Free Preparation Discussions
MENU
PECB ISO-IEC-27005-Risk-Manager Exam Questions
- Topic 1: Fundamental Principles and Concepts of Information Security Risk Management: This domain covers the essential ideas and core elements behind managing risks in information security, with a focus on identifying and mitigating potential threats to protect valuable data and IT resources.
- Topic 2: Implementation of an Information Security Risk Management Program: This domain discusses the steps for setting up and operationalizing a risk management program, including procedures to recognize, evaluate, and reduce security risks within an organization’s framework.
- Topic 3: Information Security Risk Management Framework and Processes Based on ISO/IEC 27005: Centered around ISO/IEC 27005, this domain provides structured guidelines for managing information security risks, promoting a systematic and standardized approach aligned with international practices.
- Topic 4: Other Information Security Risk Assessment Methods: Beyond ISO/IEC 27005, this domain reviews alternative methods for assessing and managing risks, allowing organizations to select tools and frameworks that align best with their specific requirements and risk profile.
Free PECB ISO-IEC-27005-Risk-Manager Exam Actual Questions
Note: Premium Questions for ISO-IEC-27005-Risk-Manager were last updated On Apr. 11, 2025 (see below)
According to CRAMM methodology, how is risk assessment initiated?
According to the CRAMM (CCTA Risk Analysis and Management Method) methodology, risk assessment begins by collecting detailed information on the system and identifying all assets that fall within the defined scope. This foundational step ensures that the assessment is comprehensive and includes all relevant assets, which could be potential targets for risk. This makes option A the correct answer.
Scenario 8: Biotide is a pharmaceutical company that produces medication for treating different kinds of diseases. The company was founded in 1997, and since then it has contributed in solving some of the most challenging healthcare issues.
As a pharmaceutical company, Biotide operates in an environment associated with complex risks. As such, the company focuses on risk management strategies that ensure the effective management of risks to develop high-quality medication. With the large amount of sensitive information generated from the company, managing information security risks is certainly an important part of the overall risk management process. Biotide utilizes a publicly available methodology for conducting risk assessment related to information assets. This methodology helps Biotide to perform risk assessment by taking into account its objectives and mission. Following this method, the risk management process is organized into four activity areas, each of them involving a set of activities, as provided below.
1. Activity area 1: The organization determines the criteria against which the effects of a risk occurring can be evaluated. In addition, the impacts of risks are also defined.
2. Activity area 2: The purpose of the second activity area is to create information asset profiles. The organization identifies critical information assets, their owners, as well as the security requirements for those assets. After determining the security requirements, the organization prioritizes them. In addition, the organization identifies the systems that store, transmit, or process information.
3. Activity area 3: The organization identifies the areas of concern which initiates the risk identification process. In addition, the organization analyzes and determines the probability of the occurrence of possible threat scenarios.
4. Activity area 4: The organization identifies and evaluates the risks. In addition, the criteria specified in activity area 1 is reviewed and the consequences of the areas of concerns are evaluated. Lastly, the level of identified risks is determined.
The table below provides an example of how Biotide assesses the risks related to its information assets following this methodology:
According to the risk assessment methodology used by Biotide, what else should be performed during activity area 4? Refer to scenario 8.
In Activity Area 4 of the risk assessment methodology used by Biotide, the focus is on identifying and evaluating risks, reviewing the criteria defined in Activity Area 1, and evaluating the consequences of identified areas of concern to determine the level of risk. However, an essential part of completing a risk assessment process also includes determining appropriate mitigation strategies for the identified risks.
ISO/IEC 27005 provides guidance on selecting and implementing security measures to manage the risk to an acceptable level. Therefore, selecting a mitigation strategy for the identified risk profiles is a crucial next step. This involves deciding on controls or measures that will reduce either the likelihood of the threat exploiting the vulnerability or the impact of the risk should it occur. Thus, the correct answer is B.
ISO/IEC 27005:2018, Section 8.3.5 'Risk treatment' outlines the process of selecting appropriate risk treatment options (mitigation strategies) once risks have been identified and evaluated.
Scenario 1
The risk assessment process was led by Henry, Bontton's risk manager. The first step that Henry took was identifying the company's assets. Afterward, Henry created various potential incident scenarios. One of the main concerns regarding the use of the application was the possibility of being targeted by cyber attackers, as a great number of organizations were experiencing cyberattacks during that time. After analyzing the identified risks, Henry evaluated them and concluded that new controls must be implemented if the company wants to use the application. Among others, he stated that training should be provided to personnel regarding the use of the application and that awareness sessions should be conducted regarding the importance of protecting customers' personal data.
Lastly, Henry communicated the risk assessment results to the top management. They decided that the application will be used only after treating the identified risks.
Based on scenario 1, Bontton used ISO/IEC 27005 to ensure effective implementation of all ISO/IEC 27001 requirements. Is this appropriate?
ISO/IEC 27005 is an international standard specifically focused on providing guidelines for information security risk management within the context of an organization's overall Information Security Management System (ISMS). It does not provide direct guidance on implementing the specific requirements of ISO/IEC 27001, which is a standard for establishing, implementing, maintaining, and continually improving an ISMS. Instead, ISO/IEC 27005 provides a framework for managing risks that could affect the confidentiality, integrity, and availability of information assets. Therefore, while ISO/IEC 27005 supports the risk management process that is crucial for compliance with ISO/IEC 27001, it does not contain specific guidelines or methodologies for implementing all the requirements of ISO/IEC 27001. This makes option C the correct answer.
ISO/IEC 27005:2018, 'Information Security Risk Management,' which emphasizes risk management guidance rather than direct implementation of ISO/IEC 27001 requirements.
ISO/IEC 27001:2013, Clause 6.1.2, 'Information Security Risk Assessment,' where risk assessment and treatment options are outlined but not in a prescriptive manner found in ISO/IEC 27005.
Scenario 2: Travivve is a travel agency that operates in more than 100 countries. Headquartered in San Francisco, the US, the agency is known for its personalized vacation packages and travel services. Travivve aims to deliver reliable services that meet its clients' needs. Considering the impact of information security in its reputation, Travivve decided to implement an information security management system (ISMS) based on ISO/IEC 27001. In addition, they decided to establish and implement an information security risk management program. Based on the priority of specific departments in Travivve, the top management decided to initially apply the risk management process only in the Sales Management Department. The process would be applicable for other departments only when introducing new technology.
Travivve's top management wanted to make sure that the risk management program is established based on the industry best practices. Therefore, they created a team of three members that would be responsible for establishing and implementing it. One of the team members was Travivve's risk manager who was responsible for supervising the team and planning all risk management activities. In addition, the risk manager was responsible for monitoring the program and reporting the monitoring results to the top management.
Initially, the team decided to analyze the internal and external context of Travivve. As part of the process of understanding the organization and its context, the team identified key processes and activities. Then, the team identified the interested parties and their basic requirements and determined the status of compliance with these requirements. In addition, the team identified all the reference documents that applied to the defined scope of the risk management process, which mainly included the Annex A of ISO/IEC 27001 and the internal security rules established by Travivve. Lastly, the team analyzed both reference documents and justified a few noncompliances with those requirements.
The risk manager selected the information security risk management method which was aligned with other approaches used by the company to manage other risks. The team also communicated the risk management process to all interested parties through previously established communication mechanisms. In addition, they made sure to inform all interested parties about their roles and responsibilities regarding risk management. Travivve also decided to involve interested parties in its risk management activities since, according to the top management, this process required their active participation.
Lastly, Travivve's risk management team decided to conduct the initial information security risk assessment process. As such, the team established the criteria for performing the information security risk assessment which included the consequence criteria and likelihood criteria.
Based on the scenario above, answer the following question:
Travivve decided to initially apply the risk management process only in the Sales Management Department. Is this acceptable?
ISO/IEC 27005 provides guidance on risk management for information security, and it allows flexibility in applying the risk management process to different parts of an organization. The decision to initially apply the risk management process only to the Sales Management Department is acceptable under ISO/IEC 27005, as the standard supports the selective application of risk management activities based on the specific needs and priorities of the organization. This is in line with risk management best practices, where organizations may focus on critical areas first (such as high-risk departments or those that handle sensitive information) and later expand the process as needed. Therefore, applying the risk management process to a subset of departments is appropriate, making option B the correct answer.
ISO/IEC 27005:2018, Clause 7, 'Context Establishment,' which allows defining the scope and boundaries of risk management as relevant to the organization's needs.
ISO/IEC 27001:2013, Clause 4.3, 'Determining the scope of the information security management system,' which also permits defining a scope based on priorities and relevance.
Which statement regarding information gathering techniques is correct?
ISO/IEC 27005 supports the use of various information-gathering techniques, including technical tools, to identify and assess risks. Technical tools such as vulnerability scanners and asset management software can help organizations identify technical vulnerabilities and compile a list of assets that are critical for risk assessment. This aligns with the standard's recommendation to use automated tools for an effective risk assessment process. Option B is correct because it accurately describes an effective information-gathering technique.
ISO/IEC 27005:2018, Clause 8.2, 'Risk Identification,' which discusses using tools and techniques to identify risks.
- Select Question Types you want
- Set your Desired Pass Percentage
- Allocate Time (Hours : Minutes)
- Create Multiple Practice tests with Limited Questions
- Customer Support
Arlie
11 days agoSylvia
1 months agoDarrin
2 months agoArgelia
3 months agoLisha
3 months agoTricia
4 months agoWillodean
4 months agoMarylou
4 months agoKaron
5 months agoJacinta
5 months agoNakita
5 months agoAmalia
6 months agoKaitlyn
6 months agoFloyd
6 months agoLisbeth
7 months agoAnnmarie
7 months agoKattie
7 months agoCorinne
7 months agoMelynda
7 months ago