Free Preparation Discussions
MENU
PECB Certified ISO/IEC 27005 Risk Manager Exam Questions
- Topic 1: Fundamental Principles and Concepts of Information Security Risk Management: This domain covers the essential ideas and core elements behind managing risks in information security, with a focus on identifying and mitigating potential threats to protect valuable data and IT resources.
- Topic 2: Implementation of an Information Security Risk Management Program: This domain discusses the steps for setting up and operationalizing a risk management program, including procedures to recognize, evaluate, and reduce security risks within an organization’s framework.
- Topic 3: Information Security Risk Management Framework and Processes Based on ISO/IEC 27005: Centered around ISO/IEC 27005, this domain provides structured guidelines for managing information security risks, promoting a systematic and standardized approach aligned with international practices.
- Topic 4: Other Information Security Risk Assessment Methods: Beyond ISO/IEC 27005, this domain reviews alternative methods for assessing and managing risks, allowing organizations to select tools and frameworks that align best with their specific requirements and risk profile.
Free PECB PECB Certified ISO/IEC 27005 Risk Manager Exam Actual Questions
Note: Premium Questions for PECB Certified ISO/IEC 27005 Risk Manager were last updated On Oct. 24, 2024 (see below)
Scenario 4: In 2017, seeing that millions of people turned to online shopping, Ed and James Cordon founded the online marketplace for footwear called Poshoe. In the past, purchasing pre-owned designer shoes online was not a pleasant experience because of unattractive pictures and an inability to ascertain the products' authenticity. However, after Poshoe's establishment, each product was well advertised and certified as authentic before being offered to clients. This increased the customers' confidence and trust in Poshoe's products and services. Poshoe has approximately four million users and its mission is to dominate the second-hand sneaker market and become a multi-billion dollar company.
Due to the significant increase of daily online buyers, Poshoe's top management decided to adopt a big data analytics tool that could help the company effectively handle, store, and analyze dat
a. Before initiating the implementation process, they decided to conduct a risk assessment. Initially, the company identified its assets, threats, and vulnerabilities associated with its information systems. In terms of assets, the company identified the information that was vital to the achievement of the organization's mission and objectives. During this phase, the company also detected a rootkit in their software, through which an attacker could remotely access Poshoe's systems and acquire sensitive data.
The company discovered that the rootkit had been installed by an attacker who had gained administrator access. As a result, the attacker was able to obtain the customers' personal data after they purchased a product from Poshoe. Luckily, the company was able to execute some scans from the target device and gain greater visibility into their software's settings in order to identify the vulnerability of the system.
The company initially used the qualitative risk analysis technique to assess the consequences and the likelihood and to determine the level of risk. The company defined the likelihood of risk as ''a few times in two years with the probability of 1 to 3 times per year.'' Later, it was decided that they would use a quantitative risk analysis methodology since it would provide additional information on this major risk. Lastly, the top management decided to treat the risk immediately as it could expose the company to other issues. In addition, it was communicated to their employees that they should update, secure, and back up Poshoe's software in order to protect customers' personal information and prevent unauthorized access from attackers.
According to scenario 4, which type of assets was identified during the risk identification process?
During the risk identification process, Poshoe identified the information that was vital to the achievement of the organization's mission and objectives. Such information is considered a primary asset because it directly supports the organization's core business objectives. Primary assets are those that are essential to the organization's functioning and achieving its strategic goals. Option A (Tangible assets) refers to physical assets like hardware or facilities, which is not relevant here. Option C (Supporting assets) refers to assets that support primary assets, like IT infrastructure or software, which also does not fit the context.
According to CRAMM methodology, how is risk assessment initiated?
According to the CRAMM (CCTA Risk Analysis and Management Method) methodology, risk assessment begins by collecting detailed information on the system and identifying all assets that fall within the defined scope. This foundational step ensures that the assessment is comprehensive and includes all relevant assets, which could be potential targets for risk. This makes option A the correct answer.
Which activity below is NOT included in the information security risk assessment process?
The information security risk assessment process, as outlined in ISO/IEC 27005, typically includes identifying risks, assessing their potential impact, and prioritizing them. However, selecting risk treatment options is not part of the risk assessment process itself; it is part of the subsequent risk treatment phase. Therefore, option C is the correct answer as it is not included in the risk assessment process.
Based on NIST Risk Management Framework, what is the last step of a risk management process?
Based on the NIST Risk Management Framework (RMF), the last step of the risk management process is 'Monitoring Security Controls.' This step involves continuously tracking the effectiveness of the implemented security controls, ensuring they remain effective against identified risks, and adapting them to any changes in the threat landscape. Option A correctly identifies the final step.
After creating a plan for outsourcing to a cloud service provider to store their confidential information in cloud, OrgX decided to not pursue this business strategy since the risk of doing so was high. Which risk treatment option did OrgX use?
OrgX decided not to pursue a business strategy involving outsourcing to a cloud service provider due to the high risk. This decision reflects a 'risk avoidance' strategy, where the organization chooses not to engage in an activity that poses unacceptable risks. This aligns with option A.
- Select Question Types you want
- Set your Desired Pass Percentage
- Allocate Time (Hours : Minutes)
- Create Multiple Practice tests with Limited Questions
- Customer Support
Amalia
8 days agoKaitlyn
20 days agoFloyd
23 days agoLisbeth
1 months agoAnnmarie
1 months agoKattie
2 months agoCorinne
2 months agoMelynda
2 months ago