ISO 27001 Lead Implementer - Part C

You are going to play the role an ISO/IEC 27001:2022 lead implementer, during a business meeting you are asked, how many approaches can be user for the identification of information security risks?

• Detection approach and risk mitigation approach

• Event-based approach and approach based on the identification of assets, threats, and vulnerabilities

• It is advisable to use only an asset detection approach

• All approaches are correct

The objectives of an ISMS are associated with confidentiality, integrity, and availability of information. Availability is the property that refers to:

• The information maintains the same data as in its last access

• Information property which keeps the information accesible when needed

• That the information is not stolen by a cybercriminal

• All of the above

According to ISO/IEC 27001:2022 and as explained in the CertiProf's certification program material, scope approval shall be a responsibility and authority assigned by:

• The IT Manager

• The Top Management

• The management representative

• The company's Internal Auditor

What is the purpose of an Information Security policy?

• An information security policy makes the security plan concrete by providing the necessary details

• An information security policy provides insught into threats and the possible consequences

• An information security policy provides direction and support to the management regarding information security

• An information security policy documents the analysis of risks and the search for countermeasures

Which of the following does a lack of adequate security controls represent?

• Asset

• Vulnerability

• Impact

• Threat

You are working on implementing ISO/IEC 27001:2022. Some specific policies you should consider are:

1. Physical security policy

2. Desktop policy

3. Access Control Policy

4. Remote Work Policy

5. Software Use Policy

• 2, 3, and 4

• 1 and 2

• ISO/IEC 27001:2022 defines that you should only have one IS Policy and not so many specific policies

• 1 to 5

What is definition of compliance?

• Laws, considered collectively or the process of making or enacting laws

• The state or fact of accoring with or meeting rules or standards

• An official or authoritative instruction

• A rule of directive made and maintained by an authority

What type of compliancy standard, regulation or legisation provides a code of practice for information security?

• ISO/IEC 27002

• Personal data protection act

• Computer criminality act

• IT Service Management

You have been hired to implement an information security management system. Top management consults you on what the information security policy according to ISO/IEC 27001:2022 should include. Select the most complete list:

• Version, executive summary, policy objective, approved budget, policy duration

• Introduction, ISMS scope, audit results, exclusion of controls

• Document version, date of publication, ISMS scope, policy objective, related policies

• Document version, list of controls to be implemented, annual audit dates, checklists, audit plan, and audit schedule

The risk treatment options or strategies are:

• Avoid risk, assume risk, modify risk, share risk, transfer risk

• Eliminate the risk, assume the risk, modify the risk, share the risk, retain the risk

• Avoid risk, assume risk, modify risk, share risk, retain risk

• Eliminate risk, assume risk, modify risk, delegate risk, retain risk