ISO 27000 Foundation Certification Risk Assessment and Treatment 3

Question 1

Which ISO/IEC standard provides detailed guidance specifically on information security risk management to support ISO/IEC 27001?

Accepted Answer

ISO/IEC 27005

Answer

ISO/IEC 27005 is the dedicated standard providing guidelines for information security risk management aligned with ISO/IEC 27001.

Question 2

An organization stops offering an online service because the associated information security risks are too high to manage cost-effectively. Which treatment option is being used?

Accepted Answer

Risk avoidance

Answer

Discontinuing an activity to eliminate the associated risk is the definition of risk avoidance.

Question 3

What does 'residual risk' mean in the context of ISO 27001?

Accepted Answer

Risk remaining after risk treatment measures have been applied

Answer

Residual risk is the level of risk that remains after the organization has implemented its chosen risk treatment controls.

Question 4

In a risk matrix, if a threat has HIGH likelihood but LOW impact, the overall risk level is typically classified as:

Accepted Answer

Medium

Answer

A high-likelihood, low-impact risk generally results in a medium overall risk rating when combined in a standard risk matrix.

Question 5

Which of the following is an example of a vulnerability rather than a threat?

Accepted Answer

Unpatched operating system software

Answer

An unpatched operating system is a weakness (vulnerability) that could be exploited by a threat such as malware.

ISO 27000 Foundation Certification Practice Test

ISO 27000 Foundation Certification Practice Test

ISO 27000 Foundation Certification Risk Assessment and Treatment 3