NEW
Font size
WorksheetsCertiprof ISO 27001 Foundation - Simulation
Total questions: 40
Worksheet time: 20mins
Clause 6.1 (Actions to Address Risks and Opportunities) has some common strategies among the risk treatment options, which one(s) of the following are valid:
A. Transfer.
B. Mitigate.
C. Assume.
D. All of the above.
The activity within the ISMS of approving and securing the necessary resources for the ISMS is a responsibility of:
A. The IT Security Manager.
B. The IT Manager.
C. The person responsible for the QMS.
D. The top management.
The activity within the ISMS of ensuring the integration of information security management system requirements into the organization's processes is the responsibility of:
A. The top management.
B. The IT Security Manager.
C. The person responsible for the QMS.
D. The Operations Manager.
What control is required for documented information?
Each document is classified as an asset.
Records must be retained for three years.
Documents are protected from loss of integrity.
Only the owner of the document can update the document.
Which of the following activities correspond to top management responsibilities?
Ensure compliance with the information security policy.
Allocate resources necessary to maintain the system.
Supporting the drive for continuous improvement.
All of the above.
The information security policy must be known by:
IT Security Manager.
Everyone.
QMS manager.
IT Manager.
The activity within the ISMS of communicating the importance of effective information security management and compliance with ISMS requirements is a responsibility of:
The top management.
The IT Security Manager.
The person responsible for the QMS.
The IT Manager.
Who is required to perform the review of the ISMS to ensure its suitability, adequacy and effectiveness?
Top management.
The external company performing the certification audit.
The process owners.
The internal audit team.
Identify the missing words in the following sentence.
The organization shall establish, ........................……. security management system.
Operate, review.
Manage, check.
Implement, maintain.and continually improve an information
Monitor, measure.
What should be taken into account in determining the scope of the information security management system?
The results of the gap analysis.
Legal, regulatory, contractual requirements.
The objectives of the organization.
All of the above.
What aspects should be considered to determine the scope of the ISMS?
External and internal issues.
Assets and resources.
Risks and opportunities.
Threats and
vulnerabilities.
In ISO/EC 27001, what does the information security risk assessment process refer to?
Identify risk owners.
Identify security risks.
Establish and maintain information security risk criteria.
All of the above.
Which of the following benefits are not fully maximized by implementing an ISMS?
Provide consistent management and operation of information security throughout the organization.
Increasing the confidence of interested parties in the organization.
Eliminate all information security vulnerabilities in the organization.
Reducing the probability of information security incidents.
Which of the following should be included in the ISMS policy?
The deadline for the implementation of the ISMS.
The certificate of previous audits.
The result of a gap analysis.
A commitment to continual improvement of the ISMS.
What does ISO 27001 require for information security risk assessment?
A. Implement an information security risk assessment process that establishes and maintains information security risk criteria.
To acquire a set of information security tools that allow the assessment to be done automatically using artificial intelligence.
A manager appointed by top management.
A consultancy to perform information security risk assessment in a professional manner.
What details should be contained in a Statement of Applicability?
A. Justification for exclusion of controls.
B. Justification for inclusion of controls.
• C. Necessary controls.
D. All of the above.
What does the ISO 27001 standard require for the treatment of information security risks?
Perform an information security risk treatment process to select appropriate information security risk treatment options taking into account the results of the risk assessment.
A consultancy to carry out precisely the treatment of information security risks.
A manager appointed by the top management to carry out the information security risk treatment under his expertise.
To acquire a set of information security tools to automate the treatment of risks.
Which statement describes the critical success factors of an information security management system (ISMS)?
Conduct a second party audit.
Hire an information security coordinator.
Implementing a measurement system used to evaluate information security management performance that can provide suggestions for improvement.
Appoint at least two internal auditors for the information security system.
What does ISO 27001 require for the control of documented information?
A responsible person designated by the top management to carry out the control of documented information under his expertise.
Acquire a set of information security tools to control documented information effectively.
A consultancy to accurately perform the control of documented information.
Adequate protection, e.g., against loss of confidentiality, misuse, or loss of integrity.
According to ISO/EC 27001 it is necessary to ensure that the information security management system can achieve its intended results.
It is only an observation to take into account when auditing the management system.
It is a requirement to be fulfilled.
It is a recommendation, but not a requirement.
D. None of the above.
What does ISO 27001 require to assess information security performance and the effectiveness of the information security management system?
A consultancy to accurately perform the information security performance assessment and validate the effectiveness of the management system.
Information security tools to assess information security performance and system effectiveness.
A manager appointed by top management to perform the evaluation of the information security performance and the effectiveness of the management system.
Determination by the organization of what needs to be monitored and what needs to be measured, including information security processes and controls.
How should top management provide evidence of its commitment to the ISMS?
By defining a risk assessment approach.
Conducting an annual internal audit of the information security management system.
Communicating the importance of complying with the ISMS requirements.
By approving the information security management system once it has been established.
The activity within the ISMS of ensuring that the information security policy and objectives are established and are consistent with the strategic direction of the organization is the responsibility of:
The IT manager.
The top management.
The ISMS implementation consultant.
The ISMS manager.
Which relevant factor should be considered in internal audit programs?
Number of third-party suppliers involved in the area to be audited.
Ensure that audits are conducted at least twice during the first year of implementation of the information security management system.
Availability of the certification body's auditors.
Audit programs should take into account the importance of the processes involved and the results of previous audits.
Which statement describes the difference between ISO/IEC 27001 and ISO/IEC 27002?
A. ISO/IEC 27002 provides guidance on measurement and ISO/IEC 27001 provides guidance on information security controls.
B. ISO/EC 27002 contains mandatory requirements, while ISO/IEC 27001 provides guidance on information security controls.
C. ISO/EC 27001 contains mandatory requirements, while ISO/IEC 27002 provides guidance on information security controls.
D. ISO/EC 27002 provides mandatory requirements for a risk management approach, ISO/IEC 27001 contains mandatory requirements for an ISMS.
Annex A of the ISO/IEC 27001:2022 consists of:
• A. Elements necessary for good ISMS design and implementation.
B. A comprehensive list of controls grouped into domains.
• C. Guidelines for risk management.
D. None of the above.
What control is required for documented information?
Each document is classified as an asset.
Records must be retained for three years.
Documents are protected from loss of integrity.
Only the owner of the document can update the document.
Which of the following should be included in the ISMS policy?
A. The name of the intrusion detection system.
B. The information security objectives.
C. The results of previous audits.
D. The history of the company with the motivation for implementing the ISMS.
What does ISO 27001 require about the information security policy?
The information security policy must be available as documented information.
It must be available to interested parties.
Be appropriate and communicated within the organization.
All of the above.
Which of the following benefits are not fully maximized by implementing an ISMS?
To prevent information security incidents altogether.
Satisfy social needs and expectations.
Increasing confidence in the organization by interested parties.
Promoting good information security practices.
During the operation of the ISMS, what is the requirement for information security objectives?
• A. Maintain documented information on objectives.
B. Ensure that the objectives are consistent with the information security policy.
• C. Develop improvement plans using ISO 27002 that enable information security objectives to be met.
D. Establish objectives for relevant functions and levels.
What does ISO 27001 require to establish the information security policy?
A. To acquire software containing policies that fit the management system to be implemented.
B. A consultancy to determine the best way.
C. Include a commitment by top management to continually improve the information security management system.
D. An initial audit to know the current status of the quality management system.
The management review shall include consideration of:
A. Changes in external and internal issues that are relevant to the ISMS.
B. The status of actions since previous management reviews.
C. Opportunities for continual improvement.
D. All of the above.
Which of the following activities correspond to top management responsibilities?
A. Motivate employees to contribute to the effectiveness of the ISMS.
B. Approve and secure the necessary resources for the ISMS.
Establish the appropriate conditions for the involvement of employees in the achievement of the organization's information security objectives.
D. All of the above.
What are the three main aspects of information security?
Durability, auditability, confidentiality.
Confidentiality, integrity, availability.
B. Confidentiality, recoverability, integrity.
Non-repudiation, Authenticity, Accountability.
According to the terms and definitions associated with ISO 27001, Effectiveness is defined as:
A. Property relating to consistency in behavior and desired results.
Extent to which planned activities are carried out and planned results are achieved
C. Ability to corroborate that the claim that a certain event occurred or a certain action was performed by the originating entities is true.
D. None of the above.
Focusing on clause 4.3 (Determination of the scope of the Information Security Management System), what should the organization consider when determining the scope of the ISMS?
A. The external and internal issues referred to in clause 4.1.
B. The requirements referred to in section 4.2.
C. The interfaces and dependencies between the activities performed by the organization and those performed by other organizations.
D. All of the above.
What does ISO 27001 require for scoping the information security management system?
A. Acquire a set of security tools.
B. Consider organizational boundaries, information systems boundaries and physical
C. Processes, Technology, People.
D. All of the above.
According to ISO IEC 27001:2022, supporting the drive for continuous improvement is
considered a responsibility of the IT manager in the organization. This statement is:
True
False
According to ISO/IEC 27001:2022 in its clause 9.3, The internal audit team is required to
review the ISMS to ensure its suitability, adequacy and effectiveness. This statement is:
True
False
