ISO 27000 Foundation Certification Information Security Risk Management 4

Question 1

In ISO 27000 terminology, which term refers to the combination of the probability of an event and its consequence?

Accepted Answer

Risk

Answer

Risk is defined as the effect of uncertainty on objectives, typically expressed as the combination of likelihood and impact.

Question 2

An organization scores each risk by multiplying a likelihood score (1–5) by an impact score (1–5). This approach is an example of which assessment method?

Accepted Answer

Semi-quantitative assessment

Answer

Semi-quantitative assessment uses numerical scales (like 1–5) that are ordinal rather than true monetary values, combining elements of both qualitative and quantitative approaches.

Question 3

Which process ensures that the ISMS risk treatment remains effective as the organization's environment changes over time?

Accepted Answer

Risk monitoring and review

Answer

Risk monitoring and review is an ongoing process that verifies whether risk treatment measures remain effective and whether new risks have emerged.

Question 4

Under ISO 27001, which document formally records top management's decision to accept residual risks?

Accepted Answer

Signed risk acceptance records

Answer

Formal records of risk acceptance decisions must be maintained and are typically documented as signed acceptance statements by authorized risk owners.

Question 5

The Annual Loss Expectancy (ALE) calculation is associated with which type of risk assessment methodology?

Accepted Answer

Quantitative

Answer

ALE (Single Loss Expectancy × Annual Rate of Occurrence) is a quantitative method that expresses risk in monetary terms.

ISO 27000 Foundation Certification Practice Test

ISO 27000 Foundation Certification Practice Test

ISO 27000 Foundation Certification Information Security Risk Management 4