100% Free ISO-27005-LRM Practice Exam Questions and Answers

Stay Ahead with Latest ISO-27005-LRM GAQM ISO Practice Test Questions 2026

Page: 1 / 160

Total 796 Questions | Updated On: Oct 26, 2026

Add To Cart

Question 1

A manufacturing company identifies a high risk of equipment failure. After applying maintenance and monitoring controls, the risk is reassessed. What type of risk rating does this reassessment represent?

A : Transferred risk, as it considers the outsourcing of equipment maintenance.

B : Residual risk, as it reflects the risk level after applying controls.

C : Target risk, as it indicates the risk level the company aims for.

D : Inherent risk, as it is the initial risk level.

Answer: B

Question 2

A healthcare organization is evaluating risks to its patient data management system. To effectively identify risks, what approach should be used?

A : Conducting a comprehensive audit of the IT infrastructure.

B : Asset-based risk identification, including hardware, software, and data assets.

C : Focusing on the legal and regulatory compliance aspects of patient data.

D : Engaging external experts to perform a risk assessment.

Answer: B

Question 3

A manufacturing company is using MEHARI to assess the risks to its industrial control systems. The team is at the initial stage of the process. What should be the primary focus at this stage according to MEHARI, and how does it contribute to the risk assessment process?

A : Determining the security objectives and identifying the scope, including the assets and processes of the industrial control systems.

B : Directly implementing security controls based on industry best practices.

C : Conducting a financial analysis to estimate potential losses from security incidents.

D : Outsourcing risk assessment to an external cybersecurity firm.

Answer: A

Question 4

A multinational corporation is implementing a new enterprise resource planning (ERP) system. During the risk identification phase, what should be the primary focus to ensure comprehensive coverage of potential risks?

A : Analyzing financial impacts of potential ERP system failures.

B : Focusing on the security of data transmission within the ERP system.

C : Identifying all assets associated with the ERP system, including hardware, software, and data.

D : Assessing the impact of the ERP system on employee productivity.

Answer: C

Question 5

A technology firm is using the NIST framework for risk assessment of its cloud services. The firm has multiple cloud service models (IaaS, PaaS, SaaS) in operation. In this scenario, what should be the focus of the risk assessment process according to the NIST framework, and why is this focus important?

A : Assessing risks based only on the highest level of service model (SaaS).

B : Evaluating risks for each service model separately, considering their specific characteristics and threat landscapes.

C : Concentrating solely on physical security risks of cloud infrastructure.

D : Delegating the risk assessment process entirely to the cloud service provider.

Answer: B

Page: 1 / 160

Total 796 Questions | Updated On: Oct 26, 2026

Add To Cart