ISO 27000 Foundation Certification Information Security Risk Management 5

Question 1

Which of the following BEST describes 'information security risk treatment' according to ISO 27005?

Accepted Answer

Selecting and implementing measures to modify risk

Answer

Risk treatment is the process of selecting and implementing options to address risk, which may include modifying, avoiding, sharing, or retaining it.

Question 2

A risk owner is BEST described as which of the following?

Accepted Answer

The individual accountable for managing a specific risk

Answer

A risk owner is the person or entity with the accountability and authority to manage a particular risk.

Question 3

Which ISO/IEC standard provides guidelines specifically on information security risk management and supports ISO 27001 implementation?

Accepted Answer

ISO/IEC 27005

Answer

ISO/IEC 27005 provides guidelines on information security risk management and is aligned with the concepts of ISO/IEC 27001.

Question 4

When an organization identifies a risk but determines that the cost of treatment exceeds the potential loss, it may decide to:

Accepted Answer

Retain the risk and monitor it

Answer

Risk retention is appropriate when treatment costs exceed the potential impact, and the organization consciously accepts the risk.

Question 5

Which of the following is a key characteristic of a good information security risk assessment process?

Accepted Answer

It produces results that are repeatable and comparable over time

Answer

A good risk assessment process should be repeatable and produce consistent, comparable results that can be tracked over time.

ISO 27000 Foundation Certification Practice Test