What is the primary role of ISO/IEC 27005 in an organization's IT risk management process?

To provide guidelines for the process of information security risk management

To offer a generic framework for enterprise risk management applicable to all business areas

To provide a certification standard for information security management systems

To define specific security controls that must be implemented

A large enterprise has a mature IT governance structure based on COBIT and wants to integrate risk management more formally. The board wants to ensure that IT risks are considered in strategic decision-making. Which approach best integrates risk management with IT governance?

Replace COBIT with NIST RMF to ensure comprehensive risk management.

Use ISO/IEC 27005 as the sole governance framework.

Align COBIT's risk management processes with ISO 31000 principles and embed risk reviews into IT investment decisions.

Keep COBIT and risk management separate to avoid complexity.

Certified in the Governance of Enterprise IT

Domain 4Objective 1

Risk Frameworks and Standards CGEIT Practice Questions (Page 4)

Part of the Risk Optimization domain, which accounts for 19% of the CGEIT exam.

23questions here

5free pages

5concepts

19%of the exam

Questions 16–20

16foundation · easy
An organization that must comply with U.S. federal cybersecurity requirements is selecting a risk framework. Which framework would be most appropriate for this regulatory context?
Select an answer first
17foundation · easy
A company is using ISO/IEC 27005 to manage risks to its customer database. After identifying a risk of unauthorized access, what is the next step in the risk management process?
Select an answer first
18foundation · easy
What is the primary role of ISO/IEC 27005 in an organization's IT risk management process?
Select an answer first
19expert · hard
A large enterprise has a mature IT governance structure based on COBIT and wants to integrate risk management more formally. The board wants to ensure that IT risks are considered in strategic decision-making. Which approach best integrates risk management with IT governance?
Select an answer first
20application · medium
A non-profit organization wants to implement a risk management framework that is simple, cost-effective, and focuses on mission-critical risks. The organization does not have a dedicated IT risk team. Which framework is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CGEIT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISACA. “CGEIT” is a trademark of its owner, used for identification only.

Risk Frameworks and Standards CGEIT Practice Questions (Page 4)

Questions 16–20

An organization that must comply with U.S. federal cybersecurity requirements is selecting a risk framework. Which framework would be most appropriate for this regulatory context?

A company is using ISO/IEC 27005 to manage risks to its customer database. After identifying a risk of unauthorized access, what is the next step in the risk management process?

What is the primary role of ISO/IEC 27005 in an organization's IT risk management process?

A large enterprise has a mature IT governance structure based on COBIT and wants to integrate risk management more formally. The board wants to ensure that IT risks are considered in strategic decision-making. Which approach best integrates risk management with IT governance?

A non-profit organization wants to implement a risk management framework that is simple, cost-effective, and focuses on mission-critical risks. The organization does not have a dedicated IT risk team. Which framework is most appropriate?

Keep studying — Risk Optimization