ISO 27000 Foundation Certification Exam — Questions and Answers

Question 1: A hacker sends a deceptive email pretending to be the CEO to trick an employee into transferring funds. This is an example of which attack type?

Man-in-the-middle
SQL injection
Social engineering / phishing (Correct answer)
Denial of Service

Correct answer: Social engineering / phishing

Phishing/social engineering attacks manipulate people into divulging information or performing actions by impersonating trusted entities.

Question 2: In the context of the ISO 27000 series, what is the primary responsibility of a designated 'risk owner'?

To conduct the annual internal audit of the Information Security Management System (ISMS).
To develop and write the organization's information security policies and procedures.
To have the accountability and authority to manage an identified risk. (Correct answer)
To perform the day-to-day technical administration of a specific information asset.

Correct answer: To have the accountability and authority to manage an identified risk.

According to ISO 27000 vocabulary, the 'risk owner' is the person or entity with the accountability and authority to manage a risk. This includes approving risk treatment plans and accepting residual risks. While they work with others, their key role is one of authority and accountability for the risk itself, which is distinct from the day-to-day management of an asset (asset owner).

Question 3: Which ISO 27000 family standard specifically focuses on guidelines for information security controls?

ISO 27000
ISO 27005
ISO 27001
ISO 27002 (Correct answer)

Correct answer: ISO 27002

ISO 27002 provides a reference set of information security controls and implementation guidance for organizations.

Question 4: A company is defining its overall information security policies, assigning security roles and responsibilities, and establishing its process for information classification. These foundational activities fall under which Annex A control theme?

People controls
Technological controls
Organizational controls (Correct answer)
Physical controls

Correct answer: Organizational controls

The 'Organizational controls' theme (A.5) establishes the governance framework for the ISMS. This includes creating policies (A.5.1), defining roles and responsibilities (A.5.2), and classifying information (A.5.12), which are all high-level, process-oriented controls.

Question 5: A company decides to purchase cyber insurance to handle a specific risk. Which risk treatment option does this represent?

Risk retention
Risk reduction
Risk transfer (Correct answer)
Risk avoidance

Correct answer: Risk transfer

Purchasing insurance transfers the financial consequences of a risk to another party (the insurer).

Question 6: What distinguishes an information security policy from an information security procedure?

A policy states management's intent and direction; a procedure describes specific steps to follow (Correct answer)
They are identical documents
Procedures are for management; policies are for technical staff
A policy provides technical steps; a procedure states intent

Correct answer: A policy states management's intent and direction; a procedure describes specific steps to follow

A policy communicates high-level management intent and principles, whereas a procedure details the specific steps employees must follow to comply with the policy.

Question 7: Which of the following is the PRIMARY purpose of an Information Security Management System (ISMS) as described in the ISO 27000 series?

To satisfy the requirements of a single, specific data protection regulation.
To implement the latest cybersecurity technology and software.
To guarantee that the organization will never experience a security breach.
To establish, implement, maintain, and continually improve information security within an organization. (Correct answer)

Correct answer: To establish, implement, maintain, and continually improve information security within an organization.

The ISO 27000 family of standards describes an ISMS as a systematic approach for establishing, implementing, operating, monitoring, reviewing, maintaining, and improving an organization's information security to achieve business objectives. It is a continuous, process-based approach, not just a one-time implementation of technology.

Question 8: Which of the following BEST describes 'information security risk treatment' according to ISO 27005?

Selecting and implementing measures to modify risk (Correct answer)
Communicating risk results to senior management
Identifying and listing all risks in the organization's environment
Evaluating risks against pre-defined acceptance criteria

Correct answer: Selecting and implementing measures to modify risk

Risk treatment is the process of selecting and implementing options to address risk, which may include modifying, avoiding, sharing, or retaining it.

Question 9: A risk analysis team is evaluating information security risks using descriptive terms such as 'High', 'Medium', and 'Low' for both likelihood and impact. This method of analysis is best described as:

Asset-based
Quantitative
Qualitative (Correct answer)
Event-based

Correct answer: Qualitative

Qualitative risk analysis uses subjective, descriptive scales (e.g., High, Medium, Low) to assess the likelihood and impact of risks. This approach is contrasted with quantitative analysis, which assigns specific numerical or monetary values to risks.

Question 10: During a risk evaluation phase, an organization compares the estimated levels of risk against criteria they have predefined. What is the primary goal of this activity?

To identify all possible threats and vulnerabilities to the organization's assets.
To select the most cost-effective security controls from Annex A.
To make decisions on which risks require treatment. (Correct answer)
To assign ownership for each of the identified risks.

Correct answer: To make decisions on which risks require treatment.

The risk evaluation step involves comparing the results of the risk analysis (the calculated risk levels) with the organization's predefined risk acceptance criteria. This comparison is crucial for deciding which risks are unacceptably high and therefore need to be treated, and which risks are low enough to be accepted without further action.

Question 11: Which of the following is TRUE about the relationship between assets, threats, and vulnerabilities in risk assessment?

Risk arises when a threat exploits a vulnerability affecting an asset (Correct answer)
A vulnerability alone constitutes a risk
A threat can only target one type of asset
Assets must be quantified in monetary terms for risk assessment

Correct answer: Risk arises when a threat exploits a vulnerability affecting an asset

Risk materializes when a threat agent exploits a vulnerability to cause harm to an asset, combining all three elements.

Question 12: Which of the following controls is a primary example of a Technological Control as defined in the ISO 27001:2022 Annex A themes?

Securing offices, rooms, and facilities
Management of privileged access rights (Correct answer)
Information security policy and procedures
Information security awareness, education, and training

Correct answer: Management of privileged access rights

The management of privileged access rights is a Technological Control. This theme includes controls implemented through technology, such as access control systems, encryption, network security, and secure coding. The other options fall under People (training), Physical (securing offices), and Organizational (policies) controls respectively.

Question 13: What is the main goal of the risk communication and consultation process in ISO 27005?

To formally accept all residual risks identified during assessment
To ensure stakeholders are informed and their input is considered throughout risk management (Correct answer)
To document risk owners for audit purposes
To transfer risk information to an external insurance provider

Correct answer: To ensure stakeholders are informed and their input is considered throughout risk management

Risk communication and consultation ensures that stakeholders share information and contribute to risk decisions throughout the process.

Question 14: Which activity BEST demonstrates the principle of 'continual improvement' within an ISMS as required by ISO 27001 Clause 10?

Implementing the exact same set of controls every year without change.
Certifying the ISMS once and not conducting any further performance evaluations.
Using the results from internal audits and management reviews to make targeted changes to the ISMS. (Correct answer)
Performing a one-time risk assessment during the initial ISMS setup.

Correct answer: Using the results from internal audits and management reviews to make targeted changes to the ISMS.

Continual improvement (Clause 10.1) is a core principle of ISO 27001, requiring the organization to continually improve the suitability, adequacy, and effectiveness of the ISMS. This is achieved by taking action based on the results of performance evaluation activities like internal audits (Clause 9.2) and management reviews (Clause 9.3), creating a cycle of improvement.

Question 15: In the context of ISO 27001, what is the PRIMARY purpose of a Statement of Applicability (SoA)?

To define the risk appetite of the organization
To document which Annex A controls are applicable and their justification (Correct answer)
To list all identified risks and their owners
To record residual risk acceptance decisions

Correct answer: To document which Annex A controls are applicable and their justification

The SoA documents which of the ISO 27001 Annex A controls have been selected or excluded and the reasons why.

Question 16: An organization reviews its ISMS scope annually and expands it to include a newly acquired subsidiary. What does this reflect?

An unnecessary increase in certification costs
A failure to define scope correctly at the outset
Continual improvement and adaptation of the ISMS to changing organizational context (Correct answer)
A violation of ISO 27001 scope stability requirements

Correct answer: Continual improvement and adaptation of the ISMS to changing organizational context

Updating the ISMS scope in response to organizational changes reflects the continual improvement principle central to ISO 27001.

Question 17: "The only emphasis of ISO 27001:2013 is the protection of personal information."

True
False (Correct answer)

Correct answer: False

This statement is false. While the protection of personal information is often a critical aspect addressed by an ISMS, ISO 27001's scope is much broader. It aims to protect all types of information and information assets from a wide range of threats, ensuring confidentiality, integrity, and availability for the entire organization, not just personal data.

Question 18: Which ISO/IEC 27000 series standard specifically defines the PDCA model's application to information security management?

ISO/IEC 27003
ISO/IEC 27002
ISO/IEC 27005
ISO/IEC 27001 (Correct answer)

Correct answer: ISO/IEC 27001

ISO/IEC 27001 is the ISMS requirements standard that formally applies the PDCA model to information security management.

Question 19: What is the difference between a threat and a threat agent in ISO 27000?

They are synonymous terms used interchangeably
A threat agent is a technical vulnerability; a threat is a human actor
A threat is always accidental; a threat agent is always deliberate
A threat is the potential for harm; a threat agent is the entity that exploits a vulnerability (Correct answer)

Correct answer: A threat is the potential for harm; a threat agent is the entity that exploits a vulnerability

A threat is the potential cause of an incident, while the threat agent is the specific individual, group, or force that carries out the threat.

Question 20: Which ISO standard provides the vocabulary and definitions used across the ISO 27000 family?

ISO 27000 (Correct answer)
ISO 27005
ISO 27002
ISO 27001

Correct answer: ISO 27000

ISO 27000 is the overview and vocabulary standard that provides common terms and definitions for the entire ISO 27000 family.

Question 21: According to the vocabulary defined in the ISO 27000 family, which statement BEST describes the relationship between a threat, a vulnerability, and an asset?

A threat exploits an asset to cause harm to a vulnerability.
A vulnerability is a potential cause of an incident that may result in harm to an asset.
A threat is a potential cause of an incident that may harm an asset by exploiting a vulnerability. (Correct answer)
An asset is a weakness that can be exploited by a threat.

Correct answer: A threat is a potential cause of an incident that may harm an asset by exploiting a vulnerability.

The standard risk model is that a threat (a potential cause of an incident) can exploit a vulnerability (a weakness) to cause harm to an asset (something of value). For a risk to exist, all three elements are typically present. Option B correctly places these three components in their logical relationship.

Question 22: Which ISO 27000 series standard provides requirements for establishing an Information Security Management System (ISMS)?

ISO 27005
ISO 27002
ISO 27017
ISO 27001 (Correct answer)

Correct answer: ISO 27001

ISO 27001 is the standard that specifies the requirements for establishing, implementing, maintaining, and continually improving an ISMS.

Question 23: Which of the following is a key characteristic of a good information security risk assessment process?

It is conducted solely by external consultants to avoid bias
It produces results that are repeatable and comparable over time (Correct answer)
It is performed once during ISMS implementation and never repeated
It focuses exclusively on technical vulnerabilities in IT systems

Correct answer: It produces results that are repeatable and comparable over time

A good risk assessment process should be repeatable and produce consistent, comparable results that can be tracked over time.

Question 24: Which factor is considered when estimating the likelihood of a threat in an ISO 27005 risk assessment?

The replacement cost of hardware assets
The motivation and capability of potential threat agents (Correct answer)
The number of employees in the IT department
The organization's annual revenue

Correct answer: The motivation and capability of potential threat agents

Likelihood estimation considers threat agent attributes such as motivation, capability, and the opportunity presented by existing vulnerabilities.

Question 25: In the context of ISO 27001, what is meant by 'continual improvement' of the ISMS?

Ongoing activities to enhance ISMS performance over time (Correct answer)
Replacing legacy systems on a fixed schedule
Achieving ISO certification every three years
Adding new security tools every year

Correct answer: Ongoing activities to enhance ISMS performance over time

Continual improvement means systematically enhancing ISMS effectiveness based on audit results, incidents, and performance metrics.

Question 26: What must an organization determine when deciding what to monitor and measure in its ISMS?

The budget allocated to each information security control
Which employees are responsible for each control
Which external auditors will review the measurements
What methods will be used and when results will be analyzed (Correct answer)

Correct answer: What methods will be used and when results will be analyzed

ISO 27001 Clause 9.1 requires organizations to determine what to monitor and measure, the methods to use, and when results will be analyzed and evaluated.

Question 27: An organization discovers during an internal audit that its incident response procedures are not being followed. Which PDCA phase does this discovery belong to?

Do
Plan
Check (Correct answer)
Act

Correct answer: Check

Internal audits and reviews are Check phase activities that measure whether implemented controls are effective.

Question 28: Which PDCA phase includes defining the ISMS scope?

Check
Act
Plan (Correct answer)
Do

Correct answer: Plan

Defining the ISMS scope is a foundational planning activity that determines what the ISMS will cover.

Question 29: How does the PDCA cycle relate to the concept of 'risk-based thinking' in ISO/IEC 27001?

Risk-based thinking is an Act phase activity only
Risk-based thinking is only applied during the Check phase
Risk assessment and treatment in the Plan phase drive all subsequent PDCA phases (Correct answer)
PDCA replaces the need for risk-based thinking

Correct answer: Risk assessment and treatment in the Plan phase drive all subsequent PDCA phases

Risk assessment in the Plan phase determines what controls to implement (Do), monitor (Check), and improve (Act).

Question 30: An organization is updating its information security policies to include guidelines for the use of cloud services, threat intelligence, and ICT readiness for business continuity. According to the ISO 27001:2022 Annex A structure, these controls primarily fall under which theme?

People Controls
Organizational Controls (Correct answer)
Physical Controls
Technological Controls

Correct answer: Organizational Controls

The ISO 27001:2022 Annex A is structured into four themes. Controls like defining policies, threat intelligence, and ensuring readiness for business continuity are foundational, governance-level activities. These are categorized under Organizational Controls, which deal with the overarching framework and management of information security.

Question 31: An organization's ISMS scope excludes cloud services used to process customer data. What is the PRIMARY concern with this approach?

The cloud provider will lose its own certification
Customer data may be processed outside any ISMS controls (Correct answer)
Cloud exclusions automatically violate ISO 27001
The organization must migrate all data to on-premise systems

Correct answer: Customer data may be processed outside any ISMS controls

Excluding cloud services that process customer data means significant information assets are outside the ISMS controls, exposing the organization to unmanaged security risks.

Question 32: Which ISO/IEC 27005 process step involves determining the consequences of a risk materializing?

Risk treatment
Risk estimation (Correct answer)
Risk evaluation
Risk identification

Correct answer: Risk estimation

Risk estimation involves determining the likelihood and consequences (impact) of a risk to produce a level of risk.

Question 33: A weakness in a system's security procedures, design, implementation, or internal controls that could be exploited by a threat source is known as a:

Consequence
Threat
Risk
Vulnerability (Correct answer)

Correct answer: Vulnerability

ISO/IEC 27000 defines a 'vulnerability' as a weakness of an asset or control that can be exploited by one or more threats. A threat is a potential cause of an incident, and a risk is the effect of uncertainty on objectives, often expressed as a combination of the consequences of an event and the associated likelihood of occurrence.

Question 34: What is the main output of the risk treatment process within an operational ISMS?

A final list of all organizational assets
An updated organizational chart showing security roles
A risk treatment plan and updated Statement of Applicability (Correct answer)
A report submitted directly to regulators

Correct answer: A risk treatment plan and updated Statement of Applicability

Risk treatment produces a risk treatment plan detailing selected controls and updates the SoA to reflect implementation decisions.

Question 35: What does 'availability' mean as a core property of information security?

Information cannot be modified by unauthorized parties
Information is accessible only to authorized users at all times (Correct answer)
Information is kept secret from all external parties
Information is encrypted at rest and in transit

Correct answer: Information is accessible only to authorized users at all times

Availability means that information and systems are accessible to authorized users whenever needed.

Question 36: A financial services firm's ISMS scope statement reads: 'All systems supporting retail banking operations at the New York headquarters.' What type of boundary does this represent?

Vendor and supply chain boundary
Temporal and personnel boundary
Functional and physical boundary (Correct answer)
Network topology boundary only

Correct answer: Functional and physical boundary

The scope statement defines both a functional boundary (retail banking operations) and a physical boundary (New York headquarters).

Question 37: Which of the following is an example of a physical information security control?

Password complexity policies
Locked server room doors (Correct answer)
Firewall rule sets
Encryption algorithms

Correct answer: Locked server room doors

Physical controls protect assets through tangible means such as locked doors, security cameras, and access badges.

Question 38: An auditor is reviewing a company's 'clear desk and clear screen' policy and the measures taken to secure equipment located off-premises. These specific controls are key components of which Annex A theme?

Organizational controls
Physical controls (Correct answer)
People controls
Technological controls

Correct answer: Physical controls

Both the 'clear desk and clear screen' policy (A.7.7) and the security of assets off-premises (A.7.9) are classified under 'Physical controls' (A.7). These controls aim to reduce the risk of unauthorized access, loss, and damage to information and equipment in the physical environment, whether on-site or remote.

Question 39: A key aspect of operating an ISMS involves periodically re-evaluating risks. According to Clause 8.2 (Information security risk assessment), when must an organization perform subsequent risk assessments?

Exclusively during the 'Check' phase of the PDCA cycle.
At planned intervals or when significant changes are proposed or occur. (Correct answer)
Only when a major security incident occurs.
Annually on the anniversary of the initial assessment.

Correct answer: At planned intervals or when significant changes are proposed or occur.

Clause 8.2 specifies that the organization shall perform information security risk assessments at planned intervals or when significant changes are proposed or occur. This ensures the risk assessment remains current and relevant to the organization's evolving context and threat landscape, making it an ongoing operational activity.

Question 40: The 2022 revision of ISO/IEC 27001 restructured the Annex A controls into four high-level themes. Which of the following correctly lists these four themes?

Policies, Procedures, Technical Implementations, and Physical Safeguards
Organizational, People, Physical, and Technological (Correct answer)
Access Control, Cryptography, Operations Security, and Communications Security
Risk Assessment, Asset Management, Incident Management, and Business Continuity

Correct answer: Organizational, People, Physical, and Technological

The ISO/IEC 27001:2022 standard updated Annex A by consolidating the previous 14 domains into four distinct themes: A.5 Organizational controls, A.6 People controls, A.7 Physical controls, and A.8 Technological controls. This structure simplifies the categorization of the 93 controls.

Question 41: According to ISO/IEC 27001, which three elements must an organization consider when determining the boundaries and applicability of its Information Security Management System (ISMS)?

The organization's asset inventory, the IT department's structure, and the annual security budget.
Risk assessment results, business continuity plans, and physical security perimeters.
The number of employees, the geographical locations of offices, and the primary products or services offered.
External and internal issues, requirements of interested parties, and interfaces and dependencies with other organizations. (Correct answer)

Correct answer: External and internal issues, requirements of interested parties, and interfaces and dependencies with other organizations.

ISO/IEC 27001, Clause 4.3, explicitly states that when determining the scope of the ISMS, an organization must consider: a) the external and internal issues (from Clause 4.1), b) the requirements of interested parties (from Clause 4.2), and c) the interfaces and dependencies between its activities and those of other organizations.

Question 42: Which of the following best ensures that an ISMS scope remains valid over time?

Asking the certification body to approve all scope changes in advance
Locking the scope document and preventing changes after certification
Regularly reviewing scope as part of management reviews and internal audits (Correct answer)
Limiting scope reviews to once every three years

Correct answer: Regularly reviewing scope as part of management reviews and internal audits

Regular management reviews and internal audits provide formal mechanisms to reassess and update the ISMS scope as the organization and its context change.

Question 43: What does "fulfillment of a requirement" mean in ISO 27001:2013?

Conformity (Correct answer)
None of the above
Compliance

Correct answer: Conformity

In the context of ISO standards, 'conformity' specifically refers to the fulfillment of a requirement. When an organization's Information Security Management System (ISMS) meets all the requirements outlined in ISO 27001, it is considered to be in conformity with the standard. This term is precise for demonstrating adherence to the standard's clauses.

Question 44: Which term describes the potential for a threat to exploit a vulnerability?

Risk (Correct answer)
Impact
Residual risk
Control

Correct answer: Risk

Risk is the combination of the likelihood that a threat will exploit a vulnerability and the resulting impact on the organization.

Question 45: A threat agent has high motivation but lacks the technical skills to exploit a complex vulnerability. How does this affect the likelihood score?

Likelihood becomes critical because intent alone constitutes a risk
Likelihood increases because motivation is the only factor
Likelihood is unaffected because only vulnerability severity matters
Likelihood decreases because capability is insufficient to exploit the vulnerability (Correct answer)

Correct answer: Likelihood decreases because capability is insufficient to exploit the vulnerability

Likelihood depends on both motivation and capability; without sufficient technical capability, the threat agent is unlikely to successfully exploit the vulnerability.

Question 46: Which ISO/IEC 27001 clause activity most directly aligns with the 'Do' phase of PDCA?

Clause 6: Planning
Clause 8: Operation (Correct answer)
Clause 10: Improvement
Clause 9: Performance Evaluation

Correct answer: Clause 8: Operation

Clause 8 (Operation) covers implementing and controlling processes, which corresponds to the Do phase.

Question 47: What is 'segregation of duties' as referenced in ISO 27001 controls?

Separating development and production environments only
Dividing tasks so no single person controls all aspects of a critical process (Correct answer)
Assigning all security tasks to one dedicated team
Encrypting duties across multiple servers

Correct answer: Dividing tasks so no single person controls all aspects of a critical process

Segregation of duties reduces the risk of fraud or error by ensuring no single individual can complete a sensitive process without oversight from another.

Question 48: During ISMS implementation, who holds ultimate accountability for accepting residual risk?

The external auditor
The IT security analyst
Top management or designated risk owners (Correct answer)
The third-party consultant

Correct answer: Top management or designated risk owners

Risk owners, approved by top management, are accountable for accepting residual risk after treatment options have been applied.

Question 49: Which of the following scenarios best represents a 'Plan' phase failure in an ISO 27001 ISMS?

Controls are implemented incorrectly by staff
Corrective actions are not tracked to closure
Audit logs are not reviewed regularly
Risk assessments do not consider all relevant assets (Correct answer)

Correct answer: Risk assessments do not consider all relevant assets

Incomplete risk assessment during the Plan phase leads to gaps in the risk treatment plan and unmitigated risks.

Question 50: In which PDCA phase would management review of the ISMS typically occur?

Plan
Do
Act
Check (Correct answer)

Correct answer: Check

Management review is a monitoring activity in the Check phase that evaluates the ISMS performance and suitability.

Question 51: Which statement about the relationship between threats and vulnerabilities is correct?

A threat is always internal; a vulnerability is always external
A vulnerability causes harm without a threat present
Threats and vulnerabilities are interchangeable terms in ISO 27000
A threat exploits a vulnerability to cause harm to an asset (Correct answer)

Correct answer: A threat exploits a vulnerability to cause harm to an asset

A threat acts as the agent that exploits an existing vulnerability to cause harm to an information asset.

Question 52: A cybersecurity team is deploying a new firewall, configuring access control lists, and conducting mandatory security awareness training for all employees. These activities are characteristic of which phase of the PDCA cycle?

Plan
Do (Correct answer)
Check
Act

Correct answer: Do

The 'Do' phase is where the plans established in the 'Plan' phase are put into action. This includes implementing the risk treatment plan and deploying the selected security controls, such as new hardware, software configurations, and training programs.

Question 53: Which of the following now poses a threat to several organizations?

Unauthorized access
All of the above (Correct answer)
Loss of information
Fraud

Correct answer: All of the above

Information security threats are diverse and constantly evolving, impacting organizations in various ways. Fraud, unauthorized access, and loss of information are all significant and common risks that can compromise the confidentiality, integrity, and availability of an organization's assets. Therefore, all these options represent valid threats that organizations must address through robust information security measures.

Question 54: What is an escalation procedure in the context of incident management?

A defined path for elevating an incident to higher management or specialists when needed (Correct answer)
A method for encrypting and securing incident reports from unauthorized access
A process for increasing security control stringency after a major incident
A technique used to prevent low-level incidents from escalating into major ones

Correct answer: A defined path for elevating an incident to higher management or specialists when needed

Escalation procedures define when and how an incident should be elevated to higher authority or specialized teams when it exceeds the current responder's ability or authority to handle it.

Question 55: According to ISO/IEC 27001, who has the ultimate responsibility for deciding how to treat identified information security risks?

The IT security team
The certification body
The external auditor
Risk owners (Correct answer)

Correct answer: Risk owners

Risk owners are accountable for approving risk treatment plans and accepting residual risks within their area of responsibility.

Question 56: Which phase of incident management involves removing the threat and restoring systems to normal operation?

Identification
Eradication and Recovery (Correct answer)
Containment
Lessons Learned

Correct answer: Eradication and Recovery

The eradication and recovery phase involves removing malware, closing vulnerabilities, and restoring affected systems to their normal, trusted operational state.

Question 57: What is the purpose of triage in information security incident management?

To notify law enforcement about confirmed security breaches
To restore affected systems to normal operation as quickly as possible
To prioritize incidents based on their severity and potential business impact (Correct answer)
To assign financial costs to each reported incident

Correct answer: To prioritize incidents based on their severity and potential business impact

Triage involves assessing and prioritizing incidents so that the most critical ones receive immediate attention first, based on severity and potential business impact.

Question 58: A software firm includes its development team in the ISMS scope but excludes the sales team. Customer contracts handled by sales contain sensitive data. What should the firm do?

Transfer all customer data handling to the development team
Keep the scope unchanged since sales is a non-technical function
Instruct sales staff to follow informal security guidelines
Extend the scope to include sales or implement compensating controls for customer data handled by sales (Correct answer)

Correct answer: Extend the scope to include sales or implement compensating controls for customer data handled by sales

When sensitive data is processed outside the ISMS scope, the organization must either expand the scope or ensure equivalent controls exist for that data.

Question 59: Why is it mandatory for the scope of the ISMS to be maintained as documented information?

To serve as the main input for the annual financial audit.
To fulfill a legal requirement mandated by international trade agreements.
To allow the marketing team to use it in promotional materials.
To provide a clear basis for the information security risk assessment and to inform stakeholders. (Correct answer)

Correct answer: To provide a clear basis for the information security risk assessment and to inform stakeholders.

ISO/IEC 27001 Clause 4.3 explicitly states, 'The scope shall be available as documented information.' This documentation is crucial because it defines the boundaries for all subsequent ISMS activities, including risk assessment (Clause 6.1.2) and the creation of the Statement of Applicability. It also serves to clearly communicate the coverage of the ISMS to all stakeholders, including auditors, customers, and employees.

Question 60: In the PDCA model, what is the primary risk of skipping the 'Check' phase?

The ISMS will become too expensive to operate
New employees will not receive security training
The risk treatment plan cannot be updated
Ineffective controls may go undetected, leaving the organization exposed (Correct answer)

Correct answer: Ineffective controls may go undetected, leaving the organization exposed

Without Check phase activities, failed or ineffective controls are not identified, undermining the entire ISMS.

Question 61: An organization's internal audit of its ISMS was conducted by the IT systems administrators, who audited the server configurations and network access controls they had personally implemented. Which fundamental principle of ISO 27001's internal audit requirements has been violated?

The requirement for competence of the auditors.
The requirement to audit at planned intervals.
The need to maintain documented information of audit results.
The need for objectivity and impartiality in the audit process. (Correct answer)

Correct answer: The need for objectivity and impartiality in the audit process.

ISO 27001 Clause 9.2 requires that auditors be selected to ensure objectivity and impartiality of the audit process. Auditors cannot audit their own work, as it creates a conflict of interest and undermines the integrity and objectivity of the audit findings.

ISO 27000 Foundation Certification Exam

The ISO 27000 Foundation Certification Exam exam validates essential knowledge and skills required for certification or licensure in this field.

Questions

60 min

Time Limit

65%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds