ISO 27001 FOUNDATION EN D2 - EX 5

What is an information security policy?

• A. A document presenting results to be achieved in information security

• B. Intentions and direction of an organization about information security, as formally expressed by its top management

• C. A high level document that affects the whole organization and defines security roles and responsibilities

• D. A set of information security procedures that work together to address risks

When designing a backup plan, what following item should NOT be taken into consideration?

• 1

• 2

• 3

• 4

Risk assessment consists of the following activities:

• A. Identification, Evaluation, Analysis, Treatment

• B. Identification, Analysis, Evaluation

• C. Identification, Response, Evaluation

• D. Identification, Analysis, Evaluation, Treatment

For what MAIN reason should risk communication be carried out?

• A. To provide assurance of the outcome of the organization’s risk management

• B. To obtain new information security knowledge

• C. To address risk owners’ security concerns

• D. To ensure that residual risks are explicitly accepted by top management

Choose the BEST explanation about the difference between consequence and impact

• A. A consequence extent of damage to the organization’s objectives resulting from a risk while an impact is an adverse change to the level of business objectives achieved. Both are mainly negative

• B. A consequence is the outcome of an event affecting objectives while an impact is an adverse change to the level of business objectives achieved. Both are usually negative

• C. A consequence is an adverse change to the level of business objectives achieved and is mainly negative while an impact is the outcome of an event affecting objectives and can be as positive as negative

• D. A consequence is the extent of damage to the organization’s objectives resulting from a risk while an impact is an adverse change to the level of business objectives achieved. Both can be positive or negative

In what type of document would the statement “maintaining a chain of custody for information while in transit” be the MOST relevant?

• A. Email policy

• B. Network topology

• C. Network access policy

• D. Information transfer agreement

When is it better to put several physical barriers around the organization’s premises?

• A. Always

• B. When the related area contains either sensitive or critical information and information processing facilities

• C. When the related area contains sensitive information and information processing facilities

• D. When the related area contains critical information and information processing facilities

What set of principles stated below does NOT come from the OWASP?

• A. Least privilege, segregation of duties, secure default

• B. Defense in depth, reuse, compartmentalize

• C. Simplicity, availability, auditability

• D. Minimize attack surface, do not trust service, fail securely

What layer that improve security of operations does FIRSTLY address the fact of preventing threat from arising by addressing its underlying causes?

• A. Security through environmental design

• B. Security through behavior

• C. Security through controls

• D. Security through prevention, protection and resilience

What do you need to get strongly authenticated on a logical access control system?

• A. A strong password compliant with NIST’s recommendations

• B. A passphrase in more than 22 characters

• C. Something biometric, no matter what

• D. A password and your finger, for instance