無料ISO-IEC-27005-Risk-Manager試験ブレーン問題集認定ガイド問題と解答
ISO-IEC-27005-Risk-Manager認定概要最新のISO-IEC-27005-Risk-ManagerPDF問題集
PECB ISO-IEC-27005-Risk-Manager 認定試験の出題範囲：
| トピック | 出題範囲 |
|---|---|
| トピック 1 |
|
| トピック 2 |
|
| トピック 3 |
|
| トピック 4 |
|
質問 # 17
According to ISO/IEC 27005, what is the input when selecting information security risk treatment options?
- A. A risk treatment plan and residual risks subject to the acceptance decision
- B. A list of prioritized risks with event or risk scenarios that lead to those risks
- C. A list of risks with level values assigned
正解：B
解説：
According to ISO/IEC 27005, the input for selecting information security risk treatment options should include a list of prioritized risks along with the specific event or risk scenarios that led to those risks. This information helps decision-makers understand the context and potential impact of each risk, allowing them to choose the most appropriate treatment options. Option A is incorrect because the risk treatment plan and residual risks are outputs, not inputs, of the risk treatment process. Option C is incorrect because a list of risks with level values assigned provides limited context for selecting appropriate treatment options.
質問 # 18
Scenario 2: Travivve is a travel agency that operates in more than 100 countries. Headquartered in San Francisco, the US, the agency is known for its personalized vacation packages and travel services. Travivve aims to deliver reliable services that meet its clients' needs. Considering the impact of information security in its reputation, Travivve decided to implement an information security management system (ISMS) based on ISO/IEC 27001. In addition, they decided to establish and implement an information security risk management program. Based on the priority of specific departments in Travivve, the top management decided to initially apply the risk management process only in the Sales Management Department. The process would be applicable for other departments only when introducing new technology.
Travivve's top management wanted to make sure that the risk management program is established based on the industry best practices. Therefore, they created a team of three members that would be responsible for establishing and implementing it. One of the team members was Travivve's risk manager who was responsible for supervising the team and planning all risk management activities. In addition, the risk manager was responsible for monitoring the program and reporting the monitoring results to the top management.
Initially, the team decided to analyze the internal and external context of Travivve. As part of the process of understanding the organization and its context, the team identified key processes and activities. Then, the team identified the interested parties and their basic requirements and determined the status of compliance with these requirements. In addition, the team identified all the reference documents that applied to the defined scope of the risk management process, which mainly included the Annex A of ISO/IEC 27001 and the internal security rules established by Travivve. Lastly, the team analyzed both reference documents and justified a few noncompliances with those requirements.
The risk manager selected the information security risk management method which was aligned with other approaches used by the company to manage other risks. The team also communicated the risk management process to all interested parties through previously established communication mechanisms. In addition, they made sure to inform all interested parties about their roles and responsibilities regarding risk management. Travivve also decided to involve interested parties in its risk management activities since, according to the top management, this process required their active participation.
Lastly, Travivve's risk management team decided to conduct the initial information security risk assessment process. As such, the team established the criteria for performing the information security risk assessment which included the consequence criteria and likelihood criteria.
Based on scenario 2, the team decided to involve interested parties in risk management activities. Is this a good practice?
- A. Yes, relevant interested parties should be involved in risk management activities to ensure the successful completion of the risk assessment
- B. No. only internal interested parties should be involved in risk management activities
- C. No, only the risk management team should be involved in risk management activities
正解：A
解説：
According to ISO/IEC 27005, involving relevant interested parties in the risk management process is considered a best practice. This approach ensures that all perspectives are considered, and relevant knowledge is leveraged, which helps in comprehensively identifying, analyzing, and managing risks. Interested parties, such as stakeholders, can provide valuable insights and information regarding the organization's assets, processes, threats, and vulnerabilities, contributing to a more accurate and effective risk assessment. Therefore, option B is correct because it supports the principle that involving relevant parties leads to a more successful risk assessment process. Options A and C are incorrect because excluding either external interested parties or restricting involvement only to the risk management team would limit the effectiveness of the risk management process.
質問 # 19
Scenario 3: Printary is an American company that offers digital printing services. Creating cost-effective and creative products, the company has been part of the printing industry for more than 30 years. Three years ago, the company started to operate online, providing greater flexibility for its clients. Through the website, clients could find information about all services offered by Printary and order personalized products. However, operating online increased the risk of cyber threats, consequently, impacting the business functions of the company. Thus, along with the decision of creating an online business, the company focused on managing information security risks. Their risk management program was established based on ISO/IEC 27005 guidelines and industry best practices.
Last year, the company considered the integration of an online payment system on its website in order to provide more flexibility and transparency to customers. Printary analyzed various available solutions and selected Pay0, a payment processing solution that allows any company to easily collect payments on their website. Before making the decision, Printary conducted a risk assessment to identify and analyze information security risks associated with the software. The risk assessment process involved three phases: identification, analysis, and evaluation. During risk identification, the company inspected assets, threats, and vulnerabilities. In addition, to identify the information security risks, Printary used a list of the identified events that could negatively affect the achievement of information security objectives. The risk identification phase highlighted two main threats associated with the online payment system: error in use and data corruption After conducting a gap analysis, the company concluded that the existing security controls were sufficient to mitigate the threat of data corruption. However, the user interface of the payment solution was complicated, which could increase the risk associated with user errors, and, as a result, impact data integrity and confidentiality.
Subsequently, the risk identification results were analyzed. The company conducted risk analysis in order to understand the nature of the identified risks. They decided to use a quantitative risk analysis methodology because it would provide more detailed information. The selected risk analysis methodology was consistent with the risk evaluation criteri a. Firstly, they used a list of potential incident scenarios to assess their potential impact. In addition, the likelihood of incident scenarios was defined and assessed. Finally, the level of risk was defined as low.
In the end, the level of risk was compared to the risk evaluation and acceptance criteria and was prioritized accordingly.
Did Primary perform risk analysis in accordance with the guidelines of ISO/IEC 27005? Refer to scenario 3.
- A. Yes, according to ISO/IEC 27005. the consequences, likelihood, and the level of risk should be determined during risk analysis
- B. No. according to ISO/IEC 27005, the risk level should be determined during risk evaluation
- C. No, the gap analysis should have been conducted during risk analysis, as suggested by ISO/IEC 27005
正解：A
解説：
ISO/IEC 27005 specifies that risk analysis should involve determining the potential consequences (impact) and the likelihood of identified risks, which together form the basis for calculating the level of risk. In Scenario 3, Printary followed this approach by assessing potential incident scenarios, determining their impact, evaluating their likelihood, and finally defining the level of risk. This process is aligned with the guidelines of ISO/IEC 27005 for conducting a thorough risk analysis. Therefore, Printary performed the risk analysis in accordance with the standard's guidelines, making option C the correct answer.
Reference:
ISO/IEC 27005:2018, Clause 8.4, "Risk Analysis," which outlines the steps to analyze risks by determining their consequences, likelihood, and overall level of risk.
質問 # 20
Scenario 3: Printary is an American company that offers digital printing services. Creating cost-effective and creative products, the company has been part of the printing industry for more than 30 years. Three years ago, the company started to operate online, providing greater flexibility for its clients. Through the website, clients could find information about all services offered by Printary and order personalized products. However, operating online increased the risk of cyber threats, consequently, impacting the business functions of the company. Thus, along with the decision of creating an online business, the company focused on managing information security risks. Their risk management program was established based on ISO/IEC 27005 guidelines and industry best practices.
Last year, the company considered the integration of an online payment system on its website in order to provide more flexibility and transparency to customers. Printary analyzed various available solutions and selected Pay0, a payment processing solution that allows any company to easily collect payments on their website. Before making the decision, Printary conducted a risk assessment to identify and analyze information security risks associated with the software. The risk assessment process involved three phases: identification, analysis, and evaluation. During risk identification, the company inspected assets, threats, and vulnerabilities. In addition, to identify the information security risks, Printary used a list of the identified events that could negatively affect the achievement of information security objectives. The risk identification phase highlighted two main threats associated with the online payment system: error in use and data corruption After conducting a gap analysis, the company concluded that the existing security controls were sufficient to mitigate the threat of data corruption. However, the user interface of the payment solution was complicated, which could increase the risk associated with user errors, and, as a result, impact data integrity and confidentiality.
Subsequently, the risk identification results were analyzed. The company conducted risk analysis in order to understand the nature of the identified risks. They decided to use a quantitative risk analysis methodology because it would provide more detailed information. The selected risk analysis methodology was consistent with the risk evaluation criteri a. Firstly, they used a list of potential incident scenarios to assess their potential impact. In addition, the likelihood of incident scenarios was defined and assessed. Finally, the level of risk was defined as low.
In the end, the level of risk was compared to the risk evaluation and acceptance criteria and was prioritized accordingly.
Based on scenario 3, Printary used a list of identified events that could negatively influence the achievement of its information security objectives to identify information security risks. Is this in compliance with the guidelines of ISO/IEC 27005?
- A. Yes, a list of events that can negatively influence the achievement of information security objectives in the company should be used to identity information security risks
- B. No, a list of risk scenarios with their consequences related to assets or events and their likelihood should be used to identity information security risks
- C. No. a list of risk sources, business processes. and business objectives should be used to identify information security risks
正解：A
解説：
According to ISO/IEC 27005, identifying risks to information security involves recognizing events that could adversely affect the achievement of information security objectives. Using a list of events that could negatively impact these objectives is consistent with the risk identification process as outlined in ISO/IEC 27005. This approach focuses on identifying specific incidents or events that could result in security breaches or compromises, providing a clear understanding of the potential risks to the organization. Thus, Printary's use of a list of such events to identify information security risks complies with the standard's guidelines, making option B the correct answer.
Reference:
ISO/IEC 27005:2018, Clause 8.2, "Risk Identification," which states that the organization should identify the events that could compromise information security objectives.
質問 # 21
Scenario 3: Printary is an American company that offers digital printing services. Creating cost-effective and creative products, the company has been part of the printing industry for more than 30 years. Three years ago, the company started to operate online, providing greater flexibility for its clients. Through the website, clients could find information about all services offered by Printary and order personalized products. However, operating online increased the risk of cyber threats, consequently, impacting the business functions of the company. Thus, along with the decision of creating an online business, the company focused on managing information security risks. Their risk management program was established based on ISO/IEC 27005 guidelines and industry best practices.
Last year, the company considered the integration of an online payment system on its website in order to provide more flexibility and transparency to customers. Printary analyzed various available solutions and selected Pay0, a payment processing solution that allows any company to easily collect payments on their website. Before making the decision, Printary conducted a risk assessment to identify and analyze information security risks associated with the software. The risk assessment process involved three phases: identification, analysis, and evaluation. During risk identification, the company inspected assets, threats, and vulnerabilities. In addition, to identify the information security risks, Printary used a list of the identified events that could negatively affect the achievement of information security objectives. The risk identification phase highlighted two main threats associated with the online payment system: error in use and data corruption After conducting a gap analysis, the company concluded that the existing security controls were sufficient to mitigate the threat of data corruption. However, the user interface of the payment solution was complicated, which could increase the risk associated with user errors, and, as a result, impact data integrity and confidentiality.
Subsequently, the risk identification results were analyzed. The company conducted risk analysis in order to understand the nature of the identified risks. They decided to use a quantitative risk analysis methodology because it would provide more detailed information. The selected risk analysis methodology was consistent with the risk evaluation criteri a. Firstly, they used a list of potential incident scenarios to assess their potential impact. In addition, the likelihood of incident scenarios was defined and assessed. Finally, the level of risk was defined as low.
In the end, the level of risk was compared to the risk evaluation and acceptance criteria and was prioritized accordingly.
Which of the following situations indicates that Printary identified consequences of risk scenarios? Refer to scenario 3.
- A. Printary identified two main threats associated with the online payment system: error in use and corruption of data
- B. Printary concluded that the complicated user interface could increase the risk of user error and impact data integrity and confidentiality
- C. Printary used the list of potential incident scenarios and assessed their impact on company's information security
正解：C
解説：
According to ISO/IEC 27005, the risk management process involves identifying, analyzing, and evaluating risks in a structured manner. Specifically, risk identification entails recognizing potential threats, vulnerabilities, and consequences to information assets. Once risks are identified, ISO/IEC 27005 emphasizes the importance of risk analysis, where risks are assessed in terms of their potential consequences and likelihood.
In the scenario, Printary followed this structured approach, aligning with the ISO/IEC 27005 framework. First, they identified the threats associated with the online payment system, which were categorized as user errors and data corruption. However, identification of threats alone does not equate to identifying the consequences of risk scenarios, as required by the risk analysis phase in ISO/IEC 27005.
The key to recognizing that Printary identified the consequences lies in the fact that they "used the list of potential incident scenarios and assessed their impact on the company's information security." This directly corresponds to ISO/IEC 27005's guidelines on risk analysis, where organizations must evaluate both the likelihood and the impact (consequences) of potential incidents on their assets. In other words, by assessing the impact of the incident scenarios, Printary is analyzing the consequences of the identified risks, which is a crucial step in the risk analysis process.
Option A refers to identifying a risk (user error leading to compromised data integrity and confidentiality), but this does not constitute a comprehensive analysis of the risk's consequences as per ISO/IEC 27005. Similarly, Option C highlights the identification of threats, but the threats themselves are not the consequences of risk scenarios.
Thus, Option B is the most accurate as it reflects Printary's alignment with ISO/IEC 27005 guidelines in assessing the potential consequences of risk scenarios by evaluating their impact on the company's information security.
質問 # 22
Scenario 7: Adstry is a business growth agency that specializes in digital marketing strategies. Adstry helps organizations redefine the relationships with their customers through innovative solutions. Adstry is headquartered in San Francisco and recently opened two new offices in New York. The structure of the company is organized into teams which are led by project managers. The project manager has the full power in any decision related to projects. The team members, on the other hand, report the project's progress to project managers.
Considering that data breaches and ad fraud are common threats in the current business environment, managing risks is essential for Adstry. When planning new projects, each project manager is responsible for ensuring that risks related to a particular project have been identified, assessed, and mitigated. This means that project managers have also the role of the risk manager in Adstry. Taking into account that Adstry heavily relies on technology to complete their projects, their risk assessment certainly involves identification of risks associated with the use of information technology. At the earliest stages of each project, the project manager communicates the risk assessment results to its team members.
Adstry uses a risk management software which helps the project team to detect new potential risks during each phase of the project. This way, team members are informed in a timely manner for the new potential risks and are able to respond to them accordingly. The project managers are responsible for ensuring that the information provided to the team members is communicated using an appropriate language so it can be understood by all of them.
In addition, the project manager may include external interested parties affected by the project in the risk communication. If the project manager decides to include interested parties, the risk communication is thoroughly prepared. The project manager firstly identifies the interested parties that should be informed and takes into account their concerns and possible conflicts that may arise due to risk communication. The risks are communicated to the identified interested parties while taking into consideration the confidentiality of Adstry's information and determining the level of detail that should be included in the risk communication. The project managers use the same risk management software for risk communication with external interested parties since it provides a consistent view of risks. For each project, the project manager arranges regular meetings with relevant interested parties of the project, they discuss the detected risks, their prioritization, and determine appropriate treatment solutions. The information taken from the risk management software and the results of these meetings are documented and are used for decision-making processes. In addition, the company uses a computerized documented information management system for the acquisition, classification, storage, and archiving of its documents.
Based on scenario 7, which principle of efficient communication strategy Adstry's project managers follow when communicating risks to team members?
- A. Clarity
- B. Credibility
- C. Responsiveness
正解：A
解説：
Adstry's project managers focus on ensuring that the information provided to team members is communicated using an appropriate language that can be understood by all. This approach reflects the principle of clarity, which is a key element of an effective communication strategy. Clear communication helps to ensure that all parties understand the risks, their implications, and the necessary actions to mitigate them. Option B (Credibility) relates to trustworthiness, which is not the primary focus here, and Option C (Responsiveness) involves timely reactions, which is also not the main point of emphasis in this context.
質問 # 23
Based on the EBIOS RM method, which of the following is one of the four attack sequence phases?
- A. Attacking
- B. Exploiting
- C. Treating
正解：B
解説：
Based on the EBIOS Risk Manager (EBIOS RM) methodology, the attack sequence phases include various steps that an attacker might take to compromise an organization's assets. The four phases generally cover reconnaissance, exploiting vulnerabilities, achieving objectives, and maintaining persistence. "Exploiting" is specifically the phase where the attacker takes advantage of identified vulnerabilities in the system, which directly aligns with option A.
質問 # 24
Scenario 1
The risk assessment process was led by Henry, Bontton's risk manager. The first step that Henry took was identifying the company's assets. Afterward, Henry created various potential incident scenarios. One of the main concerns regarding the use of the application was the possibility of being targeted by cyber attackers, as a great number of organizations were experiencing cyberattacks during that time. After analyzing the identified risks, Henry evaluated them and concluded that new controls must be implemented if the company wants to use the application. Among others, he stated that training should be provided to personnel regarding the use of the application and that awareness sessions should be conducted regarding the importance of protecting customers' personal data.
Lastly, Henry communicated the risk assessment results to the top management. They decided that the application will be used only after treating the identified risks.
Henry concluded that one of the main concerns regarding the use of the application for online ordering was cyberattacks. What did Henry identify in this case? Refer to scenario 1.\
- A. A threat
- B. The vulnerabilities of an asset
- C. The consequences of a potential security incident
正解：A
解説：
In this scenario, Henry identifies "cyberattacks" as one of the main concerns related to the use of the application for online ordering. According to ISO/IEC 27005, a "threat" is any potential cause of an unwanted incident that may result in harm to a system or organization. In this context, cyberattacks are considered a threat because they represent a potential cause that could compromise the security of the application. Henry's identification of cyberattacks as a primary concern aligns with recognizing a specific threat that could exploit vulnerabilities within the system.
Reference:
ISO/IEC 27005:2018, Clause 8.3, "Threat identification," which provides guidance on identifying threats that could affect the organization's information assets.
ISO/IEC 27001:2013, Clause 6.1.2, "Information Security Risk Assessment," where identifying threats is part of the risk assessment process.
These answers are verified based on the standards' definitions and guidelines, providing a comprehensive understanding of how ISO/IEC 27005 is used within the context of ISO/IEC 27001.
質問 # 25
Scenario 1
The risk assessment process was led by Henry, Bontton's risk manager. The first step that Henry took was identifying the company's assets. Afterward, Henry created various potential incident scenarios. One of the main concerns regarding the use of the application was the possibility of being targeted by cyber attackers, as a great number of organizations were experiencing cyberattacks during that time. After analyzing the identified risks, Henry evaluated them and concluded that new controls must be implemented if the company wants to use the application. Among others, he stated that training should be provided to personnel regarding the use of the application and that awareness sessions should be conducted regarding the importance of protecting customers' personal data.
Lastly, Henry communicated the risk assessment results to the top management. They decided that the application will be used only after treating the identified risks.
Based on scenario 1, Bontton used ISO/IEC 27005 to ensure effective implementation of all ISO/IEC 27001 requirements. Is this appropriate?
- A. Yes, ISO/IEC 27005 provides direct guidance on the implementation of the requirements given in ISO/IEC 27001
- B. No, ISO/IEC 27005 does not contain direct guidance on the implementation of all requirements given in ISO/IEC 27001
- C. Yes, ISO/IEC 27005 provides a number of methodologies that can be used under the risk management framework for implementing all requirements given in ISO/IEC 27001
正解：B
解説：
ISO/IEC 27005 is an international standard specifically focused on providing guidelines for information security risk management within the context of an organization's overall Information Security Management System (ISMS). It does not provide direct guidance on implementing the specific requirements of ISO/IEC 27001, which is a standard for establishing, implementing, maintaining, and continually improving an ISMS. Instead, ISO/IEC 27005 provides a framework for managing risks that could affect the confidentiality, integrity, and availability of information assets. Therefore, while ISO/IEC 27005 supports the risk management process that is crucial for compliance with ISO/IEC 27001, it does not contain specific guidelines or methodologies for implementing all the requirements of ISO/IEC 27001. This makes option C the correct answer.
Reference:
ISO/IEC 27005:2018, "Information Security Risk Management," which emphasizes risk management guidance rather than direct implementation of ISO/IEC 27001 requirements.
ISO/IEC 27001:2013, Clause 6.1.2, "Information Security Risk Assessment," where risk assessment and treatment options are outlined but not in a prescriptive manner found in ISO/IEC 27005.
質問 # 26
Scenario 1
The risk assessment process was led by Henry, Bontton's risk manager. The first step that Henry took was identifying the company's assets. Afterward, Henry created various potential incident scenarios. One of the main concerns regarding the use of the application was the possibility of being targeted by cyber attackers, as a great number of organizations were experiencing cyberattacks during that time. After analyzing the identified risks, Henry evaluated them and concluded that new controls must be implemented if the company wants to use the application. Among others, he stated that training should be provided to personnel regarding the use of the application and that awareness sessions should be conducted regarding the importance of protecting customers' personal data.
Lastly, Henry communicated the risk assessment results to the top management. They decided that the application will be used only after treating the identified risks.
Based on the scenario above, answer the following question:
Bontton established a risk management process based on ISO/IEC 27005, to systematically manage information security threats. Is this a good practice?
- A. Yes, ISO/IEC 27005 provides guidelines for information security risk management that enable organizations to systematically manage information security threats
- B. No, ISO/IEC 27005 cannot be used to manage information security threats in the food sector
- C. Yes, ISO/IEC 27005 provides guidelines to systematically manage all types of threats that organizations may face
正解：A
解説：
ISO/IEC 27005 is the standard that provides guidelines for information security risk management, which supports the requirements of an Information Security Management System (ISMS) as specified in ISO/IEC 27001. In the scenario provided, Bontton established a risk management process to identify, analyze, evaluate, and treat information security risks, which is in alignment with the guidelines set out in ISO/IEC 27005. The standard emphasizes a systematic approach to identifying assets, identifying threats and vulnerabilities, assessing risks, and implementing appropriate risk treatment measures, such as training and awareness sessions. Thus, option A is correct, as it accurately reflects the purpose and application of ISO/IEC 27005 in managing information security threats. Option B is incorrect because ISO/IEC 27005 specifically addresses information security threats, not all types of threats, and option C is incorrect because ISO/IEC 27005 is applicable to any sector, including the food industry, as long as it concerns information security risks.
質問 # 27
Scenario 5: Detika is a private cardiology clinic in Pennsylvania, the US. Detika has one of the most advanced healthcare systems for treating heart diseases. The clinic uses sophisticated apparatus that detects heart diseases in early stages. Since 2010, medical information of Detika's patients is stored on the organization's digital systems. Electronic health records (EHR), among others, include patients' diagnosis, treatment plan, and laboratory results.
Storing and accessing patient and other medical data digitally was a huge and a risky step for Detik a. Considering the sensitivity of information stored in their systems, Detika conducts regular risk assessments to ensure that all information security risks are identified and managed. Last month, Detika conducted a risk assessment which was focused on the EHR system. During risk identification, the IT team found out that some employees were not updating the operating systems regularly. This could cause major problems such as a data breach or loss of software compatibility. In addition, the IT team tested the software and detected a flaw in one of the software modules used. Both issues were reported to the top management and they decided to implement appropriate controls for treating the identified risks. They decided to organize training sessions for all employees in order to make them aware of the importance of the system updates. In addition, the manager of the IT Department was appointed as the person responsible for ensuring that the software is regularly tested.
Another risk identified during the risk assessment was the risk of a potential ransomware attack. This risk was defined as low because all their data was backed up daily. The IT team decided to accept the actual risk of ransomware attacks and concluded that additional measures were not required. This decision was documented in the risk treatment plan and communicated to the risk owner. The risk owner approved the risk treatment plan and documented the risk assessment results.
Following that, Detika initiated the implementation of new controls. In addition, one of the employees of the IT Department was assigned the responsibility for monitoring the implementation process and ensure the effectiveness of the security controls. The IT team, on the other hand, was responsible for allocating the resources needed to effectively implement the new controls.
Based on scenario 5, the IT team was responsible for allocating the necessary resources to ensure that the new controls are implemented effectively. Is this acceptable?
- A. Yes, the team that is responsible for conducting the risk assessment should ensure that the necessary resources for treating the risk are allocated
- B. No, the organization should allocate the necessary resources to ensure the effective implementation of the risk treatment plan
- C. No, the necessary resources for treating the risk should be allocated in the beginning of the risk assessment process
正解：A
解説：
According to ISO/IEC 27005, the team responsible for the risk assessment is often tasked with coordinating the resources necessary to treat identified risks effectively. This includes ensuring that the resources required for implementing risk treatment actions, such as financial, technical, and human resources, are available and allocated appropriately. Option B is incorrect because it is not only the organization that allocates resources, but rather a combined effort involving the risk management team to ensure proper allocation. Option C is incorrect because resources must be managed and allocated continually throughout the risk management process, not just at the beginning.
質問 # 28
Scenario 2: Travivve is a travel agency that operates in more than 100 countries. Headquartered in San Francisco, the US, the agency is known for its personalized vacation packages and travel services. Travivve aims to deliver reliable services that meet its clients' needs. Considering the impact of information security in its reputation, Travivve decided to implement an information security management system (ISMS) based on ISO/IEC 27001. In addition, they decided to establish and implement an information security risk management program. Based on the priority of specific departments in Travivve, the top management decided to initially apply the risk management process only in the Sales Management Department. The process would be applicable for other departments only when introducing new technology.
Travivve's top management wanted to make sure that the risk management program is established based on the industry best practices. Therefore, they created a team of three members that would be responsible for establishing and implementing it. One of the team members was Travivve's risk manager who was responsible for supervising the team and planning all risk management activities. In addition, the risk manager was responsible for monitoring the program and reporting the monitoring results to the top management.
Initially, the team decided to analyze the internal and external context of Travivve. As part of the process of understanding the organization and its context, the team identified key processes and activities. Then, the team identified the interested parties and their basic requirements and determined the status of compliance with these requirements. In addition, the team identified all the reference documents that applied to the defined scope of the risk management process, which mainly included the Annex A of ISO/IEC 27001 and the internal security rules established by Travivve. Lastly, the team analyzed both reference documents and justified a few noncompliances with those requirements.
The risk manager selected the information security risk management method which was aligned with other approaches used by the company to manage other risks. The team also communicated the risk management process to all interested parties through previously established communication mechanisms. In addition, they made sure to inform all interested parties about their roles and responsibilities regarding risk management. Travivve also decided to involve interested parties in its risk management activities since, according to the top management, this process required their active participation.
Lastly, Travivve's risk management team decided to conduct the initial information security risk assessment process. As such, the team established the criteria for performing the information security risk assessment which included the consequence criteria and likelihood criteria.
Based on the scenario above, answer the following question:
Travivve decided to initially apply the risk management process only in the Sales Management Department. Is this acceptable?
- A. Yes, the risk management process may be applied to only a subset of departments in an organization
- B. No, the risk management process must be applied in all organizational levels
- C. Yes, the risk management process must be applied to only those departments that handle customers' personal information in an organization
正解：A
解説：
ISO/IEC 27005 provides guidance on risk management for information security, and it allows flexibility in applying the risk management process to different parts of an organization. The decision to initially apply the risk management process only to the Sales Management Department is acceptable under ISO/IEC 27005, as the standard supports the selective application of risk management activities based on the specific needs and priorities of the organization. This is in line with risk management best practices, where organizations may focus on critical areas first (such as high-risk departments or those that handle sensitive information) and later expand the process as needed. Therefore, applying the risk management process to a subset of departments is appropriate, making option B the correct answer.
Reference:
ISO/IEC 27005:2018, Clause 7, "Context Establishment," which allows defining the scope and boundaries of risk management as relevant to the organization's needs.
ISO/IEC 27001:2013, Clause 4.3, "Determining the scope of the information security management system," which also permits defining a scope based on priorities and relevance.
質問 # 29
Which of the following risk assessment methods provides an information security risk assessment methodology and involves three phases build asset-based threat profiles, identify infrastructure vulnerabilities, and develop security strategy and plans?
- A. MEHARI
- B. TRA
- C. OCTAVE-S
正解：C
解説：
OCTAVE-S (Operationally Critical Threat, Asset, and Vulnerability Evaluation for Small Organizations) is a risk assessment methodology tailored for small organizations. It provides a structured approach for identifying and managing information security risks. The OCTAVE-S method involves three main phases:
Building asset-based threat profiles, where critical assets and their associated threats are identified.
Identifying infrastructure vulnerabilities by assessing the organization's technological infrastructure for weaknesses that could be exploited by threats.
Developing security strategy and plans to address the identified risks and improve the overall security posture.
The OCTAVE-S method aligns with the description provided in the question, making it the correct answer. MEHARI and TRA are other risk assessment methods, but they do not specifically follow the three phases outlined above.
質問 # 30
Scenario 5: Detika is a private cardiology clinic in Pennsylvania, the US. Detika has one of the most advanced healthcare systems for treating heart diseases. The clinic uses sophisticated apparatus that detects heart diseases in early stages. Since 2010, medical information of Detika's patients is stored on the organization's digital systems. Electronic health records (EHR), among others, include patients' diagnosis, treatment plan, and laboratory results.
Storing and accessing patient and other medical data digitally was a huge and a risky step for Detik a. Considering the sensitivity of information stored in their systems, Detika conducts regular risk assessments to ensure that all information security risks are identified and managed. Last month, Detika conducted a risk assessment which was focused on the EHR system. During risk identification, the IT team found out that some employees were not updating the operating systems regularly. This could cause major problems such as a data breach or loss of software compatibility. In addition, the IT team tested the software and detected a flaw in one of the software modules used. Both issues were reported to the top management and they decided to implement appropriate controls for treating the identified risks. They decided to organize training sessions for all employees in order to make them aware of the importance of the system updates. In addition, the manager of the IT Department was appointed as the person responsible for ensuring that the software is regularly tested.
Another risk identified during the risk assessment was the risk of a potential ransomware attack. This risk was defined as low because all their data was backed up daily. The IT team decided to accept the actual risk of ransomware attacks and concluded that additional measures were not required. This decision was documented in the risk treatment plan and communicated to the risk owner. The risk owner approved the risk treatment plan and documented the risk assessment results.
Following that, Detika initiated the implementation of new controls. In addition, one of the employees of the IT Department was assigned the responsibility for monitoring the implementation process and ensure the effectiveness of the security controls. The IT team, on the other hand, was responsible for allocating the resources needed to effectively implement the new controls.
Based on the scenario above, answer the following question:
Which risk treatment option did Detika select to treat the risk regarding the update of operating system?
- A. Risk retention
- B. Risk sharing
- C. Risk modification
正解：C
解説：
Risk modification (also known as risk mitigation) involves applying controls to reduce the likelihood or impact of a risk to an acceptable level. In the scenario, Detika decided to organize training sessions for employees to ensure that they regularly update the operating systems. This action is aimed at modifying or reducing the risk associated with not updating the operating systems, which could lead to security breaches or software incompatibility. Therefore, the risk treatment option chosen by Detika for the risk regarding the update of the operating system is risk modification. Option A is the correct answer.
Reference:
ISO/IEC 27005:2018, Clause 8.6, "Risk Treatment," which includes modifying risk by implementing controls to mitigate it.
質問 # 31
Scenario 7: Adstry is a business growth agency that specializes in digital marketing strategies. Adstry helps organizations redefine the relationships with their customers through innovative solutions. Adstry is headquartered in San Francisco and recently opened two new offices in New York. The structure of the company is organized into teams which are led by project managers. The project manager has the full power in any decision related to projects. The team members, on the other hand, report the project's progress to project managers.
Considering that data breaches and ad fraud are common threats in the current business environment, managing risks is essential for Adstry. When planning new projects, each project manager is responsible for ensuring that risks related to a particular project have been identified, assessed, and mitigated. This means that project managers have also the role of the risk manager in Adstry. Taking into account that Adstry heavily relies on technology to complete their projects, their risk assessment certainly involves identification of risks associated with the use of information technology. At the earliest stages of each project, the project manager communicates the risk assessment results to its team members.
Adstry uses a risk management software which helps the project team to detect new potential risks during each phase of the project. This way, team members are informed in a timely manner for the new potential risks and are able to respond to them accordingly. The project managers are responsible for ensuring that the information provided to the team members is communicated using an appropriate language so it can be understood by all of them.
In addition, the project manager may include external interested parties affected by the project in the risk communication. If the project manager decides to include interested parties, the risk communication is thoroughly prepared. The project manager firstly identifies the interested parties that should be informed and takes into account their concerns and possible conflicts that may arise due to risk communication. The risks are communicated to the identified interested parties while taking into consideration the confidentiality of Adstry's information and determining the level of detail that should be included in the risk communication. The project managers use the same risk management software for risk communication with external interested parties since it provides a consistent view of risks. For each project, the project manager arranges regular meetings with relevant interested parties of the project, they discuss the detected risks, their prioritization, and determine appropriate treatment solutions. The information taken from the risk management software and the results of these meetings are documented and are used for decision-making processes. In addition, the company uses a computerized documented information management system for the acquisition, classification, storage, and archiving of its documents.
Based on scenario 7, Adstry's project managers hold regular meetings with interested parties to discuss risks and risk treatment solutions. According to the guidelines of ISO/IEC 27005, is this in compliance with best practices?
- A. Yes, the coordination between project managers and relevant interested parties can be achieved by discussions upon risks and appropriate treatment solutions
- B. No, risk owners should not communicate or discuss risk treatment options with external interested parties
- C. Yes, risks can be communicated to and discussed with relevant interested parties only if the project manager decides that it is appropriate to do so
正解：A
質問 # 32
Scenario 1
The risk assessment process was led by Henry, Bontton's risk manager. The first step that Henry took was identifying the company's assets. Afterward, Henry created various potential incident scenarios. One of the main concerns regarding the use of the application was the possibility of being targeted by cyber attackers, as a great number of organizations were experiencing cyberattacks during that time. After analyzing the identified risks, Henry evaluated them and concluded that new controls must be implemented if the company wants to use the application. Among others, he stated that training should be provided to personnel regarding the use of the application and that awareness sessions should be conducted regarding the importance of protecting customers' personal data.
Lastly, Henry communicated the risk assessment results to the top management. They decided that the application will be used only after treating the identified risks.
According to scenario 1, Bontton wanted to use an application that ensures only authorized users have access to customers' personal dat a. Which information security principle does Bontton want to ensure in this case?
- A. Integrity
- B. Confidentiality
- C. Availability
正解：B
解説：
In the context of information security, confidentiality refers to ensuring that information is accessible only to those who are authorized to have access. According to scenario 1, Bontton wanted to use an application that ensures only authorized users have access to customers' personal data. This directly aligns with the principle of confidentiality, as Bontton aims to protect personal data from unauthorized access or disclosure. This focus on restricting access to sensitive data to authorized personnel clearly indicates that the confidentiality of information is the primary concern in this case. Thus, the correct answer is C.
質問 # 33
Scenario 3: Printary is an American company that offers digital printing services. Creating cost-effective and creative products, the company has been part of the printing industry for more than 30 years. Three years ago, the company started to operate online, providing greater flexibility for its clients. Through the website, clients could find information about all services offered by Printary and order personalized products. However, operating online increased the risk of cyber threats, consequently, impacting the business functions of the company. Thus, along with the decision of creating an online business, the company focused on managing information security risks. Their risk management program was established based on ISO/IEC 27005 guidelines and industry best practices.
Last year, the company considered the integration of an online payment system on its website in order to provide more flexibility and transparency to customers. Printary analyzed various available solutions and selected Pay0, a payment processing solution that allows any company to easily collect payments on their website. Before making the decision, Printary conducted a risk assessment to identify and analyze information security risks associated with the software. The risk assessment process involved three phases: identification, analysis, and evaluation. During risk identification, the company inspected assets, threats, and vulnerabilities. In addition, to identify the information security risks, Printary used a list of the identified events that could negatively affect the achievement of information security objectives. The risk identification phase highlighted two main threats associated with the online payment system: error in use and data corruption After conducting a gap analysis, the company concluded that the existing security controls were sufficient to mitigate the threat of data corruption. However, the user interface of the payment solution was complicated, which could increase the risk associated with user errors, and, as a result, impact data integrity and confidentiality.
Subsequently, the risk identification results were analyzed. The company conducted risk analysis in order to understand the nature of the identified risks. They decided to use a quantitative risk analysis methodology because it would provide more detailed information. The selected risk analysis methodology was consistent with the risk evaluation criteri a. Firstly, they used a list of potential incident scenarios to assess their potential impact. In addition, the likelihood of incident scenarios was defined and assessed. Finally, the level of risk was defined as low.
In the end, the level of risk was compared to the risk evaluation and acceptance criteria and was prioritized accordingly.
Based on scenario 3, what does the complicated user interface of the software which could lead to error present?
- A. An asset
- B. A vulnerability
- C. A threat
正解：B
解説：
ISO/IEC 27005 defines a vulnerability as a weakness in an asset or control that could potentially be exploited by one or more threats. In the scenario, the complicated user interface of the payment software represents a weakness that could lead to user errors, potentially impacting data integrity and confidentiality. This aligns with the definition of a vulnerability, as it is a weakness that could be exploited by threats (e.g., errors in use). Therefore, the complicated user interface is correctly identified as a vulnerability, making option A the correct answer.
Reference:
ISO/IEC 27005:2018, Clause 8.3, "Risk Identification," where vulnerabilities are identified as weaknesses that can be exploited by threats.
質問 # 34
Which of the following statements best defines information security risk?
- A. The potential that threats will exploit vulnerabilities of an information asset and cause harm to an organization
- B. Potential cause of an unwanted incident related to information security that can cause harm to an organization
- C. Weakness of an asset or control that can be exploited by one or a group of threats
正解：A
解説：
Information security risk, as defined by ISO/IEC 27005, is "the potential that a threat will exploit a vulnerability of an asset or group of assets and thereby cause harm to the organization." This definition emphasizes the interplay between threats (e.g., cyber attackers, natural disasters), vulnerabilities (e.g., weaknesses in software, inadequate security controls), and the potential impact or harm that could result from this exploitation. Therefore, option A is the most comprehensive and accurate description of information security risk. In contrast, option B describes a vulnerability, and option C focuses on the cause of an incident rather than defining risk itself. Option A aligns directly with the risk definition in ISO/IEC 27005.
質問 # 35
Scenario 7: Adstry is a business growth agency that specializes in digital marketing strategies. Adstry helps organizations redefine the relationships with their customers through innovative solutions. Adstry is headquartered in San Francisco and recently opened two new offices in New York. The structure of the company is organized into teams which are led by project managers. The project manager has the full power in any decision related to projects. The team members, on the other hand, report the project's progress to project managers.
Considering that data breaches and ad fraud are common threats in the current business environment, managing risks is essential for Adstry. When planning new projects, each project manager is responsible for ensuring that risks related to a particular project have been identified, assessed, and mitigated. This means that project managers have also the role of the risk manager in Adstry. Taking into account that Adstry heavily relies on technology to complete their projects, their risk assessment certainly involves identification of risks associated with the use of information technology. At the earliest stages of each project, the project manager communicates the risk assessment results to its team members.
Adstry uses a risk management software which helps the project team to detect new potential risks during each phase of the project. This way, team members are informed in a timely manner for the new potential risks and are able to respond to them accordingly. The project managers are responsible for ensuring that the information provided to the team members is communicated using an appropriate language so it can be understood by all of them.
In addition, the project manager may include external interested parties affected by the project in the risk communication. If the project manager decides to include interested parties, the risk communication is thoroughly prepared. The project manager firstly identifies the interested parties that should be informed and takes into account their concerns and possible conflicts that may arise due to risk communication. The risks are communicated to the identified interested parties while taking into consideration the confidentiality of Adstry's information and determining the level of detail that should be included in the risk communication. The project managers use the same risk management software for risk communication with external interested parties since it provides a consistent view of risks. For each project, the project manager arranges regular meetings with relevant interested parties of the project, they discuss the detected risks, their prioritization, and determine appropriate treatment solutions. The information taken from the risk management software and the results of these meetings are documented and are used for decision-making processes. In addition, the company uses a computerized documented information management system for the acquisition, classification, storage, and archiving of its documents.
Based on the scenario above, answer the following question:
Which of the following documented information management systems does Adstry use?
- A. Content management system
- B. Electronic documented management system
- C. Cloud-based documented management system
正解：B
解説：
Adstry uses a computerized documented information management system for the acquisition, classification, storage, and archiving of documents. This type of system is typically referred to as an Electronic Document Management System (EDMS). An EDMS is designed to handle digital documents and support the management of information, ensuring that documents are stored, retrieved, and maintained efficiently. Option B (Content management system) is incorrect because it primarily manages web content rather than organizational documents. Option C (Cloud-based documented management system) could be partially correct if the EDMS is hosted in the cloud, but the scenario does not specify this.
質問 # 36
What are opportunities?
- A. Combination of circumstances expected to be favorable to objectives
- B. Outcome of an event affecting objectives
- C. Occurrence or change of a particular set of circumstances
正解：A
解説：
Opportunities, according to ISO standards such as ISO 31000, are situations or conditions that have the potential to provide a favorable impact on achieving objectives. They represent circumstances that, when leveraged, can lead to beneficial outcomes for the organization, such as competitive advantage, growth, or improved performance. Option B is correct as it accurately describes opportunities as circumstances expected to be favorable to achieving objectives. Option A (Occurrence or change of a particular set of circumstances) is a more general definition that could apply to both risks and opportunities, while Option C (Outcome of an event affecting objectives) is more aligned with the concept of risk.
質問 # 37
Scenario 6: Productscape is a market research company headquartered in Brussels, Belgium. It helps organizations understand the needs and expectations of their customers and identify new business opportunities. Productscape's teams have extensive experience in marketing and business strategy and work with some of the best-known organizations in Europe. The industry in which Productscape operates requires effective risk management. Considering that Productscape has access to clients' confidential information, it is responsible for ensuring its security. As such, the company conducts regular risk assessments. The top management appointed Alex as the risk manager, who is responsible for monitoring the risk management process and treating information security risks.
The last risk assessment conducted was focused on information assets. The purpose of this risk assessment was to identify information security risks, understand their level, and take appropriate action to treat them in order to ensure the security of their systems. Alex established a team of three members to perform the risk assessment activities. Each team member was responsible for specific departments included in the risk assessment scope. The risk assessment provided valuable information to identify, understand, and mitigate the risks that Productscape faces.
Initially, the team identified potential risks based on the risk identification results. Prior to analyzing the identified risks, the risk acceptance criteria were established. The criteria for accepting the risks were determined based on Productscape's objectives, operations, and technology. The team created various risk scenarios and determined the likelihood of occurrence as "low," "medium," or "high." They decided that if the likelihood of occurrence for a risk scenario is determined as "low," no further action would be taken. On the other hand, if the likelihood of occurrence for a risk scenario is determined as "high" or "medium," additional controls will be implemented. Some information security risk scenarios defined by Productscape's team were as follows:
1. A cyber attacker exploits a security misconfiguration vulnerability of Productscape's website to launch an attack, which, in turn, could make the website unavailable to users.
2. A cyber attacker gains access to confidential information of clients and may threaten to make the information publicly available unless a ransom is paid.
3. An internal employee clicks on a link embedded in an email that redirects them to an unsecured website, installing a malware on the device.
The likelihood of occurrence for the first risk scenario was determined as "medium." One of the main reasons that such a risk could occur was the usage of default accounts and password. Attackers could exploit this vulnerability and launch a brute-force attack. Therefore, Productscape decided to start using an automated "build and deploy" process which would test the software on deploy and minimize the likelihood of such an incident from happening. However, the team made it clear that the implementation of this process would not eliminate the risk completely and that there was still a low possibility for this risk to occur. Productscape documented the remaining risk and decided to monitor it for changes.
The likelihood of occurrence for the second risk scenario was determined as "medium." Productscape decided to contract an IT company that would provide technical assistance and monitor the company's systems and networks in order to prevent such incidents from happening.
The likelihood of occurrence for the third risk scenario was determined as "high." Thus, Productscape decided to include phishing as a topic on their information security training sessions. In addition, Alex reviewed the controls of Annex A of ISO/IEC 27001 in order to determine the necessary controls for treating this risk. Alex decided to implement control A.8.23 Web filtering which would help the company to reduce the risk of accessing unsecure websites. Although security controls were implemented to treat the risk, the level of the residual risk still did not meet the risk acceptance criteria defined in the beginning of the risk assessment process. Since the cost of implementing additional controls was too high for the company, Productscape decided to accept the residual risk. Therefore, risk owners were assigned the responsibility of managing the residual risk.
Based on scenario 6, Productscape decided to monitor the remaining risk after risk treatment. Is this necessary?
- A. No, there is no need to monitor risks that meet the risk acceptance criteria
- B. No, unless the risk has a severe impact if it occurs, there is no need to monitor the risk
- C. Yes, the remaining risk after risk treatment should be monitored and reviewed
正解：C
解説：
ISO/IEC 27005 advises that even after risks have been treated, any residual risks should be continuously monitored and reviewed. This is necessary to ensure that they remain within acceptable levels and that any changes in the internal or external environment do not escalate the risk beyond acceptable thresholds. Monitoring also ensures that the effectiveness of the controls remains adequate over time. Option A is incorrect because all risks, including those meeting the risk acceptance criteria, should be monitored. Option B is incorrect because monitoring is necessary regardless of the perceived severity if it occurs, to detect changes early.
質問 # 38
After creating a plan for outsourcing to a cloud service provider to store their confidential information in cloud, OrgX decided to not pursue this business strategy since the risk of doing so was high. Which risk treatment option did OrgX use?
- A. Risk sharing
- B. Risk modification
- C. Risk avoidance
正解：C
解説：
OrgX decided not to pursue a business strategy involving outsourcing to a cloud service provider due to the high risk. This decision reflects a "risk avoidance" strategy, where the organization chooses not to engage in an activity that poses unacceptable risks. This aligns with option A.
質問 # 39
What should an organization do after it has established the risk communication plan?
- A. Establish internal and external communication
- B. Update the information security policy
- C. Change the communication approach and tools
正解：A
解説：
Once an organization has established a risk communication plan, it should implement it by establishing both internal and external communication channels to ensure all stakeholders are informed and involved in the risk management process. This step is crucial for maintaining transparency, ensuring clarity, and fostering a collaborative environment where risks are managed effectively. Therefore, option C is the correct answer.
Reference:
ISO/IEC 27005:2018, Clause 7, "Communication and Consultation," which outlines the importance of establishing both internal and external communication mechanisms to ensure effective risk management.
質問 # 40
......
ベストなPECB ISO-IEC-27005-Risk-Manager学習ガイドと問題集には2025：https://www.goshiken.com/PECB/ISO-IEC-27005-Risk-Manager-mondaishu.html
トップクラスPECB ISO-IEC-27005-Risk-Manager試験材料で学習ガイド！練習問題バージョンで挑もう：https://drive.google.com/open?id=1TwoorPQYKvfuoxCFb66J4TD0IROdiVTH