ISO/IEC 27005:2022 Quiz

What is the primary purpose of ISO/IEC 27005:2022?

• To provide guidelines for implementing ISO/IEC 27001 controls

• To offer guidance on managing information security risks

• To define cybersecurity incident response procedures

• To standardize encryption algorithms

Which ISO standard is most closely related to ISO/IEC 27005:2022?

• ISO/IEC 27001 (ISMS requirements)

• ISO/IEC 27002 (Security controls)

• ISO/IEC 27017 (Cloud security)

• ISO/IEC 27031 (ICT disaster recovery)

Which of the following is NOT a key step in the ISO/IEC 27005 risk management process?

• Risk identification

• Risk assessment

• Risk transfer (insurance)

• Risk treatment

What is the difference between "inherent risk" and "residual risk" in ISO/IEC 27005?

• Inherent risk is before controls, residual risk is after controls

• Inherent risk is financial, residual risk is operational

• Inherent risk is external, residual risk is internal

• They are the same

Which risk assessment methodology is recommended by ISO/IEC 27005:2022?

• Only quantitative methods

• Only qualitative methods

• A combination of qualitative and quantitative methods

• No specific method is prescribed

What is the purpose of a "risk appetite" in ISO/IEC 27005?

• To define the maximum budget for cybersecurity

• To set the level of risk an organization is willing to accept

• To measure employee awareness of risks

• To determine insurance premiums

Which of the following is a valid risk treatment option per ISO/IEC 27005?

• Risk avoidance (discontinuing the activity)

• Risk sharing (outsourcing)

• Risk acceptance (tolerating the risk)

• All of the above

What role does "risk communication" play in ISO/IEC 27005?

• It ensures stakeholders understand the risks and controls

• It is only needed for regulatory compliance

• It replaces the need for risk assessments

• It focuses only on IT department risks

How often should risk assessments be performed per ISO/IEC 27005?

• Only once during ISMS implementation

• Annually or when significant changes occur

• Only after a security breach

• Every 5 years

Which document should record the outcomes of risk assessments per ISO/IEC 27005?

• Statement of Applicability (SoA)

• Risk Treatment Plan (RTP)

• Risk Register

• All of the above