IPA IP 2022 Question 86
A question IPA Japan published in 令和4年度 ITパスポート試験 公開問題 問86, translated into English. ITPEC is based on the same exams.
When risk assessment in information security is divided into three (3) processes, namely, risk identification, risk analysis, and risk evaluation, which of the following is the most appropriate description concerning risk analysis?
Explanation
Determine each risk’s level so it can be compared with the acceptance criteria — that is what risk analysis produces.
In ISO/IEC 27001 risk assessment, the three processes run in order:
- •Risk identification: find the risks, with the assets, threats and vulnerabilities behind them
- •Risk analysis: work out the likelihood and consequence of each risk and so its level
- •Risk evaluation: compare those levels with the risk acceptance criteria and decide which risks are acceptable and which must be treated first
Analysis therefore has to express each risk as a level that evaluation can set against the criteria.
Answer (a)
Why not others:
- •(b) — the scope of analysis is the risks found in identification; assets may be grouped or prioritized, and nothing requires every asset to be analysed
- •(c) — techniques may differ by risk (qualitative for some, quantitative for others), so one technique for all is not required
- •(d) — deciding whether a risk is acceptable is risk evaluation, the step after analysis
Key rule: Identification finds risks, analysis measures their level, evaluation compares the level with the acceptance criteria.
Security · AI-written, may contain errors
This question comes from the past questions IPA Japan publishes, translated into English by ITPEC Practice. ITPEC Practice is an independent study tool and is not affiliated with IPA or ITPEC. See the original paper (PDF) or Report an issue.