CREST Compliance, Risk & Governance

Question 1

What is the primary purpose of an Information Security Management System (ISMS) as defined by ISO/IEC 27001?

Accepted Answer

To establish, implement, maintain, and continually improve information security controls

Answer

ISO/IEC 27001 defines an ISMS as a systematic approach to managing sensitive information to keep it secure, covering people, processes, and IT systems.

Question 2

What does a risk assessment in information security aim to identify?

Accepted Answer

Threats, vulnerabilities, likelihood, and potential impact to organizational assets

Answer

A risk assessment identifies what can go wrong, how likely it is, and what the impact would be, enabling informed decisions about risk treatment.

Question 3

Which of the following is a risk treatment option in information security risk management?

Accepted Answer

Risk transfer (e.g., cyber insurance)

Answer

Risk transfer shifts the financial consequences of a risk to a third party such as an insurer, and is one of four main risk treatment options alongside accept, avoid, and reduce.

Question 4

What does the NIST Cybersecurity Framework (CSF) organize its functions around?

Accepted Answer

Identify, Protect, Detect, Respond, Recover

Answer

The NIST CSF organizes cybersecurity activities into five core functions: Identify, Protect, Detect, Respond, and Recover.

Question 5

What is the difference between a vulnerability and a risk in information security?

Accepted Answer

A vulnerability is a weakness; a risk is the potential for harm when a threat exploits that weakness

Answer

A vulnerability is a specific weakness in a system, while risk combines the threat exploiting that vulnerability with the likelihood and potential impact.

(CREST) Council for Registered Ethical Security Testers Practice Test

(CREST) Council for Registered Ethical Security Testers Practice Test

CREST Compliance, Risk & Governance