ISO 27000 Foundation Certification Risk Assessment and Treatment 2

Question 1

Which term describes the combination of the likelihood of a threat exploiting a vulnerability and the resulting impact on the organization?

Accepted Answer

Risk

Answer

Risk is defined as the combination of the probability of a threat event occurring and the magnitude of its impact.

Question 2

In ISO 27005, which step directly follows risk identification in the risk assessment process?

Accepted Answer

Risk estimation

Answer

Risk estimation follows risk identification and involves assigning values to the likelihood and impact of identified risks.

Question 3

An organization decides to purchase cyber insurance to handle a particular information security risk. Which risk treatment option does this represent?

Accepted Answer

Risk sharing

Answer

Transferring risk via insurance is an example of risk sharing, where the financial consequence is distributed to another party.

Question 4

What is the PRIMARY purpose of establishing a risk acceptance criteria in an ISMS?

Accepted Answer

To define the level of risk the organization is willing to tolerate

Answer

Risk acceptance criteria set the threshold above which risks require treatment and below which residual risks may be accepted.

Question 5

Which of the following BEST describes a qualitative risk assessment approach?

Accepted Answer

Uses descriptive scales such as high, medium, and low to rate likelihood and impact

Answer

Qualitative risk assessment uses subjective descriptive scales rather than precise numerical calculations.

ISO 27000 Foundation Certification Practice Test

ISO 27000 Foundation Certification Practice Test

ISO 27000 Foundation Certification Risk Assessment and Treatment 2