ISO 27000 Foundation Certification Risk Assessment and Treatment 4

Question 1

What is the role of the Statement of Applicability (SoA) in relation to risk treatment?

Accepted Answer

It documents which Annex A controls are applicable and justifies inclusions or exclusions

Answer

The SoA maps the selected controls to identified risks and justifies why each Annex A control is included or excluded.

Question 2

An organization implements multi-factor authentication to reduce the risk of unauthorized access. This is an example of which type of control?

Accepted Answer

Preventive control

Answer

Multi-factor authentication prevents unauthorized access from occurring, making it a preventive control.

Question 3

Which of the following BEST describes risk evaluation in the ISO 27005 process?

Accepted Answer

Comparing estimated risk levels against risk criteria to prioritize treatment

Answer

Risk evaluation involves comparing risk estimates against acceptance criteria to determine which risks require treatment and in what order.

Question 4

A company keeps a small amount of sensitive data on an unencrypted laptop and decides the cost of a breach is acceptable given the low probability. This decision represents:

Accepted Answer

Risk retention

Answer

Knowingly accepting a risk without applying additional controls, because the expected impact is acceptable, is risk retention.

Question 5

Which of the following is TRUE about the relationship between assets, threats, and vulnerabilities in risk assessment?

Accepted Answer

Risk arises when a threat exploits a vulnerability affecting an asset

Answer

Risk materializes when a threat agent exploits a vulnerability to cause harm to an asset, combining all three elements.

ISO 27000 Foundation Certification Practice Test

ISO 27000 Foundation Certification Practice Test

ISO 27000 Foundation Certification Risk Assessment and Treatment 4