ISO 27001 Quiz

ISO/IEC 27002:2013 does not specify technology

• TRUE

• FALSE

One of the best methods for reducing risks to the data of an organization is to implement a program that establishes an information security governance framework.

• TRUE

• FALSE

ISO/IEC 27001:2013 is a methodology that includes requirements for the assessment and treatment of information security risks tailored to the needs of the organization.

• TRUE

• FALSE

According to ISO/IEC 27001:2013, the four main steps in an ISMS implementation are: 1- Understanding organization’s needs, 2- implementing and operating controls and measures, 3- monitoring and reviewing performance of the ISMS, 4- continuously improving the ISMS

• TRUE

• FALSE

What is an information security policy?

• A. A document presenting results to be achieved in information security

• B. Intentions and direction of an organization about information security, as formally expressed by its top management

• C. A high level document that affects the whole organization and defines security roles and responsibilities

• D. A set of information security procedures that work together to address risks

Risk assessment consists of the following activities:

• A. Identification, Evaluation, Analysis, Treatment

• B. Identification, Analysis, Evaluation

• C. Identification, Response, Evaluation

• D. Identification, Analysis, Evaluation, Treatment

What do you need to get strongly authenticated on a logical access control system?

• A. A strong password compliant with NIST’s recommendations

• B. A passphrase in more than 22 characters

• C. Something biometric, no matter what

• D. A password and your finger, for instance

When is it better to put several physical barriers around the organization’s premises?

• A. Always

• B. When the related area contains either sensitive or critical information and information processing facilities

• C. When the related area contains sensitive information and information processing facilities

• D. When the related area contains critical information and information processing facilities

What layer that improve security of operations does FIRSTLY address the fact of preventing threat from arising by addressing its underlying causes?

• A. Security through environmental design

• B. Security through behavior

• C. Security through controls

• D. Security through prevention, protection and resilience

FIRST OF ALL, persons doing work under the organization’s control shall be aware of:

• A. The information security policy

• B. Their role during an information security incident impacting their own availability

• C. Their roles and responsibilities

• D. The nature and importance of the risk assessment result