Comprehensive and Detailed Explanation From Exact Extract:

According to ISO/IEC 27035-1:2016, an information security incident is any event that compromises the confidentiality, integrity, or availability of information. In this scenario, RoLawyers experienced an attack where their online database was overloaded with excessive traffic, resulting in a system crash. This incident made it impossible for employees to access the database for several hours.

This type of event is characteristic of a Denial-of-Service (DoS) attack. ISO/IEC 27035-1 Annex B provides examples of typical incidents, and one example includes “network-based attacks, including denial-of-service attacks.” A DoS attack typically aims to make a service or resource unavailable to its intended users by overwhelming it with traffic.

There is no indication in the scenario that the attackers were intercepting communications (as would be seen in a Man-in-the-Middle attack) or installing malware to damage or steal data. The nature of the attack—excess traffic causing a crash—clearly aligns with the definition of a DoS attack.

Reference Extracts:

ISO/IEC 27035-1:2016, Clause B.2.1 (Examples of incident types): “Denial-of-service (DoS) attacks cause disruption or degradation of services.”

ISO/IEC 27035-1:2016, Clause 4.1: “An incident can result from deliberate attacks such as DoS, malicious code, or unauthorized access.”

Therefore, the incident faced by RoLawyers was a Denial-of-Service attack.

—

Comprehensive and Detailed Explanation:

According to ISO/IEC 27005:2018, the risk treatment process begins after risk analysis and evaluation. The main input to this phase is a prioritized set of identified and assessed risks, chosen based on the organization’s risk acceptance criteria. These risks are then assigned treatments such as mitigation, avoidance, or acceptance.

Comprehensive and Detailed Explanation From Exact Extract:

L & K Associates employed two distinct approaches as described in ISO/IEC 27005:2018 and referenced in ISO/IEC 27035-2:

Strategic scenario identification, which involves analyzing sources of risk and their impact on stakeholders and objectives. This is aligned with the event-based approach, which focuses on risk sources and events that may lead to incidents.

Operational scenario identification, which involves a thorough assessment of assets, threats, and vulnerabilities — aligning with the asset-based approach, where the focus is on critical assets and the threats that may exploit their weaknesses.

ISO/IEC 27005:2018, Clause 8.2.2, identifies multiple methods for risk identification, including:

Asset-based approach

Event-based (or threat-based) approach

Vulnerability-centered approach

In this scenario, both the asset- and event-based methods were clearly applied by Leona, which is encouraged in ISO risk management practices to provide a holistic view of risk.

Therefore, the correct answer is C: Both A and B.

Comprehensive and Detailed Explanation From Exact Extract:

According to ISO/IEC 27035 and industry best practices, a Security Operations Center (SOC) is the central hub for an organization’s cybersecurity operations. Its responsibilities go beyond pure incident response. SOCs continuously monitor the organization’s network and systems for suspicious activity and threats, providing real-time threat detection, incident response coordination, vulnerability management, and overall security infrastructure oversight.

While CSIRTs and CERTs specialize in handling and managing security incidents, their roles are generally more narrowly focused on the detection, reporting, and resolution of security events. SOCs, on the other hand, manage the broader spectrum of operations, including:

Real-time monitoring and logging

Threat hunting and intelligence

Security incident analysis and triage

Coordinating CSIRT activities

Supporting policy compliance and auditing

Integration with vulnerability management and security infrastructure

Reference Extracts:

ISO/IEC 27035-2:2016, Clause 7.3.1: “Monitoring systems and activities should be established, operated and maintained to identify deviations from normal behavior.”

NIST SP 800-61 Revision 2 and industry alignment with ISO/IEC 27035 recognize the SOC as the broader operational environment that houses or interacts with the CSIRT/CERT.

Therefore, the correct answer is: B – Security Operations Center (SOC)

—