Question 1

An organization is transitioning to cloud-based services and has conducted a risk assessment to identify related security risks. The risk manager must report the results to different departments within the organization. How should the risk manager tailor the reports to be relevant to each department?

Options :

A : Customize the reports to highlight risks and treatments pertinent to each department’s functions.

B : Deliver oral summaries without providing written reports to save time.

C : Focus the reports only on the most severe risks to avoid overwhelming the departments.

D : Provide the same detailed report to all departments for consistency.

Answer: A

Question 2

An educational institution is implementing MEHARI to assess risks to its learning management system (LMS). The team is in the process of risk treatment decision-making. What approach should be taken in this stage according to MEHARI, and why is it important for the institution's risk management?

Options :

A : Automatically opting for the most advanced technological solutions for all identified risks.

B : Choosing risk treatment options by considering their effectiveness in reducing risk levels and their alignment with the institution-s objectives and risk appetite.

C : Selecting risk treatment options based solely on their cost-effectiveness.

D : Delegating risk treatment decisions to the LMS vendor without internal analysis.

Answer: B

Question 3

A retail company has recently conducted a risk assessment for its new online store platform. The risk manager is responsible for documenting the results. What key elements should be included in the risk assessment documentation to ensure it is comprehensive and useful for risk management?

Options :

A : The personal opinions of the IT staff about the platform’s security.

B : Identification of risks, their likelihood, impact, existing controls, and recommended risk treatment options.

C : A record of sales figures since the platform’s launch.

D : A detailed list of all products sold on the platform.

Answer: B

Question 4

A software company is expanding its operations globally and faces various information security risks associated with different regions. The CISO wants to utilize ISO/IEC 27005 to manage these risks effectively. How does the application of ISO/IEC 27005 specifically support the company in this global expansion in terms of risk management?

Options :

A : By replacing the need for regional compliance and security laws with a single framework.

B : By focusing solely on the technical aspects of security risks in global operations.

C : By emphasizing financial risk management strategies suitable for global expansion.

D : By providing a standardized approach for risk management that is universally applicable across all regions.

Answer: D

Question 5

A financial services firm is updating its cybersecurity policies. The risk manager must communicate these changes to all employees to ensure compliance and awareness of new security protocols. What should be the primary objective of this risk communication?

Options :

A : To focus solely on the penalties for non-compliance with the new policies.

B : To ensure employees understand how the policy changes affect their day-to-day activities.

C : To provide a high-level overview of the policy changes without details.

D : To inform employees about the technical aspects of the new cybersecurity policies.

Answer: B

Free ISO-27005-LRM Mock Exam – Practice Online Confidently

Buying Options: