PECB ISO-IEC-27005-Risk-Manager PECB Certified ISO/IEC 27005 Risk Manager Exam Practice Test

Page: 1 / 14
Total 60 questions
Question 1

Scenario 1

The risk assessment process was led by Henry, Bontton's risk manager. The first step that Henry took was identifying the company's assets. Afterward, Henry created various potential incident scenarios. One of the main concerns regarding the use of the application was the possibility of being targeted by cyber attackers, as a great number of organizations were experiencing cyberattacks during that time. After analyzing the identified risks, Henry evaluated them and concluded that new controls must be implemented if the company wants to use the application. Among others, he stated that training should be provided to personnel regarding the use of the application and that awareness sessions should be conducted regarding the importance of protecting customers' personal data.

Lastly, Henry communicated the risk assessment results to the top management. They decided that the application will be used only after treating the identified risks.

According to scenario 1, Bontton wanted to use an application that ensures only authorized users have access to customers' personal dat

a. Which information security principle does Bontton want to ensure in this case?



Answer : C

In the context of information security, confidentiality refers to ensuring that information is accessible only to those who are authorized to have access. According to scenario 1, Bontton wanted to use an application that ensures only authorized users have access to customers' personal data. This directly aligns with the principle of confidentiality, as Bontton aims to protect personal data from unauthorized access or disclosure. This focus on restricting access to sensitive data to authorized personnel clearly indicates that the confidentiality of information is the primary concern in this case. Thus, the correct answer is C.


Question 2

Scenario 1

The risk assessment process was led by Henry, Bontton's risk manager. The first step that Henry took was identifying the company's assets. Afterward, Henry created various potential incident scenarios. One of the main concerns regarding the use of the application was the possibility of being targeted by cyber attackers, as a great number of organizations were experiencing cyberattacks during that time. After analyzing the identified risks, Henry evaluated them and concluded that new controls must be implemented if the company wants to use the application. Among others, he stated that training should be provided to personnel regarding the use of the application and that awareness sessions should be conducted regarding the importance of protecting customers' personal data.

Lastly, Henry communicated the risk assessment results to the top management. They decided that the application will be used only after treating the identified risks.

Based on scenario 1, Bontton used ISO/IEC 27005 to ensure effective implementation of all ISO/IEC 27001 requirements. Is this appropriate?



Answer : C

ISO/IEC 27005 is an international standard specifically focused on providing guidelines for information security risk management within the context of an organization's overall Information Security Management System (ISMS). It does not provide direct guidance on implementing the specific requirements of ISO/IEC 27001, which is a standard for establishing, implementing, maintaining, and continually improving an ISMS. Instead, ISO/IEC 27005 provides a framework for managing risks that could affect the confidentiality, integrity, and availability of information assets. Therefore, while ISO/IEC 27005 supports the risk management process that is crucial for compliance with ISO/IEC 27001, it does not contain specific guidelines or methodologies for implementing all the requirements of ISO/IEC 27001. This makes option C the correct answer.


ISO/IEC 27005:2018, 'Information Security Risk Management,' which emphasizes risk management guidance rather than direct implementation of ISO/IEC 27001 requirements.

ISO/IEC 27001:2013, Clause 6.1.2, 'Information Security Risk Assessment,' where risk assessment and treatment options are outlined but not in a prescriptive manner found in ISO/IEC 27005.

Question 3

According to ISO/IEC 27000, what is the definition of information security?



Answer : A

According to ISO/IEC 27000, information security is defined as the 'preservation of confidentiality, integrity, and availability of information.' This definition highlights the three core principles of information security:

Confidentiality ensures that information is not disclosed to unauthorized individuals or systems.

Integrity ensures the accuracy and completeness of information and its processing methods.

Availability ensures that authorized users have access to information and associated assets when required.

This definition encompasses the protection of information in all forms and aligns with ISO/IEC 27005's guidelines on managing information security risks. Therefore, option A is the correct answer. Options B and C are incorrect as they refer to more specific aspects or other areas of information management.


Question 4

Scenario 6: Productscape is a market research company headquartered in Brussels, Belgium. It helps organizations understand the needs and expectations of their customers and identify new business opportunities. Productscape's teams have extensive experience in marketing and business strategy and work with some of the best-known organizations in Europe. The industry in which Productscape operates requires effective risk management. Considering that Productscape has access to clients' confidential information, it is responsible for ensuring its security. As such, the company conducts regular risk assessments. The top management appointed Alex as the risk manager, who is responsible for monitoring the risk management process and treating information security risks.

The last risk assessment conducted was focused on information assets. The purpose of this risk assessment was to identify information security risks, understand their level, and take appropriate action to treat them in order to ensure the security of their systems. Alex established a team of three members to perform the risk assessment activities. Each team member was responsible for specific departments included in the risk assessment scope. The risk assessment provided valuable information to identify, understand, and mitigate the risks that Productscape faces.

Initially, the team identified potential risks based on the risk identification results. Prior to analyzing the identified risks, the risk acceptance criteria were established. The criteria for accepting the risks were determined based on Productscape's objectives, operations, and technology. The team created various risk scenarios and determined the likelihood of occurrence as ''low,'' ''medium,'' or ''high.'' They decided that if the likelihood of occurrence for a risk scenario is determined as ''low,'' no further action would be taken. On the other hand, if the likelihood of occurrence for a risk scenario is determined as ''high'' or ''medium,'' additional controls will be implemented. Some information security risk scenarios defined by Productscape's team were as follows:

1. A cyber attacker exploits a security misconfiguration vulnerability of Productscape's website to launch an attack, which, in turn, could make the website unavailable to users.

2. A cyber attacker gains access to confidential information of clients and may threaten to make the information publicly available unless a ransom is paid.

3. An internal employee clicks on a link embedded in an email that redirects them to an unsecured website, installing a malware on the device.

The likelihood of occurrence for the first risk scenario was determined as ''medium.'' One of the main reasons that such a risk could occur was the usage of default accounts and password. Attackers could exploit this vulnerability and launch a brute-force attack. Therefore, Productscape decided to start using an automated ''build and deploy'' process which would test the software on deploy and minimize the likelihood of such an incident from happening. However, the team made it clear that the implementation of this process would not eliminate the risk completely and that there was still a low possibility for this risk to occur. Productscape documented the remaining risk and decided to monitor it for changes.

The likelihood of occurrence for the second risk scenario was determined as ''medium.'' Productscape decided to contract an IT company that would provide technical assistance and monitor the company's systems and networks in order to prevent such incidents from happening.

The likelihood of occurrence for the third risk scenario was determined as ''high.'' Thus, Productscape decided to include phishing as a topic on their information security training sessions. In addition, Alex reviewed the controls of Annex A of ISO/IEC 27001 in order to determine the necessary controls for treating this risk. Alex decided to implement control A.8.23 Web filtering which would help the company to reduce the risk of accessing unsecure websites. Although security controls were implemented to treat the risk, the level of the residual risk still did not meet the risk acceptance criteria defined in the beginning of the risk assessment process. Since the cost of implementing additional controls was too high for the company, Productscape decided to accept the residual risk. Therefore, risk owners were assigned the responsibility of managing the residual risk.

Based on scenario 6, Productscape decided to monitor the remaining risk after risk treatment. Is this necessary?



Answer : C

ISO/IEC 27005 advises that even after risks have been treated, any residual risks should be continuously monitored and reviewed. This is necessary to ensure that they remain within acceptable levels and that any changes in the internal or external environment do not escalate the risk beyond acceptable thresholds. Monitoring also ensures that the effectiveness of the controls remains adequate over time. Option A is incorrect because all risks, including those meeting the risk acceptance criteria, should be monitored. Option B is incorrect because monitoring is necessary regardless of the perceived severity if it occurs, to detect changes early.


Question 5

Scenario 1

The risk assessment process was led by Henry, Bontton's risk manager. The first step that Henry took was identifying the company's assets. Afterward, Henry created various potential incident scenarios. One of the main concerns regarding the use of the application was the possibility of being targeted by cyber attackers, as a great number of organizations were experiencing cyberattacks during that time. After analyzing the identified risks, Henry evaluated them and concluded that new controls must be implemented if the company wants to use the application. Among others, he stated that training should be provided to personnel regarding the use of the application and that awareness sessions should be conducted regarding the importance of protecting customers' personal data.

Lastly, Henry communicated the risk assessment results to the top management. They decided that the application will be used only after treating the identified risks.

Based on the scenario above, answer the following question:

Bontton established a risk management process based on ISO/IEC 27005, to systematically manage information security threats. Is this a good practice?



Answer : A

ISO/IEC 27005 is the standard that provides guidelines for information security risk management, which supports the requirements of an Information Security Management System (ISMS) as specified in ISO/IEC 27001. In the scenario provided, Bontton established a risk management process to identify, analyze, evaluate, and treat information security risks, which is in alignment with the guidelines set out in ISO/IEC 27005. The standard emphasizes a systematic approach to identifying assets, identifying threats and vulnerabilities, assessing risks, and implementing appropriate risk treatment measures, such as training and awareness sessions. Thus, option A is correct, as it accurately reflects the purpose and application of ISO/IEC 27005 in managing information security threats. Option B is incorrect because ISO/IEC 27005 specifically addresses information security threats, not all types of threats, and option C is incorrect because ISO/IEC 27005 is applicable to any sector, including the food industry, as long as it concerns information security risks.


Question 6

Scenario 1

The risk assessment process was led by Henry, Bontton's risk manager. The first step that Henry took was identifying the company's assets. Afterward, Henry created various potential incident scenarios. One of the main concerns regarding the use of the application was the possibility of being targeted by cyber attackers, as a great number of organizations were experiencing cyberattacks during that time. After analyzing the identified risks, Henry evaluated them and concluded that new controls must be implemented if the company wants to use the application. Among others, he stated that training should be provided to personnel regarding the use of the application and that awareness sessions should be conducted regarding the importance of protecting customers' personal data.

Lastly, Henry communicated the risk assessment results to the top management. They decided that the application will be used only after treating the identified risks.

According to scenario 1, what type of controls did Henry suggest?



Answer : C

In the context of Scenario 1, the controls suggested by Henry, such as training personnel on the use of the application and conducting awareness sessions on protecting customers' personal data, fall under the category of 'Administrative' controls. Administrative controls are policies, procedures, guidelines, and training programs designed to manage the human factors of information security. These controls are aimed at reducing the risks associated with human behavior, such as lack of awareness or improper handling of sensitive data, and are distinct from 'Technical' controls (like firewalls or encryption) and 'Managerial' controls (which include risk management strategies and governance frameworks).


ISO/IEC 27005:2018, Annex A, 'Controls and Safeguards,' which mentions the importance of administrative controls, such as awareness training and the development of policies, to mitigate identified risks.

ISO/IEC 27001:2013, Annex A, Control A.7.2.2, 'Information security awareness, education, and training,' which directly relates to administrative controls for personnel security.

Question 7

Scenario 1

The risk assessment process was led by Henry, Bontton's risk manager. The first step that Henry took was identifying the company's assets. Afterward, Henry created various potential incident scenarios. One of the main concerns regarding the use of the application was the possibility of being targeted by cyber attackers, as a great number of organizations were experiencing cyberattacks during that time. After analyzing the identified risks, Henry evaluated them and concluded that new controls must be implemented if the company wants to use the application. Among others, he stated that training should be provided to personnel regarding the use of the application and that awareness sessions should be conducted regarding the importance of protecting customers' personal data.

Lastly, Henry communicated the risk assessment results to the top management. They decided that the application will be used only after treating the identified risks.

Henry concluded that one of the main concerns regarding the use of the application for online ordering was cyberattacks. What did Henry identify in this case? Refer to scenario 1.\



Answer : A

In this scenario, Henry identifies 'cyberattacks' as one of the main concerns related to the use of the application for online ordering. According to ISO/IEC 27005, a 'threat' is any potential cause of an unwanted incident that may result in harm to a system or organization. In this context, cyberattacks are considered a threat because they represent a potential cause that could compromise the security of the application. Henry's identification of cyberattacks as a primary concern aligns with recognizing a specific threat that could exploit vulnerabilities within the system.


ISO/IEC 27005:2018, Clause 8.3, 'Threat identification,' which provides guidance on identifying threats that could affect the organization's information assets.

ISO/IEC 27001:2013, Clause 6.1.2, 'Information Security Risk Assessment,' where identifying threats is part of the risk assessment process.

These answers are verified based on the standards' definitions and guidelines, providing a comprehensive understanding of how ISO/IEC 27005 is used within the context of ISO/IEC 27001.

Page:    1 / 14   
Total 60 questions