ISO_IEC-27001.2022

ISO 27001:2022

Certification Notes

PECB Guides

Official PECB Courseware

Practice Tests

Whiteboard Notes

Whiteboard Notes Whiteboard Notes Whiteboard Notes Whiteboard Notes Whiteboard Notes Whiteboard Notes

Question Bank - Foundation Exam - MCQ Type

Question 1

Anything that has value to the organization is known as?

Correct Answer: b) Asset

Explanation: Anything that has value to the organization is considered an asset. Information is also considered an asset that drives business in today’s networked environment.

Assets can include:

Utilities themselves do not carry information, but they support devices that do. Information can be static (e.g., stored on a hard disk) or being transmitted (e.g., via email). Whatever form the information takes, it must always be protected.

Access to assets should be authorized and restricted based on business and security requirements. An inventory of assets, including their owners, should be developed and maintained. The term ‘owner’ refers to the individual or entity with management responsibility for controlling the asset’s security, use, development, and maintenance. The owner approves the risk level and the controls selected for protecting that asset.

Question 2

Property of being accessible and usable on demand by an authorized entity:

Correct Answer: d) Availability

Explanation: The property of being accessible and usable on demand by an authorized entity is availability.

Availability is one of the three types of protection for information security, the others being confidentiality and integrity.

These three aspects are vital for business survival, as is the identification of information security requirements.

Question 3

Set of interrelated or interacting elements of an organization to establish policies and objectives and processes to achieve those objectives:

Correct Answer: c) Management System (References/1)

Explanation: Based on the standard:

Therefore, the most accurate answer is c) Management System, as this term most closely describes the set of interrelated or interacting elements designed to establish policies, objectives, and processes to achieve those objectives within an organisation. The other options represent important components of the ISMS, but not the entire framework of interacting elements themselves.

Question 4

Non-fulfilment of a requirement is:

Correct Answer: a) Non-conformity

Explanation: Non-fulfilment of a requirement is a non-conformity.

The standard describes nonconformity and its management within the context of an Information Security Management System (ISMS) as below:

Other terms in the question mentioned:

Question 5

Overall process of risk identification, risk analysis and risk evaluation:

Correct Answer: c) Risk Assessment

Explanation: The overall process of risk identification, risk analysis, and risk evaluation is known as risk assessment.

Here’s a breakdown of the terms in the question, according to standard:

Therefore, while risk analysis is a component of risk assessment, and risk management encompasses all of the processes, risk assessment is the correct answer to this question.

The standard also note the following points about risk assessment and its related processes:

In addition, the standard identifies a variety of standards and guides related to risk assessment including ISO 31000, IEC 31010, and ISO/IEC 27005.

Question 6

Person or group of people who directs and controls an organization at the highest level?

Correct Answer: c) Top Management

Explanation: The person or group of people who directs and controls an organisation at the highest level is top management. Top management has a crucial role in the implementation and maintenance of an Information Security Management System (ISMS).

Here’s a breakdown of the responsibilities and aspects of top management, as described in the sources:

While the term ‘Management Representative’ is used in the sources, it is noted that this is not a requirement of the ISO/IEC 27001:2022 standard, and that the responsibility for managing the ISMS can be assigned to an individual, shared by several individuals or assigned to a team. The sources also indicate that the individual or team managing the ISMS should have sufficient access to top management to keep them informed of the status and performance of the ISMS.

Therefore, the correct answer is c. Top Management.

Question 7

Processes and procedures for ensuring continued information security operations?

Correct Answer: a) Information Security Continuity (References/2)

Explanation: The question asks about processes and procedures for ensuring continued information security operations. Considering the options provided:

While all four options are related to ensuring operational resilience, they have different roles. Options b, c, and d contribute to the broader goal of maintaining business operations during disruptions but not necessarily information security operations alone. Option a, Information Security Continuity, directly addresses maintaining security during adverse conditions, therefore, it is the most correct answer on its own.

Therefore, the most correct answer is a) Information Security Continuity.

Question 8

Which of the following is an evidence of commitment and leadership in regard to the ISMS?

Correct Answer: a) Promoting continual improvement

Explanation: Of the options you’ve provided, promoting continual improvement is the most direct evidence of commitment and leadership in regard to the Information Security Management System (ISMS).

Here’s why, based on the standard:

While the other options are also important for an effective ISMS, they don’t directly demonstrate leadership commitment in the same way:

Therefore, while all of these are important activities within an ISMS, promoting continual improvement is the one that specifically demonstrates leadership and commitment.

Question 9

What does the management review include?

Correct Answer: a) Fulfilment of Information Security Objectives

Explanation: Based on the standard, the most appropriate single answer to your question about what a management review includes is: Fulfilment of Information Security Objectives.

Here’s why:

Here is more detail about what a management review includes:

Therefore, while detection of non-conformities and implementing corrective actions are part of the ISMS processes and are considered during a management review, the fulfilment of information security objectives is the most direct and central element of the management review according to the sources. The discipline of non-complying employees is not specifically mentioned as a direct component of a management review.

Question 10

An information security risk is?

Correct Answer: c) The potential of a loss or damage when a threat exploits a vulnerability

Explanation: Based on the standard, an information security risk is best defined as the potential for loss or damage when a threat exploits a vulnerability.

Here’s a more detailed breakdown:

Let’s consider the options you provided, based on the sources:

Therefore, the most accurate definition of an information security risk is: the potential of a loss or damage when a threat exploits a vulnerability. This captures the combined effect of a threat exploiting a vulnerability and leading to a potential negative consequence, which is at the core of understanding information security risk.

Question 11

Top management must assign and communicate?

Correct Answer: a) Responsibilities and Roles for Information Security

Explanation: Based on the standard, top management must assign and communicate responsibilities and roles for information security.

Here’s a breakdown of why this is the most accurate answer, with references to the sources:

Let’s examine the other options you provided and why they are not the primary responsibility that top management must assign and communicate, according to the sources:

In summary, while all of the other options are related to the operation of an ISMS, the most direct and fundamental requirement for top management is to assign and communicate responsibilities and roles for information security. This sets the foundation for the rest of the ISMS processes.

Question 12

Which of the following is part of the Risk Treatment Plan?

Correct Answer: d) All of the Above

Explanation: Based on the provided sources, the most accurate answer is all of the above are part of a risk treatment plan.

Here’s why, with a detailed breakdown:

Therefore, all of the options you listed — which controls to implement, what are the resources to implement the security controls, and what are the deadlines of the security controls implementation — are indeed essential components of a comprehensive risk treatment plan as defined in the sources.

Question 13

Which of the following is a statement of a top level information security policy?

Correct Answer: a) Ensure that information is accessible only to those authorised to have access to it

Explanation: Based on the provided sources and our conversation history, the statement that best represents a top-level information security policy is: ensure that information is accessible only to those authorised to have access to it.

Here’s a breakdown of why this is the most accurate answer, with references to the sources:

Let’s examine the other options you provided and why they are more likely to be specific controls or topic-specific policies, rather than top-level information security policies:

In summary, a top-level information security policy is meant to be a guiding principle that sets the tone for all information security activities within the organisation, as well as being appropriate for the purpose of the organisation. While the other options are relevant to information security, they are specific controls, rules or practices, rather than high-level strategic statements. Therefore, the statement “ensure that information is accessible only to those authorised to have access to it” best represents a top-level information security policy.

Question 14

Complete the Sentence: An information security incident is a security ____ that have a significant probability of compromising information security.

Correct Answer: d) Event

Explanation: Based on the standard, the most accurate completion of the sentence is: An information security incident is a security event that has a significant probability of compromising information security.

Here’s why, with a detailed explanation drawing from the sources:

Therefore, based on the definitions and distinctions made in the sources, the most accurate completion of the sentence is: An information security incident is a security event that has a significant probability of compromising information security.

Question 15

Which of the following has non-conformities as an output?

Correct Answer: c) Internal Audit

Explanation: Based on the standard, the most accurate answer is internal audit has nonconformities as an output.

Here’s a detailed breakdown:

Therefore, while risk assessment and risk identification are crucial for an ISMS, it is the internal audit process that has nonconformities as a direct output.

Question 16

Which of the following is part of risk assessment?

Correct Answer: a) Assign an owner to the risk

Explanation: The question asks which of the provided options is part of risk assessment. According to the sources, the risk assessment process involves several key steps.

Looking at the provided options:

Therefore, the most correct answer is a) Assign an owner to the risk as this is a component of the risk assessment process.

Question 17

Which responsibility and authority the top management is required to assign?

Correct Answer: b) Ensuring the ISMS conforms to ISO 27001 requirements

Explanation: The question asks what responsibility and authority top management is required to assign. According to the standard, top management has specific obligations regarding the Information Security Management System (ISMS).

Here’s an analysis of the options:

Therefore, the most correct answer is b) Ensuring the ISMS conforms to ISO 27001 requirements. Top management must delegate the responsibility and authority to someone to ensure that the ISMS is compliant with the standard. This includes making sure all requirements of the standard are met.

Question 18

Which of the following is part of ISMS Scope?

Correct Answer: c) Locations of Information

Explanation: The question asks what is included in the scope of an Information Security Management System (ISMS). According to the standard, the scope of an ISMS defines its boundaries and applicability within an organisation. It is important to consider several factors when defining the scope of an ISMS.

Analysing the given options:

Therefore, the most correct answer is c) Locations of Information because it directly relates to defining the boundaries of where the ISMS applies. While business processes are also important, the question asks for “part of the ISMS scope,” making locations a more direct and definitive answer. The scope must also consider the interfaces and dependencies between the organisation’s activities and those of other parties.

Question 19

Information Security objectives should be?

Correct Answer: d) Measurable

Explanation: The question asks what characteristic information security objectives should have. According to the standard, information security objectives are a crucial part of an Information Security Management System (ISMS) and must adhere to specific criteria.

Analysing the provided options:

Therefore, the most correct answer is d) Measurable. Information security objectives must be measurable so that progress towards them can be tracked, and their fulfilment can be verified.

Question 20

Which of the following is not required to be documented according to ISO 27001?

Correct Answer: c) Resources required by the ISMS

Explanation: The question asks which of the listed items is not required to be documented according to ISO 27001. The standard specifies several requirements for documented information within an Information Security Management System (ISMS).

Here’s an analysis of each option:

Therefore, the correct answer is c) Resources required by the ISMS. Although the provision of resources is a requirement, the standard does not specifically mandate that the resources themselves be documented. The other options are all explicitly required to be documented according to ISO 27001.

Question 21

Which of the following is required by ISO/IEC 27001 in regard to employees?

Correct Answer: b) Keeping records as evidence of competence of all employees

Explanation: The question asks what ISO/IEC 27001 requires in regard to employees. According to the standard, ISO/IEC 27001 places several requirements on organisations regarding their personnel, focusing on competence, awareness, and responsibilities.

Here’s an analysis of each option:

Therefore, the most correct answer is b) Keeping records as evidence of competence of all employees. ISO/IEC 27001 mandates the organisation to maintain documented evidence of employee competence, ensuring that those who impact information security are adequately skilled and knowledgeable.

Question 22

Which of the following is an output of the ISMS internal audit?

Correct Answer: a) Observations

Explanation: The correct option is a) Observations.

Here’s why:

Therefore, while risk and vulnerability information might be considered during the audit process, observations are a key output of the ISMS internal audit.

Question 23

Complete the sentence: Helping employees understand their role and the impact they have on the ISMS is a form of ? which is part of the support that top management should demonstrate to the ISMS

Correct Answer: c) Awareness

Explanation: The correct answer is c) Awareness.

Here’s why:

Therefore, helping employees understand their role and the impact they have on the ISMS is most accurately described as a form of awareness, which is a key part of the support that top management should demonstrate to the ISMS.

Question 24

What action about a non-conformity is required?

Correct Answer: c) Corrective Action

Explanation: The correct answer is c) Corrective Action.

When a nonconformity occurs, the organisation must react and take action to control and correct it, and deal with the consequences. The organisation must then evaluate the need for action to eliminate the causes of the nonconformity, in order that it does not recur or occur elsewhere.

This involves:

Corrective actions should be appropriate to the effects of the nonconformities encountered. Documented information must be available as evidence of the nature of the nonconformities and any subsequent actions taken, as well as the results of any corrective action.

The organisation should also confirm that the nonconformity and corrective action includes taking action to correct the situation, examine the cause and determine if other occurrences exist or potentially exist elsewhere so that action can be taken to prevent recurrence. The organisation’s response should cover evaluation of the action taken to confirm that the intended result was achieved, and evaluation of the ISMS to determine if changes are warranted to avoid future occurrences of similar nonconformities.

Question 25

Which of the following should appear in the risk treatment plan?

Correct Answer: b) Who is responsible to implement the controls

Explanation: The correct answer is b) Who is responsible to implement the controls.

A risk treatment plan should include:

Additionally, the risk treatment plan should include or link to:

While the residual risk is related to the risk treatment process, it is not explicitly included in the risk treatment plan itself. The residual risk is the remaining risk after treatment actions are applied and needs to be evaluated similarly to the initial process to see if it falls into the acceptable category. If it does not, new treatment should be decided.

Question 26

What does restricting alteration of information to only authorised persons refer to?

Correct Answer: d) Integrity

Explanation: Restricting alteration of information to only authorised persons refers to integrity.

Question 27

Regarding resources, ISO/ IEC 27001 requires organisations to ensure?

Correct Answer: a) They are available to operate the ISMS without interruption

Explanation: The correct answer is a) They are available to operate the ISMS without interruption.

While the other options might be helpful for a well-resourced ISMS, they are not explicitly required by the ISO/IEC 27001 standard.

Here’s why:

Therefore, while options b), c) and d) could contribute to a robust ISMS, option a) best reflects the core requirement of the standard regarding resource availability for operating the ISMS.

Question 28

What is NOT a risk treatment option

Correct Answer: d) Ignore

Explanation: The correct answer is d) Ignore.

According to the sources, risk treatment options include:

The sources do not include “ignore” as a valid risk treatment option.

Question 29

ISO 27001 requires that companies continually improve

Correct Answer: b) The effectiveness of the Information Security Management System

Explanation: The correct answer is b) The effectiveness of the Information Security Management System.

ISO/IEC 27001 requires that organisations continually improve the suitability, adequacy, and effectiveness of the ISMS. This means that the organisation should be working to enhance the ISMS, making it better at achieving its objectives, and ensuring that it remains appropriate for the organisation’s needs.

The standard does not explicitly require organisations to continually improve:

While these other options may be related to or impacted by the ISMS, they are not the specific focus of the continual improvement requirement in ISO/IEC 27001.

The focus of continual improvement within ISO 27001 is on enhancing the ISMS itself through activities such as:

Question 30

What is true about an Information Security Management System?

Correct Answer: d) All of the above

Explanation: The correct answer is d) All of the above.

Here’s why:

Therefore, all of the options are true about an Information Security Management System. It is a structured framework comprised of policies, procedures and practices that follows a systematic approach based on a risk management process.

Question 31

Employees working within the ISMS should be aware of?

Correct Answer: c) The implications of not conforming to the ISMS requirements

Explanation: The correct answer is c) The implications of not conforming to the ISMS requirements.

According to the sources, personnel working under the organisation’s control should be aware of:

The sources do not state that employees working within the ISMS should be specifically aware of:

While these may be relevant to some employees or to the overall management of the ISMS, they are not explicitly mentioned as awareness requirements in the standard.

Therefore, the most appropriate answer, based on the information in the sources, is that employees working within the ISMS should be aware of the implications of not conforming to the ISMS requirements.

Question 32

The policies for information security need to be reviewed at planned intervals, or if significant changes occur, to ensure their continuing?

Correct Answer: d) All of the above

Explanation: The correct answer is d) All of the above.

According to the sources, the policies for information security should be reviewed at planned intervals or when significant changes occur to ensure their continuing:

The review process should take into account changes to:

The review should also include assessing opportunities for improvement.

Therefore, the policies for information security need to be reviewed to ensure that they remain suitable, adequate, and effective, making “All of the above” the correct option.

Question 33

What is a vulnerability?

Correct Answer: b) A weakness of an asset or a resource that can be exploited by one or more threats

Explanation: The correct answer is b) A weakness of an asset or a resource that can be exploited by one or more threats.

Here’s why:

Therefore, a vulnerability is a weakness that a threat can exploit, which can then result in risk or impact to the organisation.

Let’s look at why the other options are not correct:

In summary, a vulnerability is a specific weakness that a threat can exploit, leading to a potential risk with a certain impact and likelihood.

Question 34

Information must be classified in terms of all the following except one

Correct Answer: d) Complexity

Explanation: The correct answer is d) Complexity.

According to the sources, information needs to be classified taking into consideration:

The sources do not mention complexity as a factor for classifying information.

Therefore, while legal requirements, value, and criticality are all valid criteria for information classification, complexity is not. Hence, complexity is the exception.

Question 35

The organisation should provide metrics for the ISMS performance regarding?

Correct Answer: d) The compliance with the standard

Explanation: The correct answer is d) The compliance with the standard.

Here’s why:

The sources also provide examples of what can be monitored and measured which include:

While the number of risks, IT security employees turnover, and increase of threats are all potentially relevant to the ISMS, they are not explicitly stated as the primary focus for metrics of ISMS performance.

Therefore, the most suitable option is that the organisation should provide metrics for the ISMS performance regarding compliance with the standard, as well as considering whether the ISMS is meeting its objectives and addressing identified risks.

Question 36

What is NOT true about ISO/IEC 27001 Internal Audit?

Correct Answer: d) Audit should be performed by internal auditors

Explanation: The correct answer is d) Audit should be performed by internal auditors.

Here’s why:

Therefore, while the other options are true of an ISO/IEC 27001 internal audit, it is not a requirement that the audit is performed by internal auditors, as external personnel may also be used.

Question 37

What is a control of compliance in the Annex A of the ISO 27001 standard?

Correct Answer: d) All of the above

Explanation: The correct answer is d) All of the above.

Here’s why:

Therefore, all of the options - Privacy & Protection of Personally Identifiable Information, Intellectual Property Rights, and Protection of Records - are controls related to compliance found within Annex A of the ISO 27001 standard.

Question 38

When determining the scope of the ISMS which of the following need to be considered?

Correct Answer: d) External and Internal Issues

Explanation: The correct answer is d) External and Internal Issues.

Here’s why:

Let’s look at why the other options are not correct:

In summary, external and internal issues, the requirements of interested parties, and interfaces and dependencies are the factors that should be directly considered when determining the scope of the ISMS.

Question 39

What does the organisation need to consider when determining the ISMS scope?

Correct Answer: d) All of the above.

Explanation: The correct answer is d) All of the above.

Here’s why:

Therefore, the ISMS scope should be determined based on:

By considering all of these factors, the organisation can establish a scope that is appropriate for its context and that effectively addresses its information security risks.

Question 40

What is the purpose of ISO 27001?

Correct Answer: a) Providing the requirements of the ISMS development and operation

Explanation: The correct answer is a) Providing the requirements of the ISMS development and operation.

Here’s why:

Let’s look at why the other options are not correct:

In summary, while other standards in the ISO 27000 family provide guidance, ISO 27001 itself is focused on setting the requirements for establishing and operating the ISMS.

Question 41

Which of the following is an external issue that can affect the scope of ISMS?

Correct Answer: b) Government Regulations

Explanation: The correct answer is b) Government Regulations.

Here’s why:

Let’s look at why the other options are not correct:

Therefore, of the options provided, government regulations is the only one that is an external issue that can affect the scope of an ISMS.

Question 42

Which item is part of the ISMS Policy?

Correct Answer: c) The Commitment of Top Management to improve the ISMS

Explanation: The correct answer is (c) The Commitment of Top Management to improve the ISMS.

An information security policy should include a commitment to the continual improvement of the information security management system.

Other elements of an information security policy include:

While password management and access control are important aspects of an ISMS, they are typically addressed in topic-specific policies, which support the overarching information security policy. Risk management is a key process within the ISMS, but is not specifically part of the ISMS policy itself.

Question 43

A Risk Owner is the one who?

Correct Answer: c) Is accountable and has the authority to manage the Risk

Explanation: The correct answer is (c) Is accountable and has the authority to manage the Risk.

A risk owner is the individual or entity that has the accountability and authority to manage an identified risk.

The sources also indicate:

While a risk owner plays a key role in the risk management process, they do not necessarily identify the risk or perform the mitigation themselves. The risk owner is responsible for ensuring the risk is appropriately managed.

Question 44

Interested Parties who can affect the scope of the ISMS are?

Correct Answer: d) All the above

Explanation: The correct answer is (d) All the above.

Interested parties, also referred to as stakeholders, are defined as a person or organization that can affect, be affected by, or perceive themselves to be affected by a decision or activity.

The sources indicate that interested parties can include:

Therefore, the scope of an ISMS needs to take into account all of the above mentioned parties. The requirements of these interested parties can include legal and regulatory requirements and contractual obligations.

Question 45

An antivirus software protects information from being corrupted by malware. It is ensuring the?

Correct Answer: c) Integrity of Information

Explanation: The correct answer is (c) Integrity of Information.

Here’s why:

Question 46

Which of the following is required to be included in the Statement of Applicability?

Correct Answer: b) Justification for excluding any of the Annex A controls

Explanation: The correct answer is (b) Justification for excluding any of the Annex A controls.

The Statement of Applicability (SoA) is a key document within an Information Security Management System (ISMS) that maps how an organisation implements its ISMS. According to the sources, the SoA should include:

The SoA is derived from the risk register and the risk treatment plan. The controls included in the SoA can be from Annex A of ISO/IEC 27001, other standards, or custom controls designed by the organisation.

While the information security policy is a critical element of the ISMS, it is not part of the SoA. Identified risks are part of the risk register, which informs the SoA, but not part of the SoA itself. The availability of IT security staff is a resource consideration for implementing the ISMS, but not a component of the SoA.

Question 46

The documentation of internal and external issues is?

Correct Answer: a) Not Required

Explanation: The correct answer is (a) Not Required.

According to the sources, there is no explicit requirement for documented information concerning external and internal issues. While the organisation must determine these issues, there is no requirement to formally document them.

However, it is important to note:

Therefore, while an organisation must understand its external and internal issues, it is not required to document them specifically. However, the impact of these issues should be evident in other areas of the ISMS.

Question 47

What is Residual Risk?

Correct Answer: b) Remaining Risk after Treatment

Explanation: The correct answer is (b) Remaining Risk after Treatment.

Here’s why:

Let’s consider the other options:

Therefore, residual risk is specifically the risk that remains after risk treatment is applied, and the organisation must evaluate if that residual risk is acceptable.

Question 48

Internal & External Issues are reviewed and monitored?

Correct Answer: d) Regularly

Explanation: The correct answer is (d) Regularly.

While the sources do not specify a fixed time period like six months or yearly for reviewing internal and external issues, they do indicate that these issues should be reviewed and monitored regularly and whenever significant changes occur.

Here’s why:

While the sources do not prescribe the exact frequency, the review of internal and external issues should occur on an ongoing basis in response to changes and as part of the management review process. Therefore, ‘regularly’ is the most suitable answer.

Question 49

Owners of a Company who may require a return on investment of the ISMS are an example of?

Correct Answer: a) Interested Parties

Explanation: The correct answer is (a) Interested Parties.

Here’s why:

Therefore, while owners of a company may also be part of the top management structure, and may also be business partners, their position as stakeholders who expect a return on investment of the ISMS falls within the scope of interested parties as defined by the sources.

Question 50

The policies for information security control in Annex A of ISO/IEC 27001 must be reviewed in order to?

Correct Answer: c) Check the effectiveness of information security policies and identify any improvements

Explanation: The correct answer is (c) Check the effectiveness of information security policies and identify any improvements.

Here’s why:

Let’s consider why the other options are incorrect:

Therefore, the review of information security policies is a broader process, and aims to check their effectiveness and identify opportunities for improvement, encompassing the factors mentioned above, and also to reflect changes in the environment and business operations.

Question 51

What audit outcome should be used to identify an opportunity for improvement?

Correct Answer: a) Observation

Explanation: The correct answer is (a) Observation.

Here’s why, based on the sources:

Therefore, while nonconformities and risk levels are important aspects of an ISMS, it is the observation that is specifically used to identify an opportunity for improvement.

Question 52

Which benefit is gained from operating an Information Security Management System?

Correct Answer: d) All of the above

Explanation: The correct answer is (d) All of the above.

Here’s why, based on the sources:

Therefore, an ISMS provides a centrally managed framework that protects the entire organisation and helps to reduce the number of information security incidents.

Question 53

Who is responsible of conducting the review of the ISMS to ensure its continuing suitability, adequacy and effectiveness?

Correct Answer: b) Top Management

Explanation: The correct answer is (b) Top Management.

Here’s why, based on the sources:

Therefore, while other roles such as the Internal Auditor, ISMS Manager or CISO are involved in the ISMS, it is the top management that has the responsibility of conducting the review to ensure its continuing suitability, adequacy, and effectiveness.

Question 54

Information Security Awareness, Education and Training controls belong to which category in Annex A of ISO/IEC 27001?

Correct Answer: b) People

Explanation: The correct answer is (b) People.

Here’s why, based on the sources:

Therefore, as the sources classify Information Security Awareness, Education and Training under the People controls category, the answer is (b) People.

Question 55

Which steps should the collection of evidence (Control A.5.28) follow after the occurrence of an information security incident?

Correct Answer: c) Identify, collect and preserve

Explanation: The correct answer is (c) Identify, collect and preserve.

Here’s why, based on the sources:

In summary, the correct order of steps for the collection of evidence, according to the sources, is to first identify the relevant evidence, then collect it, and finally preserve it to maintain its integrity.

Question 56

The scope of the ISMS should be validated by?

Correct Answer: c) Top Management

Explanation: The correct answer is (c) Top Management.

Here’s why, based on the sources:

Therefore, while the Internal Auditor, ISMS Manager, and ISMS Team are involved in the ISMS, it is Top Management who is ultimately responsible for validating the scope of the ISMS to ensure it is suitable, adequate, and effective for the organisation.

Question 57

Reassessment of risk should be performed?

Correct Answer: a) Regularly and when significant changes occur

Explanation: The correct answer is (a) Regularly and when significant changes occur.

Here’s why, based on the sources:

While the other options might introduce changes in an organisation, they do not necessarily trigger a reassessment of risk by themselves, as such, they are not the best answer:

Therefore, based on the sources, the reassessment of risk should be performed (a) regularly and when significant changes occur.

Question 58

As per ISO/IEC 27001 requirements, documenting the results of the risk treatment plan is?

Correct Answer: b) Mandatory

Explanation: According to the standard, documenting the results of the risk treatment plan is mandatory. Specifically, the sources state that “the organization shall retain documented information of the results of the information security risk treatment”.

Additionally, the sources indicate that the risk treatment plan itself, which includes the necessary controls, how the controls modify the risk, risk owners, selected options, and more must also be documented. Furthermore, it is required that the organisation retain documented information about the information security risk treatment process.

Question 59

Reporting information security incidents is the responsibility of?

Correct Answer: d) All Employees

Explanation: According to the sources, all employees are responsible for reporting information security incidents. The sources emphasize the importance of establishing clear communication channels for reporting security events, and that all personnel should be trained to report any security weakness or potential incidents.

While the sources indicate that other roles, such as the IT security staff, internal auditors and ISMS managers, have responsibilities related to incident management, they do not exclude the responsibility of all employees in reporting.

Therefore, while specific teams or individuals may be responsible for managing and responding to incidents, the initial responsibility of reporting information security incidents lies with all employees.

Question 60

Which of the following is a valid option for risk treatment according to ISO/IEC 27001?

Correct Answer: b) Buying an insurance to share the risk

Explanation: According to the sources, a valid option for risk treatment is buying insurance to share the risk. The sources explicitly state that risk treatment can involve “sharing the risk with another party or parties (including contracts and risk financing)”. This includes methods such as insurance policies.

Other risk treatment options, as described in the sources, include:

The sources indicate that evaluating and reassessing the risk are aspects of the risk management process, but they are not risk treatment options. Also, ignoring the risk is not a valid risk treatment option.

Question 61

When is an organization required to perform a security risk assessment?

Correct Answer: a) When a significant change occurs

Explanation: According to the sources, an organisation is required to perform a security risk assessment when a significant change occurs. The sources specify that information security risk assessments should be carried out at planned intervals or when significant changes are proposed or occur. This is further supported by the following points:

While the sources also mention that risk assessments should be done at planned intervals, they specifically highlight that a risk assessment is required when significant changes are proposed or occur.

The sources do not indicate that a risk assessment is explicitly required every year, after an internal audit, or after a management review, although these activities may trigger a risk assessment if they reveal significant changes or issues.

Question 62

Changes to software packages should be controlled and restricted in order to?

Correct Answer: d) Minimise introducing security vulnerabilities

Explanation: According to the sources, changes to software packages should be controlled and restricted in order to minimise introducing security vulnerabilities. The sources emphasise that changes to software, especially vendor-supplied software, should be limited to only necessary changes and strictly controlled. The following points from the sources support this:

The sources do not suggest that the primary reason for controlling changes to software packages is to minimise functional bugs, increase business value, or maintain the ISMS budget within limits, although these could be secondary benefits. The main focus is on preventing the introduction of security vulnerabilities through uncontrolled changes.

Question 63

A nonconformity occurs when?

Correct Answer: b) A certain requirement is not complied with

Explanation: According to the sources, a nonconformity occurs when a certain requirement is not complied with. The sources define a nonconformity as the non-fulfilment of a requirement. This definition aligns with the general understanding of a nonconformity within the context of ISO standards.

Here’s further clarification based on the sources:

While an information security incident, an internal audit observation, or issues with documentation can lead to the identification of a nonconformity, they are not the definition of nonconformity. A nonconformity is specifically a failure to meet a requirement.

Question 64

Which of the following is an activity of the plan phase?

Correct Answer: a) Risk Identification

Explanation: According to the sources, risk identification is an activity of the plan phase. The sources describe the planning phase as including activities such as:

The sources also describe the following phases, which are distinct from the planning phase:

Question 65

Which of the following statements are true about Information security continuity? Information security continuity should be regularly?

Correct Answer: a) 1, 3, 4

Explanation: According to the sources, the correct answer is a) 1, 3, 4. The sources state that information security continuity should be regularly verified, reviewed, and evaluated. Here’s a breakdown of why these options are correct and why ‘controlled’ is not:

Therefore, the correct answer is a) 1, 3, 4, as information security continuity should be regularly verified, reviewed and evaluated to ensure its effectiveness.

Question 66

Which of the following statements are true about Information security continuity? Information security continuity should be regularly?

Correct Answer: a) 1, 3, 4

Explanation: According to the sources, the correct answer is a) 1, 3, 4. The sources state that information security continuity should be regularly verified, reviewed, and evaluated. Here’s a breakdown of why these options are correct and why ‘controlled’ is not:

Therefore, the correct answer is a) 1, 3, 4, as information security continuity should be regularly verified, reviewed and evaluated to ensure its effectiveness.

Question 67

An information security control is?

Correct Answer: a) A measure that modified the risk

Explanation: According to the sources, an information security control is a measure that modifies the risk. The sources provide the following details:

The sources make it clear that controls are implemented to change the risk, not just to correct nonconformities, or analyse root causes. Therefore, the correct answer is a) A measure that modifies the risk.

Question 68

Which is an example of risk transfer?

Correct Answer: d) 1 and 2

Explanation: The correct answer is d) 1 and 2.

Here’s why:

Therefore, only options 1 and 2 represent actual risk transfer, and option 3 is a risk mitigation technique.

Question 69

Which PDCA Cycle Phase does improvement clause of ISO/ IEC 27001 belong to?

Correct Answer: d) Act

Explanation: The correct answer is d) Act.

The sources indicate that the ISO/IEC 27001 standard does not explicitly emphasize the Plan-Do-Check-Act (PDCA) cycle. However, the standard does require continual improvement of the information security management system (ISMS). This concept of continual improvement aligns with the “Act” phase of the PDCA cycle.

The sources also specify that the organization can adopt any process improvement model, including the PDCA model, to improve its ISMS. In this model, the “Act” phase focuses on taking actions based on the results of the “Check” phase, which includes making changes to improve the ISMS.

The improvement clause of ISO/IEC 27001 is about making changes to the ISMS to improve its suitability, adequacy and effectiveness. Specifically, the organisation should take actions based on audit results, analyse monitored events, and ensure that corrective actions are taken effectively and on time, all of which fall within the “Act” phase. The sources also specify that the improvement process includes taking actions to address risks and opportunities, establishing objectives, upgrading operational controls, and analyzing and evaluating performance.

Therefore, while ISO/IEC 27001 doesn’t explicitly mandate the PDCA cycle, the actions taken for improvement correspond to the “Act” phase of the PDCA model.

Question 70

Which of the following is not required to be documented by ISO/IEC 27001 standard?

Correct Answer: b) Internal Issues

Explanation: The correct answer is b) Internal Issues.

Here’s why:

Therefore, while internal issues are a key consideration in establishing and maintaining an ISMS, they are not explicitly required to be documented, whereas the scope of the ISMS, the information security policy and objectives and the SoA are explicitly required to be documented.

Question 71

Which of the following information must be included in the Statement of Applicability?

Correct Answer: d) All of the Above

Explanation: The correct answer is d) All of the Above.

Here’s why:

Therefore, the SoA must include the justification for inclusion of security controls, whether those controls are implemented or not, and the reasons for their implementation, making ‘All of the Above’ the correct answer. The SoA also needs to include a justification for the exclusion of any Annex A controls that are deemed not applicable.

Question 72

Which of the following are examples of Information Security Policy?

Correct Answer: d) 1, 2, 5

Explanation: The correct answer is d) 1, 2, 5.

Here’s why:

Therefore, options 1, 2 and 5 are examples of statements that would be included in an information security policy, whereas options 3 and 4 are examples of specific security controls and would not be part of the policy.

Question 73

Who should approve the risk treatment plan?

Correct Answer: b) Risk Owners

Explanation: The correct answer is b) Risk Owners.

Here’s why:

Therefore, the responsibility for approving the risk treatment plan and accepting the residual risk lies with the risk owners.

Question 74

What should be included in the supplier agreements regarding information security?

Correct Answer: d) All of the Above

Explanation: The correct answer is d) All of the Above.

Here’s why:

Additionally, supplier agreements should include:

Therefore, supplier agreements need to include all of the above elements related to information security, making ‘All of the Above’ the correct answer.

Question 75

Which clause of ISO/IEC 27001 is part of the PLAN phase of the PDCA cycle?

Correct Answer: b) Context

Explanation: The correct answer is b) Context.

Here’s why:

Therefore, the clause that is part of the PLAN phase is Context.

Question 76

Which of the following statement about information security objectives is correct? Information Security Objectives should be: 1. Established and communicated to all employees 2. Aligned with security policy 3. Reviewed every six months 4. Documented 5. Measurable

Correct Answer: b) 1, 2, 4, 5

Explanation: The correct answer is b) 1, 2, 4, 5.

Here’s why:

Therefore, based on the requirements of ISO/IEC 27001, information security objectives should be established and communicated to all employees, aligned with the security policy, documented, and measurable, but there is no requirement to review them every six months, so the correct answer is b) 1, 2, 4, 5.

Question 77

Interested Parties relevant to the ISMS need to be identified in order to?

Correct Answer: b) Understand the context of the organisation

Explanation: The correct answer is b) Understand the context of the organisation.

Here’s why:

Therefore, the identification of interested parties is primarily done to understand the context of the organisation, which will then influence the scope and objectives of the ISMS, and inform the risk management processes.

Question 78

Which of the following should be mandatorily documented as per ISO/IEC 27001:2022 standards requirements?

Correct Answer: b) Scope of the information security management system

Explanation: The correct answer is b) Scope of the information security management system.

According to the sources, the following are requirements for documented information:

While the sources mention the importance of interested parties analysis and communication, they do not explicitly state that these need to be documented. Interested parties are identified as part of establishing the scope of the ISMS. The communication needs are to be identified, implemented, and maintained effectively. Therefore, while these are important aspects of an ISMS, they are not specifically mandated to be documented, as the scope of the ISMS is.

The sources also note that the extent of documented information can differ from one organisation to another due to factors such as the size of the organisation and complexity of processes.

Question 79

When you are auditing a transport company’s ISMS, which of the following ‘documented information’ is/are a requirement in ISO/IEC 27001:2022?

Correct Answer: d) All of the above

Explanation: The correct answer is d) All of the above.

According to the sources, the following are requirements for documented information within an Information Security Management System (ISMS) according to ISO/IEC 27001:2022:

Therefore, when auditing a transport company’s ISMS, auditors should expect to find documented information relating to the information security risk assessment process, the information security objectives, and evidence of competence. All of the above are mandatory requirements of the standard.

Question 80

Which of the following documented information is/are are required to be maintained in an ISMS that is compliant to ISO/IEC 27001:2022?

Correct Answer: c) Information security policy and the information security objectives

Explanation: The correct answer is c) Information security policy and the information security objectives.

According to the sources, the following documented information is required to be maintained in an Information Security Management System (ISMS) that is compliant with ISO/IEC 27001:2022:

While the sources do discuss the importance of training, they do not require a list of training providers. Similarly, while the sources discuss the importance of threat intelligence, there is no requirement to document a forward schedule of natural threats. The core documented requirements for ISO 27001 include items such as the ISMS scope, the information security policy, objectives, risk assessments, and treatment plans, as well as monitoring, audit, and review results.

Therefore, only option c), information security policy and the information security objectives, is explicitly required to be documented in an ISMS compliant with ISO/IEC 27001:2022 from the options provided.

Question 81

Which of the following is not a requirement when creating and updating documented information for ISMS?

Correct Answer: d) Information Rights of the document

Explanation: The correct answer is d) Information Rights of the document.

According to the sources, when creating and updating documented information for an Information Security Management System (ISMS), the following are requirements:

The sources do not specify “Information Rights of the document” as a requirement for creating and updating documented information. While access controls are necessary to protect the documents, “Information Rights of the document” as a specific concept isn’t mentioned as a requirement for creating and updating documentation.

Therefore, of the options given, Information Rights of the document is not a requirement when creating and updating documented information for an ISMS.

Question 82

In order to select appropriate information security risk treatment, we refer to:

Correct Answer: a) Risk assessment results

Explanation: The correct answer is a) Risk assessment results.

Here’s why, based on the sources:

Let’s look at why the other options are not the primary basis for selecting risk treatments:

Therefore, the most appropriate answer is a) Risk assessment results because this is the direct input that informs the selection of risk treatment options.

Question 83

Which of the following are true with respect to Risk Treatment?

Correct Answer: d) All of the above

Explanation: The correct answer is d) All of the above.

Here’s why, based on the sources and our conversation history:

Therefore, all three statements are true with respect to risk treatment according to the ISO/IEC 27001 standard.

In short, the risk treatment process relies on the risk assessment, includes identifying necessary controls, and requires risk owner approval.

Question 84

When selecting the controls, which of the following is/are correct about Controls listed in Annexure A?

Correct Answer: d) All of the above

Explanation: The correct answer is d) All of the above.

Here’s why, based on the sources:

Therefore, all the statements are correct regarding the controls listed in Annex A of ISO/IEC 27001:2022. Annex A is a starting point, but not all controls are necessary for every situation, and the list is not exhaustive. It is essential to consider the controls in Annex A to ensure no necessary controls are missed, while also recognizing that further controls may be required.

Question 85

Which of the following is true for preparing Statement of Applicability?

Correct Answer: b) All controls that are necessary to implement the information security risk treatment should be included

Explanation: The correct answer is b) All controls that are necessary to implement the information security risk treatment should be included.

Here’s why, based on the sources:

Let’s look at why the other options are incorrect:

In summary, the SoA must include all the controls that are deemed necessary to implement the risk treatment plan. It should also provide justification for both inclusions and exclusions and state whether each control is implemented or not.

Question 86

Which of the following shall be used in order to continually improve the effectiveness of the ISMS?

Correct Answer: d) All of the above

Explanation: The correct answer is d. All of the above. Here’s why, based on the sources:

All three elements – monitoring and analysis of metrics, internal audits, and management reviews – work together to drive the continual improvement of the ISMS. They help identify weaknesses, nonconformities, and opportunities for enhancement, thus ensuring the ISMS is constantly evolving and improving.

Question 87

Which of the following option is correct when monitoring, measurement, analysis and evaluation

Correct Answer: d) All of the above

Explanation: The correct answer is d) All of the above. Here’s a breakdown of why each component is essential for effective monitoring, measurement, analysis, and evaluation within an ISMS, according to the sources:

In summary, all the options listed are crucial for a robust monitoring, measurement, analysis, and evaluation process in an ISMS. Therefore, the correct answer is d) All of the above. These activities are fundamental to understanding the effectiveness of the ISMS and driving continual improvement.

Question 88

Greenhouse Hospitals has recently implemented an Information Security Management System based on ISO/IEC 27001:2022. Which of the following are relevant for discussion during the management review?

Correct Answer: a) Changes in external and internal issues that are relevant to the ISMS

Explanation: The correct answer is a) Changes in external and internal issues that are relevant to the ISMS. Here’s why, based on the sources:

In summary, while other types of information can be valuable to an organisation, the ISO/IEC 27001:2022 standard requires the management review to specifically include changes in external and internal issues that are relevant to the ISMS. Therefore, option a) is the correct answer.

Question 89

Which of the following evidence demonstrates that internal ISMS audits process is complete?

Correct Answer: b) Follow up report is available on verification and closure of ISMS audit findings

Explanation: The correct answer is b) Follow up report is available on verification and closure of ISMS audit findings. Here’s why, based on the sources:

In summary, while all the options relate to the internal audit process, only option b) provides evidence that the entire audit process, including the crucial follow-up on corrective actions, has been completed. The other options represent preparatory or administrative steps but do not confirm the completion of the audit cycle. Therefore, option b is the correct answer.

Question Bank - Foundation Exam - Case Study Type

Case Study - I

‘Good Security’ is one of the few software companies to have implemented ISMS based on ISO/IEC 27001:2022. They have invited you to seek clarification on the requirements of the standard. Indicate whether the following statements are True or False with respect to their ISMS and also indicate the relevant clause numbers:

Case Study - II

Good Health Hospital has recently implemented ISMS based on ISO/IEC 27001:2022. Indicate whether the following statements about Risk Assessment of the Hospital are True or False in relation to the requirements of ISMS based on ISO/IEC 27001:2022 :

Question Bank - Foundation Exam - Gap Assessments

You have been provided with various control measures that the companies have taken for the identified risks for their products and services. Please state whether it is ‘Conforming’ {C} or ‘Non-Conforming’ {NC}:

Notes on Important Topics for Foundation Exam

Shared below are some bulleted notes to help you prepare for the ISO 27001 Foundation exam, based on the topics marked by the Instructor as important for the Foundation exam:

I have tried to incorporate the most relevant information from the sources related to the topics you’ve provided. Remember to cross-reference these points with the actual text in the sources for a more complete understanding.

Question Bank - Lead Implementer Exam - MCQ Type

Question 1

How does ISO/IEC 27000 define an ‘asset’ in relation to ISO/IEC 27001?

Correct Answer: a) Anything that is of value to the organisation

Explanation: According to the sources, ISO/IEC 27000 defines an asset as anything that has value to the organisation. Therefore, the correct answer is a) Anything that is of value to the organisation.

The sources also provide additional context regarding assets:

Question 2

Annex A of ISO/IEC 27001 contains best practices for managing and securing information assets within an organisation. Which of the below are ISO 27001 control sets, as outlined in Annex A?

Correct Answer: d) All of the above

Explanation: The correct answer is d) All of the above.

Question 3

The PDCA cycle is a 4-step model for carrying out change that is constantly repeated for continuous improvement. But what are those 4 steps?

Correct Answer: b) Plan, Do, Check, Act

Explanation: The correct answer is b) Plan, Do, Check, Act.

The Plan-Do-Check-Act (PDCA) model is a process improvement model that can be followed to improve an Information Security Management System (ISMS). The PDCA cycle is a four-step model for carrying out change, which is constantly repeated for continuous improvement. The four steps of the PDCA cycle are:

Other models can be used to improve the ISMS process, including CMMi - IDEAL, Six Sigma - DMAIC, GMP, GLP, and the Malcolm Baldridge and EFQM Models of excellence. Although there is no emphasis on the PDCA cycle in the ISO/IEC 27001 standard, the management system is required to be established, implemented, maintained, and continually improved.

Question 4

Which of the below are current threats to many organisations?

Correct Answer: d) All of the above

Explanation: The correct answer is d) All of the above.

Many sources in the document identify various threats that organisations face, which include:

These are only some of the threats to organisations, and it’s important for an organisation to identify risks, evaluate them, and take steps to mitigate them as part of their Information Security Management System (ISMS).

Question 5

What is the purpose of ISO/IEC 27000 in relation to ISO/IEC 27001?

Correct Answer: c) Provides terms and definitions commonly used in ISO/IEC 27001

Explanation: The correct answer is c) Provides terms and definitions commonly used in ISO/IEC 27001.

Therefore, while other standards in the ISO/IEC 27000 family cover risk management, network security, and control implementation, ISO/IEC 27000’s specific purpose is to define the terms used within the family, and in particular within ISO/IEC 27001.

Question 6

When should organisations perform an information security risk assessments?

Correct Answer: d) At planned intervals or when significant changes are proposed to occur

Explanation: The correct answer is d) At planned intervals or when significant changes are proposed to occur.

Organisations should perform information security risk assessments:

The risk assessment process should be defined and applied. It should also be implemented and integrated into the organisation’s operations. A risk assessment should identify the information security risks associated with the ISMS. The risk assessment should consist of risk identification, risk analysis, and risk evaluation processes.

The results of information security risk assessments must be documented. The documented information about the risk assessment process should contain:

The risk assessment process should be repeatable, so the same person, when carrying out a risk assessment over a period of time, will arrive at similar conclusions. The process should also be comparable, so that if several people use the same method, they will arrive at similar conclusions about the information security risk level.

Question 7

In line with clause 9.3, who shall review the organisation’s information security management system at planned intervals to ensure its continuing suitability, adequacy and effectiveness?

Correct Answer: d) Top Management

Explanation: The correct answer is d) Top Management.

According to clause 9.3 of ISO/IEC 27001:2022:

While other roles, such as internal auditors and quality managers, play crucial roles in the ISMS, the ultimate responsibility for reviewing the ISMS for its suitability, adequacy, and effectiveness lies with top management.

Question 8

Clause 5.2 focuses on the requirements related to the information security policy within an organisation. Who or what does clause 5.2 say shall establish an information security policy?

Correct Answer: b) Top Management

Explanation: Clause 5.2 of ISO/IEC 27001:2022 states that top management shall establish an information security policy. Therefore, the correct answer is b) Top Management.

Question 9

Of what should those doing work under the organisation’s control be aware?

Correct Answer: d) All of the above

Explanation: The correct answer is d) All of the above.

Those doing work under the organisation’s control should be aware of:

Question 10

Within ISO standards, what does “shall” indicate?

Correct Answer: d) Requirement

Explanation: The correct answer is d) Requirement.

Within the ISO/IEC 27001 standard, the term “shall” indicates a requirement. Specifically, the standard states that “the organization shall establish, implement, maintain and continually improve an information security management system”. This demonstrates the use of “shall” to denote mandatory actions or conditions for an organization seeking to conform to the standard.

The document also notes that “excluding any of the requirements specified in Clauses 4 to 10 is not acceptable when an organization claims conformity to this International Standard”, further reinforcing that “shall” statements are requirements that must be met for compliance.

Question 11

How does ISO/IEC 27000 define an ‘information system’?

Correct Answer: b) A set of applications, services, information technology assets or other information-handling components

Explanation: The sources do not contain a direct definition of an ‘information system’ from ISO/IEC 27000. However, the sources do contain information that is relevant to this concept. Based on the provided material, here’s an analysis of how an information system can be understood within the context of ISO/IEC standards:

While the provided sources do not explicitly define “information system” using a specific definition from ISO/IEC 27000, the most appropriate response based on the concepts discussed would be b) A set of applications, services, information technology assets or other information-handling components. This is because:

Although not a definition, it is clear from the sources that an “information system” involves a combination of hardware, software, services, and processes that handle information, as well as the measures implemented to protect them.

The other options are less accurate:

Question 12

Within ISO/IEC 27001, which clause relates to leadership and the role of top management in the establishment, implementation, maintenance, and continual improvement of the ISMS?

Correct Answer: b) 5

Explanation: The correct answer is b) 5.

Clause 5 of ISO/IEC 27001 specifically addresses leadership and the role of top management in the establishment, implementation, maintenance, and continual improvement of the Information Security Management System (ISMS).

Here’s why clause 5 is the correct answer, drawing from the sources:

The other clauses are related to different aspects of the ISMS:

Question 13

Clause 9.3 is titled ‘Management Review’, and is part of the broader section 9, which focuses on performance evaluation. In line with clause 9.3, how regularly shall top management review the organisation’s ISMS?

Correct Answer: d) At planned intervals

Explanation: The correct answer is d) At planned intervals.

Clause 9.3.1 states that top management must review the organisation’s information security management system at planned intervals to ensure its continuing suitability, adequacy and effectiveness. While for small organizations, one Management Review Meeting (MRM) per year may suffice, the standard requires reviews to occur at planned intervals, implying a flexible schedule determined by the organization’s specific context and needs.

Question 14

An SoA is important because it aligns the information security management efforts with the organisation’s business objectives, facilitates risk management, supports compliance, and enables effective communication and resource allocation. It is a central document in the ISO 27001 framework, contributing to the establishment of a robust and continually improving information security management system. But what does SoA stand for?

Correct Answer: a) Statement of Applicability

Explanation: The correct answer is a) Statement of Applicability. The sources define the Statement of Applicability (SoA) as a documented statement describing the control objectives and controls that are relevant and applicable to the organization’s ISMS. It is a central component of ISO/IEC 27001. The SoA includes all the necessary controls, their justification for inclusion, whether they are implemented or not, and justification for excluding any controls from Annex A of ISO/IEC 27001. The SoA should be revised as the activities of the organisation change.

Question 15

OpenTech, headquartered in San Francisco, specializes in information and communication technology (ICT) solutions. Its clientele primarily includes data communication enterprises and network operators. The company’s core objective is to enable its clients to transition smoothly into multi-service providers, aligning their operations with the complex demands of the digital landscape. Recently, Tim, the internal auditor of OpenTech, conducted an internal audit that uncovered nonconformities related to their monitoring procedures and system vulnerabilities. In response to these nonconformities, OpenTech decided to employ a comprehensive problem-solving approach to address the issues systematically. This method encompasses a team-oriented approach, aiming to identify, correct, and eliminate the root causes of the issues. The approach involves several steps: First, establish a group of experts with deep knowledge of processes and controls. Next, break down the nonconformity into measurable components and implement interim containment measures. Then, identify potential root causes and select and verify permanent corrective actions. Finally, put those actions into practice, validate them, take steps to prevent recurrence, and recognize and acknowledge the team’s efforts. Following the analysis of the root causes of the nonconformities, OpenTech’s ISMS project manager, Julia, developed a list of potential actions to address the identified nonconformities. Julia carefully evaluated the list to ensure that each action would effectively eliminate the root cause of the respective nonconformity. While assessing potential corrective actions, Julia identified one issue as significant and assessed a high likelihood of its recurrence. Consequently, she chose to implement temporary corrective actions. Julia then combined all the nonconformities into a single action plan and sought approval from top management. The submitted action plan was written as follows: “A new version of the access control policy will be established and new restrictions will be created to ensure that network access is effectively managed and monitored by the Information and Communication Technology (ICT) Department.” However, Julia’s submitted action plan was not approved by top management. The reason cited was that a general action plan meant to address all nonconformities was deemed unacceptable. Consequently, Julia revised the action plan and submitted separate ones for approval. Unfortunately, Julia did not adhere to the organization’s specified deadline for submission, resulting in a delay in the corrective action process. Additionally, the revised action plans lacked a defined schedule for execution. Based on scenario 9, was it acceptable that the top management rejected the action plan submitted by Julia?

Correct Answer: c) Yes, an action plan must be submitted to address each nonconformity separately

Explanation: Yes, it was acceptable for top management to reject Julia’s initial action plan.

The scenario states that top management rejected Julia’s initial action plan for being “too general”. While the standard discusses the need for action plans to address nonconformities, they emphasise the importance of identifying the causes of each nonconformity and implementing appropriate corrective actions.

According to the information on nonconformity and corrective action, when a nonconformity occurs, the organisation should evaluate the need for action to eliminate the causes of the nonconformity. Corrective actions are expected to be appropriate to the effects of the nonconformities encountered. This implies that the actions taken should be specific to the identified issues and their root causes. A general action plan might not adequately address the specific causes and consequences of each nonconformity.

Furthermore, the process involves reviewing the nonconformity, determining its causes, and determining if similar nonconformities exist. A general plan might not demonstrate a thorough evaluation of each specific nonconformity and its underlying causes.

Therefore, it is reasonable for top management to expect action plans that are detailed enough to address the specific root causes and consequences of the identified issues. A plan deemed “too general” would likely not meet this expectation, making its rejection acceptable. Option (c), which suggests that an action plan must be submitted to address each nonconformity separately, aligns with the principle of addressing specific causes with appropriate actions, although the sources do not explicitly mandate separate plans. However, the rejection of a general plan for lacking specificity supports the need for a more detailed approach for each nonconformity, making option c) Yes, an action plan must be submitted to address each nonconformity separately the most appropriate conclusion based on the information provided in the scenario and the underlying principles of managing nonconformities discussed in the sources.

Question 16

HealthGenic is a pediatric clinic that monitors the health and growth of individuals from infancy to early adulthood using a web-based medical software. The software is also used to schedule appointments, create customized medical reports, store patients’ data and medical history, and communicate with all the [^involved parties, including parents, other physicians, and the medical laboratory staff. Last month, HealthGenic experienced a number of service interruptions due to the increased number of users accessing the software Another issue the company faced while using the software was the complicated user interface, which the untrained personnel found challenging to use. The top management of HealthGenic immediately informed the company that had developed the software about the issue. The software company fixed the issue; however, in the process of doing so, it modified some files that comprised sensitive information related to HealthGenic’s patients. The modifications that were made resulted in incomplete and incorrect medical reports and, more importantly, invaded the patients’ privacy. Based on scenario 8. how does the HealthGenic’s negligence affect the ISMS certificate?

Correct Answer: a) HealthGenic might not be able to renew the ISMS certificate, as it has not conducted management reviews at planned intervals

Explanation: Based on the scenario and the information in the standard, the most likely impact on HealthGenic’s ISMS certificate renewal is related to their oversight and management of information security risks.

Option (a) states: “HealthGenic might not be able to renew the ISMS certificate, as it has not conducted management reviews at planned intervals”. While the scenario doesn’t explicitly mention the frequency of management reviews (as per ISO/IEC 27001:2022, 9.3), the significant data privacy and integrity issues that occurred suggest a potential failure in the ISMS’s effectiveness. Management reviews are intended to ensure the continuing suitability, adequacy, and effectiveness of the ISMS. If such a major incident occurred, it could indicate that risks were not adequately identified or treated during these reviews, potentially leading to a failure to maintain an effective ISMS. Therefore, a lack of effective management reviews could contribute to the inability to renew the certificate.

Option (b) states: “HealthGenic will be able to renew the ISMS certificate, as they did not detect any information security incident in the past two years”. This is incorrect because the scenario clearly describes a significant information security incident involving the modification of sensitive patient data, leading to incomplete and incorrect reports and a breach of privacy. An ISMS certification requires an ongoing commitment to protecting information, and a privacy breach of this nature would likely be considered a major issue.

Option (c) states: “HealthGenic might not be able to renew the ISMS certificate, as the internal audit lasted longer than planned”. The duration of an internal audit (as per ISO/IEC 27001:2022, 9.2) is not directly stated to be the cause of potential non-renewal in the provided scenario. While a prolonged audit might indicate underlying problems, the actual data breach and integrity issues are more direct reasons for potential issues with certification.

Considering the significant impact of the data modification and privacy breach, it indicates a failure in HealthGenic’s ability to safeguard information. While the scenario doesn’t explicitly state that management reviews weren’t conducted at planned intervals, the occurrence of such a serious incident suggests a potential deficiency in the overall management of the ISMS, which is a key focus of management reviews. Therefore, the most plausible reason, based on the given options and the scenario, is that HealthGenic’s negligence in allowing this incident to occur could lead to them not being able to renew their ISMS certificate, potentially linked to ineffective management oversight which should be addressed through management reviews.

Therefore, the most fitting answer is a) HealthGenic might not be able to renew the ISMS certificate, as it has not conducted management reviews at planned intervals. This option, while not directly stated in the scenario, implies a potential systemic failure in the ISMS management that could have contributed to the incident and subsequently affect certification renewal.

Question 17

Scenario 4: TradeB. a commercial bank that has just entered the market, accepts deposits from its clients and offers basic financial services and loans for investments. TradeB has decided to implement an information security management system (ISMS) based on ISO/IEC 27001 Having no experience of a management [^system implementation, TradeB’s top management contracted two experts to direct and manage the ISMS implementation project. First, the project team analyzed the 93 controls of ISO/IEC 27001 Annex A and listed only the security controls deemed applicable to the company and their objectives Based on this analysis, they drafted the Statement of Applicability. Afterward, they conducted a risk assessment, during which they identified assets, such as hardware, software, and networks, as well as threats and vulnerabilities, assessed potential consequences and likelihood, and determined the level of risks based on three nonnumerical categories (low, medium, and high). They evaluated the risks based on the risk evaluation criteria and decided to treat only the high risk category They also decided to focus primarily on the unauthorized use of administrator rights and system interruptions due to several hardware failures by establishing a new version of the access control policy, implementing controls to manage and control user access, and implementing a control for ICT readiness for business continuity Lastly, they drafted a risk assessment report, in which they wrote that if after the implementation of these security controls the level of risk is below the acceptable level, the risks will be accepted Which of the actions presented in scenario 4 is NOT compliant with the requirements of ISO/IEC 27001?

Correct Answer: a) The Statement of Applicability was drafted before conducting the risk assessment

Explanation: Based on the information in the standard, the action in Scenario 4 that is NOT compliant with ISO/IEC 27001 requirements is:

a) The Statement of Applicability was drafted before conducting the risk assessment

Here’s why:

Let’s look at why the other options are compliant:

PECB Official Lecture Videos

Section 1


Section 2


Section 3




Section 4



Section 5


Section 6




Section 7



Section 8



Section 9


Section 10




Section 11



Section 12




Section 13



Section 14



Section 15


Section 16






Section 17


Section 18


Section 19



Section 20





Section 21


Section 22




Section 23


Section 24



Section 25


Section 26



Section 27


© Lt Cdr Shubham Mehta, 2024

References

  1. Foundation: Q3
  2. Foundation: Q7
This site is open source. Improve this page.