PECB ISO-IEC-27005-Risk-Manager Exam - Topic 1 Question 16 Discussion

Actual exam question for PECB's ISO-IEC-27005-Risk-Manager exam

Question #: 16
Topic #: 1

[All ISO-IEC-27005-Risk-Manager Questions]

Which statement regarding information gathering techniques is correct?

ASending questionnaires to a group of people who represent the interested parties is NOT preferred

BOrganizations can utilize technical tools to identify technical vulnerabilities and compile a list of assets that influence risk assessment

CInterviews should be conducted only with individuals responsible for information security management

Show Suggested Answer

Suggested Answer: C

ISO/IEC 27005 advises that even after risks have been treated, any residual risks should be continuously monitored and reviewed. This is necessary to ensure that they remain within acceptable levels and that any changes in the internal or external environment do not escalate the risk beyond acceptable thresholds. Monitoring also ensures that the effectiveness of the controls remains adequate over time. Option A is incorrect because all risks, including those meeting the risk acceptance criteria, should be monitored. Option B is incorrect because monitoring is necessary regardless of the perceived severity if it occurs, to detect changes early.

by Joanna at Jan 23, 2025, 02:09 PM

Limited Time Offer

25%

Off

Get Premium ISO-IEC-27005-Risk-Manager Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Basilia

4 months ago

B is spot on, tech tools are a game changer for identifying vulnerabilities.

upvoted 0 times

...

Larae

4 months ago

Wait, are we really saying questionnaires aren't preferred? That seems off.

upvoted 0 times

...

Leeann

4 months ago

C seems too limiting, interviews should include more perspectives.

upvoted 0 times

...

Mable

5 months ago

I disagree with A, questionnaires can be really useful!

upvoted 0 times

...

Dalene

5 months ago

B is definitely correct, tools are essential for risk assessment.

upvoted 0 times

...

William

5 months ago

I vaguely recall that sending questionnaires is often preferred for gathering diverse opinions, which makes me question option A.

upvoted 0 times

...

Madalyn

5 months ago

I'm not sure about option C. I thought interviews could be useful with a broader range of people, not just those in security management.

upvoted 0 times

...

Tamra

5 months ago

I'm leaning towards option B since we practiced a similar question about using tools for risk assessment. It seems like a solid approach.

upvoted 0 times

...

Lashawna

6 months ago

I think option A might be correct because I remember reading that questionnaires can sometimes miss important insights from stakeholders.

upvoted 0 times

...

Simona

6 months ago

Option B sounds like the most comprehensive and accurate statement. I'll go with that one.

upvoted 0 times

...

Karima

6 months ago

I'm not entirely sure about the best approach here. I'll need to review my notes on information gathering techniques to make an informed decision.

upvoted 0 times

...

Cheryl

6 months ago

Option A seems incorrect, as questionnaires can be a useful information gathering technique. I'm leaning towards B or C.

upvoted 0 times

...

Tamie

6 months ago

Hmm, I'm a bit unsure about this one. I'll need to think it through carefully before selecting an answer.

upvoted 0 times

...

Tashia

6 months ago

This question seems straightforward. I'm pretty confident that option B is the correct answer.

upvoted 0 times

...

Mari

10 months ago

Option B all the way! Gotta use all the tools in the toolbox to get a complete picture. Who needs those old-fashioned questionnaires anyway?

upvoted 0 times

Delila

9 months ago

Yeah, a combination of techniques is probably the best approach to get a comprehensive understanding.

upvoted 0 times

...

Terry

9 months ago

I think it's important to gather information from a variety of sources, not just one method.

upvoted 0 times

...

Billye

9 months ago

Questionnaires can be helpful too, but I see your point about using all available tools.

upvoted 0 times

...

Rory

10 months ago

I agree, using technical tools can really help identify vulnerabilities.

upvoted 0 times

...

Herman

11 months ago

Personally, I think option B covers the bases. Leveraging technology to gather intel is a smart way to go about it.

upvoted 0 times

...

Carlton

11 months ago

Ha! Option C is a bit too narrow-minded. You need input from a variety of personnel, not just the security managers.

upvoted 0 times

...

Theola

11 months ago

I disagree with option A. Gathering feedback from a range of stakeholders is crucial for understanding the full scope of information security concerns.

upvoted 0 times

Selma

9 months ago

I believe option B is more effective. Using technical tools can help identify vulnerabilities and assess risks accurately.

upvoted 0 times

...

Marleen

9 months ago

I agree with you. It's important to gather feedback from a diverse group of people to fully understand the information security landscape.

upvoted 0 times

...

Nell

10 months ago

I think option A is not the best approach. We need input from various stakeholders to get a comprehensive view of information security.

upvoted 0 times

...

Nichelle

11 months ago

Option B sounds like the right approach to me. Using technical tools to identify vulnerabilities and assess assets is key for a thorough risk assessment.

upvoted 0 times