ISO 27001 PRACTITIONER EN D1 - EX 1

The statement "risk = value X vulnerability X threat" indicates that:

• A. Risk can be quantified using annual loss expectancy (ALE).

• B. The level of risk is greater where the asset value is highest.

• C. Risk is derived from one or all of its subcomponents.

• D. Without knowing value, risk cannot be calculated.

A risk analysis should:

• A. Limits the scope to a benchmark of similar companies.

• B. Assume an equal degree of protection for all assets.

• C. Address the potential impacts and likelihood of loss.

• D. Give more weight to the likelihood vs. the size of the loss.

Residual risk can be determined by:

• A. Assessing risk after security controls are in place.

• B. Performing a threat analysis.

• C. Identification of new risk scenarios after treatment of risk

• D. Carrying out a risk transfer

Which of the following factors BEST helps determine the appropriate protection level for an information asset?

• A. The cost of acquisition and implementation of the asset.

• B. Knowledge of vulnerabilities present in the asset.

• C. The degree of exposure to known threats.

• D. The criticality of the business process supported by the asset.

What are the MOST important considerations when prioritizing the implementation of security controls to treat

the risks?

• A. Likelihood and impact.

• B. Impact and exposure.

• C. Asset criticality and sensitivity.

• D. Asset value and classification.