在 2026 年的求職市場上，PECB 認證依然是企業辨識專業能力的重要依據。想順利取得 PECB Certified ISO/IEC 27005 Risk Manager 認證，KaoGuTi 的 ISO-IEC-27005-Risk-Manager 題庫是值得信賴的備考工具。

PECB ISO-IEC-27005-Risk-Manager 考試概覽:

認證廠商:	PECB ()
考試名稱:	PECB 認證 ISO/IEC 27005 風險經理考試
考試代碼:	ISO-IEC-27005-Risk-Manager
考試形式:	閉卷考試, 選擇題
考試費用:	因地區而異（通常在 500-1000 USD 之間，官方未固定價格）
相關認證:	ISO/IEC 27005 Risk Manager ISO/IEC 27001 Lead Implementer ISO/IEC 27001 Lead Auditor
及格分數:	70%
考試時間:	120-180
實際考試題數:	80
支援語言:	Portuguese, English, French, Spanish, Arabic
證照有效期限:	3 年
推薦課程:	PECB ISO/IEC 27005 風險經理培訓課程
考試報名:	PECB 官方認證入口網站
範例考題:
考試方式:	線上或現場監考考試
必備條件:	無強制性先決條件，但強烈建議具備 ISO/IEC 27001 和資訊安全管理知識
官方大綱網址:	https://pecb.com

PECB ISO-IEC-27005-Risk-Manager 考試大綱主題:

PECB Certified ISO/IEC 27005 Risk Manager 考試常見問題解答

最新的 ISO/IEC 27005 ISO-IEC-27005-Risk-Manager 免費考試真題：

問題 #1

According to ISO 31000, which of the following is a principle of risk management?

A. Dynamic
B. Qualitative
C. Reliability

問題 #2

Scenario 4: In 2017, seeing that millions of people turned to online shopping, Ed and James Cordon founded the online marketplace for footwear called Poshoe. In the past, purchasing pre-owned designer shoes online was not a pleasant experience because of unattractive pictures and an inability to ascertain the products' authenticity. However, after Poshoe's establishment, each product was well advertised and certified as authentic before being offered to clients. This increased the customers' confidence and trust in Poshoe's products and services. Poshoe has approximately four million users and its mission is to dominate the second-hand sneaker market and become a multi-billion dollar company.
Due to the significant increase of daily online buyers, Poshoe's top management decided to adopt a big data analytics tool that could help the company effectively handle, store, and analyze dat a. Before initiating the implementation process, they decided to conduct a risk assessment. Initially, the company identified its assets, threats, and vulnerabilities associated with its information systems. In terms of assets, the company identified the information that was vital to the achievement of the organization's mission and objectives. During this phase, the company also detected a rootkit in their software, through which an attacker could remotely access Poshoe's systems and acquire sensitive data.
The company discovered that the rootkit had been installed by an attacker who had gained administrator access. As a result, the attacker was able to obtain the customers' personal data after they purchased a product from Poshoe. Luckily, the company was able to execute some scans from the target device and gain greater visibility into their software's settings in order to identify the vulnerability of the system.
The company initially used the qualitative risk analysis technique to assess the consequences and the likelihood and to determine the level of risk. The company defined the likelihood of risk as "a few times in two years with the probability of 1 to 3 times per year." Later, it was decided that they would use a quantitative risk analysis methodology since it would provide additional information on this major risk. Lastly, the top management decided to treat the risk immediately as it could expose the company to other issues. In addition, it was communicated to their employees that they should update, secure, and back up Poshoe's software in order to protect customers' personal information and prevent unauthorized access from attackers.
Based on scenario 4, which scanning tool did Poshoe use to detect the vulnerability in their software?

A. Network-based scanning tool
B. Host-based scanning tool
C. Penetration testing tool

問題 #3

Scenario 1
The risk assessment process was led by Henry, Bontton's risk manager. The first step that Henry took was identifying the company's assets. Afterward, Henry created various potential incident scenarios. One of the main concerns regarding the use of the application was the possibility of being targeted by cyber attackers, as a great number of organizations were experiencing cyberattacks during that time. After analyzing the identified risks, Henry evaluated them and concluded that new controls must be implemented if the company wants to use the application. Among others, he stated that training should be provided to personnel regarding the use of the application and that awareness sessions should be conducted regarding the importance of protecting customers' personal data.
Lastly, Henry communicated the risk assessment results to the top management. They decided that the application will be used only after treating the identified risks.
According to scenario 1, what type of controls did Henry suggest?

A. Technical
B. Administrative
C. Managerial

問題 #4

Which statement regarding information gathering techniques is correct?

A. Sending questionnaires to a group of people who represent the interested parties is NOT preferred
B. Organizations can utilize technical tools to identify technical vulnerabilities and compile a list of assets that influence risk assessment
C. Interviews should be conducted only with individuals responsible for information security management

問題 #5

An organization decided to use nonnumerical categories, i.e., low, medium, and high for describing consequence and probability. Which risk analysis methodology is the organization using?

A. Semi-quantitative
B. Qualitative
C. Quantitative

問題與答案：