ISMS

What is Information Security Management System?

• A method for storing data in a database.
• A set of rules for software development.
• A process for creating marketing strategies.
• An Information Security Management System (ISMS) is a framework for managing and protecting sensitive information.

Which of the following can be classified as information?

• Raw data without context
• Unprocessed numbers
• Random facts without relevance
• Processed data that provides meaning or context.

The High level structure of the management standards include:-

• Operation ; Performance evaluation ; Improvement ; Management responsibility

• Context of the organization; Leadership ; Planning ; Support

• Leadership ; Establish the ISMS ; Planning ; Support

• Management responsibility ; Planning ; Support; Context of the organization

Identify the option below that states the correct logical sequence of the Deming’s improvement cycle

• CDPA

• CPDA

• PDCA

• DPCA

Data Privacy is

• Business data that is valuable to the organization

• Availability of personal data to unauthorized entities

• Set of measures that ensure protection of PII from unauthorized access, disclosure, modification, or destruction.

• All the above are correct

Following is NOT an information security incident:

• Nonavailability of Email server owing to monthly maintenance

• Unavailability of network due to bandwidth bottlenecks

• Accidental deletion of program files by a software programmer

• All the above are security incidents

Which of the following is NOT a critical success factor for information security in an organization?

• A good understanding of the information security requirements, risk assessment, and risk management

• Visible support and commitment from all levels of management

• Information security policy, objectives, and activities that reflect business objectives

• External security consultants or technical experts

An open file cabinet can be most correctly described as a

• Threat

• Vulnerability

• Informational asset

• All of above

Which of the following is not a valid treatment option?

• Risk Acceptance

• Risk Avoidance

• Risk Transfer

• Risk Appetite

What is Statement of Applicability?

• Preservation of confidentiality, integrity and availability of information

• Detecting, reporting and preventing network and data security breaches

• Summary of Risk controls applicable for the organization including justification for inclusions and exclusion.

• None of the above