ISO27001 Quizz Section 789 (Day#2C)

An action taken to eliminate the cause of a potential nonconformity or other potential undesirable situation is known as:

• Correction

• Corrective action

• Preventive action

Answer explanation

Preventive actions are actions taken to eliminate the cause of a potential nonconformity or other potential undesirable situation.

What are the activities that should be included in the situation analysis phase of the corrective action process?

• Identification and documentation of the nonconformities

• Evaluation of options and selection of solutions

• Follow- up on and review of corrective actions

Answer explanation

Situation analysis phase of the corrective action process comprises of three activities: analysis of the root cause, evaluation of options, and selection of solutions.

What is the correlation between continual improvement and information security errors?

• Continual improvement helps reduce the number of errors

• Continual improvement helps increase the number of errors

• Continual improvement introduces new errors

Answer explanation

The continual improvement process helps reduce the number of errors

An action taken to eliminate the causes of a nonconformity helps in the creation of a continual improvement culture.

• True

• False

Answer explanation

A corrective action aims to correct; it does not promote continual improvement in an organization, nor does it foster such culture

Segregation of information security duties is :

• Detective and Technical control

• Preventive and adminsitrative control

• Corrective and managerial control

Answer explanation

By function, the segregation of duties is a preventive control that reduces the opportunities for the unauthorized use or unintentional misuse of the organization’s information. By type, it is an administrative control

Consideration of applicable legislation is:

• Detective and maangerial control

• Corrective and administrative control

• Preventive and legal control

Answer explanation

By function, taking the applicable legislation into consideration is a preventive control that prevents breaches in legal obligations related to information security. By type, it is a legal control

Why should organizations review the information security policies after the occurrence of significant changes?

• To ensure continuing reliability of the information security policy

• To ensure continuing suitability, adequacy, and effectiveness of the information security policy

• To ensure continuing efficiency, performance, and correctness of the information security policy

Answer explanation

Based on ISO/IEC 27001:2022, control 5.1 the policies for information security should be reviewed at planned intervals or if significant changes occur to ensure their continuing suitability, adequacy, and effectiveness

Which is the main purpose of control 6.1 Screening of ISO/IEC 27001:2022?

• To ensure that all personnel are eligible and suitable for their roles

• To ensure that employees and contractors are aware of and fulfil their information security responsibilities

• To protect the organization’s interests as part of the process of any changes in employment

Answer explanation

The purpose of control 6.1, as defined by ISO/IEC 27002, is to ensure all personnel are eligible and suitable for the roles for which they are considered.

Who shall have access to documented operating procedures?

• Only the top management

• The person responsible for operating procedures

• Any user that needs them

Answer explanation

Based on ISO/IEC 27001:2022, control 5.37, operating procedures for information processing facilities shall be documented and made available personnel who need them.

What is the main requirement of control 8.34 Protection of information systems during audit testing of ISO/IEC 27001:2022?

• The tester and appropriate management shall appropriately manage test information

• The tester and appropriate management shall plan and agree on audit tests and other assurance activities involving assessment of operational systems

• The tester shall separate and secure the development, testing, and production environments

Answer explanation

According to ISO/IEC 27001:2022, control 8.34, audit tests and other assurance activities involving assessment of operational systems shall be planned and agreed between the tester and appropriate management.