Deal of The Day! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions

PECB Exam ISO-IEC-27005-Risk-Manager Topic 1 Question 18 Discussion

Actual exam question for PECB's ISO-IEC-27005-Risk-Manager exam
Question #: 18
Topic #: 1
[All ISO-IEC-27005-Risk-Manager Questions]

Scenario 1

The risk assessment process was led by Henry, Bontton's risk manager. The first step that Henry took was identifying the company's assets. Afterward, Henry created various potential incident scenarios. One of the main concerns regarding the use of the application was the possibility of being targeted by cyber attackers, as a great number of organizations were experiencing cyberattacks during that time. After analyzing the identified risks, Henry evaluated them and concluded that new controls must be implemented if the company wants to use the application. Among others, he stated that training should be provided to personnel regarding the use of the application and that awareness sessions should be conducted regarding the importance of protecting customers' personal data.

Lastly, Henry communicated the risk assessment results to the top management. They decided that the application will be used only after treating the identified risks.

Based on scenario 1, Bontton used ISO/IEC 27005 to ensure effective implementation of all ISO/IEC 27001 requirements. Is this appropriate?

Show Suggested Answer Hide Answer
Suggested Answer: B

A rootkit installed in software due to an attacker gaining administrator access is considered a threat resulting from human actions. In this scenario, the attacker deliberately exploited a vulnerability to install the rootkit and gain unauthorized access to sensitive data. ISO/IEC 27005 categorizes threats into three main types: technical failures, human actions, and environmental events. Since this threat is a result of intentional malicious activity by an individual (human), it falls under the category of human actions. Option A (Technical failures) would refer to failures in hardware or software that are not caused by deliberate actions, while Option C (Organizational threats) would relate to internal organizational issues, neither of which apply to this case.


Contribute your Thoughts:

Vincent
6 days ago
I think using ISO/IEC 27005 is appropriate because it provides direct guidance on implementing ISO/IEC 27001 requirements.
upvoted 0 times
...

Save Cancel