PECB ISO-IEC-27005-Risk-Manager Exam - Topic 3 Question 29 Discussion

Actual exam question for PECB's ISO-IEC-27005-Risk-Manager exam

Question #: 29
Topic #: 3

[All ISO-IEC-27005-Risk-Manager Questions]

Scenario 1

The risk assessment process was led by Henry, Bontton's risk manager. The first step that Henry took was identifying the company's assets. Afterward, Henry created various potential incident scenarios. One of the main concerns regarding the use of the application was the possibility of being targeted by cyber attackers, as a great number of organizations were experiencing cyberattacks during that time. After analyzing the identified risks, Henry evaluated them and concluded that new controls must be implemented if the company wants to use the application. Among others, he stated that training should be provided to personnel regarding the use of the application and that awareness sessions should be conducted regarding the importance of protecting customers' personal data.

Lastly, Henry communicated the risk assessment results to the top management. They decided that the application will be used only after treating the identified risks.

Based on scenario 1, Bontton used ISO/IEC 27005 to ensure effective implementation of all ISO/IEC 27001 requirements. Is this appropriate?

AYes, ISO/IEC 27005 provides direct guidance on the implementation of the requirements given in ISO/IEC 27001

BYes, ISO/IEC 27005 provides a number of methodologies that can be used under the risk management framework for implementing all requirements given in ISO/IEC 27001

CNo, ISO/IEC 27005 does not contain direct guidance on the implementation of all requirements given in ISO/IEC 27001

Show Suggested Answer

Suggested Answer: C

ISO/IEC 27005 is an international standard specifically focused on providing guidelines for information security risk management within the context of an organization's overall Information Security Management System (ISMS). It does not provide direct guidance on implementing the specific requirements of ISO/IEC 27001, which is a standard for establishing, implementing, maintaining, and continually improving an ISMS. Instead, ISO/IEC 27005 provides a framework for managing risks that could affect the confidentiality, integrity, and availability of information assets. Therefore, while ISO/IEC 27005 supports the risk management process that is crucial for compliance with ISO/IEC 27001, it does not contain specific guidelines or methodologies for implementing all the requirements of ISO/IEC 27001. This makes option C the correct answer.

ISO/IEC 27005:2018, 'Information Security Risk Management,' which emphasizes risk management guidance rather than direct implementation of ISO/IEC 27001 requirements.

ISO/IEC 27001:2013, Clause 6.1.2, 'Information Security Risk Assessment,' where risk assessment and treatment options are outlined but not in a prescriptive manner found in ISO/IEC 27005.

by Lai at May 08, 2026, 03:43 AM

Limited Time Offer

25%

Off

Get Premium ISO-IEC-27005-Risk-Manager Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Ashlyn

17 days ago

I’m not entirely sure, but I feel like ISO/IEC 27005 does help with understanding risk assessment, which might support ISO/IEC 27001. Maybe option A is the way to go?

upvoted 0 times

...

Aracelis

22 days ago

I think I saw a practice question where ISO/IEC 27005 was mentioned as providing methodologies for risk management. That makes me think option B could be correct.

upvoted 0 times

...

Kristin

27 days ago

I remember reading that ISO/IEC 27005 is more about risk management than directly implementing all ISO/IEC 27001 requirements. So, I’m leaning towards option C.

upvoted 0 times

...