A multiple-choice question-and-answer benchmark dataset covering ISO/IEC 27000-series information security management standards.
What is an Information Security Management System (ISMS)?
A set of policies and procedures for managing sensitive company information
A software tool for managing security risks.
A consulting service for security compliance
What are the two main parts of ISO 27001 standard?
To provide a framework for managing sensitive company information
To ensure compliance with government regulations
To improve an organization's overall security posture
What are the benefits of implementing ISO 27001?
Improving an organization's overall security posture
Enhancing an organization's reputation and credibility
Facilitating compliance with legal and regulatory requirements
What is the main difference between ISO 27001 and ISO 27002?
ISO 27001 is a standard and ISO 27002 is a code of practice
ISO 27001 is for management and ISO 27002 is for technical implementation
ISO 27001 is for small businesses and ISO 27002 is for large organizations
ISO 27001 is for government agencies and ISO 27002 is for private sector
Which of the following best describes the structure of ISO 27001?
A set of guidelines for implementing a data backup plan
A framework for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISM
A set of regulations for protecting personal data in the healthcare industry
A standard for ensuring the security of industrial control systems
In which section of ISO 27001 standard is "Clause 6" is mentioned?
Section 7 - The Performance Evaluation Phase
How can an organization ensure the availability of their information systems according to the ISO 27001 standard?
By implementing regular backups and disaster recovery plans
By implementing strict access controls and monitoring user activity
By implementing firewalls and intrusion detection systems
By implementing encryption and secure communication protocols
What are the common types of confidentiality controls implemented in an ISMS as per ISO 27001 standard?
Which of the following best describes the principle of "integrity" in the context of ISO 27001?
Ensuring that only authorized individuals have access to sensitive information
Maintaining the accuracy and completeness of information throughout its lifecycle
Ensuring that information is protected from unauthorized modification or destruction
Ensuring that information systems are available for their intended purpose
Which of the following would be the most appropriate action for an organization to take in order to ensure the confidentiality, integrity, and availability of their information assets, according to the principles of an Information Security Management System (ISMS) as outlined in ISO 27001?
Implementing firewalls and antivirus software on all company computers
Providing regular security awareness training for all employees
Conducting regular risk assessments and implementing controls to mitigate identified risks
Restricting access to certain information assets to only a select group of individuals
A company is in the process of implementing an Information Security Management System (ISMS) in accordance with ISO 27001. The company's IT department is responsible for managing the ISMS, but they are unsure of how to proceed with the implementation. Which of the following options would be the best course of action for the IT department to take?
Hire an external consultant to handle the implementation of the ISMS
Assign a single employee within the IT department to oversee the implementation of the ISMS
Form a cross-functional team within the company to handle the implementation of the ISMS
Outsource the implementation of the ISMS to a third-party vendor
In a company's effort to implement ISO 27001 requirements, which of the following steps would be considered the MOST important?
Developing a comprehensive security policy
What is the first step in implementing ISO 27001 requirements within an organization?
Developing an Information Security Policy
Which of the following documents is required to be maintained as per ISO 27001 standard?
Improved compliance with regulatory requirements
Enhanced reputation and competitive advantage
Reduced risk of data breaches and cyber attacks
Is ISO 27001 a standard that defines the technical details for information security, e.g., how to configure a firewall?
Which of the following statements represents an external issue?
What is the first step in the planning phase of implementing an ISMS?
Developing the Information Security Policy
Understanding the organization and its context
What is the purpose of determining the scope of an ISMS?
To identify which areas of the organization will be covered by the ISMS
To identify which information assets need to be protected
To identify which information security standards need to be met
What are the key elements of effective communication in an ISMS?
What is the difference between internal and external communication in an ISMS?
Internal communication involves communication within the organization, external communication involves communication with external stakeholders
Internal communication involves communication with customers, external communication involves communication with suppliers
Internal communication involves communication with management, external communication involves communication with employees
Internal communication involves communication with regulatory bodies, external communication involves communication with the public
Who is responsible for managing the awareness program in an ISMS?
Which of the following statements describes an ISMS scope?
Company X’s ISO 27001 certificate is valid until November 22, 2028
The Information Security Management System (ISMS) applies to the provision of software development and implementation, as well as outsourcing of IT services including maintenance of hardware and software, operating from the offices in London and Edinburgh
The ISMS has implemented all the controls from Annex A
Company X has implemented ISO 9001 and ISO 27001
How can top management demonstrate leadership and commitment to the Information Security Management System?
Documenting the information security policies and procedures
Ensuring the resources necessary for the ISMS
Creating exceptions to the security rules for top management
Dedicating one week a year for information security, while the rest of the time is dedicated to everyday activities
The following statements are requirements for the Information Security Policy:
It should include detailed information about the roles and responsibilities of the employees
It should include relevant technical details and security rules
It should provide a framework for setting information security objectives
Which of the following responsibilities and authorities are relevant for the person responsible for reporting on the performance of the ISMS to top management?
Conducting a campaign for ISMS awareness raising
Measuring the KPIs (Key Performance Indicators)
Which of the following objectives represents a measurable information security objective?
Ensure 99.9% availability of the company’s services annually
Decrease the average time for solving incidents by 10% during the next 12 months
Increase the information security awareness of employees
Strengthen the overall capabilities of the Information Security Management System in the next six months
For effective implementation of incident management software in Company Y, the following resources should be available:
Available person and time to conduct analysis of the most suitable software for incident management in Company Y
Responsible person for coordinating the implementation of the procedure
Available time for all employees to pass short training on how to use the incident management software for reporting incidents
Which of the following statements represents requirements from the ISO 27001 standard?
All employees should have an ISO 27001 Introduction certificate
Assign a security mentor to each employee
All employees shall have university degrees
Information security awareness raising helps employees become information security experts:
Communication rules should cover the following elements:
When the scheduled internal audit is scheduled
Standard form for communication for each media used (e.g., social media, press, television, etc.)
Why information security objectives are important
When creating a new document, you should take into consideration the following aspects:
Storing the document wherever is suitable for you
Saving the document in the appropriate file format
The document is very well written, so it doesn’t need a title. It is pretty much obvious what it is
In a scenario where Company X is implementing an ISMS, what are the key considerations for determining the scope of the ISMS?
The physical location of the company's assets
The types of data and information processed by the company
The legal and regulatory requirements the company must comply with
The company's organizational structure and lines of communication
In a scenario where a company is implementing an ISMS, which of the following actions best demonstrates leadership according to ISO 27001?
Allowing employees to make decisions on their own regarding information security
Ignoring feedback and suggestions from employees regarding the ISMS
Actively participating in the implementation and ongoing maintenance of the ISMS
Outsourcing all responsibilities related to the ISMS to a third-party vendor
In a scenario where a company is implementing an ISMS, which of the following actions would demonstrate commitment to the system according to ISO 27001?
Allocating a budget for the ISMS implementation
Assigning a dedicated team to handle the ISMS implementation
Regularly reviewing and updating the ISMS documentation
Providing the ISMS team with necessary resources
A company is in the process of creating an Information Security Policy as part of their implementation of an ISMS according to ISO 27001. Which of the following elements should be included in the policy to ensure its effectiveness?
A list of all employees and their job titles
Detailed instructions for how to handle security incidents
A clear statement of the company's commitment to maintaining the confidentiality, integrity, and availability of information
A list of all software and hardware used by the company
Who is responsible for ensuring the effectiveness of the Information Security Management System
The Chief Information Security Officer (CISO)
Who is responsible for providing the necessary resources for the Information Security Management System?
In Company X, the risk methodology used for their ISMS includes identifying and evaluating risks, but they are unsure if they should also include a risk treatment plan. Which of the following options best aligns with the requirements of ISO 27001 for risk methodology?
Identifying and evaluating risks, and implementing a risktreatment plan
Identifying risks only, and leaving evaluation and treatment to the discretion of individual departments
Outsourcing risk management to a third-party vendor
Risks and opportunities need to be addressed in order to:
Prevent or reduce the financial and operational losses
Ensure all employees are aware of the risks and opportunities
What is the appropriate order for the steps from the Risk Management Process?
Which of the following represents assets from an information security perspective?
What is the primary outcome of a risk analysis related to ISO 27001?
Prioritizing of risk management activities
Who is responsible for managing the risks identified in an ISO 27001 audit?
What is the risk impact if an organization fails to implement appropriate technical and organizational measures to protect confidential data?
Which of the following actions are accepted as good risk treatment practices?
The Statement of Applicability document should include:
All the controls from Annex A and any additional controls that might be identified in the risk treatment process
Only additional controls that might be identified in the risk treatment process
What is the purpose of the Statement of Applicability according to ISO 27001?
To identify the security controls implemented within an organization.
To document the risk assessment and risk treatment process.
To demonstrate an organization’s commitment to information security.
To identify assets and the associated risks.
Which one of the following is a step in the risk management process:
Understand the organization and its context
Report the incidents to the top management
According to ISO 27001, the risk assessment must include which one of the following elements:
Defining the risk assessment methodology
In a scenario where a company is evaluating potential risks to their information security, which of the following is NOT a valid method for risk evaluation according to ISO 27001?
Assessing likelihood and impact of each identified risk
Comparing risks to a pre-determined set of criteria
Consulting with industry experts to determine potential risks
Ignoring risks that have a low likelihood of occurrence
Risk analysis includes assessment of the impact the risk can have on the company and assessment of the likelihood that the identified risk could really happen. The assessment scale for the impact and the likelihood must vary between the values of 1 and 10.
During the risk evaluation process according to ISO 27001, which of the following is NOT a recommended approach for identifying potential risks?
Reviewing past incidents and near-misses
Implementing a new software system without testing
Consulting external experts and industry standards
After formulating a risk treatment plan, the Statement of Applicability must be documented.
The Statement of Applicability must include the following information:
The risk treatment option associated with each control from Annex A and any additional controls that might be identified in the risk treatment process
Information regarding whether the listed controls are implemented in the organization
Choose which of the following statements can be documented as results for the follow-up from the implementation of a control-card-controlled access to the server room:
Half of the people who work in the server room are trained in the use of the card readers
Analysis of the log and the video surveillance show that the card- controlled access to the server room is very effective
Cheaper equipment for card-controlled access than the one implemented is available on the market
ISO 27001 requires that every aspect of the ISMS should be documented.
It is mandatory to change the ISMS documentation (modify, update, delete, add new documents, etc.) at least once per year:
Companies that have implemented ISO 27001 are not allowed to outsource critical operations, because that can have a negative impact on the information security.
Changes in an organization can be planned and unplanned. Both types of changes should be controlled and their consequences reviewed.
According to you, which of the listed changes that can happen in a company may require conducting a re-assessment of risks?
Outsourcing the IT maintenance process to an IT company
Buying a new laptop for the office manager
What are the key components that should be included in the risk treatment plan, according to ISO 27001?
The proposed controls to mitigate the identified risks
The cost of implementing the proposed controls
In a scenario where a company is implementing an ISMS, what is the most important factor to consider when formulating a risk treatment plan according to ISO 27001?
The likelihood and potential impact of the identified risks
The company's compliance with other regulatory standards
The ease of implementation for the IT department
A company is in the process of implementing the risk treatment plan identified during their risk assessment. Which of the following is the most important factor to consider when implementing controls to mitigate identified risks?
The effectiveness of the controls in mitigating the identified risks
The ability to monitor and measure the controls
When implementing the information security risk treatment plan, one must:
Take into consideration available resources
Document the information security risk treatment plan
ISO 27001 requires companies to document the results of the risk treatment.
The Do phase moves companies from a stage where they plan information security to a stage where they implement information security and protect the information.
ISO 27001 requires the change management procedure to be documented.
Operating an Information Security Management System (ISMS) means:
Auditing all of the activities described in the ISMS policies and procedures
Maintaining highly detailed ISMS documentation
In a scenario where a company is undergoing an ISO 27001 certification audit, which of the following documents would the auditor typically request to review as part of the ISMS documentation requirement?
What is the main goal of control implementation in an ISMS according to ISO 27001?
To ensure the ISMS is functioning properly
To meet regulatory compliance requirements
To improve the organization's overall efficiency
In a scenario where a company has recently implemented an ISMS based on ISO 27001, which of the following is the MOST important step in the ongoing monitoring and review process?
Documenting all incidents and their resolutions
Evaluating the effectiveness of the ISMS on a yearly basis
In the event of a security incident at Company X, which of the following actions should be taken first according to ISO 27001 guidelines?
Notify the affected parties and the public
Conduct a thorough investigation to determine the root cause
Report the incident to the relevant regulatory bodies
Implement temporary countermeasures to contain the incident
In XYZ Company, what is the recommended process for reporting and recording incidents according to ISO 27001 guidelines?
Employees should report incidents to their immediate supervisor and the IT department
Incidents should only be reported to the IT department and not shared with any other department
Incidents should be reported to the IT department and the incident management team for further investigation
Incidents should be reported to the IT department and the senior management team for review and analysis
Which of the following is NOT a best practice for incident management according to ISO 27001:
Assign a specific team member to be in charge of managing incidents
Immediately notify all employees of an incident as soon as it occurs
Wait to see if an incident resolves itself before taking any action
Document all incidents and their resolution in a centralized incident log
The purpose of the management review is to evaluate the results of the measurements and analyses and make crucial decisions.
A nonconformity is when a certain incident happens in the organization.
ISO 27001 requires companies to continually improve:
The ISO 27001 standard by publishing new versions of the standard
The suitability, adequacy, and effectiveness of the Information Security Management System
ISO 27001 requires companies to evaluate the information security performance and effectiveness of the ISMS through:
As part of the process for evaluating the information security performance and effectiveness of the ISMS, ISO 27001 requires companies to:
Monitor and measure the incident management process
Document a procedure for the evaluation of ISMS effectiveness
Nominate at least three responsible persons for conducting monitoring and measurements, so data tampering risk is reduced
The objective of the internal audit is to identify who is responsible for the information security problems in the organization.
ISO 27001 requires the top management to conduct management review meetings for reviewing the ISMS of the company.
In order for top management to review the suitability, adequacy, and effectiveness of the ISMS of the company, which one of the following aspects should be covered:
Feedback from employees regarding the new cafeteria
An overview of the configuration parameters of the network router
In order to effectively monitor the performance and effectiveness of an ISMS, which of the following methods should be used according to ISO 27001?
Review of security-related incidents and their causes
Analysis of ISMS-related costs and benefits
What are the criteria to be used in an internal audit of an organization’s information security management system according to ISO 27001?
Documentation, implementation, monitoring and review
Documentation, implementation and review
Documentation, implementation and maintenance
What should an organization consider when carrying out an internal audit of its information security management system?
Whether the system complies with the applicable laws and regulations
Whether the system is regularly monitored and updated
Whether the system meets the organization’s security objectives
What are the key components of an internal audit report according to ISO 27001?
Audit objectives - this outlines the purpose of the audit, such as to evaluate the effectiveness of the organization's information security management system (ISMS).
Audit scope - this outlines the areas which were audited and any specific requirements that were not included in the scope.
Audit findings - this outlines the issues identified during the audit and any recommendations for improvement.
Audit conclusion - this is a summary of the audit findings and any recommendations for improvement.
What is the purpose of an internal audit report according to ISO 27001?
To evaluate the effectiveness of the organization's ISMS;
To provide evidence of the organization's compliance with the standard.
What are the three stages of a nonconformity according to ISO 27001?
Identification, investigation, and resolution
Assessment, investigation, and corrective action
What should an organization do when a nonconformity is identified?
Investigate the nonconformity and implement corrective action
Investigate the nonconformity and report it
Identify the nonconformity and report it
Identify the nonconformity and implement corrective action
What are the four types of nonconformities associated with ISO 27001?
Minor nonconformity: A minor nonconformity is a noncompliance with one or more requirements of the ISO 27001 standard that has no significant impact on the security of the system or the implementation of the ISMS.
Major nonconformity: A major nonconformity is a noncompliance with one or more requirements of the ISO 27001 standard that has a significant impact on the security of the system or the implementation of the ISMS.
Critical nonconformity: A critical nonconformity is a noncompliance with one or more requirements of the ISO 27001 standard that has a severe impact on the security of the system or the implementation of the ISMS.
Observation: An observation is a noncompliance with one or more requirements of the ISO 27001 standard that does not have an impact on the security of the system or the implementation of the ISMS, but could lead to a nonconformity if it is not rectified.
What are the necessary steps when responding to a corrective action request according to the ISO 27001 standard?
Identify the root cause of the problem and take steps to address it.
Document the corrective action taken to remedy the issue.
Monitor and evaluate the effectiveness of the corrective action.
Implement preventive measures to reduce the likelihood of recurrence.
What is the best way to ensure continual improvement within the ISO 27001 framework?
Regularly review and update the information security management system
ISO 27001 requires the chief information security manager to be responsible for monitoring and measurement of the ISMS.
The main purpose of the internal audit is to help identify problems in the company and to identify who is responsible for those problems in order to initiate appropriate disciplinary actions.
All 93 controls listed in ISO 27001 Annex A must be implemented.
The purpose of the A.6 People controls section of Annex A is:
To punish people who don’t follow the rules
To help the company to employ high-quality people
To ensure that people working under the company understand and fulfill their information security responsibilities
To prevent information disclosure by employees
Which of the following information security controls represent physical security controls?
Securing equipment against theft when used outside of offices
Defining guidelines for classification of information
The technological controls from ISO 27001 Annex A are focused on the direct protection of data and information systems used.
To ensure that information security is integrated into the new information systems, companies should conduct the following activities:
Test the security features of the new systems
Make updates on information systems as soon as vulnerabilities are identified
Identifying information security requirements for application services transactions is the job of the company that produces the information system, not the company that buys it
Technological controls from ISO 27001 Annex A are those controls that are essential for ensuring secure operations of the IT infrastructure of the company.
Information security should be addressed in every project, regardless of its type.
According to ISO 27001, Annex A, information and assets should be managed by:
Defining a classification framework considering the levels Public, Internal, Confidential, and Top Secret
Defining expected behavior on the use of assets
Implementing an asset management software
By ensuring the former employee signs the Return of Asset form when leaving the organization
According to ISO 27001, Annex A, operational security should be managed by:
Defining rules that will forbid access by third parties
Defining how information can be transferred between organizations
Documenting procedures focusing only on employees from the IT department
Having security documents not related to regular IT processes
Security requirements can be agreed upon verbally with suppliers.
Management of information security incidents includes learning from the incidents.
The controls related to compliance are focused primarily on avoiding breaches of intellectual property rights.
Controls related to information security policies require documenting a set of policies for defining information security rules. These policies are:
High-level policies that set the basic approach of the company for information security
The physical controls from section A.7 cover two sub-topics: controls for securing the area, and controls for securing the equipment.
Section A.5 Organizational controls requires documenting operational procedures that will be available to everyone in the organization who needs them.
Section A.6 People controls aims to ensure that people are aware of their responsibilities regarding information security, have the necessary training, and will take proper measures to protect the information.
Section A.5 defines controls related to supplier management. These controls aim:
To ensure that failure to deliver reports as defined in agreements’ clauses is properly handled
To ensure that suppliers exceed the agreed levels of performance
To ensure that controls to treat risks related to suppliers are properly identified, agreed, monitored, and reviewed
To force suppliers to pay out damages that are incurred as a consequence of incidents
What is the purpose of people controls in ISO 27001?
To ensure that only authorized individuals have access to sensitive information
To track the amount of time employees spend on specific tasks
To implement background checks for new hires
Which of the following is considered a physical control in an ISO 27001 compliant environment?
A company is concerned about the security of their data center. Which of the following is a physical control that can be implemented to secure the data center?
Which of the following is an example of a technological control that can be implemented to protect an organization's information assets according to ISO 27001?
An organization is concerned about unauthorized access to their network. Which of the following would be considered a technological control to mitigate this risk?
Conducting regular security training for employees
What is an example of an organizational control in accordance with ISO 27001?
Regularly scheduled backups of important data
Installation of firewalls on network devices
In ISO/IEC 27000:2018 what is "fulfilment of a requirement"?
ISO/IEC 27001:2022 requires which of the following to be documented (in Clause 6)? Select as many as you think apply
Where in the standard will you find a reference for controls?
ISO/IEC 27001:2022 requires defined rules for which of the following? Select as many as you think apply
"ISO/IEC 27001:2022 uses the same Annex SL 10-clause framework as ISO 9001:2015 and ISO 14001:2015." Is this statement 'true' or 'false'?
Where would you find the Terms and Definitions for ISO/IEC 27001:2022?
"The scope [of the management system] shall be available as documented information".
What does the C in the CIA of Information Security stand for?
With regards to the controls, what must the organisation produce?
ISO/IEC 27001:2022 is focussed solely on the protection of personal information.
Fundamentals and Context of ISO 27001:2022 - Which of the following is NOT a key characteristic of information security according to ISO 27001?
Planning the ISMS - The primary objective of an information security risk assessment is to:
Eliminate all information security risks.
Identify, analyze, and evaluate information security risks.
Planning the ISMS - When establishing the ISMS scope, it is crucial to:
Make it as broad as possible to cover all potential risks.
Define clear boundaries and limitations of the ISMS.
Exclude any areas that are difficult to manage.
Planning the ISMS - The 'Statement of Applicability' (So
Lists all mandatory controls from Annex A that must be implemented.
Documents the selected controls from Annex A and justifies their inclusion or exclusion.
Is a summary of the risk assessment report.
Is only required for organizations seeking certification.
Support and Operation of the ISMS - Documented information in ISO 27001:2022 includes:
Any information required to be controlled and maintained by the organization and the standard.
Performance Evaluation and Improvement - Internal audits of the ISMS are conducted to:
Verify whether the ISMS conforms to the organization's own requirements and the requirements of ISO 27001:2022.
Punish employees who violate security policies.
Performance Evaluation and Improvement - Management review of the ISMS should be conducted at planned intervals to:
Ensure the continuing suitability, adequacy, and effectiveness of the ISMS.
Prepare for external certification audits.
Only focus on financial aspects of the ISMS.
Performance Evaluation and Improvement - Continual improvement of the ISMS is a:
One-time project at the start of implementation.
Recurring activity to enhance the suitability, adequacy, and effectiveness of the ISMS.
Optional activity after achieving certification.
Annex A Controls (High-Level Understanding) - Annex A of ISO 27001:2022 provides:
Mandatory security controls that all organizations must implement.
A comprehensive list of information security controls and control objectives, serving as a reference set.
Specific technical configurations for security technologies.
Annex A Controls (High-Level Understanding) - An example of a 'Technological control' from Annex A is:
Annex A Controls (High-Level Understanding) - The selection of Annex A controls should be based on:
The results of the information security risk assessment and the organization's risk treatment decisions.
The recommendations of the certification body.
Lead Implementer Specific Responsibilities and Considerations - A Lead Implementer's primary role is to:
Write all security policies and procedures.
Manage the entire ISMS implementation project, guiding the organization through all phases.
Be the sole decision-maker for all ISMS related matters.
Lead Implementer Specific Responsibilities and Considerations - Stakeholder engagement is crucial for a Lead Implementer. This involves:
Only informing top management about the ISMS project.
Identifying, communicating with, and involving relevant stakeholders throughout the ISMS implementation.
Ignoring stakeholders who are resistant to change.
Focusing only on technical stakeholders.
Lead Implementer Specific Responsibilities and Considerations - When defining the ISMS scope, a Lead Implementer should:
Impose a scope based on their own expertise.
Collaborate with relevant stakeholders to ensure the scope is realistic, achievable, and aligned with organizational objectives.
Make the scope as narrow as possible to simplify implementation.
Lead Implementer Specific Responsibilities and Considerations - During the ISMS implementation project, a Lead Implementer should:
Act as a project manager, facilitator, and subject matter expert, guiding the team and ensuring progress.
Delegate all tasks to team members and only oversee progress.
Focus solely on technical aspects and ignore organizational change management.
Lead Implementer Specific Responsibilities and Considerations - A Lead Implementer contributes to the continual improvement of the ISMS by:
Leaving the ISMS once certification is achieved.
Establishing processes for monitoring, measurement, audit, management review, and corrective action, and promoting a culture of continuous improvement.
Focusing only on implementing new technologies.
What is the purpose of ICT readiness for business continuity?
To reduce the likelihood or consequences of future incidents.
To ensure the availability of the organization's information and other associated assets during disruption.
To ensure a consistent and effective management of evidence related to information security incidents for the purposes of disciplinary and legal actions.
To protect information and other associated assets during disruption.
What is the purpose of Policies for information security?
To establish a defined, approved and understood structure for the implementation, operation and management of information security within the organization.
To ensure continuing suitability, adequacy, effectiveness of management direction and support for information security in accordance with business, legal, statutory, regulatory and contractual requirements.
To ensure management understand their role in information security and undertake actions aiming to ensure all personnel are aware of and fulfill their information security responsibilities.
To ensure appropriate flow of information takes places with respect to information security between the organization and relevant legal, regulatory and supervisory authorities.
Which of the following best describes a policy, according to the ISO/IEC 27002:2022?
A set of interrelated or interacting activities that uses or transforms inputs to deliver a result.
Intentions and direction of an organization, as formally expressed by its top management.
Accepted principle or institution that states the organization's expectations on what is required to be done, what is allowed or not allowed.
A specified way to carry out an activity or a process.
Which of the following refers to information that needs to be protected from unavailability, unauthorized access, modification or public disclosure because of potential adverse effects on an individual, organization, national security or public safety?
Which of the following describes one or multiple related an identified information security events that can harm an organization's assets or compromise its operations?
It is essential that an organization determines its information security requirements. Are three main sources of information security requirements:
The assessment of risks to the organization, taking into account the organization's overall business strategy and objectives.
The legal, statutory, regulatory and contractual requirements that an organization and its interested parties have to comply with and their socio-cultural environment.
The set of principles, objectives and business requirements for all the steps of the life cycle of information that an organization has developed to support its operations.
Which of the following best describe an attack, according to the ISO/IEC 27002:2022?
A successful or unsuccessful unauthorized attempt to destroy, alter, disable, gain access to an asset or any attempt to expose, steal, or make unauthorized use of an asset.
One or multiple related and identified information security events that can harm an organization's assets or compromise its operations.
The weakness of an asset or control that can be exploited by one or more threats.
The potential cause of an unwanted incident, which can result in harm to a system or organization.
Which of the following is best defines as a measure that modifies or maintains risk?
Which of the following best describes a threat?
Successful or unsuccessful unauthorized attempt to destroy, alter, disable, gain access to an asset or any attempt to expose, steal, or make unauthorized use of an asset.
The potential cause of an unwanted incident, which can results in harm to a system or organization.
Which of the following best describes the purpose of Application security requirements?
To validate if information security requirements are met when applications or code are deployed to the production environment.
To ensure information systems are securely designed, implemented and operated within the development life cycle.
To ensure software is written securely thereby reducing the number of potential information security vulnerabilities in the software.
To ensure all information security requirements are identified and addressed when developing or acquiring applications.
The title of ISO 27001:2022 includes following?
Information Security, Cyber Security and Privacy Protection
Information Management System, Tools and Techniques
Information Security procedures and techniques
Information Security Management practices
ISO 27002:2022 is comprises of how many controls?
Categories of control grouping in ISO 27002:2022 are
Long term, Short term, Incidental, optional
Organizational, People, Process, Technological
Organizational, People, Technological, Physical
Cyber Security Concept is ___ in ISO 27002:2022
In ISO 27002:2022 controls are more based on
New controls introduces in ISO 27002:2002 are:
Data Leakage prevention is _____ in ISO 27002:2022
The control “Conflicting duties and conflicting areas of responsibility should be segregated.” Is a:
Top Risks while working from home includes
The committee decides to either - Keep the standard as is, Withdraw the standard, Revise the standard, every
A ____ element has been applied to the controls within the 2022 version, as opposed to the use of a control objective for a group of controls.
Control Type for “ICT Readiness for Business continuity should be planned, Implemented, maintained and tested based on business continuity objectives and ICT continuity requirements.“
What is the purpose of the ISO/IEC 27004 standard?
To measure the effectiveness of security efforts.
To explain the various roles in a security department.
To detail what others in your industry are doing in security.
To identify the major risks that security programs face.
In order to effectively deliver security awareness training to specialized roles in the organization, which method is most appropriate?
A new CEO has joined your organization and considers the spending on IT and IT security to be frivolous. As the leader of the IT division, what is your response?
Implement a security awareness program and educate the CEO
Try to convince the board to approve new software to replace human resources
Reduce spending on anti-virus and malware, but keep firewalls
As a technical staff member in IT, what is your highest priority in cybersecurity?
What is the main focus of ISO/IEC 27004:2016?
Why was ISO/IEC 27004:2016 updated and extended?
To focus on cybersecurity hardware solutions
To provide guidelines on data encryption processes
To align with the revised version of ISO/IEC 27001
What role did Edward Humphreys play in the development of ISO/IEC 27004:2016?
He was the convenor of the working group developing the standard
He provided cybersecurity training to organizations
He led the organization implementing ISO/IEC 27001
Why does Edward Humphreys emphasize the importance of ISO/IEC 27004:2016?
To encourage using open-source cybersecurity tools
To highlight common cybersecurity misconceptions
To promote his cybersecurity consultancy services
Because cyber attacks are a significant organizational risk
What does ISO/IEC 27004:2016 detail about information security measurement programs?
How to efficiently use antivirus software
How to set up a secure network connection
How to construct a measurement program and select what to measure
In which areas does ISO/IEC 27004:2016 provide practical support?
Assessing the effectiveness of information security measures
Developing artificial intelligence for cybersecurity
Implementing cloud-based security measures
How does ISO/IEC 27004:2016 help organizations protect themselves?
By developing advanced encryption algorithms
By offering free cybersecurity insurance policies
By giving essential and practical support in monitoring and measurement
By providing guidelines on software development practices
"ISO/IEC 27004:2016 explains how to develop and operate ____ processes."
"ISO/IEC 27004:2016 includes examples of different types of ____."
What is the purpose of ISO/IEC 27004:2016?
To provide guidelines on cybersecurity protocols
To assess the performance of information security management systems
What has ISO/IEC 27004:2016 been updated and extended to align with?
National Institute of Standards and Technology (NIST) guidelines
Cybersecurity Framework for Critical Infrastructure
Who emphasized the importance of ISO/IEC 27004:2016 due to cybersecurity risks?
In the context of ISO/IEC 27004:2016, what is meant by 'construct an information security measurement program'?
Creating algorithms to detect cyber threats
Building a physical security system for data centers
Developing a framework to measure security performance
What is one of the key aspects detailed in ISO/IEC 27004:2016 regarding measurement processes?
Assessing the effectiveness of different types of measures
Selecting the best encryption algorithm for data protection
Designing a firewall for network security
Creating a secure authentication system for users
How does ISO/IEC 27004:2016 contribute to organizations facing security threats?
By creating a secure cloud computing architecture
By providing essential and practical support in information security management
By developing social engineering prevention techniques
By implementing advanced intrusion detection systems
What does ISO/IEC 27004:2016 help organizations select when it comes to measurement processes?
The most effective employee training programs
The best software development methodology
Why does Edward Humphreys mention that cyber attacks are significant risks?
To highlight the importance of data backups
To point out the increasing diversity of security attacks
How does ISO 27005 differ from other publications like NIST SP 800-30?
It incorporates several standards into one document.
It provides general guidelines, but no specific approach.
It requires 100% adherence to management procedures.
It provides a more detailed approach to risk management.
The five-stage process for risk management as laid out in ISO 27005 begins with what step?
What significant action must be taken to complete the second stage of the risk management framework?
The penalty levied on a convict whose crime results in damage to a computer system or its data or property to the value of $5,000 or over is a _____
What is the primary purpose of ISO/IEC 27005:2022?
To provide guidelines for implementing ISO/IEC 27001 controls
To offer guidance on managing information security risks
To define cybersecurity incident response procedures
Which ISO standard is most closely related to ISO/IEC 27005:2022?
Which of the following is NOT a key step in the ISO/IEC 27005 risk management process?
What is the difference between "inherent risk" and "residual risk" in ISO/IEC 27005?
Inherent risk is before controls, residual risk is after controls
Inherent risk is financial, residual risk is operational
Inherent risk is external, residual risk is internal
Which risk assessment methodology is recommended by ISO/IEC 27005:2022?
A combination of qualitative and quantitative methods
What is the purpose of a "risk appetite" in ISO/IEC 27005?
To define the maximum budget for cybersecurity
To set the level of risk an organization is willing to accept
Which of the following is a valid risk treatment option per ISO/IEC 27005?
Risk avoidance (discontinuing the activity)
What role does "risk communication" play in ISO/IEC 27005?
It ensures stakeholders understand the risks and controls
It is only needed for regulatory compliance
It replaces the need for risk assessments
How often should risk assessments be performed per ISO/IEC 27005?
Annually or when significant changes occur
Which document should record the outcomes of risk assessments per ISO/IEC 27005?
How do ISO 27001 and ISO 27005 relate to each other?
ISO 27001 is a standard for risk management, and ISO 27005 is for information security management
ISO 27001 and ISO 27005 are unrelated standards
ISO 27001 is an older version of ISO 27005
Which standard provides guidelines for information security risk management processes?
Which phase of the risk management process is emphasized by ISO 27005?
How does ISO 27005 support ISO 27001 in the risk treatment process?
By providing guidelines for risk assessment
By specifying security controls in the Statement of Applicability
What is the relationship between the Statement of Applicability (So
The SoA lists controls to address identified risks
The SoA is irrelevant to risk management
The SoA is an alternative to risk assessments
An organization decided to use nonnumerical categories, i.e., low, medium, and high for describing consequence and probability. Which risk analysis methodology is the organization using?
What type of process is risk management?
Ongoing, which allows organizations to monitor risk and keep it at an acceptable level
Iterative, which is conducted simultaneously with internal audits to ensure the effectiveness of an organization's operations
Ongoing, which must be conducted annually and be consistent with the selection of security controls
After creating a plan for outsourcing to a cloud service provider to store their confidential information in cloud, OrgX decided to not pursue this business strategy since the risk of doing so was high. Which risk treatment option did OrgX use?
According to ISO 31000, which of the following is a principle of risk management?
Occurrence or change of a particular set of circumstances
Combination of circumstances expected to be favorable to objectives
Outcome of an event affecting objectives
What should an organization do after it has established the risk communication plan?
Change the communication approach and tools
Establish internal and external communication
According to CRAMM methodology, how is risk assessment initiated?
By gathering information on the system and identifying assets within the scope
By determining methods and procedures for managing risks
According to ISO/IEC 27005, what is the output of the documentation of risk management processes?
Knowledge on the information security risk assessment and treatment processes in accordance with clauses 7 and 8 of the standard
Documented information about the information security risk assessment and treatment results
Documented information that is necessary for the effectiveness of the information security risk assessment or risk treatment processes
Based on the EBIOS RM method, which of the following is one of the four attack sequence phases?
Who can utilize the ISO/IEC 27000 series?
What is the ISO/IEC 27000 series used for?
Providing measurements for industry comparison.
Providing a blueprint for purchasing hardware.
Providing a framework for information security.
Providing an outline for detailing business plans.
What does it mean to adopt a ''risk-based approach'' as recommended in the ISO/IEC 27000 series?
To approach your security program without fear of unknown risks.
To make security decisions based on evaluating potential risks.
To make risky security decisions if you hope to accomplish great things.
To approach risks slowly and cautiously outside the security program.