calculating the annualized loss expectancy for each incident
  3. Identifying assets, threats and existing vulnerabilities and controls Correct answer.
  4. Drafting the statement of applicability

Explanation

Risk identification establishes what could happen and why, by identifying assets, their threats, existing vulnerabilities and controls. Only after identification can risks be analyzed and evaluated. Selecting algorithms or calculating loss expectancy are later or more specific activities.

Question 13Fundamental concepts of information security risk management

Why does ISO/IEC 27005 emphasize that risk management should be iterative?

  1. Because quantitative methods cannot be applied more than once to the same asset
  2. Because each iteration permanently removes one risk from the register
  3. Because regulations require a new risk assessment each calendar quarter
  4. Because risk levels change as threats, vulnerabilities, assets and business context evolve Correct answer.

Explanation

The risk environment is dynamic: new threats emerge, vulnerabilities are discovered, assets change and business context shifts. Iteration through monitoring and review keeps the assessment current. It is not tied to a fixed quarterly cadence or to permanently removing risks.

Question 14Fundamental concepts of information security risk management

What is the role of the 'risk register' in the risk management process?

  1. It is the audit log of access to the risk management tool
  2. It stores the technical configuration baselines of servers
  3. It records identified risks, their assessment, treatment status and owners Correct answer.
  4. It lists only the risks that have been fully mitigated

Explanation

A risk register is a record of identified risks together with assessment results, treatment decisions, status and assigned owners. It supports monitoring, review and reporting. It is not limited to mitigated risks and is not a configuration or access log.

Question 15Fundamental concepts of information security risk management

An organization decides to stop offering an online service because the associated risk cannot be reduced to an acceptable level. Which risk treatment option has been chosen?

  1. Risk transfer
  2. Risk modification
  3. Risk retention
  4. Risk avoidance Correct answer.

Explanation

Risk avoidance eliminates the activity that produces the risk, in this case by discontinuing the service. It is distinct from modifying the risk through controls or accepting it. Avoidance can itself introduce new risks, such as loss of business capability.

Question 16Fundamental concepts of information security risk management

Which factor is most directly used to determine the level of a risk during risk analysis?

  1. The color coding used in the risk matrix template
  2. The number of controls listed in the statement of applicability
  3. The seniority of the person who owns the asset
  4. The combination of likelihood of occurrence and consequences Correct answer.

Explanation

Risk level is derived from the likelihood that a threat exploits a vulnerability and the resulting consequences or impact. These two dimensions are combined in qualitative, semi-quantitative or quantitative analysis. Template colors and control counts are presentation or documentation artifacts.

Question 17Fundamental concepts of information security risk management

How does ISO/IEC 27005 treat the concept of 'uncertainty' in risk?

  1. Uncertainty is inherent in risk and should be considered when assessing likelihood and consequences Correct answer.
  2. Uncertainty must be reduced to zero before a risk can be accepted
  3. Uncertainty applies only to financial risks and not to information security
  4. Uncertainty is ignored once a control has been implemented

Explanation

Risk reflects the effect of uncertainty on objectives, so uncertainty is inherent and should inform estimates of likelihood and consequence. Assessments may state confidence levels or ranges rather than single point values. It cannot be reduced to zero, and acceptance can proceed within defined criteria.

Question 18Fundamental concepts of information security risk management

Which statement best describes the relationship between an information security event and an information security incident in risk management context?

  1. An incident is only a deliberate attack, while an event is only accidental
  2. Events and incidents are identical terms with no distinction
  3. An incident is a single or series of unwanted events with significant probability of compromising business operations Correct answer.
  4. Every event is an incident because events always cause harm

Explanation

An information security incident is a single or series of unwanted or unexpected events that have a significant probability of compromising business operations and information security. Many events are benign and never become incidents. The distinction matters when monitoring risk and evaluating consequences.

Question 19Fundamental concepts of information security risk management

In a qualitative risk assessment, which approach is typically used to express risk levels?

  1. Statistical confidence intervals computed from incident history
  2. Descriptive scales such as low, medium and high Correct answer.
  3. Exact annualized loss expectancy figures
  4. Precise monetary values derived from actuarial tables

Explanation

Qualitative assessment uses descriptive scales, such as low, medium and high, for likelihood and consequences. It is useful when data is scarce or precision is unnecessary. Monetary and statistical approaches belong to quantitative or semi-quantitative methods.

Question 20Fundamental concepts of information security risk management

An organization uses a risk matrix where likelihood and impact each have five levels and risk scores are multiplied. Which limitation should be considered when interpreting the resulting scores?

  1. The scores are always more accurate than quantitative loss estimates
  2. The matrix cannot be used for information security risks
  3. The matrix removes the need for risk evaluation against criteria
  4. The scales imply equal intervals and may hide uncertainty and subjective judgment Correct answer.

Explanation

Multiplied ordinal scales often imply equal intervals that do not exist, and they can conceal uncertainty and subjectivity in ratings. The output should be interpreted with these limitations in mind. Evaluation against acceptance criteria is still required after scoring.

Question 21Fundamental concepts of information security risk management

A risk assessment team reports that a risk is 'high' but cannot explain which threat, vulnerability and asset combination produced that rating. What is the most significant weakness in this assessment?

  1. The team should have skipped risk evaluation to save time
  2. The assessment should have excluded the asset from scope
  3. The rating was produced without traceable risk identification and analysis Correct answer.
  4. The rating should have been expressed as a monetary value

Explanation

A defensible assessment must be traceable from assets, threats and vulnerabilities through analysis to the resulting risk level. Without that traceability, the rating cannot be reviewed, justified or treated appropriately. Expressing the rating in money is a method choice, not a remedy for missing traceability.

Question 22Fundamental concepts of information security risk management

Two analysts assess the same risk. One rates likelihood as 'medium' and the other as 'high', using the same matrix. Which action best improves consistency in line with ISO/IEC 27005 guidance?

  1. Increase the number of matrix levels to ten
  2. Remove the likelihood dimension and assess impact only
  3. Average the two ratings and record only the mean
  4. Define clear likelihood scale descriptions and calibrate assessors against them Correct answer.

Explanation

Consistency improves when scales have explicit, well-defined descriptions and assessors are calibrated to apply them similarly. Documented criteria reduce subjective variation. Averaging without resolution or removing a dimension would obscure rather than resolve the disagreement.

Question 23Fundamental concepts of information security risk management

An organization accepts a risk because the cost of treatment exceeds the potential loss, but later the threat landscape changes significantly. What does ISO/IEC 27005 require conceptually?

  1. The asset must be decommissioned immediately
  2. The acceptance decision remains permanently valid once documented
  3. The risk should be re-evaluated through monitoring and review, and the decision reconsidered Correct answer.
  4. The risk must be transferred to an insurer automatically

Explanation

Risk acceptance is not permanent; monitoring and review should detect changes in context, threats or vulnerabilities and trigger re-evaluation. The acceptance decision may then be revisited. Automatic transfer or decommissioning is not a required response.

Question 24Fundamental concepts of information security risk management

Which statement correctly distinguishes a vulnerability from a threat?

  1. A vulnerability is a consequence of an incident, while a threat is its likelihood
  2. A vulnerability is a weakness that can be exploited, while a threat is a potential cause of an unwanted incident Correct answer.
  3. A vulnerability and a threat are synonyms in ISO/IEC 27005
  4. A vulnerability is a potential cause of harm, while a threat is a weakness in a control

Explanation

A vulnerability is a weakness in an asset or control that a threat could exploit, whereas a threat is a potential cause of an unwanted incident. The two interact: threats exploit vulnerabilities to produce consequences. Confusing them undermines risk identification.

Question 25Fundamental concepts of information security risk management

Why should risk acceptance criteria be established before risks are evaluated rather than after assessment results are known?

  1. Because ISO/IEC 27001 forbids changing criteria once they are written
  2. To guarantee that no risk will ever require treatment
  3. Because criteria set in advance eliminate the need for monitoring
  4. To ensure evaluation decisions are consistent and not biased by the specific results obtained Correct answer.

Explanation

Setting acceptance criteria in advance supports consistent, objective evaluation and reduces the temptation to adjust thresholds to fit known results. Criteria may still be reviewed, but predefinition strengthens governance. They do not eliminate treatment or monitoring needs.

Question 26Fundamental concepts of information security risk management

In ISO/IEC 27005, which term describes the potential for loss or harm expressed as a combination of the likelihood of an event and its consequences?

  1. Risk appetite
  2. Vulnerability
  3. Information security risk Correct answer.
  4. Residual risk

Explanation

ISO/IEC 27005 defines information security risk as the potential that a given threat will exploit vulnerabilities of an asset or group of assets and thereby cause harm to the organization, combining likelihood and consequence. The other terms describe different concepts within the risk management vocabulary.

Question 27Fundamental concepts of information security risk management

Which statement best captures the purpose of the information security risk management process described in ISO/IEC 27005?

  1. It identifies, analyses, evaluates and treats risks so that information security is aligned with organizational objectives Correct answer.
  2. It replaces the need for an information security management system
  3. It guarantees that no security incidents will occur once controls are implemented
  4. It documents the technical configuration of every network device

Explanation

The standard frames risk management as a systematic, iterative process that identifies, analyses, evaluates and treats information security risk in support of organizational objectives. It is a management activity, not a guarantee of incident-free operation and not a substitute for an ISMS.

Question 28Fundamental concepts of information security risk management

In the ISO/IEC 27005 process, which activity immediately follows risk identification?

  1. Risk acceptance
  2. Risk analysis Correct answer.
  3. Risk communication
  4. Risk monitoring

Explanation

Risk assessment comprises risk identification, risk analysis and risk evaluation, so analysis follows identification. Communication and monitoring are parallel, ongoing activities rather than the next sequential step.

Question 29Fundamental concepts of information security risk management

Which of the following best describes an 'asset' in the context of ISO/IEC 27005?

  1. Any software vulnerability that has been publicly disclosed
  2. Anything that has value to the organization and therefore requires protection Correct answer.
  3. A control selected from ISO/IEC 27002
  4. A threat source that targets the organization

Explanation

ISO/IEC 27005 builds on the definition of an asset as anything that has value to the organization, which is why assets are the objects that risk identification examines. Vulnerabilities, threat sources and controls are distinct concepts that interact with assets.

Question 30Fundamental concepts of information security risk management

Which element is a primary input to establishing the risk management context in ISO/IEC 27005?

  1. The organization's strategic objectives and the scope of the risk management activity Correct answer.
  2. The list of all past security incidents sorted by date
  3. The names of every employee with administrator rights
  4. The inventory of antivirus signatures in use

Explanation

Establishing context requires understanding the organization's objectives, its internal and external environment, and the scope to which the risk management process applies. Detailed operational data such as incident lists or user inventories are gathered later during risk identification.

Question 31Fundamental concepts of information security risk management

Which statement correctly describes the relationship between risk evaluation and risk treatment in ISO/IEC 27005?

  1. Risk treatment must be completed before risk evaluation begins
  2. Risk evaluation compares analysis results against criteria and determines whether treatment is needed Correct answer.
  3. Risk evaluation always results in immediate implementation of technical controls
  4. Risk evaluation is optional whenever risk analysis has been performed

Explanation

Risk evaluation uses the results of risk analysis and compares them with risk criteria to decide whether the risk is acceptable or requires treatment. Treatment decisions follow evaluation, so evaluation must precede them.

Question 32Fundamental concepts of information security risk management

What does ISO/IEC 27005 call the process of communicating and consulting on risk with stakeholders throughout the risk management process?

  1. Risk transfer
  2. Risk communication Correct answer.
  3. Risk avoidance
  4. Risk aggregation

Explanation

Risk communication is the continual exchange of information about risk between the organization and its stakeholders, and it is performed at every stage of the process. Transfer, aggregation and avoidance are different risk-related concepts.

Question 33Fundamental concepts of information security risk management

Which pair correctly matches an ISO/IEC 27005 activity with its main output?

  1. Risk evaluation produces the asset inventory
  2. Risk analysis produces the organization's risk appetite
  3. Risk identification produces the final statement of residual risk
  4. Risk treatment produces a treatment plan with selected controls and responsibilities Correct answer.

Explanation

Risk treatment results in a risk treatment plan that records the chosen options, controls, owners and timelines. Residual risk statements come after treatment, risk appetite is set during context establishment, and asset inventories feed identification rather than being its output.

Question 34Fundamental concepts of information security risk management

An organization is establishing its risk management context and must decide how much risk it is willing to accept in pursuit of its business goals. Which concept does this describe?

  1. Residual risk
  2. Risk analysis
  3. Risk appetite Correct answer.
  4. Risk source

Explanation

Risk appetite expresses the amount and type of risk an organization is willing to pursue or retain, and it shapes the risk criteria used in evaluation. Residual risk is what remains after treatment, while analysis and risk source are different elements of the process.

Question 35Fundamental concepts of information security risk management

A risk analyst wants to express risk levels using descriptive categories such as low, medium and high without assigning monetary values. Which approach is being used?

  1. Fault tree analysis
  2. Qualitative risk analysis Correct answer.
  3. Semi-quantitative risk analysis
  4. Quantitative risk analysis

Explanation

Qualitative analysis uses descriptive scales, such as low, medium and high, to express likelihood, consequence and risk level. Quantitative analysis uses numeric values such as monetary loss, and semi-quantitative analysis combines numeric scales with qualitative interpretation.

Question 36Fundamental concepts of information security risk management

During risk identification, an analyst documents that a database administrator has excessive privileges and that a former employee's account remains active. Which element of the risk picture is being recorded?

  1. Consequences already realized by the organization
  2. Vulnerabilities that could be exploited by threats Correct answer.
  3. Risk treatment options under consideration
  4. Threat sources acting on the organization

Explanation

Excessive privileges and orphaned accounts are weaknesses in the organization's controls, which ISO/IEC 27005 treats as vulnerabilities. Threat sources are the actors or conditions that could exploit such weaknesses, and consequences are the resulting harm.

Question 37Fundamental concepts of information security risk management

An organization decides to purchase cyber insurance to cover part of the financial impact of a data breach. Which risk treatment option does this represent?

  1. Risk retention
  2. Risk reduction
  3. Risk avoidance
  4. Risk sharing Correct answer.

Explanation

Insurance transfers or shares part of the financial consequence of a risk with another party, which ISO/IEC 27005 classifies as risk sharing. Avoidance eliminates the activity, reduction lowers likelihood or impact through controls, and retention keeps the risk within the organization.

Question 38Fundamental concepts of information security risk management

A risk assessment team proposes to modify risk criteria because the current thresholds make almost every risk unacceptable. What is the most appropriate consideration in ISO/IEC 27005 terms?

  1. Criteria should be adjusted until no risk requires treatment
  2. Criteria should reflect the organization's objectives and appetite and be set independently of individual assessment results Correct answer.
  3. Criteria should be changed each time a new risk is identified
  4. Criteria should be based solely on the preferences of the assessment team

Explanation

Risk criteria are derived from the organization's objectives and risk appetite and should be established as part of context establishment, not manipulated to fit particular results. Adjusting criteria to avoid treatment decisions undermines the integrity of the process.

Question 39Fundamental concepts of information security risk management

Which statement best explains why ISO/IEC 27005 treats risk assessment as a recurring activity rather than a one-time project?

  1. Risk assessment is repeated only to satisfy auditors
  2. Risk assessment must be repeated because the standard forbids initial assessments
  3. Assets, threats and vulnerabilities change over time, so assessments must be repeated to remain valid Correct answer.
  4. Repeating assessments eliminates the need for risk treatment

Explanation

The risk environment is dynamic: new threats emerge, assets change and vulnerabilities appear, so assessments must be repeated to keep risk information current. Repetition supports decision-making and monitoring rather than replacing treatment or serving auditors alone.

Question 40Fundamental concepts of information security risk management

An organization is deciding whether to outsource a payroll function and wants to understand the risk before committing. Which activity in the ISO/IEC 27005 process directly supports this decision?

  1. Incident response testing
  2. Risk evaluation against established criteria Correct answer.
  3. Risk treatment implementation
  4. Risk monitoring after go-live

Explanation

Risk evaluation compares the analysed risk against criteria to determine whether the risk is acceptable and whether treatment is needed before a decision is made. Treatment implementation, monitoring and incident testing occur after or alongside the decision rather than informing it directly.

Question 41Fundamental concepts of information security risk management

A risk register entry lists a risk, its owner, the chosen treatment, the controls applied and the date of the next review. Which additional element most strengthens the register's usefulness for ISO/IEC 27005 monitoring?

  1. The names of vendors that supply office furniture
  2. The current residual risk level after treatment Correct answer.
  3. The marketing budget for the coming year
  4. The number of employees in the finance department

Explanation

Monitoring requires tracking how risk changes after treatment, so recording the current residual risk level allows the organization to see whether controls remain effective. Unrelated organizational data does not support risk monitoring.

Question 42Fundamental concepts of information security risk management

Which statement correctly distinguishes likelihood from consequence in ISO/IEC 27005 risk analysis?

  1. Likelihood describes the chance of an event occurring; consequence describes the extent of resulting harm Correct answer.
  2. Likelihood describes the cost of controls; consequence describes their effectiveness
  3. Likelihood describes the legal requirements; consequence describes the audit findings
  4. Likelihood describes the number of assets; consequence describes their location

Explanation

Risk analysis considers the likelihood of a threat exploiting a vulnerability and the consequence, or impact, if that occurs. Controls, assets and compliance matters are separate inputs rather than definitions of these two factors.

Question 43Fundamental concepts of information security risk management

A team identifies a risk but cannot determine who is accountable for deciding how to treat it. Which ISO/IEC 27005 concept is missing?

  1. A quantitative analysis method
  2. A documented threat source
  3. An assigned risk owner Correct answer.
  4. A selected baseline control set

Explanation

Each risk should have a risk owner who is accountable for its management, including treatment decisions and acceptance. Threat sources and analysis methods are separate elements, and baseline control sets relate to treatment selection rather than accountability.

Question 44Fundamental concepts of information security risk management

Which of the following best illustrates the concept of a threat in ISO/IEC 27005?

  1. A firewall rule that blocks inbound traffic
  2. A missing patch on an internet-facing server
  3. A database containing customer records
  4. A criminal group that targets customer payment data Correct answer.

Explanation

A threat is a potential cause of an unwanted incident, such as an actor or natural event with the intent and capability to cause harm. A missing patch is a vulnerability, the database is an asset, and the firewall rule is a control.

Question 45Fundamental concepts of information security risk management

An organization's risk criteria state that risks above a defined threshold require treatment, while those below it may be accepted. A newly assessed risk falls just above the threshold. What does ISO/IEC 27005 expect the organization to do next?

  1. Reclassify the risk so that it falls below the threshold
  2. Immediately close the risk without further action
  3. Wait for the next annual audit before deciding
  4. Select and plan risk treatment options and record them in a treatment plan Correct answer.

Explanation

When evaluation shows a risk exceeds the acceptable threshold, the organization proceeds to risk treatment, selecting options and documenting them in a treatment plan. Reclassifying to avoid treatment or delaying until an audit defeats the purpose of the criteria.

Question 46Fundamental concepts of information security risk management

Which statement best describes how ISO/IEC 27005 relates risk management to the information security management system defined in ISO/IEC 27001?

  1. Risk management is limited to the IT department and excludes business processes
  2. Risk management is an alternative to certification that replaces the ISMS
  3. Risk management applies only to organizations that are not certified
  4. Risk management provides the systematic basis for selecting and maintaining the controls the ISMS requires Correct answer.

Explanation

ISO/IEC 27005 provides guidance on managing information security risk that supports the ISMS requirements of ISO/IEC 27001, particularly the selection and maintenance of controls. It neither replaces certification nor restricts risk management to IT.

Question 47Fundamental concepts of information security risk management

A risk assessment is performed for a new cloud service. The team documents the service, its data, the relevant threats and existing controls, and then estimates likelihood and impact. Which sequence of ISO/IEC 27005 activities does this reflect?

  1. Risk treatment followed by risk analysis
  2. Risk communication followed by context establishment
  3. Risk evaluation followed by risk identification
  4. Risk identification followed by risk analysis Correct answer.

Explanation

Documenting assets, threats, vulnerabilities and existing controls is risk identification, while estimating likelihood and impact is risk analysis. Evaluation, treatment and communication occur at other points in the process.

Question 48Fundamental concepts of information security risk management

Two departments use different likelihood scales, one with three levels and one with five levels, and their risk results cannot be compared. Which ISO/IEC 27005 principle has been violated?

  1. Consistency of risk criteria and scales across the organization Correct answer.
  2. The rule that each asset may have only one risk
  3. The need to avoid documenting assumptions
  4. The requirement to use only quantitative methods

Explanation

Consistent criteria and scales are needed so that risk results are comparable and can be aggregated and prioritized across the organization. The standard does not mandate quantitative methods, discourage documented assumptions, or limit assets to a single risk.

Question 49Fundamental concepts of information security risk management

An analyst reports that a risk is unacceptable but provides no record of the assumptions, data sources or reasoning used. Why does this matter for ISO/IEC 27005 monitoring and review?

  1. Documentation is required only when insurance is purchased
  2. Assumptions are only needed for quantitative assessments
  3. The reasoning becomes irrelevant once treatment is selected
  4. Without documented rationale, later reviewers cannot determine whether the assessment remains valid as conditions change Correct answer.

Explanation

Monitoring and review depend on understanding why a risk was assessed as it was, so that changes in threats, vulnerabilities or context can be recognized and the assessment updated. Documented assumptions and data sources make the assessment reproducible and auditable.

Question 50Fundamental concepts of information security risk management

An organization treats a risk, then discovers that the implemented control is ineffective and the exposure has returned to its original level. How should this be interpreted in ISO/IEC 27005 terms?

  1. The original risk was never real and can be removed from the register
  2. The risk has been transferred and is now the control vendor's responsibility
  3. The residual risk is higher than expected and the risk must be re-evaluated and further treated Correct answer.
  4. The risk has been successfully avoided and requires no further action

Explanation

Residual risk is the risk remaining after treatment, and if a control proves ineffective the residual risk is higher than anticipated. The organization must re-evaluate the risk and consider further treatment rather than assuming the risk has been resolved.