ISO 27000 Foundation Certification Information Security Risk Management 3

Question 1

In a qualitative risk assessment, risks are most commonly expressed using which scale?

Accepted Answer

Descriptive categories such as Low, Medium, and High

Answer

Qualitative risk assessments use descriptive scales (e.g., Low/Medium/High) rather than precise numerical values.

Question 2

Which of the following best describes the concept of 'risk appetite' in ISO 27000?

Accepted Answer

The amount and type of risk an organization is willing to pursue or retain

Answer

Risk appetite is the amount and type of risk that an organization is willing to accept in pursuit of its objectives.

Question 3

Which asset type is BEST described as 'the reputation and image of the organization'?

Accepted Answer

Intangible asset

Answer

Reputation and image are intangible assets — they have significant value but no physical form.

Question 4

According to ISO 27005, which input is REQUIRED before conducting a risk assessment?

Accepted Answer

Established risk evaluation criteria

Answer

Risk evaluation criteria must be established beforehand so that assessed risk levels can be compared and prioritized consistently.

Question 5

What is the main goal of the risk communication and consultation process in ISO 27005?

Accepted Answer

To ensure stakeholders are informed and their input is considered throughout risk management

Answer

Risk communication and consultation ensures that stakeholders share information and contribute to risk decisions throughout the process.

ISO 27000 Foundation Certification Practice Test