Which two of the following statements are true?

• A.The benefit of certifying an ISMS is to show the accreditation certificate on the website.
• B.The purpose of an ISMS is to demonstrate awareness of information security issues by management.
• C.The benefit of certifying an ISMS is to increase the number of customers.
• D.The benefits of implementing an ISMS primarily result from a reduction in information security risks.
• E.The purpose of an ISMS is to apply a risk management process for preserving information security.
• F.The purpose of an ISMS is to demonstrate compliance with regulatory requirements.

Comment: *

Name: *

Email: *

Verification: *

You have just completed a scheduled information security audit of your organisation when the IT Manager approaches you and asks for your assistance in the revision of the company's risk management process.
He is attempting to update the current documentation to make it easier for other managers to understand, however, it is clear from your discussion he is confusing several key terms.
You ask him to match each of the descriptions with the appropriate risk term. What should the correct answers be?

Correct Answer:

Explanation
The correct answers for matching each of the descriptions with the appropriate risk term are:
The strategy chosen to respond to a specific information security risk: This is a definition of information security risk treatment. According to ISO/IEC 27000:2022, information security risk treatment is "the process of selecting and implementing measures to modify the information security risk" Section 3.33.
The effect of uncertainty on information security objectives: This is a definition of information security risk. According to ISO/IEC 27000:2022, information security risk is "the effect of uncertainty on information security objectives" Section 3.32.
The requirements against which information security risks are evaluated: This is a definition of information security risk criteria. According to ISO/IEC 27000:2022, information security risk criteria are "the terms of reference by which the significance of information security risks is assessed" Section
3.31.
A definition of the overall level of information security risk that is considered to be tolerable: This is a definition of information security risk acceptance criteria. According to ISO/IEC 27000:2022, information security risk acceptance criteria are "the level of information security risk that is acceptable" Section 3.30.

Comment: *

Name: *

Email: *

Verification: *

You are the lead auditor of the courier company SpeeDelivery. You have carried out a risk analysis and now want to determine your risk strategy. You decide to take measures for the large risks but not for the small risks.
What is this risk strategy called?

• A.Risk bearing
• B.Risk avoidance
• C.Risk neutral
• D.Risk skipping

Comment: *

Name: *

Email: *

Verification: *

Does the security have the right to ask you to display your ID badges and check your bags?

• A.True
• B.False

Comment: *

Name: *

Email: *

Verification: *

How is the purpose of information security policy best described?

• A.An information security policy documents the analysis of risks and the search for countermeasures.
• B.An information security policy provides direction and support to the management regarding information security.
• C.An information security policy makes the security plan concrete by providing it with the necessary details.
• D.An information security policy provides insight into threats and the possible consequences.

Comment: *

Name: *

Email: *

Verification: *