Question 1

What risk treatment option has Company A implemented if it has required from its employees the change of email passwords at least once every 60 days?

Options :

A : Risk modification

B : Risk avoidance

C : Risk retention

Answer: A

Question 2

What do employees need to know to report a security incident?

Options :

A : How to report an incident and to whom.

B : Whether the incident has occurred before and what was the resulting damage.

C : The measures that should have been taken to prevent the incident in the first place.

D : Who is responsible for the incident and whether it was intentional.

Answer: A

Question 3

Scenario 6: Skyver offers worldwide shipping of electronic products, including gaming consoles, flat-screen TVs. computers, and printers. In order to ensure information security, the company has decidedto implement an information security management system (ISMS) based on the requirements of ISO/IEC 27001. Colin, the company's best information security expert, decided to hold a training and awareness session for the personnel of the company regarding the information security challenges and other information security-related controls. The session included topics such as Skyver's information security approaches and techniques for mitigating phishing and malware. One of the participants in the session is Lisa, who works in the HR Department. Although Colin explains the existing Skyver's information security policies and procedures in an honest and fair manner, she finds some of the issues being discussed too technical and does not fully understand the session. Therefore, in a lot of cases, she requests additional help from the trainer and her colleagues What is the difference between training and awareness? Refer to scenario 6.

Options :

A : Training helps acquire certain skills, whereas awareness develops certain habits and behaviors.

B : Training helps acquire a skill, whereas awareness helps apply it in practice

C :

Training helps transfer a message with the intent of informing, whereas awareness helps change the behavior toward the message

Answer: A

Question 4

You are the owner of a growing company, SpeeDelivery, which provides courier services. You decide that it is time to draw up a risk analysis for your information system. This includes an inventoryof threats and risks. What is the relation between a threat, risk and risk analysis?

Options :

A : A risk analysis identifies threats from the known risks.

B : A risk analysis is used to clarify which threats are relevant and what risks they involve.

C : A riskanalysis is used to remove the risk of a threat.

D : Risk analyses help to find a balance between threats and risks.

Answer: B

Question 5

The purpose of control 5.9 inventory of Information and other associated assets of ISO/IEC 27001 is to identify organization's information and other associated assets in order to preserve their information security and assign ownership. Which of the following actions docs NOT fulfill this purpose?

Options :

A : Conducting regular reviews of identified information and other associated assets

B : Establishing rules to control physical and logical access to Information and other associated assets

C :

Assigning the responsibility for appropriately classifying and protecting information and other associated assets to the asset owners

Answer: B