Question 1

A healthcare organization wants to assess the effectiveness of its controls for protecting patient data. Which method would be most appropriate for identifying these controls?

Options :

A : Monitoring the physical security of data storage facilities.

B : Analyzing patient satisfaction survey results.

C : Conducting a gap analysis against health data protection regulations.

D : Reviewing IT system logs for unusual activities.

Answer: C

Question 2

A company is reviewing its information security management system (ISMS) to ensure it aligns with the best practices for establishing, implementing, maintaining, and continually improving information security. Which ISO/IEC 27000 family standard primarily guides the structure and implementation of an ISMS?

Options :

A : ISO/IEC 27017

B : ISO/IEC 27005

C : ISO/IEC 27001

D : ISO/IEC 27002

Answer: C

Question 3

A retail company is implementing a new point-of-sale (POS) system and wants to manage the associated risks. According to ISO/IEC 27005, what should be the focus of the risk assessment for the new POS system?

Options :

A : On the ease of use and interface design of the POS system.

B : Primarily on the technical performance and speed of the POS system.

C : Solely on the physical security of the POS terminals.

D : On the potential risks to customer data privacy and transaction security posed by the POS system.

Answer: D

Question 4

A university is upgrading its learning management system (LMS), which contains student information and academic records. Who should be designated as the risk owner for the LMS upgrade project, and what would be their primary task?

Options :

A : The registrar, responsible for maintaining academic records.

B : The data protection officer (DPO), responsible for student data privacy.

C : The IT director, responsible for the technical aspects of the upgrade.

D : The Chief Information Officer (CIO), responsible for the overall IT strategy.

Answer: D

Question 5

A cloud service provider is analyzing the risk of downtime due to server failures. Given the redundancy measures in place and the potential impact on client operations, how should the risk be quantified?

Options :

A : Low risk, as redundancy measures significantly reduce the likelihood of downtime.

B : Negligible risk, as server failures are rare events.

C : Moderate risk, considering some redundancy but significant potential impact on clients.

D : High risk, due to the critical nature of cloud services for clients.

Answer: C

Free ISO-27005-LRM Mock Exam – Practice Online Confidently

Buying Options: