PECB · ISO27005RM
PECB Certified ISO/IEC 27005 Risk Manager Practice Tests
Validates the ability to manage information security risks based on ISO/IEC 27005. Covers risk management concepts, the implementation of a risk management program, the ISO/IEC 27005 framework and process, and other risk assessment methods.
Exam Details
Practice Questions
140
≈ 2 practice exams
Duration
120 minutes
Passing Score
70%
Difficulty
ProfessionalLast Updated
Oct 2026
Topics Covered
Fundamental Principles of Information Security Risk ManagementRisk Assessment Based on ISO/IEC 27005Risk Treatment, Acceptance, and CommunicationRisk Monitoring and ReviewOther Risk Assessment Methodologies (OCTAVE, EBIOS, MEHARI)
PECB Certified ISO/IEC 27005 Risk Manager Practice Exam Preparation
Use this ISO27005RM practice exam to prepare for PECB Certified ISO/IEC 27005 Risk Manager with realistic questions, detailed explanations, and focused study modes. The practice bank includes 140 questions for PECB ISO27005RM, so you can review the exam steadily instead of relying on one long cram session.
As you practice, pay extra attention to recurring topics such as Fundamental Principles of Information Security Risk Management, Risk Assessment Based on ISO/IEC 27005, Risk Treatment, Acceptance, and Communication, Risk Monitoring and Review, and Other Risk Assessment Methodologies (OCTAVE, EBIOS, MEHARI). Start with short sessions to identify weak areas, then move into timed quizzes once your accuracy is consistent.
The explanations are written for candidates preparing for PECB certification questions and reviewing how the concepts apply in practice. Use the free preview first, then unlock the full question bank when you are ready to build a complete study routine.
Sample Questions
5 sample questions with answers and explanations. The full bank has 140 questions, enough for 2 full-length practice exams.
Preview — answers shown1. The risk manager is using PESTLE analysis to establish the external context. Which factor does the 'L' in PESTLE represent? (Select one!)
ALegal
BLabor
CLeadership
DLogistics
Explanation
PESTLE stands for Political, Economic, Social, Technological, Legal, and Environmental. It is a recommended tool for analyzing external issues. Leadership, Logistics, and Labor are not components of the PESTLE framework.
2. During a risk evaluation, the team calculates a high inherent risk for a legacy application. What is the next step? (Select one!)
ARisk identification
BContext establishment
CRisk analysis
DRisk treatment
Explanation
The risk management process follows five stages: context, identification, analysis, evaluation, and treatment. After risk evaluation (which determines if the risk is tolerable), the next step is risk treatment to address unacceptable risks. Identification and analysis precede evaluation.
3. A risk analyst is calculating the Single Loss Expectancy (SLE) for a critical database. If the asset value is $100,000 and the exposure factor is 20%, what is the SLE? (Select one!)
A$500,000
B$100,000
C$20,000
D$80,000
Explanation
Single Loss Expectancy (SLE) is calculated as Asset Value multiplied by the Exposure Factor (EF). In this scenario, $100,000 multiplied by 0.20 (20%) equals $20,000. This quantitative measure helps in determining the financial impact of a single risk event.
4. A risk manager is performing a qualitative analysis and assigns a 'High' rating to the chance of a server failure. What term best describes this 'High' rating? (Select one!)
AVulnerability
BThreat
CConsequence
DLikelihood
Explanation
Likelihood is the chance of something happening. In qualitative risk analysis, likelihood is often expressed using descriptive scales such as Low, Medium, or High. It is distinct from consequence (the result of the event), vulnerability (the weakness), and threat (the cause).
5. Which document lists selected controls and their justification for risk treatment? (Select one!)
AThe Statement of Applicability
BThe security incident report
CThe organizational risk register
DThe internal audit checklist
Explanation
The Statement of Applicability (SoA) is a required document under ISO/IEC 27001 that lists selected controls and their justification, aligning with ISO/IEC 27005 risk treatment planning. The risk register tracks identified risks but does not primarily list control justifications. Incident reports document past events, not planned controls. Audit checklists verify compliance but do not define control selection.
More PECB Practice Exams
PECB Certified ISO/IEC 27001 Lead Implementer
ISO27001LI · 300 questions
PECB Certified ISO/IEC 42001 Lead Implementer
ISO42001LI · 121 questions
PECB ISO/IEC 27001:2022 Foundation
ISO/IEC 27001 Foundation · 300 questions
PECB Certified ISO/IEC 27701 Lead Auditor
ISO27701LA · 188 questions
PECB Certified ISO/IEC 27701 Lead Implementer
ISO27701LI · 210 questions
PECB ISO/IEC 42001 Foundation
ISO/IEC 42001 Foundation · 111 questions
$29.99
One-time access to this exam
140 questions (2 practice exams' worth)
Unlimited timed exam simulations
Lifetime $29.99 or $9.99/month, cancel anytime
Detailed explanations
Free preview stays available