PECB ISO/IEC 27005 ISO-IEC-27005-Risk-Manager

Certification exams change, and Getcertkey keeps pace: the ISO-IEC-27005-Risk-Manager practice question set is reviewed continuously and updated free of charge for 365 days. Your PECB Certified ISO/IEC 27005 Risk Manager preparation stays aligned with the current exam throughout 2026 and beyond.

PECB ISO-IEC-27005-Risk-Manager Exam Overview:

Certification Vendor:	PECB
Exam Name:	PECB Certified ISO/IEC 27005 Risk Manager Exam
Exam Number:	ISO-IEC-27005-Risk-Manager
Real Exam Qty:	60
Exam Price:	$300 - $450 USD
Available Languages:	Portuguese, German, Italian, Spanish, French, English
Related Certifications:	PECB Certified ISO/IEC 27005 Lead Risk Manager PECB Certified ISO/IEC 27005 Provisional Risk Manager
Passing Score:	70%
Exam Duration:	120 minutes
Certificate Validity Period:	3 years
Exam Format:	Scenario-based questions, Multiple-choice questions
Recommended Training:	PECB ISO/IEC 27005 Risk Manager Training Course
Exam Registration:	PECB Official Registration
Sample Questions:
Exam Way:	Online proctored or onsite at authorized exam centers
Pre Condition:	Basic knowledge of information security and ISO/IEC 27001; no mandatory prior certification required; for full certification: 2 years professional experience including 1 year in risk management, 200 hours of relevant activities, sign PECB Code of Ethics
Official Syllabus URL:	https://pecb.com/en/education-and-certification-for-individuals/iso-iec-27005/iso-iec-27005-risk-manager

PECB ISO-IEC-27005-Risk-Manager Exam Syllabus Topics:

ISO-IEC-27005-Risk-Manager Exam FAQs for 2026 Candidates

Which certification does the ISO-IEC-27005-Risk-Manager exam lead to?

The ISO-IEC-27005-Risk-Manager exam is the official PECB exam behind the PECB Certified ISO/IEC 27005 Risk Manager certification, validating the skills measured by the PECB Certified ISO/IEC 27005 Risk Manager credential. It sits at the Manager level of the PECB certification program. It also connects to PECB Certified ISO/IEC 27005 Provisional Risk Manager, PECB Certified ISO/IEC 27005 Lead Risk Manager, so the knowledge you build here carries over to those tracks as well.

How many questions are on the ISO-IEC-27005-Risk-Manager exam, and how much time do I get?

The ISO-IEC-27005-Risk-Manager exam contains 60 questions to be completed within 120 minutes. Before exam day, divide the available time by the question count to work out a comfortable per-question pace, and mark any item that eats into it so you can return later instead of getting stuck. Timed sessions in the Getcertkey test engines make that pacing automatic — run at least two full-length mock exams under the clock so time pressure never becomes the reason you drop points.

What score do I need to pass the ISO-IEC-27005-Risk-Manager exam, and what does it cost?

The passing score for the ISO-IEC-27005-Risk-Manager exam is 70%, and the official registration fee is $300 - $450 USD. Retakes are not discounted — every new attempt means paying the full fee again — so it pays to measure yourself before you book. Work through the 62 practice questions on Getcertkey, sit a timed practice test, and schedule your exam only when your scores are consistently comfortable. That simple habit is the cheapest exam strategy there is.

Are there any prerequisites for the ISO-IEC-27005-Risk-Manager exam?

Basic knowledge of information security and ISO/IEC 27001; no mandatory prior certification required; for full certification: 2 years professional experience including 1 year in risk management, 200 hours of relevant activities, sign PECB Code of Ethics Requirements can change when PECB revises its certification program, so confirm the current eligibility rules on the official exam page before you register.

How do I register for the ISO-IEC-27005-Risk-Manager exam?

You can book the PECB Certified ISO/IEC 27005 Risk Manager exam through the official registration channels below:

• PECB Official Registration

As for delivery, the exam is offered in the following format: Online proctored or onsite at authorized exam centers. Choose the option that suits you best when you book your seat.

What official training is recommended for the ISO-IEC-27005-Risk-Manager exam?

PECB recommends the following training resources for the PECB Certified ISO/IEC 27005 Risk Manager exam:

• PECB ISO/IEC 27005 Risk Manager Training Course

Official courses build the foundation; the 62 practice questions from Getcertkey then show you how that knowledge is examined, so the two work best together.

Can I try the ISO-IEC-27005-Risk-Manager practice questions before I buy?

Yes. Getcertkey provides a free ISO-IEC-27005-Risk-Manager PDF demo so you can review the question style and answer quality before purchasing. Every purchase also includes 365 days of free updates — if PECB revises the exam during that period, the updated material reaches you at no cost. Once the free-update year ends, you can extend your update service at a 50% discount.

What if I fail the ISO-IEC-27005-Risk-Manager exam, and how is my order delivered?

Every PECB Certified ISO/IEC 27005 Risk Manager purchase on Getcertkey is covered by a 100% money-back guarantee with clear conditions: if you take the corresponding exam within 60 days of your purchase and do not pass, you can claim a full refund by submitting a scanned copy of your exam enrollment slip and your official score report as a PDF within two days of the exam date; claims are processed within seven days of submission. The guarantee does not apply to exams taken within three days of purchase, to material that was downloaded but never used in an exam attempt, or to free products and expired orders, and the candidate name must match the payer name. If you would rather not take a refund, you can instead exchange your purchase for two free exam preparation products of equal value and keep the update service on your original product.

Delivery is instant: your download is sent to your email within one minute of payment, with no limit on how many computers you may install the material on. If nothing arrives within two hours, check your spam folder and contact customer service for help.

What topics are covered in the ISO-IEC-27005-Risk-Manager exam?

The PECB Certified ISO/IEC 27005 Risk Manager exam blueprint is organized into 4 domains. The first three are:

• Implementation of an Information Security Risk Management Program — 25% of the exam
• Information Security Risk Management Framework and Processes — 30% of the exam
• Fundamental Principles and Concepts of Information Security Risk Management — 25% of the exam

For the complete domain-by-domain breakdown, scroll up to the full exam topics outline above and use it to plan how you distribute your study time.

PECB Certified ISO/IEC 27005 Risk Manager Sample Questions:

Question #1

Based on NIST Risk Management Framework, what is the last step of a risk management process?

A. Communicating findings and recommendations
B. Monitoring security controls
C. Accessing security controls

Question #2

According to CRAMM methodology, how is risk assessment initiated?

A. By determining methods and procedures for managing risks
B. By identifying the security risks
C. By gathering information on the system and identifying assets within the scope

Question #3

Scenario 6: Productscape is a market research company headquartered in Brussels, Belgium. It helps organizations understand the needs and expectations of their customers and identify new business opportunities. Productscape's teams have extensive experience in marketing and business strategy and work with some of the best-known organizations in Europe. The industry in which Productscape operates requires effective risk management. Considering that Productscape has access to clients' confidential information, it is responsible for ensuring its security. As such, the company conducts regular risk assessments. The top management appointed Alex as the risk manager, who is responsible for monitoring the risk management process and treating information security risks.
The last risk assessment conducted was focused on information assets. The purpose of this risk assessment was to identify information security risks, understand their level, and take appropriate action to treat them in order to ensure the security of their systems. Alex established a team of three members to perform the risk assessment activities. Each team member was responsible for specific departments included in the risk assessment scope. The risk assessment provided valuable information to identify, understand, and mitigate the risks that Productscape faces.
Initially, the team identified potential risks based on the risk identification results. Prior to analyzing the identified risks, the risk acceptance criteria were established. The criteria for accepting the risks were determined based on Productscape's objectives, operations, and technology. The team created various risk scenarios and determined the likelihood of occurrence as "low," "medium," or "high." They decided that if the likelihood of occurrence for a risk scenario is determined as "low," no further action would be taken. On the other hand, if the likelihood of occurrence for a risk scenario is determined as "high" or "medium," additional controls will be implemented. Some information security risk scenarios defined by Productscape's team were as follows:
1. A cyber attacker exploits a security misconfiguration vulnerability of Productscape's website to launch an attack, which, in turn, could make the website unavailable to users.
2. A cyber attacker gains access to confidential information of clients and may threaten to make the information publicly available unless a ransom is paid.
3. An internal employee clicks on a link embedded in an email that redirects them to an unsecured website, installing a malware on the device.
The likelihood of occurrence for the first risk scenario was determined as "medium." One of the main reasons that such a risk could occur was the usage of default accounts and password. Attackers could exploit this vulnerability and launch a brute-force attack. Therefore, Productscape decided to start using an automated "build and deploy" process which would test the software on deploy and minimize the likelihood of such an incident from happening. However, the team made it clear that the implementation of this process would not eliminate the risk completely and that there was still a low possibility for this risk to occur. Productscape documented the remaining risk and decided to monitor it for changes.
The likelihood of occurrence for the second risk scenario was determined as "medium." Productscape decided to contract an IT company that would provide technical assistance and monitor the company's systems and networks in order to prevent such incidents from happening.
The likelihood of occurrence for the third risk scenario was determined as "high." Thus, Productscape decided to include phishing as a topic on their information security training sessions. In addition, Alex reviewed the controls of Annex A of ISO/IEC 27001 in order to determine the necessary controls for treating this risk. Alex decided to implement control A.8.23 Web filtering which would help the company to reduce the risk of accessing unsecure websites. Although security controls were implemented to treat the risk, the level of the residual risk still did not meet the risk acceptance criteria defined in the beginning of the risk assessment process. Since the cost of implementing additional controls was too high for the company, Productscape decided to accept the residual risk. Therefore, risk owners were assigned the responsibility of managing the residual risk.
Based on scenario 6, Productscape decided to accept the residual risk and risk owners were assigned the responsibility of managing this risk.
Based on the guidelines of ISO/IEC 27005, is this acceptable?

A. No, the top management should manage the residual risk
B. No, risk approvers are responsible for managing the residual risk after accepting it
C. Yes, risk owners must be aware of the residual risk and accept the responsibility for managing it

Question #4

Scenario 6: Productscape is a market research company headquartered in Brussels, Belgium. It helps organizations understand the needs and expectations of their customers and identify new business opportunities. Productscape's teams have extensive experience in marketing and business strategy and work with some of the best-known organizations in Europe. The industry in which Productscape operates requires effective risk management. Considering that Productscape has access to clients' confidential information, it is responsible for ensuring its security. As such, the company conducts regular risk assessments. The top management appointed Alex as the risk manager, who is responsible for monitoring the risk management process and treating information security risks.
The last risk assessment conducted was focused on information assets. The purpose of this risk assessment was to identify information security risks, understand their level, and take appropriate action to treat them in order to ensure the security of their systems. Alex established a team of three members to perform the risk assessment activities. Each team member was responsible for specific departments included in the risk assessment scope. The risk assessment provided valuable information to identify, understand, and mitigate the risks that Productscape faces.
Initially, the team identified potential risks based on the risk identification results. Prior to analyzing the identified risks, the risk acceptance criteria were established. The criteria for accepting the risks were determined based on Productscape's objectives, operations, and technology. The team created various risk scenarios and determined the likelihood of occurrence as "low," "medium," or "high." They decided that if the likelihood of occurrence for a risk scenario is determined as "low," no further action would be taken. On the other hand, if the likelihood of occurrence for a risk scenario is determined as "high" or "medium," additional controls will be implemented. Some information security risk scenarios defined by Productscape's team were as follows:
1. A cyber attacker exploits a security misconfiguration vulnerability of Productscape's website to launch an attack, which, in turn, could make the website unavailable to users.
2. A cyber attacker gains access to confidential information of clients and may threaten to make the information publicly available unless a ransom is paid.
3. An internal employee clicks on a link embedded in an email that redirects them to an unsecured website, installing a malware on the device.
The likelihood of occurrence for the first risk scenario was determined as "medium." One of the main reasons that such a risk could occur was the usage of default accounts and password. Attackers could exploit this vulnerability and launch a brute-force attack. Therefore, Productscape decided to start using an automated "build and deploy" process which would test the software on deploy and minimize the likelihood of such an incident from happening. However, the team made it clear that the implementation of this process would not eliminate the risk completely and that there was still a low possibility for this risk to occur. Productscape documented the remaining risk and decided to monitor it for changes.
The likelihood of occurrence for the second risk scenario was determined as "medium." Productscape decided to contract an IT company that would provide technical assistance and monitor the company's systems and networks in order to prevent such incidents from happening.
The likelihood of occurrence for the third risk scenario was determined as "high." Thus, Productscape decided to include phishing as a topic on their information security training sessions. In addition, Alex reviewed the controls of Annex A of ISO/IEC 27001 in order to determine the necessary controls for treating this risk. Alex decided to implement control A.8.23 Web filtering which would help the company to reduce the risk of accessing unsecure websites. Although security controls were implemented to treat the risk, the level of the residual risk still did not meet the risk acceptance criteria defined in the beginning of the risk assessment process. Since the cost of implementing additional controls was too high for the company, Productscape decided to accept the residual risk. Therefore, risk owners were assigned the responsibility of managing the residual risk.
Based on scenario 6, Alex reviewed the controls of Annex A of ISO/IEC 27001 to determine the necessary controls for treating the risk described in the third risk scenario. According to the guidelines of ISO/IEC 27005, is this acceptable?

A. No, Annex A controls should be used as a control set only if the organization seeks compliance to ISO/IEC 27001
B. No, organizations should define custom controls that accurately reflect the selected information security risk treatment options
C. Yes. organizations should select all controls from a chosen control set that are necessary for treating the risks

Question #5

Scenario 5: Detika is a private cardiology clinic in Pennsylvania, the US. Detika has one of the most advanced healthcare systems for treating heart diseases. The clinic uses sophisticated apparatus that detects heart diseases in early stages. Since 2010, medical information of Detika's patients is stored on the organization's digital systems. Electronic health records (EHR), among others, include patients' diagnosis, treatment plan, and laboratory results.
Storing and accessing patient and other medical data digitally was a huge and a risky step for Detik a. Considering the sensitivity of information stored in their systems, Detika conducts regular risk assessments to ensure that all information security risks are identified and managed. Last month, Detika conducted a risk assessment which was focused on the EHR system. During risk identification, the IT team found out that some employees were not updating the operating systems regularly. This could cause major problems such as a data breach or loss of software compatibility. In addition, the IT team tested the software and detected a flaw in one of the software modules used. Both issues were reported to the top management and they decided to implement appropriate controls for treating the identified risks. They decided to organize training sessions for all employees in order to make them aware of the importance of the system updates. In addition, the manager of the IT Department was appointed as the person responsible for ensuring that the software is regularly tested.
Another risk identified during the risk assessment was the risk of a potential ransomware attack. This risk was defined as low because all their data was backed up daily. The IT team decided to accept the actual risk of ransomware attacks and concluded that additional measures were not required. This decision was documented in the risk treatment plan and communicated to the risk owner. The risk owner approved the risk treatment plan and documented the risk assessment results.
Following that, Detika initiated the implementation of new controls. In addition, one of the employees of the IT Department was assigned the responsibility for monitoring the implementation process and ensure the effectiveness of the security controls. The IT team, on the other hand, was responsible for allocating the resources needed to effectively implement the new controls.
Based on scenario 5, the decision to accept the risk of a potential ransomware attack was approved by the risk owner. Is this acceptable?

A. No, the risk treatment plan should be approved by the top management and implemented by risk owners
B. No, all interested parties should approve the risk treatment plan
C. Yes, the risk treatment plan should be approved by the risk owners

Solutions: