ISO-IEC-27005-Risk-Manager Exam Dumps : PECB Certified ISO/IEC 27005 Risk Manager

Based on the NIST Risk Management Framework (RMF), the last step of the risk management process is "Monitoring Security Controls." This step involves continuously tracking the effectiveness of the implemented security controls, ensuring they remain effective against identified risks, and adapting them to any changes in the threat landscape. Option A correctly identifies the final step.

Aqualitative risk analysismethod uses nonnumerical categories such as low, medium, and high to describe the consequences and probability of risks. This method involves subjective judgment based on expertise, experience, and intuition rather than mathematical calculations. Qualitative methods are often used when it is challenging to obtain accurate numerical data, and they provide a general understanding of risks to prioritize them for further action. Option C is correct because the use of nonnumerical categories aligns with the qualitative risk analysis methodology. Option A (Quantitative) is incorrect as it involves numerical values and statistical methods, while Option B (Semi-quantitative) is a mix of qualitative and quantitative methods, usually involving ranges of numerical values.

According to ISO/IEC 27005, the input for selecting information security risk treatment options should include a list of prioritized risks along with the specific event or risk scenarios that led to those risks. This information helps decision-makers understand the context and potential impact of each risk, allowing them to choose the most appropriate treatment options. Option A is incorrect because the risk treatment plan and residual risks are outputs, not inputs, of the risk treatment process. Option C is incorrect because a list of risks with level values assigned provides limited context for selecting appropriate treatment options.