ITPEC FE Morning October 2021 Question 40

Magnitude of a risk as the combination of consequences and their likelihood — ISO/IEC 27000 measures a risk by how bad it is and how likely.

A risk with severe consequences but a tiny likelihood can have the same level as a minor one that is almost certain. Risk analysis determines this level, and risk evaluation then compares it with the risk criteria to decide which risks need treatment.

Answer (a)

Why not others:

• •(b) — terms of reference for evaluating the significance of a risk are the risk criteria
• •(c) — a priority order for handling risks is an outcome of risk evaluation, not the definition of level of risk
• •(d) — a weakness of an asset or control that threats can exploit is a vulnerability

Key rule: In ISO/IEC 27000, a vulnerability is the weakness, level of risk combines consequences and likelihood, and risk criteria are the yardstick the level is compared against.

Security · AI-written, may contain errors