ISO 27K Q&A Benchmark Dataset
type: Dataset
description: A multiple-choice question-and-answer benchmark dataset covering ISO/IEC 27000-series information security management standards.
creator: Dimitar Jovanovski
license: https://creativecommons.org/licenses/by/4.0/
keywords: ISO 27001
keywords: ISO 27002
keywords: information security
keywords: ISMS
keywords: benchmark
keywords: QnA
number of items: 222
has part: Question 1
has part: Question 2
has part: Question 3
has part: Question 4
has part: Question 5
has part: Question 6
has part: Question 7
has part: Question 8
has part: Question 9
has part: Question 10
has part: Question 11
has part: Question 12
has part: Question 13
has part: Question 14
has part: Question 15
has part: Question 16
has part: Question 17
has part: Question 18
has part: Question 19
has part: Question 20
has part: Question 21
has part: Question 22
has part: Question 23
has part: Question 24
has part: Question 25
has part: Question 26
has part: Question 27
has part: Question 28
has part: Question 29
has part: Question 30
has part: Question 31
has part: Question 32
has part: Question 33
has part: Question 34
has part: Question 35
has part: Question 36
has part: Question 37
has part: Question 38
has part: Question 39
has part: Question 40
has part: Question 41
has part: Question 42
has part: Question 43
has part: Question 44
has part: Question 45
has part: Question 46
has part: Question 47
has part: Question 48
has part: Question 49
has part: Question 50
has part: Question 51
has part: Question 52
has part: Question 53
has part: Question 54
has part: Question 55
has part: Question 56
has part: Question 57
has part: Question 58
has part: Question 59
has part: Question 60
has part: Question 61
has part: Question 62
has part: Question 63
has part: Question 64
has part: Question 65
has part: Question 66
has part: Question 67
has part: Question 68
has part: Question 69

Question 1
type: Question
text: What is an Information Security Management System (ISMS)?
suggested answer: answer-1-A
suggested answer: answer-1-B
suggested answer: answer-1-C
suggested answer: answer-1-D
accepted answer: answer-1-A
is part of: ISO 27K Q&A Benchmark Dataset

answer-1-A
type: Answer
position: A
text: A set of policies and procedures for managing sensitive company information
is accepted: true
is part of: Question 1

answer-1-B
type: Answer
position: B
text: A software tool for managing security risks.
is part of: Question 1

answer-1-C
type: Answer
position: C
text: A physical security system
is part of: Question 1

answer-1-D
type: Answer
position: D
text: A consulting service for security compliance
is part of: Question 1

Question 2
type: Question
text: What are the two main parts of ISO 27001 standard?
suggested answer: answer-2-A
suggested answer: answer-2-B
suggested answer: answer-2-C
suggested answer: answer-2-D
accepted answer: answer-2-D
is part of: ISO 27K Q&A Benchmark Dataset

answer-2-A
type: Answer
position: A
text: Risk management and compliance
is part of: Question 2

answer-2-B
type: Answer
position: B
text: Governance and technical controls
is part of: Question 2

answer-2-C
type: Answer
position: C
text: Leadership and management
is part of: Question 2

answer-2-D
type: Answer
position: D
text: Implementation and maintenance
is accepted: true
is part of: Question 2

Question 3
type: Question
text: What is the purpose of ISO 27001?
suggested answer: answer-3-A
suggested answer: answer-3-B
suggested answer: answer-3-C
suggested answer: answer-3-D
accepted answer: answer-3-D
is part of: ISO 27K Q&A Benchmark Dataset

answer-3-A
type: Answer
position: A
text: To provide a framework for managing sensitive company information
is part of: Question 3

answer-3-B
type: Answer
position: B
text: To ensure compliance with government regulations
is part of: Question 3

answer-3-C
type: Answer
position: C
text: To improve an organization's overall security posture
is part of: Question 3

answer-3-D
type: Answer
position: D
text: All of the above
is accepted: true
is part of: Question 3

Question 4
type: Question
text: What are the benefits of implementing ISO 27001?
suggested answer: answer-4-A
suggested answer: answer-4-B
suggested answer: answer-4-C
suggested answer: answer-4-D
accepted answer: answer-4-D
is part of: ISO 27K Q&A Benchmark Dataset

answer-4-A
type: Answer
position: A
text: Improving an organization's overall security posture
is part of: Question 4

answer-4-B
type: Answer
position: B
text: Enhancing an organization's reputation and credibility
is part of: Question 4

answer-4-C
type: Answer
position: C
text: Facilitating compliance with legal and regulatory requirements
is part of: Question 4

answer-4-D
type: Answer
position: D
text: All of the above
is accepted: true
is part of: Question 4

Question 5
type: Question
text: What is the main difference between ISO 27001 and ISO 27002?
suggested answer: answer-5-A
suggested answer: answer-5-B
suggested answer: answer-5-C
suggested answer: answer-5-D
accepted answer: answer-5-A
is part of: ISO 27K Q&A Benchmark Dataset

answer-5-A
type: Answer
position: A
text: ISO 27001 is a standard and ISO 27002 is a code of practice
is accepted: true
is part of: Question 5

answer-5-B
type: Answer
position: B
text: ISO 27001 is for management and ISO 27002 is for technical implementation
is part of: Question 5

answer-5-C
type: Answer
position: C
text: ISO 27001 is for small businesses and ISO 27002 is for large organizations
is part of: Question 5

answer-5-D
type: Answer
position: D
text: ISO 27001 is for government agencies and ISO 27002 is for private sector
is part of: Question 5

Question 6
type: Question
text: Which of the following best describes the structure of ISO 27001?
suggested answer: answer-6-A
suggested answer: answer-6-B
suggested answer: answer-6-S
suggested answer: answer-6-C
suggested answer: answer-6-D
accepted answer: answer-6-B
is part of: ISO 27K Q&A Benchmark Dataset

answer-6-A
type: Answer
position: A
text: A set of guidelines for implementing a data backup plan
is part of: Question 6

answer-6-B
type: Answer
position: B
text: A framework for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISM
is accepted: true
is part of: Question 6

answer-6-S
type: Answer
position: S
is part of: Question 6

answer-6-C
type: Answer
position: C
text: A set of regulations for protecting personal data in the healthcare industry
is part of: Question 6

answer-6-D
type: Answer
position: D
text: A standard for ensuring the security of industrial control systems
is part of: Question 6

Question 7
type: Question
text: In which section of ISO 27001 standard is "Clause 6" is mentioned?
suggested answer: answer-7-A
suggested answer: answer-7-B
suggested answer: answer-7-C
suggested answer: answer-7-D
accepted answer: answer-7-C
is part of: ISO 27K Q&A Benchmark Dataset

answer-7-A
type: Answer
position: A
text: Section 4 - The Planning Phase
is part of: Question 7

answer-7-B
type: Answer
position: B
text: Section 5 - The Support Phase
is part of: Question 7

answer-7-C
type: Answer
position: C
text: Section 6 - The Operation Phase
is accepted: true
is part of: Question 7

answer-7-D
type: Answer
position: D
text: Section 7 - The Performance Evaluation Phase
is part of: Question 7

Question 8
type: Question
text: How can an organization ensure the availability of their information systems according to the ISO 27001 standard?
suggested answer: answer-8-A
suggested answer: answer-8-B
suggested answer: answer-8-C
suggested answer: answer-8-D
accepted answer: answer-8-A
is part of: ISO 27K Q&A Benchmark Dataset

answer-8-A
type: Answer
position: A
text: By implementing regular backups and disaster recovery plans
is accepted: true
is part of: Question 8

answer-8-B
type: Answer
position: B
text: By implementing strict access controls and monitoring user activity
is part of: Question 8

answer-8-C
type: Answer
position: C
text: By implementing firewalls and intrusion detection systems
is part of: Question 8

answer-8-D
type: Answer
position: D
text: By implementing encryption and secure communication protocols
is part of: Question 8

Question 9
type: Question
text: What are the common types of confidentiality controls implemented in an ISMS as per ISO 27001 standard?
suggested answer: answer-9-A
suggested answer: answer-9-B
suggested answer: answer-9-C
suggested answer: answer-9-D
accepted answer: answer-9-A
is part of: ISO 27K Q&A Benchmark Dataset

answer-9-A
type: Answer
position: A
text: Encryption and firewalls
is accepted: true
is part of: Question 9

answer-9-B
type: Answer
position: B
text: Access controls and intrusion detection
is part of: Question 9

answer-9-C
type: Answer
position: C
text: Backup and disaster recovery
is part of: Question 9

answer-9-D
type: Answer
position: D
text: Physical security and surveillance
is part of: Question 9

Question 10
type: Question
text: Which of the following best describes the principle of "integrity" in the context of ISO 27001?
suggested answer: answer-10-A
suggested answer: answer-10-B
suggested answer: answer-10-C
suggested answer: answer-10-D
accepted answer: answer-10-B
is part of: ISO 27K Q&A Benchmark Dataset

answer-10-A
type: Answer
position: A
text: Ensuring that only authorized individuals have access to sensitive information
is part of: Question 10

answer-10-B
type: Answer
position: B
text: Maintaining the accuracy and completeness of information throughout its lifecycle
is accepted: true
is part of: Question 10

answer-10-C
type: Answer
position: C
text: Ensuring that information is protected from unauthorized modification or destruction
is part of: Question 10

answer-10-D
type: Answer
position: D
text: Ensuring that information systems are available for their intended purpose
is part of: Question 10

Question 11
type: Question
text: Which of the following would be the most appropriate action for an organization to take in order to ensure the confidentiality, integrity, and availability of their information assets, according to the principles of an Information Security Management System (ISMS) as outlined in ISO 27001?
suggested answer: answer-11-A
suggested answer: answer-11-B
suggested answer: answer-11-C
suggested answer: answer-11-D
accepted answer: answer-11-C
is part of: ISO 27K Q&A Benchmark Dataset

answer-11-A
type: Answer
position: A
text: Implementing firewalls and antivirus software on all company computers
is part of: Question 11

answer-11-B
type: Answer
position: B
text: Providing regular security awareness training for all employees
is part of: Question 11

answer-11-C
type: Answer
position: C
text: Conducting regular risk assessments and implementing controls to mitigate identified risks
is accepted: true
is part of: Question 11

answer-11-D
type: Answer
position: D
text: Restricting access to certain information assets to only a select group of individuals
is part of: Question 11

Question 12
type: Question
text: A company is in the process of implementing an Information Security Management System (ISMS) in accordance with ISO 27001. The company's IT department is responsible for managing the ISMS, but they are unsure of how to proceed with the implementation. Which of the following options would be the best course of action for the IT department to take?
suggested answer: answer-12-A
suggested answer: answer-12-B
suggested answer: answer-12-C
suggested answer: answer-12-D
accepted answer: answer-12-C
is part of: ISO 27K Q&A Benchmark Dataset

answer-12-A
type: Answer
position: A
text: Hire an external consultant to handle the implementation of the ISMS
is part of: Question 12

answer-12-B
type: Answer
position: B
text: Assign a single employee within the IT department to oversee the implementation of the ISMS
is part of: Question 12

answer-12-C
type: Answer
position: C
text: Form a cross-functional team within the company to handle the implementation of the ISMS
is accepted: true
is part of: Question 12

answer-12-D
type: Answer
position: D
text: Outsource the implementation of the ISMS to a third-party vendor
is part of: Question 12

Question 13
type: Question
text: In a company's effort to implement ISO 27001 requirements, which of the following steps would be considered the MOST important?
suggested answer: answer-13-A
suggested answer: answer-13-B
suggested answer: answer-13-C
suggested answer: answer-13-D
accepted answer: answer-13-C
is part of: ISO 27K Q&A Benchmark Dataset

answer-13-A
type: Answer
position: A
text: Creating a detailed project plan
is part of: Question 13

answer-13-B
type: Answer
position: B
text: Conducting a gap analysis
is part of: Question 13

answer-13-C
type: Answer
position: C
text: Obtaining management buy-in and support
is accepted: true
is part of: Question 13

answer-13-D
type: Answer
position: D
text: Developing a comprehensive security policy
is part of: Question 13

Question 14
type: Question
text: What is the first step in implementing ISO 27001 requirements within an organization?
suggested answer: answer-14-A
suggested answer: answer-14-B
suggested answer: answer-14-C
suggested answer: answer-14-D
accepted answer: answer-14-A
is part of: ISO 27K Q&A Benchmark Dataset

answer-14-A
type: Answer
position: A
text: Conducting a risk assessment
is accepted: true
is part of: Question 14

answer-14-B
type: Answer
position: B
text: Developing an Information Security Policy
is part of: Question 14

answer-14-C
type: Answer
position: C
text: Designing and implementing controls
is part of: Question 14

answer-14-D
type: Answer
position: D
text: Obtaining management commitment
is part of: Question 14

Question 15
type: Question
text: Which of the following documents is required to be maintained as per ISO 27001 standard?
suggested answer: answer-15-A
suggested answer: answer-15-B
suggested answer: answer-15-C
suggested answer: answer-15-D
accepted answer: answer-15-B
is part of: ISO 27K Q&A Benchmark Dataset

answer-15-A
type: Answer
position: A
text: Employee handbook
is part of: Question 15

answer-15-B
type: Answer
position: B
text: Statement of applicability
is accepted: true
is part of: Question 15

answer-15-C
type: Answer
position: C
text: Health and safety manual
is part of: Question 15

answer-15-D
type: Answer
position: D
text: Employee performance evaluations
is part of: Question 15

Question 16
type: Question
text: What are the benefits of implementing ISO 27001?
suggested answer: answer-16-A
suggested answer: answer-16-B
suggested answer: answer-16-C
suggested answer: answer-16-D
suggested answer: answer-16-E
accepted answer: answer-16-E
is part of: ISO 27K Q&A Benchmark Dataset

answer-16-A
type: Answer
position: A
text: Improved compliance with regulatory requirements
is part of: Question 16

answer-16-B
type: Answer
position: B
text: Increased customer trust and confidence
is part of: Question 16

answer-16-C
type: Answer
position: C
text: Enhanced reputation and competitive advantage
is part of: Question 16

answer-16-D
type: Answer
position: D
text: Reduced risk of data breaches and cyber attacks
is part of: Question 16

answer-16-E
type: Answer
position: E
text: All of the above
is accepted: true
is part of: Question 16

Question 17
type: Question
text: Is ISO 27001 a standard that defines the technical details for information security, e.g., how to configure a firewall?
suggested answer: answer-17-A
suggested answer: answer-17-B
accepted answer: answer-17-B
is part of: ISO 27K Q&A Benchmark Dataset

answer-17-A
type: Answer
position: A
text: Yes
is part of: Question 17

answer-17-B
type: Answer
position: B
text: No
is accepted: true
is part of: Question 17

Question 18
type: Question
text: Which of the following statements represents an external issue?
suggested answer: answer-18-A
suggested answer: answer-18-B
suggested answer: answer-18-C
suggested answer: answer-18-D
accepted answer: answer-18-B
is part of: ISO 27K Q&A Benchmark Dataset

answer-18-A
type: Answer
position: A
text: Organizational culture
is part of: Question 18

answer-18-B
type: Answer
position: B
text: Economic environment
is accepted: true
is part of: Question 18

answer-18-C
type: Answer
position: C
text: The structure of the company
is part of: Question 18

answer-18-D
type: Answer
position: D
text: The business strategy
is part of: Question 18

Question 19
type: Question
text: What is the first step in the planning phase of implementing an ISMS?
suggested answer: answer-19-A
suggested answer: answer-19-B
suggested answer: answer-19-C
suggested answer: answer-19-D
accepted answer: answer-19-D
is part of: ISO 27K Q&A Benchmark Dataset

answer-19-A
type: Answer
position: A
text: Identifying the scope of the ISMS
is part of: Question 19

answer-19-B
type: Answer
position: B
text: Developing the Information Security Policy
is part of: Question 19

answer-19-C
type: Answer
position: C
text: Conducting a risk assessment
is part of: Question 19

answer-19-D
type: Answer
position: D
text: Understanding the organization and its context
is accepted: true
is part of: Question 19

Question 20
type: Question
text: What is the purpose of determining the scope of an ISMS?
suggested answer: answer-20-A
suggested answer: answer-20-B
suggested answer: answer-20-C
suggested answer: answer-20-D
accepted answer: answer-20-D
is part of: ISO 27K Q&A Benchmark Dataset

answer-20-A
type: Answer
position: A
text: To identify which areas of the organization will be covered by the ISMS
is part of: Question 20

answer-20-B
type: Answer
position: B
text: To identify which information assets need to be protected
is part of: Question 20

answer-20-C
type: Answer
position: C
text: To identify which information security standards need to be met
is part of: Question 20

answer-20-D
type: Answer
position: D
text: All of the above
is accepted: true
is part of: Question 20

Question 21
type: Question
text: What are the key elements of effective communication in an ISMS?
suggested answer: answer-21-A
suggested answer: answer-21-B
suggested answer: answer-21-C
suggested answer: answer-21-D
accepted answer: answer-21-D
is part of: ISO 27K Q&A Benchmark Dataset

answer-21-A
type: Answer
position: A
text: Who needs to be communicated to
is part of: Question 21

answer-21-B
type: Answer
position: B
text: What needs to be communicated
is part of: Question 21

answer-21-C
type: Answer
position: C
text: How communication will be done
is part of: Question 21

answer-21-D
type: Answer
position: D
text: All of the above
is accepted: true
is part of: Question 21

Question 22
type: Question
text: What is the difference between internal and external communication in an ISMS?
suggested answer: answer-22-A
suggested answer: answer-22-B
suggested answer: answer-22-C
suggested answer: answer-22-D
accepted answer: answer-22-A
is part of: ISO 27K Q&A Benchmark Dataset

answer-22-A
type: Answer
position: A
text: Internal communication involves communication within the organization, external communication involves communication with external stakeholders
is accepted: true
is part of: Question 22

answer-22-B
type: Answer
position: B
text: Internal communication involves communication with customers, external communication involves communication with suppliers
is part of: Question 22

answer-22-C
type: Answer
position: C
text: Internal communication involves communication with management, external communication involves communication with employees
is part of: Question 22

answer-22-D
type: Answer
position: D
text: Internal communication involves communication with regulatory bodies, external communication involves communication with the public
is part of: Question 22

Question 23
type: Question
text: Who is responsible for managing the awareness program in an ISMS?
suggested answer: answer-23-A
suggested answer: answer-23-B
suggested answer: answer-23-C
suggested answer: answer-23-D
accepted answer: answer-23-A
is part of: ISO 27K Q&A Benchmark Dataset

answer-23-A
type: Answer
position: A
text: The ISMS manager
is accepted: true
is part of: Question 23

answer-23-B
type: Answer
position: B
text: The security officer
is part of: Question 23

answer-23-C
type: Answer
position: C
text: All employees
is part of: Question 23

answer-23-D
type: Answer
position: D
text: All of the above
is part of: Question 23

Question 24
type: Question
text: Which of the following statements describes an ISMS scope?
suggested answer: answer-24-A
suggested answer: answer-24-B
suggested answer: answer-24-C
suggested answer: answer-24-D
accepted answer: answer-24-B
is part of: ISO 27K Q&A Benchmark Dataset

answer-24-A
type: Answer
position: A
text: Company X’s ISO 27001 certificate is valid until November 22, 2028
is part of: Question 24

answer-24-B
type: Answer
position: B
text: The Information Security Management System (ISMS) applies to the provision of software development and implementation, as well as outsourcing of IT services including maintenance of hardware and software, operating from the offices in London and Edinburgh
is accepted: true
is part of: Question 24

answer-24-C
type: Answer
position: C
text: The ISMS has implemented all the controls from Annex A
is part of: Question 24

answer-24-D
type: Answer
position: D
text: Company X has implemented ISO 9001 and ISO 27001
is part of: Question 24

Question 25
type: Question
text: How can top management demonstrate leadership and commitment to the Information Security Management System?
suggested answer: answer-25-A
suggested answer: answer-25-B
suggested answer: answer-25-C
suggested answer: answer-25-D
accepted answer: answer-25-B
is part of: ISO 27K Q&A Benchmark Dataset

answer-25-A
type: Answer
position: A
text: Documenting the information security policies and procedures
is part of: Question 25

answer-25-B
type: Answer
position: B
text: Ensuring the resources necessary for the ISMS
is accepted: true
is part of: Question 25

answer-25-C
type: Answer
position: C
text: Creating exceptions to the security rules for top management
is part of: Question 25

answer-25-D
type: Answer
position: D
text: Dedicating one week a year for information security, while the rest of the time is dedicated to everyday activities
is part of: Question 25

Question 26
type: Question
text: The following statements are requirements for the Information Security Policy:
suggested answer: answer-26-A
suggested answer: answer-26-B
suggested answer: answer-26-C
suggested answer: answer-26-D
accepted answer: answer-26-C
is part of: ISO 27K Q&A Benchmark Dataset

answer-26-A
type: Answer
position: A
text: It should include detailed information about the roles and responsibilities of the employees
is part of: Question 26

answer-26-B
type: Answer
position: B
text: It should include relevant technical details and security rules
is part of: Question 26

answer-26-C
type: Answer
position: C
text: It should provide a framework for setting information security objectives
is accepted: true
is part of: Question 26

answer-26-D
type: Answer
position: D
text: It must include the ISMS scope
is part of: Question 26

Question 27
type: Question
text: Which of the following responsibilities and authorities are relevant for the person responsible for reporting on the performance of the ISMS to top management?
suggested answer: answer-27-A
suggested answer: answer-27-B
suggested answer: answer-27-C
suggested answer: answer-27-D
accepted answer: answer-27-D
is part of: ISO 27K Q&A Benchmark Dataset

answer-27-A
type: Answer
position: A
text: Updating the Statement of Applicability
is part of: Question 27

answer-27-B
type: Answer
position: B
text: Training employees on ISMS rules
is part of: Question 27

answer-27-C
type: Answer
position: C
text: Conducting a campaign for ISMS awareness raising
is part of: Question 27

answer-27-D
type: Answer
position: D
text: Measuring the KPIs (Key Performance Indicators)
is accepted: true
is part of: Question 27

Question 28
type: Question
text: Which of the following objectives represents a measurable information security objective?
suggested answer: answer-28-A
suggested answer: answer-28-B
suggested answer: answer-28-C
suggested answer: answer-28-D
accepted answer: answer-28-B
is part of: ISO 27K Q&A Benchmark Dataset

answer-28-A
type: Answer
position: A
text: Ensure 99.9% availability of the company’s services annually
is part of: Question 28

answer-28-B
type: Answer
position: B
text: Decrease the average time for solving incidents by 10% during the next 12 months
is accepted: true
is part of: Question 28

answer-28-C
type: Answer
position: C
text: Increase the information security awareness of employees
is part of: Question 28

answer-28-D
type: Answer
position: D
text: Strengthen the overall capabilities of the Information Security Management System in the next six months
is part of: Question 28

Question 29
type: Question
text: For effective implementation of incident management software in Company Y, the following resources should be available:
suggested answer: answer-29-A
suggested answer: answer-29-B
suggested answer: answer-29-C
suggested answer: answer-29-D
accepted answer: answer-29-D
is part of: ISO 27K Q&A Benchmark Dataset

answer-29-A
type: Answer
position: A
text: Available person and time to conduct analysis of the most suitable software for incident management in Company Y
is part of: Question 29

answer-29-B
type: Answer
position: B
text: Responsible person for coordinating the implementation of the procedure
is part of: Question 29

answer-29-C
type: Answer
position: C
text: Available time for all employees to pass short training on how to use the incident management software for reporting incidents
is part of: Question 29

answer-29-D
type: Answer
position: D
text: All of the above
is accepted: true
is part of: Question 29

Question 30
type: Question
text: Which of the following statements represents requirements from the ISO 27001 standard?
suggested answer: answer-30-A
suggested answer: answer-30-B
suggested answer: answer-30-C
suggested answer: answer-30-D
accepted answer: answer-30-B
is part of: ISO 27K Q&A Benchmark Dataset

answer-30-A
type: Answer
position: A
text: All employees should have an ISO 27001 Introduction certificate
is part of: Question 30

answer-30-B
type: Answer
position: B
text: Keep records as evidence of competence
is accepted: true
is part of: Question 30

answer-30-C
type: Answer
position: C
text: Assign a security mentor to each employee
is part of: Question 30

answer-30-D
type: Answer
position: D
text: All employees shall have university degrees
is part of: Question 30

Question 31
type: Question
text: Information security awareness raising helps employees become information security experts:
suggested answer: answer-31-A
suggested answer: answer-31-B
accepted answer: answer-31-B
is part of: ISO 27K Q&A Benchmark Dataset

answer-31-A
type: Answer
position: A
text: True
is part of: Question 31

answer-31-B
type: Answer
position: B
text: False
is accepted: true
is part of: Question 31

Question 32
type: Question
text: Communication rules should cover the following elements:
suggested answer: answer-32-A
suggested answer: answer-32-B
suggested answer: answer-32-C
suggested answer: answer-32-D
accepted answer: answer-32-B
is part of: ISO 27K Q&A Benchmark Dataset

answer-32-A
type: Answer
position: A
text: When the scheduled internal audit is scheduled
is part of: Question 32

answer-32-B
type: Answer
position: B
text: What should be communicated
is accepted: true
is part of: Question 32

answer-32-C
type: Answer
position: C
text: Standard form for communication for each media used (e.g., social media, press, television, etc.)
is part of: Question 32

answer-32-D
type: Answer
position: D
text: Why information security objectives are important
is part of: Question 32

Question 33
type: Question
text: When creating a new document, you should take into consideration the following aspects:
suggested answer: answer-33-A
suggested answer: answer-33-B
suggested answer: answer-33-C
suggested answer: answer-33-D
accepted answer: answer-33-C
is part of: ISO 27K Q&A Benchmark Dataset

answer-33-A
type: Answer
position: A
text: Storing the document wherever is suitable for you
is part of: Question 33

answer-33-B
type: Answer
position: B
text: Adding in as many examples as you can
is part of: Question 33

answer-33-C
type: Answer
position: C
text: Saving the document in the appropriate file format
is accepted: true
is part of: Question 33

answer-33-D
type: Answer
position: D
text: The document is very well written, so it doesn’t need a title. It is pretty much obvious what it is
is part of: Question 33

Question 34
type: Question
text: In a scenario where Company X is implementing an ISMS, what are the key considerations for determining the scope of the ISMS?
suggested answer: answer-34-A
suggested answer: answer-34-B
suggested answer: answer-34-C
suggested answer: answer-34-D
accepted answer: answer-34-C
is part of: ISO 27K Q&A Benchmark Dataset

answer-34-A
type: Answer
position: A
text: The physical location of the company's assets
is part of: Question 34

answer-34-B
type: Answer
position: B
text: The types of data and information processed by the company
is part of: Question 34

answer-34-C
type: Answer
position: C
text: The legal and regulatory requirements the company must comply with
is accepted: true
is part of: Question 34

answer-34-D
type: Answer
position: D
text: The company's organizational structure and lines of communication
is part of: Question 34

Question 35
type: Question
text: In a scenario where a company is implementing an ISMS, which of the following actions best demonstrates leadership according to ISO 27001?
suggested answer: answer-35-A
suggested answer: answer-35-B
suggested answer: answer-35-C
suggested answer: answer-35-D
accepted answer: answer-35-C
is part of: ISO 27K Q&A Benchmark Dataset

answer-35-A
type: Answer
position: A
text: Allowing employees to make decisions on their own regarding information security
is part of: Question 35

answer-35-B
type: Answer
position: B
text: Ignoring feedback and suggestions from employees regarding the ISMS
is part of: Question 35

answer-35-C
type: Answer
position: C
text: Actively participating in the implementation and ongoing maintenance of the ISMS
is accepted: true
is part of: Question 35

answer-35-D
type: Answer
position: D
text: Outsourcing all responsibilities related to the ISMS to a third-party vendor
is part of: Question 35

Question 36
type: Question
text: In a scenario where a company is implementing an ISMS, which of the following actions would demonstrate commitment to the system according to ISO 27001?
suggested answer: answer-36-A
suggested answer: answer-36-B
suggested answer: answer-36-C
suggested answer: answer-36-D
suggested answer: answer-36-E
accepted answer: answer-36-E
is part of: ISO 27K Q&A Benchmark Dataset

answer-36-A
type: Answer
position: A
text: Allocating a budget for the ISMS implementation
is part of: Question 36

answer-36-B
type: Answer
position: B
text: Assigning a dedicated team to handle the ISMS implementation
is part of: Question 36

answer-36-C
type: Answer
position: C
text: Regularly reviewing and updating the ISMS documentation
is part of: Question 36

answer-36-D
type: Answer
position: D
text: Providing the ISMS team with necessary resources
is part of: Question 36

answer-36-E
type: Answer
position: E
text: All of the above
is accepted: true
is part of: Question 36

Question 37
type: Question
text: A company is in the process of creating an Information Security Policy as part of their implementation of an ISMS according to ISO 27001. Which of the following elements should be included in the policy to ensure its effectiveness?
suggested answer: answer-37-A
suggested answer: answer-37-B
suggested answer: answer-37-C
suggested answer: answer-37-D
accepted answer: answer-37-C
is part of: ISO 27K Q&A Benchmark Dataset

answer-37-A
type: Answer
position: A
text: A list of all employees and their job titles
is part of: Question 37

answer-37-B
type: Answer
position: B
text: Detailed instructions for how to handle security incidents
is part of: Question 37

answer-37-C
type: Answer
position: C
text: A clear statement of the company's commitment to maintaining the confidentiality, integrity, and availability of information
is accepted: true
is part of: Question 37

answer-37-D
type: Answer
position: D
text: A list of all software and hardware used by the company
is part of: Question 37

Question 38
type: Question
text: Who is responsible for ensuring the effectiveness of the Information Security Management System
suggested answer: answer-38-A
suggested answer: answer-38-B
suggested answer: answer-38-C
suggested answer: answer-38-D
accepted answer: answer-38-B
is part of: ISO 27K Q&A Benchmark Dataset

answer-38-A
type: Answer
position: A
text: The Chief Information Security Officer (CISO)
is part of: Question 38

answer-38-B
type: Answer
position: B
text: The Top Management Representative
is accepted: true
is part of: Question 38

answer-38-C
type: Answer
position: C
text: The Information Security Officer
is part of: Question 38

answer-38-D
type: Answer
position: D
text: The Chief Executive Officer
is part of: Question 38

Question 39
type: Question
text: Who is responsible for providing the necessary resources for the Information Security Management System?
suggested answer: answer-39-A
suggested answer: answer-39-B
suggested answer: answer-39-C
suggested answer: answer-39-D
accepted answer: answer-39-A
is part of: ISO 27K Q&A Benchmark Dataset

answer-39-A
type: Answer
position: A
text: The Chief Executive Officer
is accepted: true
is part of: Question 39

answer-39-B
type: Answer
position: B
text: The Chief Information Security Officer
is part of: Question 39

answer-39-C
type: Answer
position: C
text: The Management Representative
is part of: Question 39

answer-39-D
type: Answer
position: D
text: The Information Security Officer
is part of: Question 39

Question 40
type: Question
text: In Company X, the risk methodology used for their ISMS includes identifying and evaluating risks, but they are unsure if they should also include a risk treatment plan. Which of the following options best aligns with the requirements of ISO 27001 for risk methodology?
suggested answer: answer-40-A
suggested answer: answer-40-B
suggested answer: answer-40-C
suggested answer: answer-40-D
accepted answer: answer-40-B
is part of: ISO 27K Q&A Benchmark Dataset

answer-40-A
type: Answer
position: A
text: Identifying and evaluating risks only
is part of: Question 40

answer-40-B
type: Answer
position: B
text: Identifying and evaluating risks, and implementing a risktreatment plan
is accepted: true
is part of: Question 40

answer-40-C
type: Answer
position: C
text: Identifying risks only, and leaving evaluation and treatment to the discretion of individual departments
is part of: Question 40

answer-40-D
type: Answer
position: D
text: Outsourcing risk management to a third-party vendor
is part of: Question 40

Question 41
type: Question
text: Risks and opportunities need to be addressed in order to:
suggested answer: answer-41-A
suggested answer: answer-41-B
suggested answer: answer-41-C
suggested answer: answer-41-D
accepted answer: answer-41-B
is part of: ISO 27K Q&A Benchmark Dataset

answer-41-A
type: Answer
position: A
text: Demonstrate management commitment
is part of: Question 41

answer-41-B
type: Answer
position: B
text: Ensure achievement of the ISMS outcomes
is accepted: true
is part of: Question 41

answer-41-C
type: Answer
position: C
text: Prevent or reduce the financial and operational losses
is part of: Question 41

answer-41-D
type: Answer
position: D
text: Ensure all employees are aware of the risks and opportunities
is part of: Question 41

Question 42
type: Question
text: What is the appropriate order for the steps from the Risk Management Process?
suggested answer: answer-42-A
suggested answer: answer-42-B
suggested answer: answer-42-C
suggested answer: answer-42-D
accepted answer: answer-42-A
is part of: ISO 27K Q&A Benchmark Dataset

answer-42-A
type: Answer
position: A
text: Identify, Assess, Analyze, Mitigate
is accepted: true
is part of: Question 42

answer-42-B
type: Answer
position: B
text: Assess, Identify, Mitigate, Analyze
is part of: Question 42

answer-42-C
type: Answer
position: C
text: Analyze, Mitigate, Assess, Identify
is part of: Question 42

answer-42-D
type: Answer
position: D
text: Mitigate, Identify, Assess, Analyze
is part of: Question 42

Question 43
type: Question
text: Which of the following represents assets from an information security perspective?
suggested answer: answer-43-A
suggested answer: answer-43-B
suggested answer: answer-43-C
suggested answer: answer-43-D
accepted answer: answer-43-C
is part of: ISO 27K Q&A Benchmark Dataset

answer-43-A
type: Answer
position: A
text: Bathroom
is part of: Question 43

answer-43-B
type: Answer
position: B
text: Unauthorized modification
is part of: Question 43

answer-43-C
type: Answer
position: C
text: Software
is accepted: true
is part of: Question 43

answer-43-D
type: Answer
position: D
text: Low awareness of information security
is part of: Question 43

Question 44
type: Question
text: What is the primary outcome of a risk analysis related to ISO 27001?
suggested answer: answer-44-A
suggested answer: answer-44-B
suggested answer: answer-44-C
suggested answer: answer-44-D
accepted answer: answer-44-A
is part of: ISO 27K Q&A Benchmark Dataset

answer-44-A
type: Answer
position: A
text: Identification of risks
is accepted: true
is part of: Question 44

answer-44-B
type: Answer
position: B
text: Prioritizing of risk management activities
is part of: Question 44

answer-44-C
type: Answer
position: C
text: Development of action plans
is part of: Question 44

answer-44-D
type: Answer
position: D
text: Written statement of compliance
is part of: Question 44

Question 45
type: Question
text: Who is responsible for managing the risks identified in an ISO 27001 audit?
suggested answer: answer-45-A
suggested answer: answer-45-B
suggested answer: answer-45-C
suggested answer: answer-45-D
accepted answer: answer-45-B
is part of: ISO 27K Q&A Benchmark Dataset

answer-45-A
type: Answer
position: A
text: The Auditor
is part of: Question 45

answer-45-B
type: Answer
position: B
text: The Risk Owner
is accepted: true
is part of: Question 45

answer-45-C
type: Answer
position: C
text: The Risk Assessor
is part of: Question 45

answer-45-D
type: Answer
position: D
text: The Risk Manager
is part of: Question 45

Question 46
type: Question
text: What is the risk impact if an organization fails to implement appropriate technical and organizational measures to protect confidential data?
suggested answer: answer-46-A
suggested answer: answer-46-B
suggested answer: answer-46-C
suggested answer: answer-46-D
suggested answer: answer-46-E
accepted answer: answer-46-E
is part of: ISO 27K Q&A Benchmark Dataset

answer-46-A
type: Answer
position: A
text: Loss of customer trust
is part of: Question 46

answer-46-B
type: Answer
position: B
text: Compromise of confidential data
is part of: Question 46

answer-46-C
type: Answer
position: C
text: Potential legal action
is part of: Question 46

answer-46-D
type: Answer
position: D
text: Damage to the organization's reputation
is part of: Question 46

answer-46-E
type: Answer
position: E
text: All of the above
is accepted: true
is part of: Question 46

Question 47
type: Question
text: Which of the following actions are accepted as good risk treatment practices?
suggested answer: answer-47-A
suggested answer: answer-47-B
suggested answer: answer-47-C
suggested answer: answer-47-D
accepted answer: answer-47-C
is part of: ISO 27K Q&A Benchmark Dataset

answer-47-A
type: Answer
position: A
text: Ignoring the risk
is part of: Question 47

answer-47-B
type: Answer
position: B
text: Risk sharing
is part of: Question 47

answer-47-C
type: Answer
position: C
text: Risk acceptance
is accepted: true
is part of: Question 47

answer-47-D
type: Answer
position: D
text: Doubling the risk
is part of: Question 47

Question 48
type: Question
text: The Statement of Applicability document should include:
suggested answer: answer-48-A
suggested answer: answer-48-B
suggested answer: answer-48-C
suggested answer: answer-48-D
accepted answer: answer-48-B
is part of: ISO 27K Q&A Benchmark Dataset

answer-48-A
type: Answer
position: A
text: Only the controls from Annex A
is part of: Question 48

answer-48-B
type: Answer
position: B
text: All the controls from Annex A and any additional controls that might be identified in the risk treatment process
is accepted: true
is part of: Question 48

answer-48-C
type: Answer
position: C
text: Only additional controls that might be identified in the risk treatment process
is part of: Question 48

answer-48-D
type: Answer
position: D
text: The risk owner
is part of: Question 48

Question 49
type: Question
text: What is the purpose of the Statement of Applicability according to ISO 27001?
suggested answer: answer-49-A
suggested answer: answer-49-B
suggested answer: answer-49-C
suggested answer: answer-49-D
suggested answer: answer-49-E
accepted answer: answer-49-E
is part of: ISO 27K Q&A Benchmark Dataset

answer-49-A
type: Answer
position: A
text: To identify the security controls implemented within an organization.
is part of: Question 49

answer-49-B
type: Answer
position: B
text: To document the risk assessment and risk treatment process.
is part of: Question 49

answer-49-C
type: Answer
position: C
text: To demonstrate an organization’s commitment to information security.
is part of: Question 49

answer-49-D
type: Answer
position: D
text: To identify assets and the associated risks.
is part of: Question 49

answer-49-E
type: Answer
position: E
text: All of the above
is accepted: true
is part of: Question 49

Question 50
type: Question
text: Which one of the following is a step in the risk management process:
suggested answer: answer-50-A
suggested answer: answer-50-B
suggested answer: answer-50-C
suggested answer: answer-50-D
accepted answer: answer-50-B
is part of: ISO 27K Q&A Benchmark Dataset

answer-50-A
type: Answer
position: A
text: Define the information Security Policy
is part of: Question 50

answer-50-B
type: Answer
position: B
text: Create the risk treatment plan
is accepted: true
is part of: Question 50

answer-50-C
type: Answer
position: C
text: Understand the organization and its context
is part of: Question 50

answer-50-D
type: Answer
position: D
text: Report the incidents to the top management
is part of: Question 50

Question 51
type: Question
text: According to ISO 27001, the risk assessment must include which one of the following elements:
suggested answer: answer-51-A
suggested answer: answer-51-B
suggested answer: answer-51-C
accepted answer: answer-51-A
is part of: ISO 27K Q&A Benchmark Dataset

answer-51-A
type: Answer
position: A
text: Risk evaluation
is accepted: true
is part of: Question 51

answer-51-B
type: Answer
position: B
text: Risk transfer
is part of: Question 51

answer-51-C
type: Answer
position: C
text: Defining the risk assessment methodology
is part of: Question 51

Question 52
type: Question
text: In a scenario where a company is evaluating potential risks to their information security, which of the following is NOT a valid method for risk evaluation according to ISO 27001?
suggested answer: answer-52-A
suggested answer: answer-52-B
suggested answer: answer-52-C
suggested answer: answer-52-D
accepted answer: answer-52-D
is part of: ISO 27K Q&A Benchmark Dataset

answer-52-A
type: Answer
position: A
text: Assessing likelihood and impact of each identified risk
is part of: Question 52

answer-52-B
type: Answer
position: B
text: Comparing risks to a pre-determined set of criteria
is part of: Question 52

answer-52-C
type: Answer
position: C
text: Consulting with industry experts to determine potential risks
is part of: Question 52

answer-52-D
type: Answer
position: D
text: Ignoring risks that have a low likelihood of occurrence
is accepted: true
is part of: Question 52

Question 53
type: Question
text: Risk analysis includes assessment of the impact the risk can have on the company and assessment of the likelihood that the identified risk could really happen. The assessment scale for the impact and the likelihood must vary between the values of 1 and 10.
suggested answer: answer-53-A
suggested answer: answer-53-B
accepted answer: answer-53-B
is part of: ISO 27K Q&A Benchmark Dataset

answer-53-A
type: Answer
position: A
text: Yes
is part of: Question 53

answer-53-B
type: Answer
position: B
text: No
is accepted: true
is part of: Question 53

Question 54
type: Question
text: During the risk evaluation process according to ISO 27001, which of the following is NOT a recommended approach for identifying potential risks?
suggested answer: answer-54-A
suggested answer: answer-54-B
suggested answer: answer-54-C
suggested answer: answer-54-D
accepted answer: answer-54-C
is part of: ISO 27K Q&A Benchmark Dataset

answer-54-A
type: Answer
position: A
text: Reviewing past incidents and near-misses
is part of: Question 54

answer-54-B
type: Answer
position: B
text: Conducting a threat analysis
is part of: Question 54

answer-54-C
type: Answer
position: C
text: Implementing a new software system without testing
is accepted: true
is part of: Question 54

answer-54-D
type: Answer
position: D
text: Consulting external experts and industry standards
is part of: Question 54

Question 55
type: Question
text: After formulating a risk treatment plan, the Statement of Applicability must be documented.
suggested answer: answer-55-A
suggested answer: answer-55-B
accepted answer: answer-55-B
is part of: ISO 27K Q&A Benchmark Dataset

answer-55-A
type: Answer
position: A
text: True
is part of: Question 55

answer-55-B
type: Answer
position: B
text: False
is accepted: true
is part of: Question 55

Question 56
type: Question
text: The Statement of Applicability must include the following information:
suggested answer: answer-56-A
suggested answer: answer-56-B
suggested answer: answer-56-C
suggested answer: answer-56-D
accepted answer: answer-56-B
is part of: ISO 27K Q&A Benchmark Dataset

answer-56-A
type: Answer
position: A
text: The risk treatment option associated with each control from Annex A and any additional controls that might be identified in the risk treatment process
is part of: Question 56

answer-56-B
type: Answer
position: B
text: Information regarding whether the listed controls are implemented in the organization
is accepted: true
is part of: Question 56

answer-56-C
type: Answer
position: C
text: The risk owner
is part of: Question 56

answer-56-D
type: Answer
position: D
text: The value of the risk
is part of: Question 56

Question 57
type: Question
text: Choose which of the following statements can be documented as results for the follow-up from the implementation of a control-card-controlled access to the server room:
suggested answer: answer-57-A
suggested answer: answer-57-B
suggested answer: answer-57-C
suggested answer: answer-57-D
accepted answer: answer-57-C
is part of: ISO 27K Q&A Benchmark Dataset

answer-57-A
type: Answer
position: A
text: The internal audit is conducted
is part of: Question 57

answer-57-B
type: Answer
position: B
text: Half of the people who work in the server room are trained in the use of the card readers
is part of: Question 57

answer-57-C
type: Answer
position: C
text: Analysis of the log and the video surveillance show that the card- controlled access to the server room is very effective
is accepted: true
is part of: Question 57

answer-57-D
type: Answer
position: D
text: Cheaper equipment for card-controlled access than the one implemented is available on the market
is part of: Question 57

Question 58
type: Question
text: ISO 27001 requires that every aspect of the ISMS should be documented.
suggested answer: answer-58-A
suggested answer: answer-58-B
accepted answer: answer-58-B
is part of: ISO 27K Q&A Benchmark Dataset

answer-58-A
type: Answer
position: A
text: True
is part of: Question 58

answer-58-B
type: Answer
position: B
text: False
is accepted: true
is part of: Question 58

Question 59
type: Question
text: It is mandatory to change the ISMS documentation (modify, update, delete, add new documents, etc.) at least once per year:
suggested answer: answer-59-A
suggested answer: answer-59-B
accepted answer: answer-59-B
is part of: ISO 27K Q&A Benchmark Dataset

answer-59-A
type: Answer
position: A
text: True
is part of: Question 59

answer-59-B
type: Answer
position: B
text: False
is accepted: true
is part of: Question 59

Question 60
type: Question
text: Companies that have implemented ISO 27001 are not allowed to outsource critical operations, because that can have a negative impact on the information security.
suggested answer: answer-60-A
suggested answer: answer-60-B
accepted answer: answer-60-B
is part of: ISO 27K Q&A Benchmark Dataset

answer-60-A
type: Answer
position: A
text: True
is part of: Question 60

answer-60-B
type: Answer
position: B
text: False
is accepted: true
is part of: Question 60

Question 61
type: Question
text: Changes in an organization can be planned and unplanned. Both types of changes should be controlled and their consequences reviewed.
suggested answer: answer-61-A
suggested answer: answer-61-B
accepted answer: answer-61-A
is part of: ISO 27K Q&A Benchmark Dataset

answer-61-A
type: Answer
position: A
text: True
is accepted: true
is part of: Question 61

answer-61-B
type: Answer
position: B
text: False
is part of: Question 61

Question 62
type: Question
text: According to you, which of the listed changes that can happen in a company may require conducting a re-assessment of risks?
suggested answer: answer-62-A
suggested answer: answer-62-B
suggested answer: answer-62-C
suggested answer: answer-62-D
accepted answer: answer-62-B
is part of: ISO 27K Q&A Benchmark Dataset

answer-62-A
type: Answer
position: A
text: Hiring a new employee
is part of: Question 62

answer-62-B
type: Answer
position: B
text: Outsourcing the IT maintenance process to an IT company
is accepted: true
is part of: Question 62

answer-62-C
type: Answer
position: C
text: Buying new furniture
is part of: Question 62

answer-62-D
type: Answer
position: D
text: Buying a new laptop for the office manager
is part of: Question 62

Question 63
type: Question
text: What are the key components that should be included in the risk treatment plan, according to ISO 27001?
suggested answer: answer-63-A
suggested answer: answer-63-B
suggested answer: answer-63-C
suggested answer: answer-63-D
accepted answer: answer-63-B
is part of: ISO 27K Q&A Benchmark Dataset

answer-63-A
type: Answer
position: A
text: The likelihood of the identified risks
is part of: Question 63

answer-63-B
type: Answer
position: B
text: The impact of the identified risks
is accepted: true
is part of: Question 63

answer-63-C
type: Answer
position: C
text: The proposed controls to mitigate the identified risks
is part of: Question 63

answer-63-D
type: Answer
position: D
text: The cost of implementing the proposed controls
is part of: Question 63

Question 64
type: Question
text: In a scenario where a company is implementing an ISMS, what is the most important factor to consider when formulating a risk treatment plan according to ISO 27001?
suggested answer: answer-64-A
suggested answer: answer-64-B
suggested answer: answer-64-C
suggested answer: answer-64-D
accepted answer: answer-64-B
is part of: ISO 27K Q&A Benchmark Dataset

answer-64-A
type: Answer
position: A
text: The cost of implementing the controls
is part of: Question 64

answer-64-B
type: Answer
position: B
text: The likelihood and potential impact of the identified risks
is accepted: true
is part of: Question 64

answer-64-C
type: Answer
position: C
text: The company's compliance with other regulatory standards
is part of: Question 64

answer-64-D
type: Answer
position: D
text: The ease of implementation for the IT department
is part of: Question 64

Question 65
type: Question
text: A company is in the process of implementing the risk treatment plan identified during their risk assessment. Which of the following is the most important factor to consider when implementing controls to mitigate identified risks?
suggested answer: answer-65-A
suggested answer: answer-65-B
suggested answer: answer-65-C
suggested answer: answer-65-D
accepted answer: answer-65-C
is part of: ISO 27K Q&A Benchmark Dataset

answer-65-A
type: Answer
position: A
text: The cost of the controls
is part of: Question 65

answer-65-B
type: Answer
position: B
text: The ease of implementing the controls
is part of: Question 65

answer-65-C
type: Answer
position: C
text: The effectiveness of the controls in mitigating the identified risks
is accepted: true
is part of: Question 65

answer-65-D
type: Answer
position: D
text: The ability to monitor and measure the controls
is part of: Question 65

Question 66
type: Question
text: When implementing the information security risk treatment plan, one must:
suggested answer: answer-66-A
suggested answer: answer-66-B
suggested answer: answer-66-C
suggested answer: answer-66-D
accepted answer: answer-66-A
is part of: ISO 27K Q&A Benchmark Dataset

answer-66-A
type: Answer
position: A
text: Take into consideration available resources
is accepted: true
is part of: Question 66

answer-66-B
type: Answer
position: B
text: Document the information security risk treatment plan
is part of: Question 66

answer-66-C
type: Answer
position: C
text: Re-assess the risks
is part of: Question 66

answer-66-D
type: Answer
position: D
text: Implement all controls from Annex A
is part of: Question 66

Question 67
type: Question
text: ISO 27001 requires companies to document the results of the risk treatment.
suggested answer: answer-67-A
suggested answer: answer-67-B
accepted answer: answer-67-A
is part of: ISO 27K Q&A Benchmark Dataset

answer-67-A
type: Answer
position: A
text: True
is accepted: true
is part of: Question 67

answer-67-B
type: Answer
position: B
text: False
is part of: Question 67

Question 68
type: Question
text: The Do phase moves companies from a stage where they plan information security to a stage where they implement information security and protect the information.
suggested answer: answer-68-A
suggested answer: answer-68-B
accepted answer: answer-68-A
is part of: ISO 27K Q&A Benchmark Dataset

answer-68-A
type: Answer
position: A
text: True
is accepted: true
is part of: Question 68

answer-68-B
type: Answer
position: B
text: False
is part of: Question 68

Question 69
type: Question
text: ISO 27001 requires the change management procedure to be documented.
suggested answer: answer-69-A
suggested answer: answer-69-B
accepted answer: answer-69-B
is part of: ISO 27K Q&A Benchmark Dataset

answer-69-A
type: Answer
position: A
text: True
is part of: Question 69

answer-69-B
type: Answer
position: B
text: False
is accepted: true
is part of: Question 69

Question 70
type: Question
text: Operating an Information Security Management System (ISMS) means:
suggested answer: answer-70-A
suggested answer: answer-70-B
suggested answer: answer-70-C
suggested answer: answer-70-D
accepted answer: answer-70-B
is part of: ISO 27K Q&A Benchmark Dataset

answer-70-A
type: Answer
position: A
text: Auditing all of the activities described in the ISMS policies and procedures
is part of: Question 70

answer-70-B
type: Answer
position: B
text: Producing ISMS records
is accepted: true
is part of: Question 70

answer-70-C
type: Answer
position: C
text: Certifying the ISMS
is part of: Question 70

answer-70-D
type: Answer
position: D
text: Maintaining highly detailed ISMS documentation
is part of: Question 70

Question 71
type: Question
text: In a scenario where a company is undergoing an ISO 27001 certification audit, which of the following documents would the auditor typically request to review as part of the ISMS documentation requirement?
suggested answer: answer-71-A
suggested answer: answer-71-B
suggested answer: answer-71-C
suggested answer: answer-71-D
accepted answer: answer-71-C
is part of: ISO 27K Q&A Benchmark Dataset

answer-71-A
type: Answer
position: A
text: Employee handbook
is part of: Question 71

answer-71-B
type: Answer
position: B
text: Emergency evacuation plan
is part of: Question 71

answer-71-C
type: Answer
position: C
text: Risk assessment report
is accepted: true
is part of: Question 71

answer-71-D
type: Answer
position: D
text: Sales forecast
is part of: Question 71

Question 72
type: Question
text: What is the main goal of control implementation in an ISMS according to ISO 27001?
suggested answer: answer-72-A
suggested answer: answer-72-B
suggested answer: answer-72-C
suggested answer: answer-72-D
accepted answer: answer-72-B
is part of: ISO 27K Q&A Benchmark Dataset

answer-72-A
type: Answer
position: A
text: To ensure the ISMS is functioning properly
is part of: Question 72

answer-72-B
type: Answer
position: B
text: To protect the organization's assets
is accepted: true
is part of: Question 72

answer-72-C
type: Answer
position: C
text: To meet regulatory compliance requirements
is part of: Question 72

answer-72-D
type: Answer
position: D
text: To improve the organization's overall efficiency
is part of: Question 72

Question 73
type: Question
text: In a scenario where a company has recently implemented an ISMS based on ISO 27001, which of the following is the MOST important step in the ongoing monitoring and review process?
suggested answer: answer-73-A
suggested answer: answer-73-B
suggested answer: answer-73-C
suggested answer: answer-73-D
accepted answer: answer-73-A
is part of: ISO 27K Q&A Benchmark Dataset

answer-73-A
type: Answer
position: A
text: Conducting regular internal audits
is accepted: true
is part of: Question 73

answer-73-B
type: Answer
position: B
text: Implementing new controls as needed
is part of: Question 73

answer-73-C
type: Answer
position: C
text: Documenting all incidents and their resolutions
is part of: Question 73

answer-73-D
type: Answer
position: D
text: Evaluating the effectiveness of the ISMS on a yearly basis
is part of: Question 73

Question 74
type: Question
text: In the event of a security incident at Company X, which of the following actions should be taken first according to ISO 27001 guidelines?
suggested answer: answer-74-A
suggested answer: answer-74-B
suggested answer: answer-74-C
suggested answer: answer-74-D
accepted answer: answer-74-D
is part of: ISO 27K Q&A Benchmark Dataset

answer-74-A
type: Answer
position: A
text: Notify the affected parties and the public
is part of: Question 74

answer-74-B
type: Answer
position: B
text: Conduct a thorough investigation to determine the root cause
is part of: Question 74

answer-74-C
type: Answer
position: C
text: Report the incident to the relevant regulatory bodies
is part of: Question 74

answer-74-D
type: Answer
position: D
text: Implement temporary countermeasures to contain the incident
is accepted: true
is part of: Question 74

Question 75
type: Question
text: In XYZ Company, what is the recommended process for reporting and recording incidents according to ISO 27001 guidelines?
suggested answer: answer-75-A
suggested answer: answer-75-B
suggested answer: answer-75-C
suggested answer: answer-75-D
accepted answer: answer-75-C
is part of: ISO 27K Q&A Benchmark Dataset

answer-75-A
type: Answer
position: A
text: Employees should report incidents to their immediate supervisor and the IT department
is part of: Question 75

answer-75-B
type: Answer
position: B
text: Incidents should only be reported to the IT department and not shared with any other department
is part of: Question 75

answer-75-C
type: Answer
position: C
text: Incidents should be reported to the IT department and the incident management team for further investigation
is accepted: true
is part of: Question 75

answer-75-D
type: Answer
position: D
text: Incidents should be reported to the IT department and the senior management team for review and analysis
is part of: Question 75

Question 76
type: Question
text: Which of the following is NOT a best practice for incident management according to ISO 27001:
suggested answer: answer-76-A
suggested answer: answer-76-B
suggested answer: answer-76-C
suggested answer: answer-76-D
accepted answer: answer-76-C
is part of: ISO 27K Q&A Benchmark Dataset

answer-76-A
type: Answer
position: A
text: Assign a specific team member to be in charge of managing incidents
is part of: Question 76

answer-76-B
type: Answer
position: B
text: Immediately notify all employees of an incident as soon as it occurs
is part of: Question 76

answer-76-C
type: Answer
position: C
text: Wait to see if an incident resolves itself before taking any action
is accepted: true
is part of: Question 76

answer-76-D
type: Answer
position: D
text: Document all incidents and their resolution in a centralized incident log
is part of: Question 76

Question 77
type: Question
text: The purpose of the management review is to evaluate the results of the measurements and analyses and make crucial decisions.
suggested answer: answer-77-A
suggested answer: answer-77-B
accepted answer: answer-77-B
is part of: ISO 27K Q&A Benchmark Dataset

answer-77-A
type: Answer
position: A
text: True
is part of: Question 77

answer-77-B
type: Answer
position: B
text: False
is accepted: true
is part of: Question 77

Question 78
type: Question
text: A nonconformity is when a certain incident happens in the organization.
suggested answer: answer-78-A
suggested answer: answer-78-B
accepted answer: answer-78-B
is part of: ISO 27K Q&A Benchmark Dataset

answer-78-A
type: Answer
position: A
text: True
is part of: Question 78

answer-78-B
type: Answer
position: B
text: False
is accepted: true
is part of: Question 78

Question 79
type: Question
text: ISO 27001 requires companies to continually improve:
suggested answer: answer-79-A
suggested answer: answer-79-B
suggested answer: answer-79-C
accepted answer: answer-79-B
is part of: ISO 27K Q&A Benchmark Dataset

answer-79-A
type: Answer
position: A
text: The ISO 27001 standard by publishing new versions of the standard
is part of: Question 79

answer-79-B
type: Answer
position: B
text: The suitability, adequacy, and effectiveness of the Information Security Management System
is accepted: true
is part of: Question 79

answer-79-C
type: Answer
position: C
text: The quality of the company’s services
is part of: Question 79

Question 80
type: Question
text: ISO 27001 requires companies to evaluate the information security performance and effectiveness of the ISMS through:
suggested answer: answer-80-A
suggested answer: answer-80-B
suggested answer: answer-80-C
suggested answer: answer-80-D
accepted answer: answer-80-C
is part of: ISO 27K Q&A Benchmark Dataset

answer-80-A
type: Answer
position: A
text: Mentoring
is part of: Question 80

answer-80-B
type: Answer
position: B
text: Awareness raising
is part of: Question 80

answer-80-C
type: Answer
position: C
text: Measuring
is accepted: true
is part of: Question 80

answer-80-D
type: Answer
position: D
text: Implementation
is part of: Question 80

Question 81
type: Question
text: As part of the process for evaluating the information security performance and effectiveness of the ISMS, ISO 27001 requires companies to:
suggested answer: answer-81-A
suggested answer: answer-81-B
suggested answer: answer-81-C
suggested answer: answer-81-D
accepted answer: answer-81-B
is part of: ISO 27K Q&A Benchmark Dataset

answer-81-A
type: Answer
position: A
text: Monitor and measure the incident management process
is part of: Question 81

answer-81-B
type: Answer
position: B
text: Determine the methods for monitoring
is accepted: true
is part of: Question 81

answer-81-C
type: Answer
position: C
text: Document a procedure for the evaluation of ISMS effectiveness
is part of: Question 81

answer-81-D
type: Answer
position: D
text: Nominate at least three responsible persons for conducting monitoring and measurements, so data tampering risk is reduced
is part of: Question 81

Question 82
type: Question
text: The objective of the internal audit is to identify who is responsible for the information security problems in the organization.
suggested answer: answer-82-A
suggested answer: answer-82-B
accepted answer: answer-82-B
is part of: ISO 27K Q&A Benchmark Dataset

answer-82-A
type: Answer
position: A
text: True
is part of: Question 82

answer-82-B
type: Answer
position: B
text: False
is accepted: true
is part of: Question 82

Question 83
type: Question
text: ISO 27001 requires the top management to conduct management review meetings for reviewing the ISMS of the company.
suggested answer: answer-83-A
suggested answer: answer-83-B
accepted answer: answer-83-B
is part of: ISO 27K Q&A Benchmark Dataset

answer-83-A
type: Answer
position: A
text: True
is part of: Question 83

answer-83-B
type: Answer
position: B
text: False
is accepted: true
is part of: Question 83

Question 84
type: Question
text: In order for top management to review the suitability, adequacy, and effectiveness of the ISMS of the company, which one of the following aspects should be covered:
suggested answer: answer-84-A
suggested answer: answer-84-B
suggested answer: answer-84-C
suggested answer: answer-84-D
accepted answer: answer-84-A
is part of: ISO 27K Q&A Benchmark Dataset

answer-84-A
type: Answer
position: A
text: Opportunities for improvement
is accepted: true
is part of: Question 84

answer-84-B
type: Answer
position: B
text: Feedback from employees regarding the new cafeteria
is part of: Question 84

answer-84-C
type: Answer
position: C
text: An overview of the configuration parameters of the network router
is part of: Question 84

answer-84-D
type: Answer
position: D
text: The financial status of the company
is part of: Question 84

Question 85
type: Question
text: In order to effectively monitor the performance and effectiveness of an ISMS, which of the following methods should be used according to ISO 27001?
suggested answer: answer-85-A
suggested answer: answer-85-B
suggested answer: answer-85-C
suggested answer: answer-85-D
accepted answer: answer-85-B
is part of: ISO 27K Q&A Benchmark Dataset

answer-85-A
type: Answer
position: A
text: Surveys of employees
is part of: Question 85

answer-85-B
type: Answer
position: B
text: Review of security-related incidents and their causes
is accepted: true
is part of: Question 85

answer-85-C
type: Answer
position: C
text: Analysis of ISMS-related costs and benefits
is part of: Question 85

answer-85-D
type: Answer
position: D
text: All of the above
is part of: Question 85

Question 86
type: Question
text: What are the criteria to be used in an internal audit of an organization’s information security management system according to ISO 27001?
suggested answer: answer-86-A
suggested answer: answer-86-B
suggested answer: answer-86-C
suggested answer: answer-86-D
accepted answer: answer-86-A
is part of: ISO 27K Q&A Benchmark Dataset

answer-86-A
type: Answer
position: A
text: Documentation, implementation, monitoring and review
is accepted: true
is part of: Question 86

answer-86-B
type: Answer
position: B
text: Documentation, implementation and review
is part of: Question 86

answer-86-C
type: Answer
position: C
text: Documentation, implementation and maintenance
is part of: Question 86

answer-86-D
type: Answer
position: D
text: Documentation and review
is part of: Question 86

Question 87
type: Question
text: What should an organization consider when carrying out an internal audit of its information security management system?
suggested answer: answer-87-A
suggested answer: answer-87-B
suggested answer: answer-87-C
suggested answer: answer-87-D
accepted answer: answer-87-D
is part of: ISO 27K Q&A Benchmark Dataset

answer-87-A
type: Answer
position: A
text: Whether the system complies with the applicable laws and regulations
is part of: Question 87

answer-87-B
type: Answer
position: B
text: Whether the system is regularly monitored and updated
is part of: Question 87

answer-87-C
type: Answer
position: C
text: Whether the system is regularly tested
is part of: Question 87

answer-87-D
type: Answer
position: D
text: Whether the system meets the organization’s security objectives
is accepted: true
is part of: Question 87

Question 88
type: Question
text: What are the key components of an internal audit report according to ISO 27001?
suggested answer: answer-88-A
suggested answer: answer-88-B
suggested answer: answer-88-C
suggested answer: answer-88-D
suggested answer: answer-88-E
accepted answer: answer-88-E
is part of: ISO 27K Q&A Benchmark Dataset

answer-88-A
type: Answer
position: A
text: Audit objectives - this outlines the purpose of the audit, such as to evaluate the effectiveness of the organization's information security management system (ISMS).
is part of: Question 88

answer-88-B
type: Answer
position: B
text: Audit scope - this outlines the areas which were audited and any specific requirements that were not included in the scope.
is part of: Question 88

answer-88-C
type: Answer
position: C
text: Audit findings - this outlines the issues identified during the audit and any recommendations for improvement.
is part of: Question 88

answer-88-D
type: Answer
position: D
text: Audit conclusion - this is a summary of the audit findings and any recommendations for improvement.
is part of: Question 88

answer-88-E
type: Answer
position: E
text: All of the above
is accepted: true
is part of: Question 88

Question 89
type: Question
text: What is the purpose of an internal audit report according to ISO 27001?
suggested answer: answer-89-A
suggested answer: answer-89-B
suggested answer: answer-89-C
suggested answer: answer-89-D
accepted answer: answer-89-D
is part of: ISO 27K Q&A Benchmark Dataset

answer-89-A
type: Answer
position: A
text: To evaluate the effectiveness of the organization's ISMS;
is part of: Question 89

answer-89-B
type: Answer
position: B
text: To identify any areas for improvement.
is part of: Question 89

answer-89-C
type: Answer
position: C
text: To provide evidence of the organization's compliance with the standard.
is part of: Question 89

answer-89-D
type: Answer
position: D
text: All of the above
is accepted: true
is part of: Question 89

Question 90
type: Question
text: What are the three stages of a nonconformity according to ISO 27001?
suggested answer: answer-90-A
suggested answer: answer-90-B
suggested answer: answer-90-C
suggested answer: answer-90-D
accepted answer: answer-90-A
is part of: ISO 27K Q&A Benchmark Dataset

answer-90-A
type: Answer
position: A
text: Identification, investigation, and resolution
is accepted: true
is part of: Question 90

answer-90-B
type: Answer
position: B
text: Assessment, investigation, and corrective action
is part of: Question 90

answer-90-C
type: Answer
position: C
text: Assessment, correction, and closure
is part of: Question 90

answer-90-D
type: Answer
position: D
text: Identification, correction, and closure
is part of: Question 90

Question 91
type: Question
text: What should an organization do when a nonconformity is identified?
suggested answer: answer-91-A
suggested answer: answer-91-B
suggested answer: answer-91-C
suggested answer: answer-91-D
accepted answer: answer-91-A
is part of: ISO 27K Q&A Benchmark Dataset

answer-91-A
type: Answer
position: A
text: Investigate the nonconformity and implement corrective action
is accepted: true
is part of: Question 91

answer-91-B
type: Answer
position: B
text: Investigate the nonconformity and report it
is part of: Question 91

answer-91-C
type: Answer
position: C
text: Identify the nonconformity and report it
is part of: Question 91

answer-91-D
type: Answer
position: D
text: Identify the nonconformity and implement corrective action
is part of: Question 91

Question 92
type: Question
text: What are the four types of nonconformities associated with ISO 27001?
suggested answer: answer-92-A
suggested answer: answer-92-B
suggested answer: answer-92-C
suggested answer: answer-92-D
suggested answer: answer-92-E
accepted answer: answer-92-E
is part of: ISO 27K Q&A Benchmark Dataset

answer-92-A
type: Answer
position: A
text: Minor nonconformity: A minor nonconformity is a noncompliance with one or more requirements of the ISO 27001 standard that has no significant impact on the security of the system or the implementation of the ISMS.
is part of: Question 92

answer-92-B
type: Answer
position: B
text: Major nonconformity: A major nonconformity is a noncompliance with one or more requirements of the ISO 27001 standard that has a significant impact on the security of the system or the implementation of the ISMS.
is part of: Question 92

answer-92-C
type: Answer
position: C
text: Critical nonconformity: A critical nonconformity is a noncompliance with one or more requirements of the ISO 27001 standard that has a severe impact on the security of the system or the implementation of the ISMS.
is part of: Question 92

answer-92-D
type: Answer
position: D
text: Observation: An observation is a noncompliance with one or more requirements of the ISO 27001 standard that does not have an impact on the security of the system or the implementation of the ISMS, but could lead to a nonconformity if it is not rectified.
is part of: Question 92

answer-92-E
type: Answer
position: E
text: All of the above
is accepted: true
is part of: Question 92

Question 93
type: Question
text: What are the necessary steps when responding to a corrective action request according to the ISO 27001 standard?
suggested answer: answer-93-A
suggested answer: answer-93-B
suggested answer: answer-93-C
suggested answer: answer-93-D
suggested answer: answer-93-E
accepted answer: answer-93-E
is part of: ISO 27K Q&A Benchmark Dataset

answer-93-A
type: Answer
position: A
text: Identify the root cause of the problem and take steps to address it.
is part of: Question 93

answer-93-B
type: Answer
position: B
text: Document the corrective action taken to remedy the issue.
is part of: Question 93

answer-93-C
type: Answer
position: C
text: Monitor and evaluate the effectiveness of the corrective action.
is part of: Question 93

answer-93-D
type: Answer
position: D
text: Implement preventive measures to reduce the likelihood of recurrence.
is part of: Question 93

answer-93-E
type: Answer
position: E
text: All of the above
is accepted: true
is part of: Question 93

Question 94
type: Question
text: What is the best way to ensure continual improvement within the ISO 27001 framework?
suggested answer: answer-94-A
suggested answer: answer-94-B
suggested answer: answer-94-C
suggested answer: answer-94-D
accepted answer: answer-94-A
is part of: ISO 27K Q&A Benchmark Dataset

answer-94-A
type: Answer
position: A
text: Regularly review and update the information security management system
is accepted: true
is part of: Question 94

answer-94-B
type: Answer
position: B
text: Implement additional security controls
is part of: Question 94

answer-94-C
type: Answer
position: C
text: Monitor and audit the security system
is part of: Question 94

answer-94-D
type: Answer
position: D
text: Train employees on security policies
is part of: Question 94

Question 95
type: Question
text: ISO 27001 requires the chief information security manager to be responsible for monitoring and measurement of the ISMS.
suggested answer: answer-95-A
suggested answer: answer-95-B
accepted answer: answer-95-B
is part of: ISO 27K Q&A Benchmark Dataset

answer-95-A
type: Answer
position: A
text: True
is part of: Question 95

answer-95-B
type: Answer
position: B
text: False
is accepted: true
is part of: Question 95

Question 96
type: Question
text: The main purpose of the internal audit is to help identify problems in the company and to identify who is responsible for those problems in order to initiate appropriate disciplinary actions.
suggested answer: answer-96-A
suggested answer: answer-96-B
accepted answer: answer-96-B
is part of: ISO 27K Q&A Benchmark Dataset

answer-96-A
type: Answer
position: A
text: True
is part of: Question 96

answer-96-B
type: Answer
position: B
text: False
is accepted: true
is part of: Question 96

Question 97
type: Question
text: All 93 controls listed in ISO 27001 Annex A must be implemented.
suggested answer: answer-97-A
suggested answer: answer-97-B
accepted answer: answer-97-B
is part of: ISO 27K Q&A Benchmark Dataset

answer-97-A
type: Answer
position: A
text: True
is part of: Question 97

answer-97-B
type: Answer
position: B
text: False
is accepted: true
is part of: Question 97

Question 98
type: Question
text: The purpose of the A.6 People controls section of Annex A is:
suggested answer: answer-98-A
suggested answer: answer-98-B
suggested answer: answer-98-C
suggested answer: answer-98-D
accepted answer: answer-98-C
is part of: ISO 27K Q&A Benchmark Dataset

answer-98-A
type: Answer
position: A
text: To punish people who don’t follow the rules
is part of: Question 98

answer-98-B
type: Answer
position: B
text: To help the company to employ high-quality people
is part of: Question 98

answer-98-C
type: Answer
position: C
text: To ensure that people working under the company understand and fulfill their information security responsibilities
is accepted: true
is part of: Question 98

answer-98-D
type: Answer
position: D
text: To prevent information disclosure by employees
is part of: Question 98

Question 99
type: Question
text: Which of the following information security controls represent physical security controls?
suggested answer: answer-99-A
suggested answer: answer-99-B
suggested answer: answer-99-C
suggested answer: answer-99-D
accepted answer: answer-99-C
is part of: ISO 27K Q&A Benchmark Dataset

answer-99-A
type: Answer
position: A
text: Public and private encryption keys
is part of: Question 99

answer-99-B
type: Answer
position: B
text: Ensuring the proper return of assets
is part of: Question 99

answer-99-C
type: Answer
position: C
text: Securing equipment against theft when used outside of offices
is accepted: true
is part of: Question 99

answer-99-D
type: Answer
position: D
text: Defining guidelines for classification of information
is part of: Question 99

Question 100
type: Question
text: The technological controls from ISO 27001 Annex A are focused on the direct protection of data and information systems used.
suggested answer: answer-100-A
suggested answer: answer-100-B
accepted answer: answer-100-A
is part of: ISO 27K Q&A Benchmark Dataset

answer-100-A
type: Answer
position: A
text: True
is accepted: true
is part of: Question 100

answer-100-B
type: Answer
position: B
text: False
is part of: Question 100

Question 101
type: Question
text: To ensure that information security is integrated into the new information systems, companies should conduct the following activities:
suggested answer: answer-101-A
suggested answer: answer-101-B
suggested answer: answer-101-C
suggested answer: answer-101-D
accepted answer: answer-101-A
is part of: ISO 27K Q&A Benchmark Dataset

answer-101-A
type: Answer
position: A
text: Test the security features of the new systems
is accepted: true
is part of: Question 101

answer-101-B
type: Answer
position: B
text: Document a Change Management Policy
is part of: Question 101

answer-101-C
type: Answer
position: C
text: Make updates on information systems as soon as vulnerabilities are identified
is part of: Question 101

answer-101-D
type: Answer
position: D
text: Identifying information security requirements for application services transactions is the job of the company that produces the information system, not the company that buys it
is part of: Question 101

Question 102
type: Question
text: Technological controls from ISO 27001 Annex A are those controls that are essential for ensuring secure operations of the IT infrastructure of the company.
suggested answer: answer-102-A
suggested answer: answer-102-B
accepted answer: answer-102-A
is part of: ISO 27K Q&A Benchmark Dataset

answer-102-A
type: Answer
position: A
text: True
is accepted: true
is part of: Question 102

answer-102-B
type: Answer
position: B
text: False
is part of: Question 102

Question 103
type: Question
text: Information security should be addressed in every project, regardless of its type.
suggested answer: answer-103-A
suggested answer: answer-103-B
accepted answer: answer-103-A
is part of: ISO 27K Q&A Benchmark Dataset

answer-103-A
type: Answer
position: A
text: True
is accepted: true
is part of: Question 103

answer-103-B
type: Answer
position: B
text: False
is part of: Question 103

Question 104
type: Question
text: According to ISO 27001, Annex A, information and assets should be managed by:
suggested answer: answer-104-A
suggested answer: answer-104-B
suggested answer: answer-104-C
suggested answer: answer-104-D
accepted answer: answer-104-B
is part of: ISO 27K Q&A Benchmark Dataset

answer-104-A
type: Answer
position: A
text: Defining a classification framework considering the levels Public, Internal, Confidential, and Top Secret
is part of: Question 104

answer-104-B
type: Answer
position: B
text: Defining expected behavior on the use of assets
is accepted: true
is part of: Question 104

answer-104-C
type: Answer
position: C
text: Implementing an asset management software
is part of: Question 104

answer-104-D
type: Answer
position: D
text: By ensuring the former employee signs the Return of Asset form when leaving the organization
is part of: Question 104

Question 105
type: Question
text: According to ISO 27001, Annex A, operational security should be managed by:
suggested answer: answer-105-A
suggested answer: answer-105-B
suggested answer: answer-105-C
suggested answer: answer-105-D
accepted answer: answer-105-B
is part of: ISO 27K Q&A Benchmark Dataset

answer-105-A
type: Answer
position: A
text: Defining rules that will forbid access by third parties
is part of: Question 105

answer-105-B
type: Answer
position: B
text: Defining how information can be transferred between organizations
is accepted: true
is part of: Question 105

answer-105-C
type: Answer
position: C
text: Documenting procedures focusing only on employees from the IT department
is part of: Question 105

answer-105-D
type: Answer
position: D
text: Having security documents not related to regular IT processes
is part of: Question 105

Question 106
type: Question
text: Security requirements can be agreed upon verbally with suppliers.
suggested answer: answer-106-A
suggested answer: answer-106-B
accepted answer: answer-106-B
is part of: ISO 27K Q&A Benchmark Dataset

answer-106-A
type: Answer
position: A
text: True
is part of: Question 106

answer-106-B
type: Answer
position: B
text: False
is accepted: true
is part of: Question 106

Question 107
type: Question
text: Management of information security incidents includes learning from the incidents.
suggested answer: answer-107-A
suggested answer: answer-107-B
accepted answer: answer-107-A
is part of: ISO 27K Q&A Benchmark Dataset

answer-107-A
type: Answer
position: A
text: True
is accepted: true
is part of: Question 107

answer-107-B
type: Answer
position: B
text: False
is part of: Question 107

Question 108
type: Question
text: The controls related to compliance are focused primarily on avoiding breaches of intellectual property rights.
suggested answer: answer-108-A
suggested answer: answer-108-B
accepted answer: answer-108-B
is part of: ISO 27K Q&A Benchmark Dataset

answer-108-A
type: Answer
position: A
text: True
is part of: Question 108

answer-108-B
type: Answer
position: B
text: False
is accepted: true
is part of: Question 108

Question 109
type: Question
text: Controls related to information security policies require documenting a set of policies for defining information security rules. These policies are:
suggested answer: answer-109-A
suggested answer: answer-109-B
suggested answer: answer-109-C
suggested answer: answer-109-D
accepted answer: answer-109-C
is part of: ISO 27K Q&A Benchmark Dataset

answer-109-A
type: Answer
position: A
text: High-level policies that set the basic approach of the company for information security
is part of: Question 109

answer-109-B
type: Answer
position: B
text: Mandatory
is part of: Question 109

answer-109-C
type: Answer
position: C
text: Topic-specific policies
is accepted: true
is part of: Question 109

answer-109-D
type: Answer
position: D
text: Updated at least once per year
is part of: Question 109

Question 110
type: Question
text: The physical controls from section A.7 cover two sub-topics: controls for securing the area, and controls for securing the equipment.
suggested answer: answer-110-A
suggested answer: answer-110-B
accepted answer: answer-110-A
is part of: ISO 27K Q&A Benchmark Dataset

answer-110-A
type: Answer
position: A
text: True
is accepted: true
is part of: Question 110

answer-110-B
type: Answer
position: B
text: False
is part of: Question 110

Question 111
type: Question
text: Section A.5 Organizational controls requires documenting operational procedures that will be available to everyone in the organization who needs them.
suggested answer: answer-111-A
suggested answer: answer-111-B
accepted answer: answer-111-A
is part of: ISO 27K Q&A Benchmark Dataset

answer-111-A
type: Answer
position: A
text: True
is accepted: true
is part of: Question 111

answer-111-B
type: Answer
position: B
text: False
is part of: Question 111

Question 112
type: Question
text: Section A.6 People controls aims to ensure that people are aware of their responsibilities regarding information security, have the necessary training, and will take proper measures to protect the information.
suggested answer: answer-112-A
suggested answer: answer-112-B
accepted answer: answer-112-A
is part of: ISO 27K Q&A Benchmark Dataset

answer-112-A
type: Answer
position: A
text: True
is accepted: true
is part of: Question 112

answer-112-B
type: Answer
position: B
text: False
is part of: Question 112

Question 113
type: Question
text: Section A.5 defines controls related to supplier management. These controls aim:
suggested answer: answer-113-A
suggested answer: answer-113-B
suggested answer: answer-113-C
suggested answer: answer-113-D
accepted answer: answer-113-C
is part of: ISO 27K Q&A Benchmark Dataset

answer-113-A
type: Answer
position: A
text: To ensure that failure to deliver reports as defined in agreements’ clauses is properly handled
is part of: Question 113

answer-113-B
type: Answer
position: B
text: To ensure that suppliers exceed the agreed levels of performance
is part of: Question 113

answer-113-C
type: Answer
position: C
text: To ensure that controls to treat risks related to suppliers are properly identified, agreed, monitored, and reviewed
is accepted: true
is part of: Question 113

answer-113-D
type: Answer
position: D
text: To force suppliers to pay out damages that are incurred as a consequence of incidents
is part of: Question 113

Question 114
type: Question
text: What is the purpose of people controls in ISO 27001?
suggested answer: answer-114-A
suggested answer: answer-114-B
suggested answer: answer-114-C
suggested answer: answer-114-D
accepted answer: answer-114-A
is part of: ISO 27K Q&A Benchmark Dataset

answer-114-A
type: Answer
position: A
text: To ensure that only authorized individuals have access to sensitive information
is accepted: true
is part of: Question 114

answer-114-B
type: Answer
position: B
text: To track the amount of time employees spend on specific tasks
is part of: Question 114

answer-114-C
type: Answer
position: C
text: To monitor employee internet usage
is part of: Question 114

answer-114-D
type: Answer
position: D
text: To implement background checks for new hires
is part of: Question 114

Question 115
type: Question
text: Which of the following is considered a physical control in an ISO 27001 compliant environment?
suggested answer: answer-115-A
suggested answer: answer-115-B
suggested answer: answer-115-C
suggested answer: answer-115-D
accepted answer: answer-115-C
is part of: ISO 27K Q&A Benchmark Dataset

answer-115-A
type: Answer
position: A
text: Employee background checks
is part of: Question 115

answer-115-B
type: Answer
position: B
text: Firewall implementation
is part of: Question 115

answer-115-C
type: Answer
position: C
text: Biometric access controls
is accepted: true
is part of: Question 115

answer-115-D
type: Answer
position: D
text: Encryption of sensitive data
is part of: Question 115

Question 116
type: Question
text: A company is concerned about the security of their data center. Which of the following is a physical control that can be implemented to secure the data center?
suggested answer: answer-116-A
suggested answer: answer-116-B
suggested answer: answer-116-C
suggested answer: answer-116-D
accepted answer: answer-116-B
is part of: ISO 27K Q&A Benchmark Dataset

answer-116-A
type: Answer
position: A
text: Employee background checks
is part of: Question 116

answer-116-B
type: Answer
position: B
text: Fire suppression system
is accepted: true
is part of: Question 116

answer-116-C
type: Answer
position: C
text: Access controls on network devices
is part of: Question 116

answer-116-D
type: Answer
position: D
text: Anti-virus software
is part of: Question 116

Question 117
type: Question
text: Which of the following is an example of a technological control that can be implemented to protect an organization's information assets according to ISO 27001?
suggested answer: answer-117-A
suggested answer: answer-117-B
suggested answer: answer-117-C
suggested answer: answer-117-D
accepted answer: answer-117-C
is part of: ISO 27K Q&A Benchmark Dataset

answer-117-A
type: Answer
position: A
text: Security cameras
is part of: Question 117

answer-117-B
type: Answer
position: B
text: Background checks on employees
is part of: Question 117

answer-117-C
type: Answer
position: C
text: Firewall
is accepted: true
is part of: Question 117

answer-117-D
type: Answer
position: D
text: Regularly scheduled employee trainings
is part of: Question 117

Question 118
type: Question
text: An organization is concerned about unauthorized access to their network. Which of the following would be considered a technological control to mitigate this risk?
suggested answer: answer-118-A
suggested answer: answer-118-B
suggested answer: answer-118-C
accepted answer: answer-118-B
is part of: ISO 27K Q&A Benchmark Dataset

answer-118-A
type: Answer
position: A
text: Background checks for employees
is part of: Question 118

answer-118-B
type: Answer
position: B
text: Installing a firewall
is accepted: true
is part of: Question 118

answer-118-C
type: Answer
position: C
text: Conducting regular security training for employees
is part of: Question 118

Question 119
type: Question
text: What is an example of an organizational control in accordance with ISO 27001?
suggested answer: answer-119-A
suggested answer: answer-119-B
suggested answer: answer-119-C
suggested answer: answer-119-D
accepted answer: answer-119-B
is part of: ISO 27K Q&A Benchmark Dataset

answer-119-A
type: Answer
position: A
text: Encryption of sensitive data
is part of: Question 119

answer-119-B
type: Answer
position: B
text: Background checks for new employees
is accepted: true
is part of: Question 119

answer-119-C
type: Answer
position: C
text: Regularly scheduled backups of important data
is part of: Question 119

answer-119-D
type: Answer
position: D
text: Installation of firewalls on network devices
is part of: Question 119

Question 120
type: Question
text: In ISO/IEC 27000:2018 what is "fulfilment of a requirement"?
suggested answer: answer-120-A
suggested answer: answer-120-B
accepted answer: answer-120-A
is part of: ISO 27K Q&A Benchmark Dataset

answer-120-A
type: Answer
position: A
text: Conformity
is accepted: true
is part of: Question 120

answer-120-B
type: Answer
position: B
text: Compliance
is part of: Question 120

Question 121
type: Question
text: ISO/IEC 27001:2022 requires which of the following to be documented (in Clause 6)? Select as many as you think apply
suggested answer: answer-121-A
suggested answer: answer-121-B
accepted answer: answer-121-B
is part of: ISO 27K Q&A Benchmark Dataset

answer-121-A
type: Answer
position: A
text: Risk assessment
is part of: Question 121

answer-121-B
type: Answer
position: B
text: Risk treatment
is accepted: true
is part of: Question 121

Question 122
type: Question
text: Where in the standard will you find a reference for controls?
suggested answer: answer-122-A
suggested answer: answer-122-B
suggested answer: answer-122-C
accepted answer: answer-122-B
is part of: ISO 27K Q&A Benchmark Dataset

answer-122-A
type: Answer
position: A
text: Clause 9 Performance evaluation
is part of: Question 122

answer-122-B
type: Answer
position: B
text: Annex A
is accepted: true
is part of: Question 122

answer-122-C
type: Answer
position: C
text: Annex SL
is part of: Question 122

Question 123
type: Question
text: ISO/IEC 27001:2022 requires defined rules for which of the following? Select as many as you think apply
suggested answer: answer-123-A
suggested answer: answer-123-B
accepted answer: answer-123-A
is part of: ISO 27K Q&A Benchmark Dataset

answer-123-A
type: Answer
position: A
text: Clear desk
is accepted: true
is part of: Question 123

answer-123-B
type: Answer
position: B
text: Clear screen
is part of: Question 123

Question 124
type: Question
text: "ISO/IEC 27001:2022 uses the same Annex SL 10-clause framework as ISO 9001:2015 and ISO 14001:2015." Is this statement 'true' or 'false'?
suggested answer: answer-124-A
suggested answer: answer-124-B
accepted answer: answer-124-A
is part of: ISO 27K Q&A Benchmark Dataset

answer-124-A
type: Answer
position: A
text: True
is accepted: true
is part of: Question 124

answer-124-B
type: Answer
position: B
text: False
is part of: Question 124

Question 125
type: Question
text: Where would you find the Terms and Definitions for ISO/IEC 27001:2022?
suggested answer: answer-125-A
suggested answer: answer-125-B
suggested answer: answer-125-C
accepted answer: answer-125-A
is part of: ISO 27K Q&A Benchmark Dataset

answer-125-A
type: Answer
position: A
text: ISO 27000
is accepted: true
is part of: Question 125

answer-125-B
type: Answer
position: B
text: ISO 9000
is part of: Question 125

answer-125-C
type: Answer
position: C
text: Oxford English Dictionary
is part of: Question 125

Question 126
type: Question
text: "The scope [of the management system] shall be available as documented information".
suggested answer: answer-126-A
suggested answer: answer-126-B
accepted answer: answer-126-A
is part of: ISO 27K Q&A Benchmark Dataset

answer-126-A
type: Answer
position: A
text: True
is accepted: true
is part of: Question 126

answer-126-B
type: Answer
position: B
text: False
is part of: Question 126

Question 127
type: Question
text: What does the C in the CIA of Information Security stand for?
suggested answer: answer-127-A
suggested answer: answer-127-B
suggested answer: answer-127-C
accepted answer: answer-127-A
is part of: ISO 27K Q&A Benchmark Dataset

answer-127-A
type: Answer
position: A
text: Confidentiality
is accepted: true
is part of: Question 127

answer-127-B
type: Answer
position: B
text: Context
is part of: Question 127

answer-127-C
type: Answer
position: C
text: Conformity
is part of: Question 127

Question 128
type: Question
text: With regards to the controls, what must the organisation produce?
suggested answer: answer-128-A
suggested answer: answer-128-B
suggested answer: answer-128-C
accepted answer: answer-128-A
is part of: ISO 27K Q&A Benchmark Dataset

answer-128-A
type: Answer
position: A
text: Statement of applicability
is accepted: true
is part of: Question 128

answer-128-B
type: Answer
position: B
text: Statement of implementation
is part of: Question 128

answer-128-C
type: Answer
position: C
text: Statement of control
is part of: Question 128

Question 129
type: Question
text: ISO/IEC 27001:2022 is focussed solely on the protection of personal information.
suggested answer: answer-129-A
suggested answer: answer-129-B
accepted answer: answer-129-B
is part of: ISO 27K Q&A Benchmark Dataset

answer-129-A
type: Answer
position: A
text: True
is part of: Question 129

answer-129-B
type: Answer
position: B
text: False
is accepted: true
is part of: Question 129

Question 130
type: Question
text: Fundamentals and Context of ISO 27001:2022 - Which of the following is NOT a key characteristic of information security according to ISO 27001?
suggested answer: answer-130-A
suggested answer: answer-130-B
suggested answer: answer-130-C
suggested answer: answer-130-D
accepted answer: answer-130-D
is part of: ISO 27K Q&A Benchmark Dataset

answer-130-A
type: Answer
position: A
text: Confidentiality
is part of: Question 130

answer-130-B
type: Answer
position: B
text: Integrity
is part of: Question 130

answer-130-C
type: Answer
position: C
text: Availability
is part of: Question 130

answer-130-D
type: Answer
position: D
text: Profitability
is accepted: true
is part of: Question 130

Question 131
type: Question
text: Planning the ISMS - The primary objective of an information security risk assessment is to:
suggested answer: answer-131-A
suggested answer: answer-131-B
suggested answer: answer-131-C
suggested answer: answer-131-D
accepted answer: answer-131-B
is part of: ISO 27K Q&A Benchmark Dataset

answer-131-A
type: Answer
position: A
text: Eliminate all information security risks.
is part of: Question 131

answer-131-B
type: Answer
position: B
text: Identify, analyze, and evaluate information security risks.
is accepted: true
is part of: Question 131

answer-131-C
type: Answer
position: C
text: Implement security controls.
is part of: Question 131

answer-131-D
type: Answer
position: D
text: Achieve ISO 27001 certification.
is part of: Question 131

Question 132
type: Question
text: Planning the ISMS - When establishing the ISMS scope, it is crucial to:
suggested answer: answer-132-A
suggested answer: answer-132-B
suggested answer: answer-132-C
suggested answer: answer-132-D
accepted answer: answer-132-B
is part of: ISO 27K Q&A Benchmark Dataset

answer-132-A
type: Answer
position: A
text: Make it as broad as possible to cover all potential risks.
is part of: Question 132

answer-132-B
type: Answer
position: B
text: Define clear boundaries and limitations of the ISMS.
is accepted: true
is part of: Question 132

answer-132-C
type: Answer
position: C
text: Focus only on IT infrastructure.
is part of: Question 132

answer-132-D
type: Answer
position: D
text: Exclude any areas that are difficult to manage.
is part of: Question 132

Question 133
type: Question
text: Planning the ISMS - The 'Statement of Applicability' (So
suggested answer: answer-133-A
suggested answer: answer-133-B
suggested answer: answer-133-C
suggested answer: answer-133-D
accepted answer: answer-133-B
is part of: ISO 27K Q&A Benchmark Dataset

answer-133-A
type: Answer
position: A
text: Lists all mandatory controls from Annex A that must be implemented.
is part of: Question 133

answer-133-B
type: Answer
position: B
text: Documents the selected controls from Annex A and justifies their inclusion or exclusion.
is accepted: true
is part of: Question 133

answer-133-C
type: Answer
position: C
text: Is a summary of the risk assessment report.
is part of: Question 133

answer-133-D
type: Answer
position: D
text: Is only required for organizations seeking certification.
is part of: Question 133

Question 134
type: Question
text: Support and Operation of the ISMS - Documented information in ISO 27001:2022 includes:
suggested answer: answer-134-A
suggested answer: answer-134-B
suggested answer: answer-134-C
suggested answer: answer-134-D
accepted answer: answer-134-B
is part of: ISO 27K Q&A Benchmark Dataset

answer-134-A
type: Answer
position: A
text: Only policies and procedures.
is part of: Question 134

answer-134-B
type: Answer
position: B
text: Any information required to be controlled and maintained by the organization and the standard.
is accepted: true
is part of: Question 134

answer-134-C
type: Answer
position: C
text: Only electronic documents.
is part of: Question 134

answer-134-D
type: Answer
position: D
text: Only paper-based documents.
is part of: Question 134

Question 135
type: Question
text: Performance Evaluation and Improvement - Internal audits of the ISMS are conducted to:
suggested answer: answer-135-A
suggested answer: answer-135-B
suggested answer: answer-135-C
suggested answer: answer-135-D
accepted answer: answer-135-B
is part of: ISO 27K Q&A Benchmark Dataset

answer-135-A
type: Answer
position: A
text: Identify all security vulnerabilities.
is part of: Question 135

answer-135-B
type: Answer
position: B
text: Verify whether the ISMS conforms to the organization's own requirements and the requirements of ISO 27001:2022.
is accepted: true
is part of: Question 135

answer-135-C
type: Answer
position: C
text: Replace external certification audits.
is part of: Question 135

answer-135-D
type: Answer
position: D
text: Punish employees who violate security policies.
is part of: Question 135

Question 136
type: Question
text: Performance Evaluation and Improvement - Management review of the ISMS should be conducted at planned intervals to:
suggested answer: answer-136-A
suggested answer: answer-136-B
suggested answer: answer-136-C
suggested answer: answer-136-D
accepted answer: answer-136-B
is part of: ISO 27K Q&A Benchmark Dataset

answer-136-A
type: Answer
position: A
text: Only review incident reports.
is part of: Question 136

answer-136-B
type: Answer
position: B
text: Ensure the continuing suitability, adequacy, and effectiveness of the ISMS.
is accepted: true
is part of: Question 136

answer-136-C
type: Answer
position: C
text: Prepare for external certification audits.
is part of: Question 136

answer-136-D
type: Answer
position: D
text: Only focus on financial aspects of the ISMS.
is part of: Question 136

Question 137
type: Question
text: Performance Evaluation and Improvement - Continual improvement of the ISMS is a:
suggested answer: answer-137-A
suggested answer: answer-137-B
suggested answer: answer-137-C
suggested answer: answer-137-D
accepted answer: answer-137-B
is part of: ISO 27K Q&A Benchmark Dataset

answer-137-A
type: Answer
position: A
text: One-time project at the start of implementation.
is part of: Question 137

answer-137-B
type: Answer
position: B
text: Recurring activity to enhance the suitability, adequacy, and effectiveness of the ISMS.
is accepted: true
is part of: Question 137

answer-137-C
type: Answer
position: C
text: Optional activity after achieving certification.
is part of: Question 137

answer-137-D
type: Answer
position: D
text: Focus solely on technological upgrades.
is part of: Question 137

Question 138
type: Question
text: Annex A Controls (High-Level Understanding) - Annex A of ISO 27001:2022 provides:
suggested answer: answer-138-A
suggested answer: answer-138-B
suggested answer: answer-138-C
suggested answer: answer-138-D
accepted answer: answer-138-B
is part of: ISO 27K Q&A Benchmark Dataset

answer-138-A
type: Answer
position: A
text: Mandatory security controls that all organizations must implement.
is part of: Question 138

answer-138-B
type: Answer
position: B
text: A comprehensive list of information security controls and control objectives, serving as a reference set.
is accepted: true
is part of: Question 138

answer-138-C
type: Answer
position: C
text: Specific technical configurations for security technologies.
is part of: Question 138

answer-138-D
type: Answer
position: D
text: A detailed risk assessment methodology.
is part of: Question 138

Question 139
type: Question
text: Annex A Controls (High-Level Understanding) - An example of a 'Technological control' from Annex A is:
suggested answer: answer-139-A
suggested answer: answer-139-B
suggested answer: answer-139-C
suggested answer: answer-139-D
accepted answer: answer-139-B
is part of: ISO 27K Q&A Benchmark Dataset

answer-139-A
type: Answer
position: A
text: Background checks of employees.
is part of: Question 139

answer-139-B
type: Answer
position: B
text: Intrusion detection systems.
is accepted: true
is part of: Question 139

answer-139-C
type: Answer
position: C
text: Security awareness training.
is part of: Question 139

answer-139-D
type: Answer
position: D
text: Secure disposal of media.
is part of: Question 139

Question 140
type: Question
text: Annex A Controls (High-Level Understanding) - The selection of Annex A controls should be based on:
suggested answer: answer-140-A
suggested answer: answer-140-B
suggested answer: answer-140-C
suggested answer: answer-140-D
accepted answer: answer-140-B
is part of: ISO 27K Q&A Benchmark Dataset

answer-140-A
type: Answer
position: A
text: Industry best practices only.
is part of: Question 140

answer-140-B
type: Answer
position: B
text: The results of the information security risk assessment and the organization's risk treatment decisions.
is accepted: true
is part of: Question 140

answer-140-C
type: Answer
position: C
text: The recommendations of the certification body.
is part of: Question 140

answer-140-D
type: Answer
position: D
text: The preference of the IT department.
is part of: Question 140

Question 141
type: Question
text: Lead Implementer Specific Responsibilities and Considerations - A Lead Implementer's primary role is to:
suggested answer: answer-141-A
suggested answer: answer-141-B
suggested answer: answer-141-C
suggested answer: answer-141-D
accepted answer: answer-141-B
is part of: ISO 27K Q&A Benchmark Dataset

answer-141-A
type: Answer
position: A
text: Write all security policies and procedures.
is part of: Question 141

answer-141-B
type: Answer
position: B
text: Manage the entire ISMS implementation project, guiding the organization through all phases.
is accepted: true
is part of: Question 141

answer-141-C
type: Answer
position: C
text: Conduct internal audits.
is part of: Question 141

answer-141-D
type: Answer
position: D
text: Be the sole decision-maker for all ISMS related matters.
is part of: Question 141

Question 142
type: Question
text: Lead Implementer Specific Responsibilities and Considerations - Stakeholder engagement is crucial for a Lead Implementer. This involves:
suggested answer: answer-142-A
suggested answer: answer-142-B
suggested answer: answer-142-C
suggested answer: answer-142-D
accepted answer: answer-142-B
is part of: ISO 27K Q&A Benchmark Dataset

answer-142-A
type: Answer
position: A
text: Only informing top management about the ISMS project.
is part of: Question 142

answer-142-B
type: Answer
position: B
text: Identifying, communicating with, and involving relevant stakeholders throughout the ISMS implementation.
is accepted: true
is part of: Question 142

answer-142-C
type: Answer
position: C
text: Ignoring stakeholders who are resistant to change.
is part of: Question 142

answer-142-D
type: Answer
position: D
text: Focusing only on technical stakeholders.
is part of: Question 142

Question 143
type: Question
text: Lead Implementer Specific Responsibilities and Considerations - When defining the ISMS scope, a Lead Implementer should:
suggested answer: answer-143-A
suggested answer: answer-143-B
suggested answer: answer-143-C
suggested answer: answer-143-D
accepted answer: answer-143-B
is part of: ISO 27K Q&A Benchmark Dataset

answer-143-A
type: Answer
position: A
text: Impose a scope based on their own expertise.
is part of: Question 143

answer-143-B
type: Answer
position: B
text: Collaborate with relevant stakeholders to ensure the scope is realistic, achievable, and aligned with organizational objectives.
is accepted: true
is part of: Question 143

answer-143-C
type: Answer
position: C
text: Make the scope as narrow as possible to simplify implementation.
is part of: Question 143

answer-143-D
type: Answer
position: D
text: Let the IT department define the scope.
is part of: Question 143

Question 144
type: Question
text: Lead Implementer Specific Responsibilities and Considerations - During the ISMS implementation project, a Lead Implementer should:
suggested answer: answer-144-A
suggested answer: answer-144-B
suggested answer: answer-144-C
suggested answer: answer-144-D
accepted answer: answer-144-B
is part of: ISO 27K Q&A Benchmark Dataset

answer-144-A
type: Answer
position: A
text: Work in isolation to maintain focus.
is part of: Question 144

answer-144-B
type: Answer
position: B
text: Act as a project manager, facilitator, and subject matter expert, guiding the team and ensuring progress.
is accepted: true
is part of: Question 144

answer-144-C
type: Answer
position: C
text: Delegate all tasks to team members and only oversee progress.
is part of: Question 144

answer-144-D
type: Answer
position: D
text: Focus solely on technical aspects and ignore organizational change management.
is part of: Question 144

Question 145
type: Question
text: Lead Implementer Specific Responsibilities and Considerations - A Lead Implementer contributes to the continual improvement of the ISMS by:
suggested answer: answer-145-A
suggested answer: answer-145-B
suggested answer: answer-145-C
suggested answer: answer-145-D
accepted answer: answer-145-B
is part of: ISO 27K Q&A Benchmark Dataset

answer-145-A
type: Answer
position: A
text: Leaving the ISMS once certification is achieved.
is part of: Question 145

answer-145-B
type: Answer
position: B
text: Establishing processes for monitoring, measurement, audit, management review, and corrective action, and promoting a culture of continuous improvement.
is accepted: true
is part of: Question 145

answer-145-C
type: Answer
position: C
text: Focusing only on implementing new technologies.
is part of: Question 145

answer-145-D
type: Answer
position: D
text: Ignoring feedback from internal audits.
is part of: Question 145

Question 146
type: Question
text: What is the purpose of ICT readiness for business continuity?
suggested answer: answer-146-A
suggested answer: answer-146-B
suggested answer: answer-146-C
suggested answer: answer-146-D
accepted answer: answer-146-B
is part of: ISO 27K Q&A Benchmark Dataset

answer-146-A
type: Answer
position: A
text: To reduce the likelihood or consequences of future incidents.
is part of: Question 146

answer-146-B
type: Answer
position: B
text: To ensure the availability of the organization's information and other associated assets during disruption.
is accepted: true
is part of: Question 146

answer-146-C
type: Answer
position: C
text: To ensure a consistent and effective management of evidence related to information security incidents for the purposes of disciplinary and legal actions.
is part of: Question 146

answer-146-D
type: Answer
position: D
text: To protect information and other associated assets during disruption.
is part of: Question 146

Question 147
type: Question
text: What is the purpose of Policies for information security?
suggested answer: answer-147-A
suggested answer: answer-147-B
suggested answer: answer-147-C
suggested answer: answer-147-D
accepted answer: answer-147-A
is part of: ISO 27K Q&A Benchmark Dataset

answer-147-A
type: Answer
position: A
text: To establish a defined, approved and understood structure for the implementation, operation and management of information security within the organization.
is accepted: true
is part of: Question 147

answer-147-B
type: Answer
position: B
text: To ensure continuing suitability, adequacy, effectiveness of management direction and support for information security in accordance with business, legal, statutory, regulatory and contractual requirements.
is part of: Question 147

answer-147-C
type: Answer
position: C
text: To ensure management understand their role in information security and undertake actions aiming to ensure all personnel are aware of and fulfill their information security responsibilities.
is part of: Question 147

answer-147-D
type: Answer
position: D
text: To ensure appropriate flow of information takes places with respect to information security between the organization and relevant legal, regulatory and supervisory authorities.
is part of: Question 147

Question 148
type: Question
text: Which of the following best describes a policy, according to the ISO/IEC 27002:2022?
suggested answer: answer-148-A
suggested answer: answer-148-B
suggested answer: answer-148-C
suggested answer: answer-148-D
accepted answer: answer-148-B
is part of: ISO 27K Q&A Benchmark Dataset

answer-148-A
type: Answer
position: A
text: A set of interrelated or interacting activities that uses or transforms inputs to deliver a result.
is part of: Question 148

answer-148-B
type: Answer
position: B
text: Intentions and direction of an organization, as formally expressed by its top management.
is accepted: true
is part of: Question 148

answer-148-C
type: Answer
position: C
text: Accepted principle or institution that states the organization's expectations on what is required to be done, what is allowed or not allowed.
is part of: Question 148

answer-148-D
type: Answer
position: D
text: A specified way to carry out an activity or a process.
is part of: Question 148

Question 149
type: Question
text: Which of the following refers to information that needs to be protected from unavailability, unauthorized access, modification or public disclosure because of potential adverse effects on an individual, organization, national security or public safety?
suggested answer: answer-149-A
suggested answer: answer-149-B
suggested answer: answer-149-C
suggested answer: answer-149-D
accepted answer: answer-149-B
is part of: ISO 27K Q&A Benchmark Dataset

answer-149-A
type: Answer
position: A
text: Personally identifiable information
is part of: Question 149

answer-149-B
type: Answer
position: B
text: Sensitive information
is accepted: true
is part of: Question 149

answer-149-C
type: Answer
position: C
text: Documented information
is part of: Question 149

answer-149-D
type: Answer
position: D
text: Encrypted information
is part of: Question 149

Question 150
type: Question
text: Which of the following describes one or multiple related an identified information security events that can harm an organization's assets or compromise its operations?
suggested answer: answer-150-A
suggested answer: answer-150-B
suggested answer: answer-150-C
suggested answer: answer-150-D
accepted answer: answer-150-D
is part of: ISO 27K Q&A Benchmark Dataset

answer-150-A
type: Answer
position: A
text: Information security event
is part of: Question 150

answer-150-B
type: Answer
position: B
text: Information security management
is part of: Question 150

answer-150-C
type: Answer
position: C
text: Information security breach
is part of: Question 150

answer-150-D
type: Answer
position: D
text: Information security incident
is accepted: true
is part of: Question 150

Question 151
type: Question
text: It is essential that an organization determines its information security requirements. Are three main sources of information security requirements:
suggested answer: answer-151-A
suggested answer: answer-151-B
suggested answer: answer-151-C
suggested answer: answer-151-D
accepted answer: answer-151-D
is part of: ISO 27K Q&A Benchmark Dataset

answer-151-A
type: Answer
position: A
text: The assessment of risks to the organization, taking into account the organization's overall business strategy and objectives.
is part of: Question 151

answer-151-B
type: Answer
position: B
text: The legal, statutory, regulatory and contractual requirements that an organization and its interested parties have to comply with and their socio-cultural environment.
is part of: Question 151

answer-151-C
type: Answer
position: C
text: The set of principles, objectives and business requirements for all the steps of the life cycle of information that an organization has developed to support its operations.
is part of: Question 151

answer-151-D
type: Answer
position: D
text: All of the above.
is accepted: true
is part of: Question 151

Question 152
type: Question
text: Which of the following best describe an attack, according to the ISO/IEC 27002:2022?
suggested answer: answer-152-A
suggested answer: answer-152-B
suggested answer: answer-152-C
suggested answer: answer-152-D
accepted answer: answer-152-A
is part of: ISO 27K Q&A Benchmark Dataset

answer-152-A
type: Answer
position: A
text: A successful or unsuccessful unauthorized attempt to destroy, alter, disable, gain access to an asset or any attempt to expose, steal, or make unauthorized use of an asset.
is accepted: true
is part of: Question 152

answer-152-B
type: Answer
position: B
text: One or multiple related and identified information security events that can harm an organization's assets or compromise its operations.
is part of: Question 152

answer-152-C
type: Answer
position: C
text: The weakness of an asset or control that can be exploited by one or more threats.
is part of: Question 152

answer-152-D
type: Answer
position: D
text: The potential cause of an unwanted incident, which can result in harm to a system or organization.
is part of: Question 152

Question 153
type: Question
text: Which of the following is best defines as a measure that modifies or maintains risk?
suggested answer: answer-153-A
suggested answer: answer-153-B
suggested answer: answer-153-C
suggested answer: answer-153-D
accepted answer: answer-153-D
is part of: ISO 27K Q&A Benchmark Dataset

answer-153-A
type: Answer
position: A
text: Procedure
is part of: Question 153

answer-153-B
type: Answer
position: B
text: Policy
is part of: Question 153

answer-153-C
type: Answer
position: C
text: Rule
is part of: Question 153

answer-153-D
type: Answer
position: D
text: Control
is accepted: true
is part of: Question 153

Question 154
type: Question
text: Which of the following best describes a threat?
suggested answer: answer-154-A
suggested answer: answer-154-B
suggested answer: answer-154-C
suggested answer: answer-154-D
accepted answer: answer-154-D
is part of: ISO 27K Q&A Benchmark Dataset

answer-154-A
type: Answer
position: A
text: One or multiple related and identified information security events that can harm an organization's assets or compromise its operations.
is part of: Question 154

answer-154-B
type: Answer
position: B
text: Successful or unsuccessful unauthorized attempt to destroy, alter, disable, gain access to an asset or any attempt to expose, steal, or make unauthorized use of an asset.
is part of: Question 154

answer-154-C
type: Answer
position: C
text: The weakness of an asset or control that can be exploited by one or more threats.
is part of: Question 154

answer-154-D
type: Answer
position: D
text: The potential cause of an unwanted incident, which can results in harm to a system or organization.
is accepted: true
is part of: Question 154

Question 155
type: Question
text: Which of the following best describes the purpose of Application security requirements?
suggested answer: answer-155-A
suggested answer: answer-155-B
suggested answer: answer-155-C
suggested answer: answer-155-D
accepted answer: answer-155-D
is part of: ISO 27K Q&A Benchmark Dataset

answer-155-A
type: Answer
position: A
text: To validate if information security requirements are met when applications or code are deployed to the production environment.
is part of: Question 155

answer-155-B
type: Answer
position: B
text: To ensure information systems are securely designed, implemented and operated within the development life cycle.
is part of: Question 155

answer-155-C
type: Answer
position: C
text: To ensure software is written securely thereby reducing the number of potential information security vulnerabilities in the software.
is part of: Question 155

answer-155-D
type: Answer
position: D
text: To ensure all information security requirements are identified and addressed when developing or acquiring applications.
is accepted: true
is part of: Question 155

Question 156
type: Question
text: The title of ISO 27001:2022 includes following?
suggested answer: answer-156-A
suggested answer: answer-156-B
suggested answer: answer-156-C
suggested answer: answer-156-D
accepted answer: answer-156-A
is part of: ISO 27K Q&A Benchmark Dataset

answer-156-A
type: Answer
position: A
text: Information Security, Cyber Security and Privacy Protection
is accepted: true
is part of: Question 156

answer-156-B
type: Answer
position: B
text: Information Management System, Tools and Techniques
is part of: Question 156

answer-156-C
type: Answer
position: C
text: Information Security procedures and techniques
is part of: Question 156

answer-156-D
type: Answer
position: D
text: Information Security Management practices
is part of: Question 156

Question 157
type: Question
text: ISO 27002:2022 is comprises of how many controls?
suggested answer: answer-157-A
suggested answer: answer-157-B
suggested answer: answer-157-C
suggested answer: answer-157-D
accepted answer: answer-157-C
is part of: ISO 27K Q&A Benchmark Dataset

answer-157-A
type: Answer
position: A
text: 128
is part of: Question 157

answer-157-B
type: Answer
position: B
text: 97
is part of: Question 157

answer-157-C
type: Answer
position: C
text: 93
is accepted: true
is part of: Question 157

answer-157-D
type: Answer
position: D
text: 79
is part of: Question 157

Question 158
type: Question
text: Categories of control grouping in ISO 27002:2022 are
suggested answer: answer-158-A
suggested answer: answer-158-B
suggested answer: answer-158-C
suggested answer: answer-158-D
accepted answer: answer-158-D
is part of: ISO 27K Q&A Benchmark Dataset

answer-158-A
type: Answer
position: A
text: Strategic, Tactical, Operational, BAU
is part of: Question 158

answer-158-B
type: Answer
position: B
text: Long term, Short term, Incidental, optional
is part of: Question 158

answer-158-C
type: Answer
position: C
text: Organizational, People, Process, Technological
is part of: Question 158

answer-158-D
type: Answer
position: D
text: Organizational, People, Technological, Physical
is accepted: true
is part of: Question 158

Question 159
type: Question
text: Cyber Security Concept is ___ in ISO 27002:2022
suggested answer: answer-159-A
suggested answer: answer-159-B
suggested answer: answer-159-C
suggested answer: answer-159-D
accepted answer: answer-159-C
is part of: ISO 27K Q&A Benchmark Dataset

answer-159-A
type: Answer
position: A
text: Information Criterion
is part of: Question 159

answer-159-B
type: Answer
position: B
text: Fundamental concept
is part of: Question 159

answer-159-C
type: Answer
position: C
text: Attribute
is accepted: true
is part of: Question 159

answer-159-D
type: Answer
position: D
text: Control concept
is part of: Question 159

Question 160
type: Question
text: New added elements in control are:
suggested answer: answer-160-A
suggested answer: answer-160-B
suggested answer: answer-160-C
suggested answer: answer-160-D
accepted answer: answer-160-A
is part of: ISO 27K Q&A Benchmark Dataset

answer-160-A
type: Answer
position: A
text: Attribute and Purpose
is accepted: true
is part of: Question 160

answer-160-B
type: Answer
position: B
text: Reference and Definition
is part of: Question 160

answer-160-C
type: Answer
position: C
text: Summary and Purpose
is part of: Question 160

answer-160-D
type: Answer
position: D
text: Attribute and Reference
is part of: Question 160

Question 161
type: Question
text: In ISO 27002:2022 controls are more based on
suggested answer: answer-161-A
suggested answer: answer-161-B
suggested answer: answer-161-C
suggested answer: answer-161-D
accepted answer: answer-161-A
is part of: ISO 27K Q&A Benchmark Dataset

answer-161-A
type: Answer
position: A
text: Risk and opportunity
is accepted: true
is part of: Question 161

answer-161-B
type: Answer
position: B
text: Interested party requirements
is part of: Question 161

answer-161-C
type: Answer
position: C
text: Regulatory requirements
is part of: Question 161

answer-161-D
type: Answer
position: D
text: Business context and risks
is part of: Question 161

Question 162
type: Question
text: New controls introduces in ISO 27002:2002 are:
suggested answer: answer-162-A
suggested answer: answer-162-B
suggested answer: answer-162-C
suggested answer: answer-162-D
accepted answer: answer-162-C
is part of: ISO 27K Q&A Benchmark Dataset

answer-162-A
type: Answer
position: A
text: 18
is part of: Question 162

answer-162-B
type: Answer
position: B
text: 54
is part of: Question 162

answer-162-C
type: Answer
position: C
text: 28
is accepted: true
is part of: Question 162

answer-162-D
type: Answer
position: D
text: 11
is part of: Question 162

Question 163
type: Question
text: Merged controls in ISO 27002:2022 are:
suggested answer: answer-163-A
suggested answer: answer-163-B
suggested answer: answer-163-C
suggested answer: answer-163-D
accepted answer: answer-163-B
is part of: ISO 27K Q&A Benchmark Dataset

answer-163-A
type: Answer
position: A
text: 28
is part of: Question 163

answer-163-B
type: Answer
position: B
text: 24
is accepted: true
is part of: Question 163

answer-163-C
type: Answer
position: C
text: 93
is part of: Question 163

answer-163-D
type: Answer
position: D
text: 58
is part of: Question 163

Question 164
type: Question
text: Data Leakage prevention is _____ in ISO 27002:2022
suggested answer: answer-164-A
suggested answer: answer-164-B
suggested answer: answer-164-C
suggested answer: answer-164-D
accepted answer: answer-164-A
is part of: ISO 27K Q&A Benchmark Dataset

answer-164-A
type: Answer
position: A
text: New control
is accepted: true
is part of: Question 164

answer-164-B
type: Answer
position: B
text: Updated control
is part of: Question 164

answer-164-C
type: Answer
position: C
text: Merged control
is part of: Question 164

answer-164-D
type: Answer
position: D
text: Deleted / removed control
is part of: Question 164

Question 165
type: Question
text: Storage media is ____ in ISO 27002:2002
suggested answer: answer-165-A
suggested answer: answer-165-B
suggested answer: answer-165-C
suggested answer: answer-165-D
accepted answer: answer-165-B
is part of: ISO 27K Q&A Benchmark Dataset

answer-165-A
type: Answer
position: A
text: New control
is part of: Question 165

answer-165-B
type: Answer
position: B
text: Updated control
is accepted: true
is part of: Question 165

answer-165-C
type: Answer
position: C
text: Merged control
is part of: Question 165

answer-165-D
type: Answer
position: D
text: Deleted / removed control
is part of: Question 165

Question 166
type: Question
text: The control “Conflicting duties and conflicting areas of responsibility should be segregated.” Is a:
suggested answer: answer-166-A
suggested answer: answer-166-B
suggested answer: answer-166-C
suggested answer: answer-166-D
accepted answer: answer-166-A
is part of: ISO 27K Q&A Benchmark Dataset

answer-166-A
type: Answer
position: A
text: Preventive Control
is accepted: true
is part of: Question 166

answer-166-B
type: Answer
position: B
text: Detective Control
is part of: Question 166

answer-166-C
type: Answer
position: C
text: Corrective Control
is part of: Question 166

answer-166-D
type: Answer
position: D
text: All of Above
is part of: Question 166

Question 167
type: Question
text: Top Risks while working from home includes
suggested answer: answer-167-A
suggested answer: answer-167-B
suggested answer: answer-167-C
suggested answer: answer-167-D
accepted answer: answer-167-D
is part of: ISO 27K Q&A Benchmark Dataset

answer-167-A
type: Answer
position: A
text: Phishing and ransomware
is part of: Question 167

answer-167-B
type: Answer
position: B
text: Employees can’t spot scams
is part of: Question 167

answer-167-C
type: Answer
position: C
text: Personal devices
is part of: Question 167

answer-167-D
type: Answer
position: D
text: All of Above
is accepted: true
is part of: Question 167

Question 168
type: Question
text: The committee decides to either - Keep the standard as is, Withdraw the standard, Revise the standard, every
suggested answer: answer-168-A
suggested answer: answer-168-B
suggested answer: answer-168-C
suggested answer: answer-168-D
accepted answer: answer-168-A
is part of: ISO 27K Q&A Benchmark Dataset

answer-168-A
type: Answer
position: A
text: Every 3 to 5 years
is accepted: true
is part of: Question 168

answer-168-B
type: Answer
position: B
text: Every 1 to 2 years
is part of: Question 168

answer-168-C
type: Answer
position: C
text: Every 5 to 7 years
is part of: Question 168

answer-168-D
type: Answer
position: D
text: Any time
is part of: Question 168

Question 169
type: Question
text: A ____ element has been applied to the controls within the 2022 version, as opposed to the use of a control objective for a group of controls.
suggested answer: answer-169-A
suggested answer: answer-169-B
suggested answer: answer-169-C
suggested answer: answer-169-D
accepted answer: answer-169-C
is part of: ISO 27K Q&A Benchmark Dataset

answer-169-A
type: Answer
position: A
text: “goal”
is part of: Question 169

answer-169-B
type: Answer
position: B
text: “Introduction”
is part of: Question 169

answer-169-C
type: Answer
position: C
text: “purpose”
is accepted: true
is part of: Question 169

answer-169-D
type: Answer
position: D
text: “Expectation”
is part of: Question 169

Question 170
type: Question
text: Control Type for “ICT Readiness for Business continuity should be planned, Implemented, maintained and tested based on business continuity objectives and ICT continuity requirements.“
suggested answer: answer-170-A
suggested answer: answer-170-B
suggested answer: answer-170-C
suggested answer: answer-170-D
accepted answer: answer-170-A
is part of: ISO 27K Q&A Benchmark Dataset

answer-170-A
type: Answer
position: A
text: Preventive Control
is accepted: true
is part of: Question 170

answer-170-B
type: Answer
position: B
text: Detective Control
is part of: Question 170

answer-170-C
type: Answer
position: C
text: Corrective Control
is part of: Question 170

answer-170-D
type: Answer
position: D
text: All of Above
is part of: Question 170

Question 171
type: Question
text: What is the purpose of the ISO/IEC 27004 standard?
suggested answer: answer-171-A
suggested answer: answer-171-B
suggested answer: answer-171-C
suggested answer: answer-171-D
accepted answer: answer-171-A
is part of: ISO 27K Q&A Benchmark Dataset

answer-171-A
type: Answer
position: A
text: To measure the effectiveness of security efforts.
is accepted: true
is part of: Question 171

answer-171-B
type: Answer
position: B
text: To explain the various roles in a security department.
is part of: Question 171

answer-171-C
type: Answer
position: C
text: To detail what others in your industry are doing in security.
is part of: Question 171

answer-171-D
type: Answer
position: D
text: To identify the major risks that security programs face.
is part of: Question 171

Question 172
type: Question
text: In order to effectively deliver security awareness training to specialized roles in the organization, which method is most appropriate?
suggested answer: answer-172-A
suggested answer: answer-172-B
suggested answer: answer-172-C
suggested answer: answer-172-D
accepted answer: answer-172-A
is part of: ISO 27K Q&A Benchmark Dataset

answer-172-A
type: Answer
position: A
text: Small group sessions
is accepted: true
is part of: Question 172

answer-172-B
type: Answer
position: B
text: Company-wide online learning
is part of: Question 172

answer-172-C
type: Answer
position: C
text: All-staff meetings
is part of: Question 172

answer-172-D
type: Answer
position: D
text: Handouts and PDFs
is part of: Question 172

Question 173
type: Question
text: A new CEO has joined your organization and considers the spending on IT and IT security to be frivolous. As the leader of the IT division, what is your response?
suggested answer: answer-173-A
suggested answer: answer-173-B
suggested answer: answer-173-C
suggested answer: answer-173-D
accepted answer: answer-173-A
is part of: ISO 27K Q&A Benchmark Dataset

answer-173-A
type: Answer
position: A
text: Implement a security awareness program and educate the CEO
is accepted: true
is part of: Question 173

answer-173-B
type: Answer
position: B
text: Try to convince the board to approve new software to replace human resources
is part of: Question 173

answer-173-C
type: Answer
position: C
text: Accept the decision - it is the CEO
is part of: Question 173

answer-173-D
type: Answer
position: D
text: Reduce spending on anti-virus and malware, but keep firewalls
is part of: Question 173

Question 174
type: Question
text: As a technical staff member in IT, what is your highest priority in cybersecurity?
suggested answer: answer-174-A
suggested answer: answer-174-B
suggested answer: answer-174-C
suggested answer: answer-174-D
accepted answer: answer-174-C
is part of: ISO 27K Q&A Benchmark Dataset

answer-174-A
type: Answer
position: A
text: Software development
is part of: Question 174

answer-174-B
type: Answer
position: B
text: Environmental security
is part of: Question 174

answer-174-C
type: Answer
position: C
text: Data protection
is accepted: true
is part of: Question 174

answer-174-D
type: Answer
position: D
text: Incident response
is part of: Question 174

Question 175
type: Question
text: What is the main focus of ISO/IEC 27004:2016?
suggested answer: answer-175-A
suggested answer: answer-175-B
suggested answer: answer-175-C
suggested answer: answer-175-D
accepted answer: answer-175-C
is part of: ISO 27K Q&A Benchmark Dataset

answer-175-A
type: Answer
position: A
text: Cybersecurity attacks prevention
is part of: Question 175

answer-175-B
type: Answer
position: B
text: Data encryption techniques
is part of: Question 175

answer-175-C
type: Answer
position: C
text: Performance assessment of ISO/IEC 27001
is accepted: true
is part of: Question 175

answer-175-D
type: Answer
position: D
text: Information security monitoring
is part of: Question 175

Question 176
type: Question
text: Why was ISO/IEC 27004:2016 updated and extended?
suggested answer: answer-176-A
suggested answer: answer-176-B
suggested answer: answer-176-C
suggested answer: answer-176-D
accepted answer: answer-176-D
is part of: ISO 27K Q&A Benchmark Dataset

answer-176-A
type: Answer
position: A
text: To focus on cybersecurity hardware solutions
is part of: Question 176

answer-176-B
type: Answer
position: B
text: To enhance cloud security measures
is part of: Question 176

answer-176-C
type: Answer
position: C
text: To provide guidelines on data encryption processes
is part of: Question 176

answer-176-D
type: Answer
position: D
text: To align with the revised version of ISO/IEC 27001
is accepted: true
is part of: Question 176

Question 177
type: Question
text: What role did Edward Humphreys play in the development of ISO/IEC 27004:2016?
suggested answer: answer-177-A
suggested answer: answer-177-B
suggested answer: answer-177-C
suggested answer: answer-177-D
accepted answer: answer-177-A
is part of: ISO 27K Q&A Benchmark Dataset

answer-177-A
type: Answer
position: A
text: He was the convenor of the working group developing the standard
is accepted: true
is part of: Question 177

answer-177-B
type: Answer
position: B
text: He provided cybersecurity training to organizations
is part of: Question 177

answer-177-C
type: Answer
position: C
text: He led the organization implementing ISO/IEC 27001
is part of: Question 177

answer-177-D
type: Answer
position: D
text: He was the chief editor of the standard
is part of: Question 177

Question 178
type: Question
text: Why does Edward Humphreys emphasize the importance of ISO/IEC 27004:2016?
suggested answer: answer-178-A
suggested answer: answer-178-B
suggested answer: answer-178-C
suggested answer: answer-178-D
accepted answer: answer-178-D
is part of: ISO 27K Q&A Benchmark Dataset

answer-178-A
type: Answer
position: A
text: To encourage using open-source cybersecurity tools
is part of: Question 178

answer-178-B
type: Answer
position: B
text: To highlight common cybersecurity misconceptions
is part of: Question 178

answer-178-C
type: Answer
position: C
text: To promote his cybersecurity consultancy services
is part of: Question 178

answer-178-D
type: Answer
position: D
text: Because cyber attacks are a significant organizational risk
is accepted: true
is part of: Question 178

Question 179
type: Question
text: What does ISO/IEC 27004:2016 detail about information security measurement programs?
suggested answer: answer-179-A
suggested answer: answer-179-B
suggested answer: answer-179-C
suggested answer: answer-179-D
accepted answer: answer-179-D
is part of: ISO 27K Q&A Benchmark Dataset

answer-179-A
type: Answer
position: A
text: How to avoid phishing attacks
is part of: Question 179

answer-179-B
type: Answer
position: B
text: How to efficiently use antivirus software
is part of: Question 179

answer-179-C
type: Answer
position: C
text: How to set up a secure network connection
is part of: Question 179

answer-179-D
type: Answer
position: D
text: How to construct a measurement program and select what to measure
is accepted: true
is part of: Question 179

Question 180
type: Question
text: In which areas does ISO/IEC 27004:2016 provide practical support?
suggested answer: answer-180-A
suggested answer: answer-180-B
suggested answer: answer-180-C
suggested answer: answer-180-D
accepted answer: answer-180-A
is part of: ISO 27K Q&A Benchmark Dataset

answer-180-A
type: Answer
position: A
text: Assessing the effectiveness of information security measures
is accepted: true
is part of: Question 180

answer-180-B
type: Answer
position: B
text: Developing artificial intelligence for cybersecurity
is part of: Question 180

answer-180-C
type: Answer
position: C
text: Data recovery after cyber attacks
is part of: Question 180

answer-180-D
type: Answer
position: D
text: Implementing cloud-based security measures
is part of: Question 180

Question 181
type: Question
text: How does ISO/IEC 27004:2016 help organizations protect themselves?
suggested answer: answer-181-A
suggested answer: answer-181-B
suggested answer: answer-181-C
suggested answer: answer-181-D
accepted answer: answer-181-C
is part of: ISO 27K Q&A Benchmark Dataset

answer-181-A
type: Answer
position: A
text: By developing advanced encryption algorithms
is part of: Question 181

answer-181-B
type: Answer
position: B
text: By offering free cybersecurity insurance policies
is part of: Question 181

answer-181-C
type: Answer
position: C
text: By giving essential and practical support in monitoring and measurement
is accepted: true
is part of: Question 181

answer-181-D
type: Answer
position: D
text: By providing guidelines on software development practices
is part of: Question 181

Question 182
type: Question
text: "ISO/IEC 27004:2016 explains how to develop and operate ____ processes."
suggested answer: answer-182-A
suggested answer: answer-182-B
suggested answer: answer-182-C
suggested answer: answer-182-D
accepted answer: answer-182-C
is part of: ISO 27K Q&A Benchmark Dataset

answer-182-A
type: Answer
position: A
text: cybersecurity training
is part of: Question 182

answer-182-B
type: Answer
position: B
text: network security
is part of: Question 182

answer-182-C
type: Answer
position: C
text: measurement
is accepted: true
is part of: Question 182

answer-182-D
type: Answer
position: D
text: data encryption
is part of: Question 182

Question 183
type: Question
text: "ISO/IEC 27004:2016 includes examples of different types of ____."
suggested answer: answer-183-A
suggested answer: answer-183-B
suggested answer: answer-183-C
suggested answer: answer-183-D
accepted answer: answer-183-C
is part of: ISO 27K Q&A Benchmark Dataset

answer-183-A
type: Answer
position: A
text: cyber attacks
is part of: Question 183

answer-183-B
type: Answer
position: B
text: network configurations
is part of: Question 183

answer-183-C
type: Answer
position: C
text: measures
is accepted: true
is part of: Question 183

answer-183-D
type: Answer
position: D
text: data breaches
is part of: Question 183

Question 184
type: Question
text: What is the purpose of ISO/IEC 27004:2016?
suggested answer: answer-184-A
suggested answer: answer-184-B
suggested answer: answer-184-C
suggested answer: answer-184-D
accepted answer: answer-184-D
is part of: ISO 27K Q&A Benchmark Dataset

answer-184-A
type: Answer
position: A
text: To develop new security technologies
is part of: Question 184

answer-184-B
type: Answer
position: B
text: To create data encryption standards
is part of: Question 184

answer-184-C
type: Answer
position: C
text: To provide guidelines on cybersecurity protocols
is part of: Question 184

answer-184-D
type: Answer
position: D
text: To assess the performance of information security management systems
is accepted: true
is part of: Question 184

Question 185
type: Question
text: What has ISO/IEC 27004:2016 been updated and extended to align with?
suggested answer: answer-185-A
suggested answer: answer-185-B
suggested answer: answer-185-C
suggested answer: answer-185-D
accepted answer: answer-185-A
is part of: ISO 27K Q&A Benchmark Dataset

answer-185-A
type: Answer
position: A
text: ISO/IEC 27001 standard
is accepted: true
is part of: Question 185

answer-185-B
type: Answer
position: B
text: National Institute of Standards and Technology (NIST) guidelines
is part of: Question 185

answer-185-C
type: Answer
position: C
text: GDPR regulations
is part of: Question 185

answer-185-D
type: Answer
position: D
text: Cybersecurity Framework for Critical Infrastructure
is part of: Question 185

Question 186
type: Question
text: Who emphasized the importance of ISO/IEC 27004:2016 due to cybersecurity risks?
suggested answer: answer-186-A
suggested answer: answer-186-B
suggested answer: answer-186-C
suggested answer: answer-186-D
accepted answer: answer-186-B
is part of: ISO 27K Q&A Benchmark Dataset

answer-186-A
type: Answer
position: A
text: Julian Assange
is part of: Question 186

answer-186-B
type: Answer
position: B
text: Edward Humphreys
is accepted: true
is part of: Question 186

answer-186-C
type: Answer
position: C
text: Chelsea Manning
is part of: Question 186

answer-186-D
type: Answer
position: D
text: Edward Snowden
is part of: Question 186

Question 187
type: Question
text: In the context of ISO/IEC 27004:2016, what is meant by 'construct an information security measurement program'?
suggested answer: answer-187-A
suggested answer: answer-187-B
suggested answer: answer-187-C
suggested answer: answer-187-D
accepted answer: answer-187-D
is part of: ISO 27K Q&A Benchmark Dataset

answer-187-A
type: Answer
position: A
text: Creating algorithms to detect cyber threats
is part of: Question 187

answer-187-B
type: Answer
position: B
text: Building a physical security system for data centers
is part of: Question 187

answer-187-C
type: Answer
position: C
text: Implementing network monitoring tools
is part of: Question 187

answer-187-D
type: Answer
position: D
text: Developing a framework to measure security performance
is accepted: true
is part of: Question 187

Question 188
type: Question
text: What is one of the key aspects detailed in ISO/IEC 27004:2016 regarding measurement processes?
suggested answer: answer-188-A
suggested answer: answer-188-B
suggested answer: answer-188-C
suggested answer: answer-188-D
accepted answer: answer-188-A
is part of: ISO 27K Q&A Benchmark Dataset

answer-188-A
type: Answer
position: A
text: Assessing the effectiveness of different types of measures
is accepted: true
is part of: Question 188

answer-188-B
type: Answer
position: B
text: Selecting the best encryption algorithm for data protection
is part of: Question 188

answer-188-C
type: Answer
position: C
text: Designing a firewall for network security
is part of: Question 188

answer-188-D
type: Answer
position: D
text: Creating a secure authentication system for users
is part of: Question 188

Question 189
type: Question
text: How does ISO/IEC 27004:2016 contribute to organizations facing security threats?
suggested answer: answer-189-A
suggested answer: answer-189-B
suggested answer: answer-189-C
suggested answer: answer-189-D
accepted answer: answer-189-B
is part of: ISO 27K Q&A Benchmark Dataset

answer-189-A
type: Answer
position: A
text: By creating a secure cloud computing architecture
is part of: Question 189

answer-189-B
type: Answer
position: B
text: By providing essential and practical support in information security management
is accepted: true
is part of: Question 189

answer-189-C
type: Answer
position: C
text: By developing social engineering prevention techniques
is part of: Question 189

answer-189-D
type: Answer
position: D
text: By implementing advanced intrusion detection systems
is part of: Question 189

Question 190
type: Question
text: What does ISO/IEC 27004:2016 help organizations select when it comes to measurement processes?
suggested answer: answer-190-A
suggested answer: answer-190-B
suggested answer: answer-190-C
accepted answer: answer-190-B
is part of: ISO 27K Q&A Benchmark Dataset

answer-190-A
type: Answer
position: A
text: The most effective employee training programs
is part of: Question 190

answer-190-B
type: Answer
position: B
text: What to measure
is accepted: true
is part of: Question 190

answer-190-C
type: Answer
position: C
text: The best software development methodology
is part of: Question 190

Question 191
type: Question
text: Why does Edward Humphreys mention that cyber attacks are significant risks?
suggested answer: answer-191-A
suggested answer: answer-191-B
accepted answer: answer-191-B
is part of: ISO 27K Q&A Benchmark Dataset

answer-191-A
type: Answer
position: A
text: To highlight the importance of data backups
is part of: Question 191

answer-191-B
type: Answer
position: B
text: To point out the increasing diversity of security attacks
is accepted: true
is part of: Question 191

Question 192
type: Question
text: How does ISO 27005 differ from other publications like NIST SP 800-30?
suggested answer: answer-192-A
suggested answer: answer-192-B
suggested answer: answer-192-C
suggested answer: answer-192-D
accepted answer: answer-192-B
is part of: ISO 27K Q&A Benchmark Dataset

answer-192-A
type: Answer
position: A
text: It incorporates several standards into one document.
is part of: Question 192

answer-192-B
type: Answer
position: B
text: It provides general guidelines, but no specific approach.
is accepted: true
is part of: Question 192

answer-192-C
type: Answer
position: C
text: It requires 100% adherence to management procedures.
is part of: Question 192

answer-192-D
type: Answer
position: D
text: It provides a more detailed approach to risk management.
is part of: Question 192

Question 193
type: Question
text: The five-stage process for risk management as laid out in ISO 27005 begins with what step?
suggested answer: answer-193-A
suggested answer: answer-193-B
suggested answer: answer-193-C
suggested answer: answer-193-D
accepted answer: answer-193-A
is part of: ISO 27K Q&A Benchmark Dataset

answer-193-A
type: Answer
position: A
text: Assessing risks, assets, and controls.
is accepted: true
is part of: Question 193

answer-193-B
type: Answer
position: B
text: Treatment high-priority risks first.
is part of: Question 193

answer-193-C
type: Answer
position: C
text: Communicating with stakeholders.
is part of: Question 193

answer-193-D
type: Answer
position: D
text: Accepting some risks without treatment.
is part of: Question 193

Question 194
type: Question
text: What significant action must be taken to complete the second stage of the risk management framework?
suggested answer: answer-194-A
suggested answer: answer-194-B
suggested answer: answer-194-C
suggested answer: answer-194-D
accepted answer: answer-194-C
is part of: ISO 27K Q&A Benchmark Dataset

answer-194-A
type: Answer
position: A
text: Looking at risks from competitors.
is part of: Question 194

answer-194-B
type: Answer
position: B
text: Talking to stakeholders about risks.
is part of: Question 194

answer-194-C
type: Answer
position: C
text: Prioritizing the severity of the risk.
is accepted: true
is part of: Question 194

answer-194-D
type: Answer
position: D
text: Determining top business objectives.
is part of: Question 194

Question 195
type: Question
text: The penalty levied on a convict whose crime results in damage to a computer system or its data or property to the value of $5,000 or over is a _____
suggested answer: answer-195-A
suggested answer: answer-195-B
suggested answer: answer-195-C
suggested answer: answer-195-D
accepted answer: answer-195-C
is part of: ISO 27K Q&A Benchmark Dataset

answer-195-A
type: Answer
position: A
text: Class B Felony
is part of: Question 195

answer-195-B
type: Answer
position: B
text: Class A Misdemeanor
is part of: Question 195

answer-195-C
type: Answer
position: C
text: Class C Felony
is accepted: true
is part of: Question 195

answer-195-D
type: Answer
position: D
text: Class D Misdemeanor
is part of: Question 195

Question 196
type: Question
text: What is the primary purpose of ISO/IEC 27005:2022?
suggested answer: answer-196-A
suggested answer: answer-196-B
suggested answer: answer-196-C
suggested answer: answer-196-D
accepted answer: answer-196-B
is part of: ISO 27K Q&A Benchmark Dataset

answer-196-A
type: Answer
position: A
text: To provide guidelines for implementing ISO/IEC 27001 controls
is part of: Question 196

answer-196-B
type: Answer
position: B
text: To offer guidance on managing information security risks
is accepted: true
is part of: Question 196

answer-196-C
type: Answer
position: C
text: To define cybersecurity incident response procedures
is part of: Question 196

answer-196-D
type: Answer
position: D
text: To standardize encryption algorithms
is part of: Question 196

Question 197
type: Question
text: Which ISO standard is most closely related to ISO/IEC 27005:2022?
suggested answer: answer-197-A
suggested answer: answer-197-B
suggested answer: answer-197-C
suggested answer: answer-197-D
accepted answer: answer-197-A
is part of: ISO 27K Q&A Benchmark Dataset

answer-197-A
type: Answer
position: A
text: ISO/IEC 27001 (ISMS requirements)
is accepted: true
is part of: Question 197

answer-197-B
type: Answer
position: B
text: ISO/IEC 27002 (Security controls)
is part of: Question 197

answer-197-C
type: Answer
position: C
text: ISO/IEC 27017 (Cloud security)
is part of: Question 197

answer-197-D
type: Answer
position: D
text: ISO/IEC 27031 (ICT disaster recovery)
is part of: Question 197

Question 198
type: Question
text: Which of the following is NOT a key step in the ISO/IEC 27005 risk management process?
suggested answer: answer-198-A
suggested answer: answer-198-B
suggested answer: answer-198-C
suggested answer: answer-198-D
accepted answer: answer-198-C
is part of: ISO 27K Q&A Benchmark Dataset

answer-198-A
type: Answer
position: A
text: Risk identification
is part of: Question 198

answer-198-B
type: Answer
position: B
text: Risk assessment
is part of: Question 198

answer-198-C
type: Answer
position: C
text: Risk transfer (insurance)
is accepted: true
is part of: Question 198

answer-198-D
type: Answer
position: D
text: Risk treatment
is part of: Question 198

Question 199
type: Question
text: What is the difference between "inherent risk" and "residual risk" in ISO/IEC 27005?
suggested answer: answer-199-A
suggested answer: answer-199-B
suggested answer: answer-199-C
suggested answer: answer-199-D
accepted answer: answer-199-A
is part of: ISO 27K Q&A Benchmark Dataset

answer-199-A
type: Answer
position: A
text: Inherent risk is before controls, residual risk is after controls
is accepted: true
is part of: Question 199

answer-199-B
type: Answer
position: B
text: Inherent risk is financial, residual risk is operational
is part of: Question 199

answer-199-C
type: Answer
position: C
text: Inherent risk is external, residual risk is internal
is part of: Question 199

answer-199-D
type: Answer
position: D
text: They are the same
is part of: Question 199

Question 200
type: Question
text: Which risk assessment methodology is recommended by ISO/IEC 27005:2022?
suggested answer: answer-200-A
suggested answer: answer-200-B
suggested answer: answer-200-C
suggested answer: answer-200-D
accepted answer: answer-200-D
is part of: ISO 27K Q&A Benchmark Dataset

answer-200-A
type: Answer
position: A
text: Only quantitative methods
is part of: Question 200

answer-200-B
type: Answer
position: B
text: Only qualitative methods
is part of: Question 200

answer-200-C
type: Answer
position: C
text: A combination of qualitative and quantitative methods
is part of: Question 200

answer-200-D
type: Answer
position: D
text: No specific method is prescribed
is accepted: true
is part of: Question 200

Question 201
type: Question
text: What is the purpose of a "risk appetite" in ISO/IEC 27005?
suggested answer: answer-201-A
suggested answer: answer-201-B
suggested answer: answer-201-C
suggested answer: answer-201-D
accepted answer: answer-201-B
is part of: ISO 27K Q&A Benchmark Dataset

answer-201-A
type: Answer
position: A
text: To define the maximum budget for cybersecurity
is part of: Question 201

answer-201-B
type: Answer
position: B
text: To set the level of risk an organization is willing to accept
is accepted: true
is part of: Question 201

answer-201-C
type: Answer
position: C
text: To measure employee awareness of risks
is part of: Question 201

answer-201-D
type: Answer
position: D
text: To determine insurance premiums
is part of: Question 201

Question 202
type: Question
text: Which of the following is a valid risk treatment option per ISO/IEC 27005?
suggested answer: answer-202-A
suggested answer: answer-202-B
suggested answer: answer-202-C
suggested answer: answer-202-D
accepted answer: answer-202-D
is part of: ISO 27K Q&A Benchmark Dataset

answer-202-A
type: Answer
position: A
text: Risk avoidance (discontinuing the activity)
is part of: Question 202

answer-202-B
type: Answer
position: B
text: Risk sharing (outsourcing)
is part of: Question 202

answer-202-C
type: Answer
position: C
text: Risk acceptance (tolerating the risk)
is part of: Question 202

answer-202-D
type: Answer
position: D
text: All of the above
is accepted: true
is part of: Question 202

Question 203
type: Question
text: What role does "risk communication" play in ISO/IEC 27005?
suggested answer: answer-203-A
suggested answer: answer-203-B
suggested answer: answer-203-C
suggested answer: answer-203-D
accepted answer: answer-203-A
is part of: ISO 27K Q&A Benchmark Dataset

answer-203-A
type: Answer
position: A
text: It ensures stakeholders understand the risks and controls
is accepted: true
is part of: Question 203

answer-203-B
type: Answer
position: B
text: It is only needed for regulatory compliance
is part of: Question 203

answer-203-C
type: Answer
position: C
text: It replaces the need for risk assessments
is part of: Question 203

answer-203-D
type: Answer
position: D
text: It focuses only on IT department risks
is part of: Question 203

Question 204
type: Question
text: How often should risk assessments be performed per ISO/IEC 27005?
suggested answer: answer-204-A
suggested answer: answer-204-B
suggested answer: answer-204-C
suggested answer: answer-204-D
accepted answer: answer-204-B
is part of: ISO 27K Q&A Benchmark Dataset

answer-204-A
type: Answer
position: A
text: Only once during ISMS implementation
is part of: Question 204

answer-204-B
type: Answer
position: B
text: Annually or when significant changes occur
is accepted: true
is part of: Question 204

answer-204-C
type: Answer
position: C
text: Only after a security breach
is part of: Question 204

answer-204-D
type: Answer
position: D
text: Every 5 years
is part of: Question 204

Question 205
type: Question
text: Which document should record the outcomes of risk assessments per ISO/IEC 27005?
suggested answer: answer-205-A
suggested answer: answer-205-B
suggested answer: answer-205-C
suggested answer: answer-205-D
accepted answer: answer-205-D
is part of: ISO 27K Q&A Benchmark Dataset

answer-205-A
type: Answer
position: A
text: Statement of Applicability (SoA)
is part of: Question 205

answer-205-B
type: Answer
position: B
text: Risk Treatment Plan (RTP)
is part of: Question 205

answer-205-C
type: Answer
position: C
text: Risk Register
is part of: Question 205

answer-205-D
type: Answer
position: D
text: All of the above
is accepted: true
is part of: Question 205

Question 206
type: Question
text: How do ISO 27001 and ISO 27005 relate to each other?
suggested answer: answer-206-A
suggested answer: answer-206-B
suggested answer: answer-206-C
suggested answer: answer-206-D
accepted answer: answer-206-A
is part of: ISO 27K Q&A Benchmark Dataset

answer-206-A
type: Answer
position: A
text: ISO 27001 is a standard for risk management, and ISO 27005 is for information security management
is accepted: true
is part of: Question 206

answer-206-B
type: Answer
position: B
text: ISO 27005 is a subset of ISO 27001
is part of: Question 206

answer-206-C
type: Answer
position: C
text: ISO 27001 and ISO 27005 are unrelated standards
is part of: Question 206

answer-206-D
type: Answer
position: D
text: ISO 27001 is an older version of ISO 27005
is part of: Question 206

Question 207
type: Question
text: Which standard provides guidelines for information security risk management processes?
suggested answer: answer-207-A
suggested answer: answer-207-B
suggested answer: answer-207-C
suggested answer: answer-207-D
accepted answer: answer-207-C
is part of: ISO 27K Q&A Benchmark Dataset

answer-207-A
type: Answer
position: A
text: ISO 9001
is part of: Question 207

answer-207-B
type: Answer
position: B
text: ISO 27001
is part of: Question 207

answer-207-C
type: Answer
position: C
text: ISO 27005
is accepted: true
is part of: Question 207

answer-207-D
type: Answer
position: D
text: ISO 14001
is part of: Question 207

Question 208
type: Question
text: Which phase of the risk management process is emphasized by ISO 27005?
suggested answer: answer-208-A
suggested answer: answer-208-B
suggested answer: answer-208-C
suggested answer: answer-208-D
accepted answer: answer-208-C
is part of: ISO 27K Q&A Benchmark Dataset

answer-208-A
type: Answer
position: A
text: Risk acceptance
is part of: Question 208

answer-208-B
type: Answer
position: B
text: Risk communication
is part of: Question 208

answer-208-C
type: Answer
position: C
text: Risk assessment
is accepted: true
is part of: Question 208

answer-208-D
type: Answer
position: D
text: Risk celebration
is part of: Question 208

Question 209
type: Question
text: How does ISO 27005 support ISO 27001 in the risk treatment process?
suggested answer: answer-209-A
suggested answer: answer-209-B
suggested answer: answer-209-C
suggested answer: answer-209-D
accepted answer: answer-209-B
is part of: ISO 27K Q&A Benchmark Dataset

answer-209-A
type: Answer
position: A
text: By providing guidelines for risk assessment
is part of: Question 209

answer-209-B
type: Answer
position: B
text: By specifying security controls in the Statement of Applicability
is accepted: true
is part of: Question 209

answer-209-C
type: Answer
position: C
text: By focusing on continuous improvement
is part of: Question 209

answer-209-D
type: Answer
position: D
text: By managing office supplies
is part of: Question 209

Question 210
type: Question
text: What is the relationship between the Statement of Applicability (So
suggested answer: answer-210-A
suggested answer: answer-210-B
suggested answer: answer-210-C
suggested answer: answer-210-D
accepted answer: answer-210-A
is part of: ISO 27K Q&A Benchmark Dataset

answer-210-A
type: Answer
position: A
text: The SoA lists controls to address identified risks
is accepted: true
is part of: Question 210

answer-210-B
type: Answer
position: B
text: The SoA is irrelevant to risk management
is part of: Question 210

answer-210-C
type: Answer
position: C
text: The SoA is an alternative to risk assessments
is part of: Question 210

answer-210-D
type: Answer
position: D
text: The SoA outlines employee benefits
is part of: Question 210

Question 211
type: Question
text: An organization decided to use nonnumerical categories, i.e., low, medium, and high for describing consequence and probability. Which risk analysis methodology is the organization using?
suggested answer: answer-211-A
suggested answer: answer-211-B
suggested answer: answer-211-C
accepted answer: answer-211-C
is part of: ISO 27K Q&A Benchmark Dataset

answer-211-A
type: Answer
position: A
text: Quantitative
is part of: Question 211

answer-211-B
type: Answer
position: B
text: Semi-quantitative
is part of: Question 211

answer-211-C
type: Answer
position: C
text: Qualitative
is accepted: true
is part of: Question 211

Question 212
type: Question
text: What type of process is risk management?
suggested answer: answer-212-A
suggested answer: answer-212-B
suggested answer: answer-212-C
accepted answer: answer-212-A
is part of: ISO 27K Q&A Benchmark Dataset

answer-212-A
type: Answer
position: A
text: Ongoing, which allows organizations to monitor risk and keep it at an acceptable level
is accepted: true
is part of: Question 212

answer-212-B
type: Answer
position: B
text: Iterative, which is conducted simultaneously with internal audits to ensure the effectiveness of an organization's operations
is part of: Question 212

answer-212-C
type: Answer
position: C
text: Ongoing, which must be conducted annually and be consistent with the selection of security controls
is part of: Question 212

Question 213
type: Question
text: After creating a plan for outsourcing to a cloud service provider to store their confidential information in cloud, OrgX decided to not pursue this business strategy since the risk of doing so was high. Which risk treatment option did OrgX use?
suggested answer: answer-213-A
suggested answer: answer-213-B
suggested answer: answer-213-C
accepted answer: answer-213-A
is part of: ISO 27K Q&A Benchmark Dataset

answer-213-A
type: Answer
position: A
text: Risk avoidance
is accepted: true
is part of: Question 213

answer-213-B
type: Answer
position: B
text: Risk sharing
is part of: Question 213

answer-213-C
type: Answer
position: C
text: Risk modification
is part of: Question 213

Question 214
type: Question
text: According to ISO 31000, which of the following is a principle of risk management?
suggested answer: answer-214-A
suggested answer: answer-214-B
suggested answer: answer-214-C
accepted answer: answer-214-A
is part of: ISO 27K Q&A Benchmark Dataset

answer-214-A
type: Answer
position: A
text: Dynamic
is accepted: true
is part of: Question 214

answer-214-B
type: Answer
position: B
text: Qualitative
is part of: Question 214

answer-214-C
type: Answer
position: C
text: Reliability
is part of: Question 214

Question 215
type: Question
text: What are opportunities?
suggested answer: answer-215-A
suggested answer: answer-215-B
suggested answer: answer-215-C
accepted answer: answer-215-B
is part of: ISO 27K Q&A Benchmark Dataset

answer-215-A
type: Answer
position: A
text: Occurrence or change of a particular set of circumstances
is part of: Question 215

answer-215-B
type: Answer
position: B
text: Combination of circumstances expected to be favorable to objectives
is accepted: true
is part of: Question 215

answer-215-C
type: Answer
position: C
text: Outcome of an event affecting objectives
is part of: Question 215

Question 216
type: Question
text: What should an organization do after it has established the risk communication plan?
suggested answer: answer-216-A
suggested answer: answer-216-B
suggested answer: answer-216-C
accepted answer: answer-216-C
is part of: ISO 27K Q&A Benchmark Dataset

answer-216-A
type: Answer
position: A
text: Change the communication approach and tools
is part of: Question 216

answer-216-B
type: Answer
position: B
text: Update the information security policy
is part of: Question 216

answer-216-C
type: Answer
position: C
text: Establish internal and external communication
is accepted: true
is part of: Question 216

Question 217
type: Question
text: According to CRAMM methodology, how is risk assessment initiated?
suggested answer: answer-217-A
suggested answer: answer-217-B
suggested answer: answer-217-C
accepted answer: answer-217-A
is part of: ISO 27K Q&A Benchmark Dataset

answer-217-A
type: Answer
position: A
text: By gathering information on the system and identifying assets within the scope
is accepted: true
is part of: Question 217

answer-217-B
type: Answer
position: B
text: By identifying the security risks
is part of: Question 217

answer-217-C
type: Answer
position: C
text: By determining methods and procedures for managing risks
is part of: Question 217

Question 218
type: Question
text: According to ISO/IEC 27005, what is the output of the documentation of risk management processes?
suggested answer: answer-218-A
suggested answer: answer-218-B
suggested answer: answer-218-C
accepted answer: answer-218-B
is part of: ISO 27K Q&A Benchmark Dataset

answer-218-A
type: Answer
position: A
text: Knowledge on the information security risk assessment and treatment processes in accordance with clauses 7 and 8 of the standard
is part of: Question 218

answer-218-B
type: Answer
position: B
text: Documented information about the information security risk assessment and treatment results
is accepted: true
is part of: Question 218

answer-218-C
type: Answer
position: C
text: Documented information that is necessary for the effectiveness of the information security risk assessment or risk treatment processes
is part of: Question 218

Question 219
type: Question
text: Based on the EBIOS RM method, which of the following is one of the four attack sequence phases?
suggested answer: answer-219-A
suggested answer: answer-219-B
suggested answer: answer-219-C
accepted answer: answer-219-A
is part of: ISO 27K Q&A Benchmark Dataset

answer-219-A
type: Answer
position: A
text: Exploiting
is accepted: true
is part of: Question 219

answer-219-B
type: Answer
position: B
text: Treating
is part of: Question 219

answer-219-C
type: Answer
position: C
text: Attacking
is part of: Question 219

Question 220
type: Question
text: Who can utilize the ISO/IEC 27000 series?
suggested answer: answer-220-A
suggested answer: answer-220-B
suggested answer: answer-220-C
suggested answer: answer-220-D
accepted answer: answer-220-D
is part of: ISO 27K Q&A Benchmark Dataset

answer-220-A
type: Answer
position: A
text: Religious institutions.
is part of: Question 220

answer-220-B
type: Answer
position: B
text: Small businesses.
is part of: Question 220

answer-220-C
type: Answer
position: C
text: Large companies.
is part of: Question 220

answer-220-D
type: Answer
position: D
text: All types of companies.
is accepted: true
is part of: Question 220

Question 221
type: Question
text: What is the ISO/IEC 27000 series used for?
suggested answer: answer-221-A
suggested answer: answer-221-B
suggested answer: answer-221-C
suggested answer: answer-221-D
accepted answer: answer-221-C
is part of: ISO 27K Q&A Benchmark Dataset

answer-221-A
type: Answer
position: A
text: Providing measurements for industry comparison.
is part of: Question 221

answer-221-B
type: Answer
position: B
text: Providing a blueprint for purchasing hardware.
is part of: Question 221

answer-221-C
type: Answer
position: C
text: Providing a framework for information security.
is accepted: true
is part of: Question 221

answer-221-D
type: Answer
position: D
text: Providing an outline for detailing business plans.
is part of: Question 221

Question 222
type: Question
text: What does it mean to adopt a ''risk-based approach'' as recommended in the ISO/IEC 27000 series?
suggested answer: answer-222-A
suggested answer: answer-222-B
suggested answer: answer-222-C
suggested answer: answer-222-D
accepted answer: answer-222-B
is part of: ISO 27K Q&A Benchmark Dataset

answer-222-A
type: Answer
position: A
text: To approach your security program without fear of unknown risks.
is part of: Question 222

answer-222-B
type: Answer
position: B
text: To make security decisions based on evaluating potential risks.
is accepted: true
is part of: Question 222

answer-222-C
type: Answer
position: C
text: To make risky security decisions if you hope to accomplish great things.
is part of: Question 222

answer-222-D
type: Answer
position: D
text: To approach risks slowly and cautiously outside the security program.
is part of: Question 222