I85PREP
⌘ K
ISO/IEC 27005 Lead Risk Manager study materials
ISO/IEC 27005 Lead Risk Manager study resources

ISO/IEC 27005 Lead Risk Manager practice questions

One question at a time. Build your ISO/IEC 27005 Lead Risk Manager understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Fundamental concepts and principles of information security risk management

In ISO/IEC 27005, what is the primary purpose of establishing the risk context before performing risk assessment?

  1. To calculate the exact annualised loss expectancy for every identified asset
  2. To document the residual risk that remains after treatment has been applied
  3. To select the cryptographic algorithms that will protect the organisation's data
  4. To define the scope, criteria, and boundaries within which risk will be identified, analysed, and evaluated Correct answer.

Explanation

Context establishment sets the scope, risk criteria, and boundaries that govern the whole risk management process, so identification, analysis, and evaluation all operate against agreed parameters. It precedes assessment rather than calculating specific losses or selecting controls.

Question 2Fundamental concepts and principles of information security risk management

Which statement best captures the ISO/IEC 27005 relationship between risk and uncertainty?

  1. Uncertainty is eliminated once a risk register is created
  2. Risk exists only when the probability of an event is exactly known
  3. Risk and uncertainty are unrelated concepts in information security
  4. Risk is the effect of uncertainty on objectives, combining likelihood and consequence Correct answer.

Explanation

ISO/IEC 27005 aligns with the definition of risk as the effect of uncertainty on objectives, expressed through the combination of likelihood and consequence. Uncertainty is inherent to risk and cannot be assumed away by documentation.

Question 3Fundamental concepts and principles of information security risk management

An organisation decides that risks below a defined threshold will be accepted without further action. What is this threshold called in ISO/IEC 27005 terminology?

  1. Risk treatment plan
  2. Vulnerability baseline
  3. Risk acceptance criteria Correct answer.
  4. Statement of applicability

Explanation

Risk acceptance criteria (part of the risk criteria set during context establishment) define which levels of risk are tolerable and can be accepted. Risks above the threshold require treatment, while those below may be accepted.

Question 4Fundamental concepts and principles of information security risk management

Which pair of factors is combined to express the level of an information security risk in ISO/IEC 27005?

  1. Asset value and control cost
  2. Threat capability and audit frequency
  3. Likelihood of an event and its consequence Correct answer.
  4. Vulnerability count and patch latency

Explanation

Risk level is derived by combining the likelihood that a threat exploits a vulnerability with the resulting consequence (impact) on the organisation. Other factors feed into these two dimensions but do not replace them.

Question 5Fundamental concepts and principles of information security risk management

In the ISO/IEC 27005 process, what is the relationship between risk assessment and risk treatment?

  1. They are independent processes that never exchange information
  2. Risk assessment informs treatment decisions, and treatment then modifies risk Correct answer.
  3. Risk treatment is performed first so that assessment can measure residual risk
  4. Risk assessment replaces treatment when risk is low

Explanation

Risk assessment produces the evaluated risk levels that drive treatment decisions, and treatment then alters likelihood or consequence. The two are sequential and iterative parts of the same management cycle.

Question 6Fundamental concepts and principles of information security risk management

What does the term 'residual risk' mean in ISO/IEC 27005?

  1. The risk that is transferred to a third party by contract
  2. The risk introduced by a newly deployed technology
  3. The risk that remains after risk treatment has been applied Correct answer.
  4. The total risk before any controls are considered

Explanation

Residual risk is the risk remaining once treatment options have been implemented and their effect assessed. It must be compared against risk acceptance criteria to decide whether further treatment is needed.

Question 7Fundamental concepts and principles of information security risk management

Which of the following best describes an 'asset' in the context of ISO/IEC 27005 risk identification?

  1. Anything that has value to the organisation and therefore requires protection Correct answer.
  2. The probability that a threat event will occur
  3. Any control that reduces the likelihood of a threat
  4. A weakness that can be exploited by a threat

Explanation

An asset is anything of value to the organisation, such as information, systems, or people, and is the object that risk identification seeks to protect. Threats, vulnerabilities, and likelihood are distinct concepts that act upon assets.

Question 8Fundamental concepts and principles of information security risk management

Why does ISO/IEC 27005 emphasise an iterative approach to information security risk management?

  1. Because each iteration eliminates all previously identified risks
  2. Because risk changes as threats, vulnerabilities, assets, and context evolve over time Correct answer.
  3. Because regulations require exactly one assessment per year
  4. Because iteration removes the need for management approval

Explanation

Risk management is continuous: threats, vulnerabilities, business context, and assets change, so assessment and treatment must be repeated to stay relevant. Iteration keeps the risk picture current rather than assuming a single static result.

Question 9Fundamental concepts and principles of information security risk management

An analyst rates a threat's likelihood as high because a known exploit is publicly available, but the affected system holds only public marketing material. How should the risk level most appropriately be determined?

  1. Rate the risk as high because the system is exposed to the internet
  2. Ignore the threat because the system is internet-facing
  3. Combine the high likelihood with the low consequence to derive a moderate or low overall risk Correct answer.
  4. Rate the risk as high solely because likelihood is high

Explanation

Risk level reflects both likelihood and consequence; a high likelihood paired with minimal impact on confidentiality, integrity, or availability should produce a lower combined rating. Using likelihood alone overstates the risk.

Question 10Fundamental concepts and principles of information security risk management

During context establishment, an organisation sets risk criteria that classify any risk affecting safety of life as unacceptable regardless of likelihood. Which concept does this illustrate?

  1. A vulnerability scan configuration rule
  2. A quantitative annualised loss calculation
  3. A statement of applicability entry
  4. Risk criteria that incorporate non-financial consequence thresholds Correct answer.

Explanation

Risk criteria can include thresholds based on consequences such as safety, legal, or reputational harm, not only monetary impact. Declaring certain consequences unacceptable regardless of likelihood is a legitimate expression of risk criteria.

Question 11Fundamental concepts and principles of information security risk management

A risk assessor documents that a database server has an unpatched service, a known exploit exists, and the database contains customer payment data. Which element of the risk picture does the unpatched service represent?

  1. A threat
  2. A vulnerability Correct answer.
  3. A consequence
  4. An asset

Explanation

An unpatched service is a weakness that a threat could exploit, which is the definition of a vulnerability. The exploit is the threat, the database is the asset, and the potential data loss is the consequence.

Question 12Fundamental concepts and principles of information security risk management

An organisation chooses to purchase cyber insurance to cover potential losses from a data breach. Which risk treatment option does this represent?

  1. Risk modification
  2. Risk avoidance
  3. Risk sharing Correct answer.
  4. Risk retention

Explanation

Insurance transfers part of the financial consequence to another party, which ISO/IEC 27005 classifies as risk sharing (transfer). The organisation retains some residual risk but shares the financial impact.

Question 13Fundamental concepts and principles of information security risk management

Which action best exemplifies risk avoidance as defined in ISO/IEC 27005?

  1. Applying encryption to protect data at rest
  2. Transferring financial exposure to an insurer
  3. Deciding not to launch a service that would create unacceptable risk Correct answer.
  4. Accepting a low residual risk after controls are applied

Explanation

Avoidance removes the activity or condition that gives rise to the risk, for example by not launching the risky service. Encryption modifies risk, acceptance retains it, and insurance shares it.

Question 14Fundamental concepts and principles of information security risk management

After implementing controls, an organisation finds residual risk still exceeds its acceptance criteria. What is the most appropriate next step under ISO/IEC 27005?

  1. Declare the acceptance criteria invalid
  2. Accept the residual risk without further action
  3. Delete the risk from the register
  4. Apply additional or alternative treatment and reassess Correct answer.

Explanation

If residual risk remains above the acceptance threshold, further treatment is required, followed by reassessment of the residual level. Accepting it would breach the organisation's own criteria, and deleting or invalidating records does not manage the risk.

Question 15Fundamental concepts and principles of information security risk management

Which factor is most relevant when establishing the scope of an information security risk assessment?

  1. The number of employees in the marketing department
  2. The preferred programming language of the development team
  3. The organisational and technical boundaries of the systems, processes, and information to be assessed Correct answer.
  4. The brand of firewall deployed at the perimeter

Explanation

Scope establishment defines which systems, processes, information, and organisational boundaries the assessment covers. Peripheral details such as department headcount, vendor brand, or language preference do not define assessment scope.

Question 16Fundamental concepts and principles of information security risk management

An organisation classifies a risk as 'high' using a qualitative scale of low, medium, high, and critical. Which characteristic distinguishes qualitative from quantitative risk analysis?

  1. Quantitative analysis ignores likelihood entirely
  2. Qualitative analysis is always more accurate than quantitative analysis
  3. Qualitative analysis requires actuarial data for every asset
  4. Qualitative analysis uses descriptive scales, while quantitative analysis uses numeric values such as monetary loss Correct answer.

Explanation

Qualitative analysis expresses risk using descriptive categories, whereas quantitative analysis assigns numeric values, often monetary, to likelihood and consequence. Neither approach is inherently more accurate; each suits different data availability and decision needs.

Question 17Fundamental concepts and principles of information security risk management

When identifying risks, why does ISO/IEC 27005 recommend considering threats, vulnerabilities, and assets together rather than in isolation?

  1. Because threats are always internal to the organisation
  2. Because assets are irrelevant once threats are known
  3. Because risk arises from a threat exploiting a vulnerability of an asset, so all three must be linked Correct answer.
  4. Because vulnerabilities only matter when no assets exist

Explanation

Risk identification links a threat source to a vulnerability on a specific asset to describe a realistic scenario and its potential consequence. Considering the elements separately misses the interaction that actually produces risk.

Question 18Fundamental concepts and principles of information security risk management

Which statement correctly describes the role of the statement of applicability in relation to risk treatment?

  1. It records which controls from the chosen control set are applied and justifies inclusions and exclusions Correct answer.
  2. It defines the organisation's risk acceptance criteria
  3. It replaces the risk assessment by listing all possible threats
  4. It measures the likelihood of each identified threat

Explanation

The statement of applicability documents the controls selected during treatment, including justification for any exclusions, providing traceability from risk to control. It does not perform assessment functions such as measuring likelihood or setting criteria.

Question 19Fundamental concepts and principles of information security risk management

A risk owner is assigned for each identified risk. What is the primary responsibility of a risk owner in ISO/IEC 27005?

  1. To perform all technical vulnerability scans personally
  2. To conduct external audits of suppliers
  3. To write the organisation's information security policy alone
  4. To be accountable for managing the risk, including approving and monitoring treatment Correct answer.

Explanation

A risk owner is accountable for a specific risk and for ensuring appropriate treatment is selected, approved, and monitored. Technical scanning, policy authorship, and supplier audits are separate roles that may support but do not define risk ownership.

Question 20Fundamental concepts and principles of information security risk management

An organisation uses a risk matrix with likelihood on one axis and consequence on the other. What is a key limitation of this approach that ISO/IEC 27005 practitioners should recognise?

  1. It cannot represent any risk at all
  2. It may aggregate very different risks into the same cell, obscuring important differences Correct answer.
  3. It eliminates the need for risk evaluation
  4. It requires actuarial data for every risk

Explanation

Risk matrices are useful for communication but can group dissimilar risks with very different underlying characteristics into the same rating, potentially masking significant differences. This is why the basis for ratings should be documented and interpreted with care.

Question 21Fundamental concepts and principles of information security risk management

During risk evaluation, an organisation compares analysed risk levels against its risk criteria. What is the direct output of this comparison?

  1. A prioritised set of risks that require treatment decisions Correct answer.
  2. A complete inventory of every hardware asset
  3. A list of cryptographic key lengths
  4. A schedule of penetration tests

Explanation

Risk evaluation determines which risks are acceptable and which require treatment, producing a prioritised set for decision-making. The other options are outputs of different activities such as asset inventory or technical testing.

Question 22Fundamental concepts and principles of information security risk management

An organisation's risk criteria state that any risk to regulatory compliance is unacceptable, but its risk matrix rates a compliance-related risk as 'medium' and therefore tolerable. What does this situation most likely indicate?

  1. The risk criteria and the evaluation method are inconsistent and must be reconciled Correct answer.
  2. The compliance requirement should be ignored
  3. The risk should be deleted from the register
  4. The risk matrix is functioning correctly and the risk should be accepted

Explanation

When qualitative ratings conflict with explicitly stated unacceptable criteria, the criteria and evaluation method are misaligned and need reconciliation. Accepting the risk would violate the organisation's own stated position on compliance.

Question 23Fundamental concepts and principles of information security risk management

A team treats a risk by adding a control that reduces likelihood, but the control itself introduces a new dependency on an external service provider. How should this be handled in the ISO/IEC 27005 process?

  1. Assume the external provider eliminates all residual risk
  2. Ignore the new dependency because the original risk was treated
  3. Record the dependency as an asset without further analysis
  4. Identify and assess the secondary risk introduced by the control Correct answer.

Explanation

Controls can introduce secondary or new risks that must be identified and assessed within the iterative process. Ignoring them leaves unmanaged exposure, and a provider relationship does not eliminate residual risk.

Question 24Fundamental concepts and principles of information security risk management

Which statement best explains why ISO/IEC 27005 treats risk communication and consultation as continuous activities rather than a single final step?

  1. Because stakeholders' understanding and the risk picture change throughout the process, affecting decisions at every stage Correct answer.
  2. Because consultation replaces the need for risk assessment
  3. Because communication eliminates the need to record risks
  4. Because communication is only needed to satisfy auditors at the end of the year

Explanation

Communication and consultation run throughout the process so that stakeholders share understanding and decisions are informed as risks and context evolve. Treating it as a final step would disconnect decision-makers from emerging information.

Question 25Fundamental concepts and principles of information security risk management

An organisation applies a control that reduces the impact of a risk but leaves its likelihood unchanged. Which statement correctly describes the effect on the risk level?

  1. The risk is automatically eliminated
  2. The risk becomes a threat rather than a risk
  3. The overall risk level may decrease because consequence is reduced Correct answer.
  4. The risk level is unchanged because likelihood did not change

Explanation

Risk level combines likelihood and consequence, so reducing consequence alone can lower the overall risk even when likelihood stays the same. Elimination would require removing the risk entirely, which is not what an impact-reducing control does.

Question 26Fundamental concepts and principles of information security risk management

In ISO/IEC 27005, what distinguishes an 'information security risk' from an arbitrary business problem?

  1. It is a defect in a software product discovered during quality testing
  2. It is the potential for loss or harm arising from the effect of uncertainty on information security objectives Correct answer.
  3. It is any event that reduces the profitability of a commercial organisation
  4. It is a legal obligation imposed by a regulator on a data controller

Explanation

ISO/IEC 27005 defines information security risk in terms of the effect of uncertainty on information security objectives, expressed as a combination of consequences and their likelihood. A business problem or a product defect only becomes an information security risk when it threatens confidentiality, integrity or availability objectives.

Question 27Fundamental concepts and principles of information security risk management

An organisation decides to accept a risk that its analysis shows is below the threshold defined in its risk criteria. Which concept does this decision illustrate?

  1. Risk sharing
  2. Risk acceptance Correct answer.
  3. Risk avoidance
  4. Risk transfer

Explanation

Risk acceptance is the informed decision to retain a risk, and ISO/IEC 27005 requires such decisions to be consistent with the organisation's risk criteria. Because the analysed level falls below the defined threshold, retaining it is a legitimate acceptance rather than an untreated oversight.

Question 28Fundamental concepts and principles of information security risk management

What is the primary purpose of establishing the risk management context in ISO/IEC 27005?

  1. To define the external and internal parameters and scope within which risk is managed Correct answer.
  2. To record the results of controls already implemented
  3. To calculate the annualised loss expectancy of each asset
  4. To certify the organisation against ISO/IEC 27001

Explanation

Context establishment sets the external and internal parameters, scope and risk criteria that bound the risk management process. It provides the frame against which risks are later identified, analysed and evaluated, and it precedes rather than follows control implementation.

Question 29Fundamental concepts and principles of information security risk management

A risk assessment team classifies likelihood and consequence using descriptive labels such as 'rare' and 'minor'. Which characteristic of this approach should the team document?

  1. It is only valid for information assets held electronically
  2. It depends on defined scales and interpretation rules to be consistent Correct answer.
  3. It eliminates the need for risk criteria
  4. It produces fully reproducible monetary estimates of loss

Explanation

Qualitative assessment relies on descriptive scales whose meaning must be defined and applied consistently so that different assessors reach comparable results. ISO/IEC 27005 treats qualitative analysis as valid but stresses that the scales and their interpretation rules need to be explicit.

Question 30Fundamental concepts and principles of information security risk management

An organisation maintains a risk register in which each entry records the risk description, the risk owner, the current risk level and planned treatment. Which purpose does this register primarily serve within the ISO/IEC 27005 process?

  1. It provides a structured record supporting communication, monitoring and review of risks Correct answer.
  2. It replaces the need for a risk treatment plan
  3. It constitutes the organisation's statement of applicability
  4. It serves as the formal acceptance of every listed risk

Explanation

The risk register is the structured record of identified risks and their attributes, supporting communication and consultation as well as ongoing monitoring and review. It complements, but does not replace, treatment plans or the statement of applicability.

Question 31Fundamental concepts and principles of information security risk management

Why does ISO/IEC 27005 distinguish between risk analysis and risk evaluation as separate activities?

  1. Analysis determines the level of risk, while evaluation compares that level against risk criteria to decide what must be done Correct answer.
  2. Analysis applies only to physical assets, while evaluation applies only to information
  3. Analysis is optional, while evaluation is mandatory for every organisation
  4. Analysis is performed by external auditors, while evaluation is performed by internal staff

Explanation

Risk analysis produces an understanding of the level of risk, whereas risk evaluation uses that result to compare against the established risk criteria and determine priorities. Separating them clarifies that measuring a risk and judging its acceptability are distinct decisions.

Question 32Fundamental concepts and principles of information security risk management

Which statement best captures how ISO/IEC 27005 treats the relationship between risk management and the information security management system?

  1. Risk management is a core process embedded within the management system and informs its decisions Correct answer.
  2. Risk management applies only after the management system has been certified
  3. Risk management and the management system are unrelated frameworks with no shared outputs
  4. Risk management is an external audit function independent of the management system

Explanation

ISO/IEC 27005 provides guidance on managing information security risk that supports the risk-related requirements of an ISMS. Its outputs, such as risk levels and treatment decisions, feed directly into management system planning and operation.

Question 33Fundamental concepts and principles of information security risk management

An organisation sets a risk criterion stating that risks to the availability of its payment service must be treated regardless of estimated level. Which characteristic of risk criteria does this illustrate?

  1. Criteria are fixed by the risk assessment methodology vendor
  2. Criteria must always be expressed as monetary values
  3. Criteria may reflect specific organisational priorities that override generic thresholds Correct answer.
  4. Criteria cannot reference particular business services

Explanation

Risk criteria express the organisation's values, objectives and priorities, and may single out certain consequences or services for mandatory treatment. They are organisation-specific and are not restricted to monetary expressions or generic thresholds.

Question 34Fundamental concepts and principles of information security risk management

During risk identification, a team lists a threat, the vulnerable asset it could affect and the potential consequence. Which additional element does ISO/IEC 27005 treat as essential to complete the picture of the risk scenario?

  1. The existing controls that affect likelihood or consequence Correct answer.
  2. The date the asset was commissioned
  3. The purchase price of the affected asset
  4. The name of the auditor who will review the scenario

Explanation

A risk scenario links threat, vulnerability, asset and consequence, and the controls already in place modify the likelihood or consequence that should be recorded. Without noting existing controls, the assessed level would not reflect the current situation.

Question 35Fundamental concepts and principles of information security risk management

An organisation's risk criteria say that any risk above the 'medium' level requires treatment, but a business unit argues that a 'high' risk should be accepted because treatment is expensive. How should this situation be handled under ISO/IEC 27005?

  1. The risk should be removed from the register to avoid conflict
  2. The risk should be reclassified as medium so that no treatment is needed
  3. The business unit may accept the risk because cost is a legitimate sole justification
  4. Acceptance of risk above the criteria requires a formal, authorised decision consistent with the risk criteria Correct answer.

Explanation

ISO/IEC 27005 requires risk acceptance decisions to be made by authorised personnel and to be consistent with the organisation's risk criteria. Where a risk exceeds the criteria, accepting it demands an explicit, accountable decision rather than informal reclassification or removal.

Question 36Fundamental concepts and principles of information security risk management

Which statement best describes the role of monitoring and review within the ISO/IEC 27005 risk management process?

  1. It replaces risk communication when resources are constrained
  2. It is performed once at the end of the project to close the risk register
  3. It is limited to verifying that risk treatment budgets were spent
  4. It is a continuous activity that detects changes in risks, controls and context and triggers reassessment Correct answer.

Explanation

Monitoring and review is continuous: it tracks changes in assets, threats, vulnerabilities, controls and organisational context that may alter risk levels. Detected changes trigger reassessment or adjustment of treatment, keeping the risk picture current.

Question 37Fundamental concepts and principles of information security risk management

An organisation uses a semi-quantitative approach that multiplies ordinal likelihood and consequence scores to produce a risk number. Which limitation should the risk manager recognise?

  1. Multiplication of ordinal ranks can imply precision and equal intervals that the scales do not possess Correct answer.
  2. The approach cannot be applied to more than one asset at a time
  3. The resulting number is a true monetary loss estimate
  4. The approach is prohibited by ISO/IEC 27005

Explanation

Ordinal scales rank values without guaranteeing equal intervals, so multiplying them can create an appearance of precision that the underlying judgements do not support. ISO/IEC 27005 recognises semi-quantitative methods but cautions about the interpretation of their outputs.

Question 38Fundamental concepts and principles of information security risk management

A risk assessment identifies that a supplier's cloud service could become unavailable, affecting a critical business process. Which characteristic makes this a supply chain risk rather than a purely internal one?

  1. The risk cannot be recorded in a risk register
  2. The risk must automatically be transferred to the supplier
  3. The consequence is always financial rather than operational
  4. The threat and vulnerability arise from a party outside the organisation's direct control Correct answer.

Explanation

Supply chain risk arises where threats, vulnerabilities or consequences originate with external parties whose controls the organisation does not directly operate. ISO/IEC 27005 addresses such dependencies because they affect likelihood and consequence just as internal weaknesses do.

Question 39Fundamental concepts and principles of information security risk management

Which statement best explains why ISO/IEC 27005 treats risk treatment as a cyclical rather than a one-time activity?

  1. Because risk treatment must always precede risk identification
  2. Because regulations require treatment to be repeated annually by law
  3. Because treatment controls can alter the risk picture and introduce new risks that must be reassessed Correct answer.
  4. Because treatment is only valid until the next audit

Explanation

Implemented controls change likelihood and consequence and may create new vulnerabilities or dependencies, so the residual risk must be reassessed. This feedback loop is why treatment, assessment and monitoring iterate rather than terminate after a single pass.

Question 40Fundamental concepts and principles of information security risk management

An organisation wants to express information security risk consistently so that different business units can compare exposures and aggregate them at enterprise level. According to ISO/IEC 27005 concepts, which pair of factors is used to express the level of an information security risk?

  1. Cost of implemented controls and the residual budget available for security
  2. Frequency of security awareness training and the percentage of staff who completed it
  3. Number of vulnerabilities found in a scan and the count of open audit findings
  4. Likelihood of the threat event and its consequence, often expressed as potential impact on business objectives Correct answer.

Explanation

ISO/IEC 27005 expresses information security risk in terms of the likelihood of a threat event occurring and the resulting consequence, typically described as potential impact on the organisation's objectives. Combining these two factors allows risks from different assets and units to be compared and aggregated. Control cost, vulnerability counts and training metrics are inputs or management data, not the defining factors of a risk level.

Question 41ISO/IEC 27005 framework, risk management process and integration with ISO/IEC 27001

In the ISO/IEC 27005 risk management process, which activity immediately follows risk identification and precedes risk treatment?

  1. Risk analysis and risk evaluation Correct answer.
  2. Establishing the risk management context
  3. Risk monitoring and review
  4. Risk communication and consultation

Explanation

The core risk assessment sequence is risk identification, then risk analysis, then risk evaluation, after which risk treatment is selected. Analysis and evaluation sit between identification and treatment, so this is the correct step. Context establishment happens earlier and communication and monitoring are parallel activities throughout.

Question 42ISO/IEC 27005 framework, risk management process and integration with ISO/IEC 27001

Within the ISO/IEC 27005 risk assessment stage, what is the primary purpose of risk analysis?

  1. To decide which risks require treatment and which can be accepted
  2. To develop an understanding of the nature and level of the identified risk Correct answer.
  3. To record the organization's risk appetite and acceptance criteria
  4. To select and apply the most cost-effective security controls

Explanation

Risk analysis develops understanding of the nature of each risk and determines its level, typically through consequences and likelihood. Risk evaluation then compares that level against criteria to decide what to do. Control selection belongs to treatment, and appetite is set during context establishment.

Question 43ISO/IEC 27005 framework, risk management process and integration with ISO/IEC 27001

An organization defines its risk evaluation criteria so that any risk rated 'high' or above must be treated. What does ISO/IEC 27005 call this threshold that separates acceptable from unacceptable risk?

  1. The risk acceptance criteria Correct answer.
  2. The risk treatment plan
  3. The statement of applicability
  4. The risk register

Explanation

Risk evaluation compares analysed risk levels against risk acceptance criteria to determine whether a risk is tolerable. Risks exceeding the criteria are judged unacceptable and require treatment. A treatment plan, statement of applicability and risk register are outputs or documents, not the criteria themselves.

Question 44ISO/IEC 27005 framework, risk management process and integration with ISO/IEC 27001

Which risk treatment option in ISO/IEC 27005 involves deliberately choosing to retain a risk after it has been evaluated?

  1. Risk modification
  2. Risk avoidance
  3. Risk sharing
  4. Risk retention Correct answer.

Explanation

Risk retention means accepting and retaining a risk, often when its level falls within acceptance criteria or treatment is not cost-effective. Avoidance removes the activity, sharing transfers part of it, and modification reduces it through controls. Retention is the option where the risk is knowingly kept.

Question 45ISO/IEC 27005 framework, risk management process and integration with ISO/IEC 27001

How does ISO/IEC 27005 relate to the risk requirements of ISO/IEC 27001?

  1. It replaces the risk clauses of ISO/IEC 27001 for certified organizations
  2. It is a certification standard that auditors use instead of ISO/IEC 27001
  3. It provides detailed guidance for implementing the risk management activities required by the information security management system Correct answer.
  4. It defines only the control catalogue used to treat risks

Explanation

ISO/IEC 27005 gives guidance on managing information security risk and supports the risk-related requirements of an ISO/IEC 27001 management system. It does not replace those requirements, nor is it a certification standard. The control catalogue is ISO/IEC 27002, not ISO/IEC 27005.

Question 46ISO/IEC 27005 framework, risk management process and integration with ISO/IEC 27001

In ISO/IEC 27005 terminology, what distinguishes a 'risk source' from an 'event'?

  1. A risk source is the measured level of risk, while an event is its consequence
  2. A risk source is a control, while an event is a vulnerability
  3. A risk source is an element that alone or in combination can give rise to a risk, while an event is an occurrence of a particular set of circumstances Correct answer.
  4. A risk source is always a person, while an event is always a technical failure

Explanation

A risk source is any element that, alone or combined with others, can give rise to a risk, such as an external party or an environment. An event is an occurrence of a particular set of circumstances. The other options misassign the definitions to unrelated concepts.

Question 47ISO/IEC 27005 framework, risk management process and integration with ISO/IEC 27001

When integrating risk management into an ISO/IEC 27001 ISMS, which document typically records identified risks, their owners, assessed levels and treatment status?

  1. The management review minutes
  2. The risk treatment plan only
  3. The risk register Correct answer.
  4. The business continuity plan

Explanation

The risk register is the record that captures identified risks together with attributes such as owner, assessed level, and treatment status. It provides the traceable basis for evaluation and monitoring. The other documents may reference risk but are not the primary consolidated record.

Question 48ISO/IEC 27005 framework, risk management process and integration with ISO/IEC 27001

Which activity establishes the basic criteria, scope and boundaries against which information security risks will be assessed and evaluated?

  1. Context establishment Correct answer.
  2. Risk treatment
  3. Risk monitoring
  4. Risk analysis

Explanation

Context establishment defines the scope, boundaries, and the basic criteria including risk evaluation and acceptance criteria. These criteria are then used during analysis and evaluation. Analysis measures risk, treatment acts on it, and monitoring tracks it over time.

Question 49ISO/IEC 27005 framework, risk management process and integration with ISO/IEC 27001

A team rates a risk's likelihood as 'likely' and its consequence as 'major', then uses a matrix to derive an overall rating of 'high'. Which part of the risk assessment process have they performed?

  1. Risk analysis Correct answer.
  2. Risk communication
  3. Risk evaluation
  4. Risk identification

Explanation

Combining likelihood and consequence to derive a risk level is risk analysis, which develops understanding of the level of each risk. Evaluation would compare that 'high' rating against acceptance criteria to decide acceptability. Identification only determines that the risk exists, and communication is a parallel activity.

Question 50ISO/IEC 27005 framework, risk management process and integration with ISO/IEC 27001

An organization decides to purchase cyber insurance to cover part of a potential financial loss from a data breach. Which ISO/IEC 27005 risk treatment option does this represent?

  1. Risk modification
  2. Risk retention
  3. Risk sharing Correct answer.
  4. Risk avoidance

Explanation

Risk sharing involves transferring or distributing part of a risk to another party, and insurance is a classic example because the insurer bears part of the financial consequence. Retention keeps the risk internally, avoidance removes the activity, and modification reduces the risk through controls.