Question 1

A financial institution is assessing the impact of a new regulatory requirement on its information security risk management program. Who is primarily responsible for ensuring that the program complies with these new regulatory requirements?

Options :

A : The information security team.

B : The legal and compliance department.

C : The risk management committee.

D : The internal audit team.

Answer: B

Question 2

A company is planning to enhance its information security risk management program. What resource is essential for conducting effective risk assessments?

Options :

A : Unlimited financial investment in the latest technology, regardless of its relevance to risk management.

B : Focusing exclusively on purchasing insurance for all identified risks.

C : Skilled personnel with expertise in information security and risk assessment.

D : A policy to outsource all risk management activities to minimize internal effort.

Answer: C

Question 3

A technology firm is using the NIST framework for risk assessment of its cloud services. The firm has multiple cloud service models (IaaS, PaaS, SaaS) in operation. In this scenario, what should be the focus of the risk assessment process according to the NIST framework, and why is this focus important?

Options :

A : Assessing risks based only on the highest level of service model (SaaS).

B : Evaluating risks for each service model separately, considering their specific characteristics and threat landscapes.

C : Concentrating solely on physical security risks of cloud infrastructure.

D : Delegating the risk assessment process entirely to the cloud service provider.

Answer: B

Question 4

A healthcare organization has included upgrading its antivirus software as a corrective action in its risk treatment plan. The risk manager is responsible for overseeing this implementation. What is an essential factor to consider during this implementation?

Options :

A : Choosing antivirus software solely based on its market reputation.

B : The preference for antivirus software that requires minimal user interaction.

C : Ensuring that the antivirus software is compatible with existing systems and effectively addresses the specific malware risks identified.

D : Implementing the antivirus upgrade as quickly as possible, regardless of staff readiness.

Answer: C

Question 5

A multinational corporation is implementing an information security risk management process and needs to assign risk ownership for the risk of data breaches in its European operations. Considering the organizational structure, who should be designated as the risk owner for this specific risk?

Options :

A : The Data Protection Officer (DPO) for the European region.

B : The Chief Information Security Officer (CISO) at the corporate headquarters.

C : The General Manager of European operations.

D : The IT Manager of the European branch.

Answer: A

Free ISO-27005-LRM Mock Exam – Practice Online Confidently

Buying Options: