PECB Exam ISO-IEC-27005-Risk-Manager Topic 1 Question 10 Discussion

Actual exam question for PECB's ISO-IEC-27005-Risk-Manager exam

Question #: 10
Topic #: 1

[All ISO-IEC-27005-Risk-Manager Questions]

Scenario 1

The risk assessment process was led by Henry, Bontton's risk manager. The first step that Henry took was identifying the company's assets. Afterward, Henry created various potential incident scenarios. One of the main concerns regarding the use of the application was the possibility of being targeted by cyber attackers, as a great number of organizations were experiencing cyberattacks during that time. After analyzing the identified risks, Henry evaluated them and concluded that new controls must be implemented if the company wants to use the application. Among others, he stated that training should be provided to personnel regarding the use of the application and that awareness sessions should be conducted regarding the importance of protecting customers' personal data.

Lastly, Henry communicated the risk assessment results to the top management. They decided that the application will be used only after treating the identified risks.

Based on the scenario above, answer the following question:

Bontton established a risk management process based on ISO/IEC 27005, to systematically manage information security threats. Is this a good practice?

AYes, ISO/IEC 27005 provides guidelines for information security risk management that enable organizations to systematically manage information security threats

BYes, ISO/IEC 27005 provides guidelines to systematically manage all types of threats that organizations may face

CNo, ISO/IEC 27005 cannot be used to manage information security threats in the food sector

Show Suggested Answer

Suggested Answer: C

The information security risk assessment process, as outlined in ISO/IEC 27005, typically includes identifying risks, assessing their potential impact, and prioritizing them. However, selecting risk treatment options is not part of the risk assessment process itself; it is part of the subsequent risk treatment phase. Therefore, option C is the correct answer as it is not included in the risk assessment process.

by Delmy at Sep 17, 2024, 04:32 AM

Limited Time Offer

25%

Off

Get Premium ISO-IEC-27005-Risk-Manager Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Patti

27 days ago

Wait, Bontton is in the food sector? Oh man, they're gonna need more than just ISO/IEC 27005 to protect their customers' data. Better call in the cybersecurity chefs!

upvoted 0 times

...

Eva

28 days ago

I'm not so sure. Doesn't ISO/IEC 27005 only apply to the IT sector? I'm not convinced it's the right framework for a company in the food industry.

upvoted 0 times

...

Mignon

29 days ago

I agree, following ISO/IEC 27005 is a best practice. It helps organizations like Bontton stay ahead of the curve when it comes to cybersecurity.

upvoted 0 times

Jacquelyne

4 days ago

B) Yes, ISO/IEC 27005 provides guidelines to systematically manage all types of threats that organizations may face

upvoted 0 times

...

Jacinta

6 days ago

A) Yes, ISO/IEC 27005 provides guidelines for information security risk management that enable organizations to systematically manage information security threats

upvoted 0 times

...

2 months ago

A) Yes, ISO/IEC 27005 provides guidelines for information security risk management that enable organizations to systematically manage information security threats.

upvoted 0 times

...