Question 1

A telecommunications company is evaluating the risk of service disruptions due to natural disasters. To effectively analyze this risk, which technique should be applied?

Options :

A : Monte Carlo simulation to model the impact of various disaster scenarios.

B : Fault tree analysis to identify potential causes of service disruptions.

C : Delphi technique involving experts to estimate the probability of natural disasters.

D : Failure mode and effects analysis (FMEA) to assess the resilience of the network.

Answer: A

Question 2

A software company is expanding its operations globally and faces various information security risks associated with different regions. The CISO wants to utilize ISO/IEC 27005 to manage these risks effectively. How does the application of ISO/IEC 27005 specifically support the company in this global expansion in terms of risk management?

Options :

A : By replacing the need for regional compliance and security laws with a single framework.

B : By focusing solely on the technical aspects of security risks in global operations.

C : By emphasizing financial risk management strategies suitable for global expansion.

D : By providing a standardized approach for risk management that is universally applicable across all regions.

Answer: D

Question 3

An online retailer is evaluating the risk of data breaches in its customer database. They are considering implementing advanced encryption, increasing cybersecurity insurance coverage, conducting regular penetration testing, or retaining the risk as is. Which option represents risk sharing according to ISO/IEC 27005?

Options :

A : Conducting regular penetration testing.

B : Increasing cybersecurity insurance coverage.

C : Retaining the risk as is.

D : Implementing advanced encryption.

Answer: B

Question 4

A government agency is evaluating the risk of cyber-attacks on its critical infrastructure systems. They are considering upgrading their cybersecurity software, establishing a dedicated cybersecurity incident response team, conducting regular vulnerability assessments, or implementing a comprehensive network segmentation strategy. Which option most effectively reduces the risk level of cyber-attacks on critical infrastructure?

Options :

A : Implementing a comprehensive network segmentation strategy.

B : Conducting regular vulnerability assessments.

C : Establishing a dedicated cybersecurity incident response team.

D : Upgrading their cybersecurity software.

Answer: A

Question 5

A company in the "Do" phase of the PDCA cycle has implemented new security controls to mitigate identified risks. Which of the following is the most appropriate next step to ensure these controls are integrated effectively into the risk management program?

Options :

A : Training employees on the importance of information security.

B : Revising the organization-s information security policy.

C : Reassessing the risk landscape to identify new risks.

D : Evaluating the effectiveness of the controls against the identified risks.

Answer: D

Confidently Practice Online with Free ISO-27005-LRM Exam Cram

Buying Options: