ISO 27000 Foundation Certification Risk Assessment and Treatment 5

Question 1

When selecting risk treatment options, which ISO/IEC 27001 principle requires that control costs should be proportionate to the risks they address?

Accepted Answer

Cost-benefit analysis

Answer

ISO/IEC 27001 encourages cost-benefit analysis to ensure that the cost of implementing a control does not exceed the value of the risk being mitigated.

Question 2

An organization uses a heat map with color-coded cells to communicate risk severity to senior management. What type of tool is this?

Accepted Answer

Risk matrix

Answer

A risk matrix (or heat map) plots likelihood against impact using a color-coded grid to visually communicate risk severity levels.

Question 3

Which of the following scenarios BEST illustrates the risk treatment option of risk modification?

Accepted Answer

Installing a firewall to reduce the likelihood of unauthorized network access

Answer

Installing a firewall modifies (reduces) the risk by lowering the likelihood of a threat exploiting a vulnerability.

Question 4

What is the PRIMARY input to the risk treatment process in an ISMS?

Accepted Answer

The results of the risk assessment

Answer

The risk assessment output, including prioritized risks and their levels, is the primary input used to determine appropriate treatment options.

Question 5

In ISO/IEC 27001, which party must formally approve the risk treatment plan and accept residual risks?

Accepted Answer

Risk owners

Answer

Risk owners are responsible for approving the treatment plan for risks within their scope and formally accepting any residual risk.

ISO 27000 Foundation Certification Practice Test

ISO 27000 Foundation Certification Practice Test

ISO 27000 Foundation Certification Risk Assessment and Treatment 5