PECB ISO-IEC-27005-Risk-Manager Exam - Topic 3 Question 4 Discussion

Actual exam question for PECB's ISO-IEC-27005-Risk-Manager exam

Question #: 4
Topic #: 3

[All ISO-IEC-27005-Risk-Manager Questions]

Which activity below is NOT included in the information security risk assessment process?

ADetermining the risk identification approach

BPrioritizing risks for risk treatment

CSelecting information security risk treatment options

Show Suggested Answer

Suggested Answer: C

The information security risk assessment process, as outlined in ISO/IEC 27005, typically includes identifying risks, assessing their potential impact, and prioritizing them. However, selecting risk treatment options is not part of the risk assessment process itself; it is part of the subsequent risk treatment phase. Therefore, option C is the correct answer as it is not included in the risk assessment process.

by Kassandra at Sep 10, 2024, 01:53 PM

Limited Time Offer

25%

Off

Get Premium ISO-IEC-27005-Risk-Manager Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Gaynell

3 months ago

I’m surprised that’s even a question!

upvoted 0 times

...

Shoshana

3 months ago

Yeah, I agree with Adolph, treatment options are key.

upvoted 0 times

...

Keneth

3 months ago

Wait, selecting treatment options isn't included? That seems off.

upvoted 0 times

...

Adolph

4 months ago

I think prioritizing risks is crucial too.

upvoted 0 times

...

Joanna

4 months ago

Risk identification is definitely part of the process.

upvoted 0 times

...

Ivette

4 months ago

Honestly, I’m a bit confused. I thought all three were part of risk assessment, but maybe one is more about treatment than assessment?

upvoted 0 times

...

Bonita

4 months ago

I feel like selecting risk treatment options is also a key part of the process. I’m leaning towards A being the one that doesn’t fit.

upvoted 0 times

...

Laila

4 months ago

I remember practicing a similar question where we had to identify steps in risk management. I think prioritizing risks is essential, so it might not be the answer.

upvoted 0 times

...

Xenia

5 months ago

I think the risk identification approach is definitely part of the process, but I'm not entirely sure about the other options.

upvoted 0 times

...

Stefanie

5 months ago

Hmm, I'm pretty confident that B is the correct answer here. Prioritizing risks for treatment is a critical part of the risk assessment process, so that can't be the step that's missing.

upvoted 0 times

...

Ilona

5 months ago

I'm a bit confused on this one. All of these activities seem like they would be part of a comprehensive risk assessment. I'll have to think it through carefully to figure out which one is the odd one out.

upvoted 0 times

...

Lashawnda

5 months ago

I've reviewed the risk assessment steps before, so I think I've got this. The answer has to be A - determining the risk identification approach, since that's more of a planning step rather than part of the actual assessment.

upvoted 0 times

...

Sharen

5 months ago

Okay, let's see. Determining the risk identification approach, prioritizing risks, and selecting risk treatment options - those all seem like key parts of the process. I'm not sure which one is missing.

upvoted 0 times

...

Grover

5 months ago

Hmm, this looks like a tricky one. I'll need to think carefully about the risk assessment process to figure out which step is not included.

upvoted 0 times

...

Nickie

5 months ago

I remember studying different types of experiments and I'm pretty sure this is about factorial experiments because they test all levels of both factors.

upvoted 0 times

...

William

1 year ago

This question is a real head-scratcher. Maybe the exam writers are trying to catch us off guard, like a bunch of mischievous hackers.

upvoted 0 times

Alida

1 year ago

C) Selecting information security risk treatment options

upvoted 0 times

...

Geraldo

1 year ago

B) Prioritizing risks for risk treatment

upvoted 0 times

...

Carmen

1 year ago

A) Determining the risk identification approach

upvoted 0 times

...

Yolande

1 year ago

Wait, is this a trick question? I feel like they're all included in the risk assessment process. Someone should tell the exam writers to get their facts straight.

upvoted 0 times

...

Marshall

1 year ago

I think B) Prioritizing risks for risk treatment is also a valid option to consider.

upvoted 0 times

...

Kimberely

1 year ago

Prioritizing risks and selecting treatment options? That's the fun part! I bet option A is the correct answer.

upvoted 0 times

Lucina

1 year ago

It's important to understand the different activities involved in the risk assessment process.

upvoted 0 times

...

Shonda

1 year ago

Yes, you're right. Option A is the correct answer.

upvoted 0 times

...

Lea

1 year ago

I think option A, determining the risk identification approach, is not included in the information security risk assessment process.

upvoted 0 times

...

Veronica

1 year ago

Yes, you're right! Option A is NOT included in the information security risk assessment process.

upvoted 0 times

...

Fletcher

1 year ago

I agree, prioritizing risks and selecting treatment options is definitely the fun part.

upvoted 0 times

...

Carissa

1 year ago

I think option A is the correct answer, determining the risk identification approach.

upvoted 0 times

...

Danica

1 year ago

I agree, prioritizing risks and selecting treatment options is definitely the fun part!

upvoted 0 times

...

Dean

1 year ago

I agree with Socorro, C) Selecting information security risk treatment options seems like the odd one out.

upvoted 0 times

...

Antonio

1 year ago

I'm going to go with option A. I mean, how can you assess risks without first knowing how to identify them? Seems like a no-brainer to me.

upvoted 0 times

Marisha

1 year ago

All of these activities are essential for a comprehensive information security risk assessment.

upvoted 0 times

...

Patti

1 year ago

True, selecting treatment options is also a key step in the process.

upvoted 0 times

...

Lanie

1 year ago

But don't forget about prioritizing risks for treatment, that's important too.

upvoted 0 times

...

Geoffrey

1 year ago

I agree, identifying risks is crucial for the assessment process.

upvoted 0 times

...

Jose

1 year ago

I disagree, I believe the answer is A) Determining the risk identification approach.

upvoted 0 times

...

Von

1 year ago

Hmm, I'm pretty sure determining the risk identification approach is part of the assessment process. This question is trickier than it seems.

upvoted 0 times

Emeline

1 year ago

B) Prioritizing risks for risk treatment

upvoted 0 times

...

Yuki

1 year ago

A) Determining the risk identification approach

upvoted 0 times

...

Socorro

1 year ago

I think the answer is C) Selecting information security risk treatment options.

upvoted 0 times

...