Free GAQM ISO-27005-LRM Exam Questions

Become GAQM Certified with updated ISO-27005-LRM exam questions and correct answers

Page: 1 / 160

Total 796 Questions | Updated On: Aug 18, 2026

Add To Cart

Question 1

An e-commerce company is developing a risk treatment plan to address the risk of DDoS attacks on its website. They are considering options such as upgrading their infrastructure, implementing a cloud-based DDoS protection service, establishing an incident response team, or a combination of these measures. Which option should be included in the risk treatment plan to effectively manage this risk?

A : Establishing an incident response team only.

B : A combination of infrastructure upgrade, cloud-based DDoS protection, and an incident response team.

C : Implementing a cloud-based DDoS protection service only.

D : Upgrading their infrastructure only.

Answer: B

Question 2

An IT service provider is monitoring and reviewing its risk management process. What is the primary objective of this stage according to ISO/IEC 27005?

A : Focusing exclusively on external audits without internal evaluations.

B : Completely discontinuing the risk management process after initial implementation.

C : Assuming that the implemented risk controls will remain effective indefinitely without further review.

D : Regularly assessing the effectiveness of the risk management process and making improvements as necessary.

Answer: D

Question 3

An e-commerce company is establishing risk acceptance criteria. What is an important factor to consider when defining these criteria?

A : Copying risk acceptance criteria from a different industry without modification.

B : Defining criteria based on the company's risk appetite and the potential impact on its online business operations.

C : Setting criteria that accept all risks to expedite the decision-making process.

D : Basing criteria solely on the personal preferences of the risk manager.

Answer: B

Question 4

A healthcare organization is evaluating risks to its patient data management system. To effectively identify risks, what approach should be used?

A : Conducting a comprehensive audit of the IT infrastructure.

B : Asset-based risk identification, including hardware, software, and data assets.

C : Focusing on the legal and regulatory compliance aspects of patient data.

D : Engaging external experts to perform a risk assessment.

Answer: B

Question 5

A financial institution has developed a risk treatment plan to address the risk of online fraud. The plan includes implementing multi-factor authentication and real-time fraud detection systems. Before proceeding, what factor is crucial for evaluating the acceptability of the risk treatment plan as per ISO/IEC 27005?

A : The level of residual risk after implementing the controls.

B : The technical feasibility of implementing the proposed controls.

C : The impact of the controls on user experience and customer satisfaction.

D : The compatibility of new controls with existing systems.

Answer: A

Page: 1 / 160

Total 796 Questions | Updated On: Aug 18, 2026

Add To Cart