ISO 27000 Foundation Certification Information Security Risk Management 2

Question 1

Which ISO/IEC 27005 process step involves determining the consequences of a risk materializing?

Accepted Answer

Risk estimation

Answer

Risk estimation involves determining the likelihood and consequences (impact) of a risk to produce a level of risk.

Question 2

An organization decides to purchase cyber-insurance to address a specific information security risk. Which risk treatment option does this represent?

Accepted Answer

Risk sharing

Answer

Risk sharing (also called risk transfer) involves distributing the financial burden of a risk to a third party such as an insurer.

Question 3

In the context of ISO 27001, what is the PRIMARY purpose of a Statement of Applicability (SoA)?

Accepted Answer

To document which Annex A controls are applicable and their justification

Answer

The SoA documents which of the ISO 27001 Annex A controls have been selected or excluded and the reasons why.

Question 4

What distinguishes a 'vulnerability' from a 'threat' in information security risk terminology?

Accepted Answer

A threat is a potential cause of harm; a vulnerability is a weakness that can be exploited by a threat

Answer

ISO 27000 defines a threat as a potential cause of an unwanted incident, while a vulnerability is a weakness that may be exploited by one or more threats.

Question 5

Which term describes the risk that remains after risk treatment controls have been applied?

Accepted Answer

Residual risk

Answer

Residual risk is the level of risk remaining after controls and other risk treatment measures have been implemented.

ISO 27000 Foundation Certification Practice Test

ISO 27000 Foundation Certification Practice Test

ISO 27000 Foundation Certification Information Security Risk Management 2