(Additional) CERTIPROF ISO27K Foundation

Which of the following should be included in the ISMS policy?

• • The deadline for the implementation of the ISMS.

• • The certificate of previous audits.

• • The result of a gap analysis.

• • A commitment to continual improvement of the ISMS.

ISO/IEC 27001 requires that you must comply with Risk Management:

• • Establish and maintain criteria on information security risks.

• • Identify risks associated with the loss of confidentiality, integrity and availability of information.

• • Select appropriate information security risk treatment options taking into account the results of the risk assessment.

• • All of the above.

What aspects should be considered to determine the scope of the ISMS?

• • External and internal issues.

• • Assets and resources.

• • Risks and opportunities.

• Threats and vulnerabilities.

Which statement describes the critical success factors of an information security management system (ISMS)?

• • Conduct a second party audit.

• • Hire an information security coordinator.

• • Implementing a measurement system used to evaluate information security management performance that can provide suggestions for improvement.

• • Appoint at least two internal auditors for the information security system.

What does the ISO 27001 standard require for the treatment of information security risks?

• • Perform an information security risk treatment process to select appropriate information security risk treatment options taking into account the results of the risk assessment.

• • A consultancy to carry out precisely the treatment of information security risks.

• • A manager appointed by the top management to carry out the information security risk treatment under his expertise.

• • To acquire a set of information security tools to automate the treatment of risks.

What does ISO 27001 require for the control of documented information?

• • A responsible person designated by the top management to carry out the control of documented information under his expertise.

• • Acquire a set of information security tools to control documented information effectively.

• • A consultancy to accurately perform the control of documented information.

• • Adequate protection, e.g., against loss of confidentiality, misuse, or loss of integrity.

What does ISO 27001 require for scoping the information security management system?

• • Acquire a set of security tools.

• • Consider organizational boundaries, information systems boundaries and physical boundaries.

• • Processes, Technology, People.

• • All of the above.

Which of the following activities correspond to top management responsibilities?

• • Motivate employees to contribute to the effectiveness of the ISMS.

• • Approve and secure the necessary resources for the ISMS.

• • Establish the appropriate conditions for the involvement of employees in the achievement of the organization's information security objectives.

• • All of the above.

According to the terms and definitions associated with ISO 27001, Authenticity is defined as:

• • Property relating to consistency in behavior and desired results.

• • Consistent property that an entity is what it claims to be.

• • Ability to corroborate that the claim that a certain event occurred or a certain action was performed by the originating entities is tru

• • e.

  • None of the above.

The management review shall include consideration of:

• • Changes in external and internal issues that are relevant to the ISMS.

• • The status of actions since previous management reviews.

• • Opportunities for continual improvement.

• All of the above.