Question 1

A company in the "Do" phase of the PDCA cycle has implemented new security controls to mitigate identified risks. Which of the following is the most appropriate next step to ensure these controls are integrated effectively into the risk management program?

Options :

A : Training employees on the importance of information security.

B : Revising the organization-s information security policy.

C : Reassessing the risk landscape to identify new risks.

D : Evaluating the effectiveness of the controls against the identified risks.

Answer: D

Question 2

A hospital's electronic health record (EHR) system is infected with ransomware, encrypting patient records. What is the primary consequence of this ransomware attack in terms of the CIA triad?

Options :

A : Financial losses due to paying the ransom.

B : Loss of availability of patient records for healthcare providers.

C : Unauthorized disclosure of patient health information.

D : Permanent deletion of patient records, impacting data integrity.

Answer: B

Question 3

A retail company has recently conducted a risk assessment for its new online store platform. The risk manager is responsible for documenting the results. What key elements should be included in the risk assessment documentation to ensure it is comprehensive and useful for risk management?

Options :

A : The personal opinions of the IT staff about the platform’s security.

B : Identification of risks, their likelihood, impact, existing controls, and recommended risk treatment options.

C : A record of sales figures since the platform’s launch.

D : A detailed list of all products sold on the platform.

Answer: B

Question 4

The C-suite of a technology firm is committed to enhancing the risk management program. Which action reflects their leadership in promoting a risk-aware culture within the firm?

Options :

A : Restricting the dissemination of risk management information to a select few senior executives.

B : Ignoring the need for ongoing risk management training and awareness programs.

C : Treating risk management as an issue only relevant to the IT security team.

D : Regularly communicating the importance of risk management to all employees and encouraging their active involvement.

Answer: D

Question 5

An organization has recently experienced a data breach. The risk manager must develop a communication plan to inform internal and external stakeholders about the breach and the steps being taken to mitigate its impact. What should be a key consideration in this communication plan?

Options :

A : Providing timely, accurate, and transparent information about the breach and mitigation efforts.

B : Limiting information to avoid legal liability.

C : Focusing solely on external communication to maintain the organization-s public image.

D : Delaying communication until a complete investigation is conducted.

Answer: A

Confidently Practice Online with Free ISO-27005-LRM Exam Cram

Buying Options: