先試後買

A. A weakness of an asset or a control that can be exploited

B. A potential cause of an unwanted incident which can result in harm to a system or organization

C. A single or a series of unwanted or unexpected information security events

D. The risk remaining after risk treatment

A. Guidelines for information security management systems auditing

B. Information security management systems ?Requirements

C. Information security controls

D. Guidance on managing information security risks

A. To ensure that employees and contractors are competent

B. To monitor the use of information assets

C. To evaluate information security performance

D. To track the use of outsourced processes

A. The criteria for acceptable levels of risk

B. How the effectiveness of the method will be measured

C. The parts of the ISMS scope which are excluded from the risk assessment

D. There are NO specific information requirements

A. To eliminate all information security risks

B. To prevent cyberattacks completely

C. To comply only with legal requirements

D. To protect information through a systematic risk management process

A. All employees, contractors and third-party users

B. Employees only

C. Personnel and the organization

D. Contractors only

A. Producing a risk assessment report

B. Communicating feedback from interested parties to the organization

C. Ensuring information security objectives are established

D. Implementing the actions from internal audits

A. Clause 4.3

B. Clause 6.1

C. Clause 5.1

D. Clause 9.2