NEW
Font size
WorksheetsDay#3 LI-Certiprof
Total questions: 20
Worksheet time: 14mins
It has been detected that some sensitive information was leaked to competitors by a form employee after his separation from the company. Which of the ISO/IEC 27001:2022 ANNEX A controls are most applicable to this case?
6.2
6.5 and 6.6
6.1
None of the above
Environmental threats and competitive drivers are elements that are considered for:
Information security policies
Information security priorities and requirements
Internal audit
None of the above
Which control in ANNEX A of ISO IEC 27001:2022 ensures that information systems are designed, implemented, and operated securely within the development life cycle:
8.27
8.28
8.20
5.1
Opportunities to improve the audit program may include:
A. Align audit dates with the availability of the auditee's key personnel
B. Allow multiple audits in a single visit
C. Minimize audit time
A, B and C
Reporting to senior management on the performance of the ISMS is an assigned responsibility:
The information security leader.
Senior Management.
Management of the organization.
The leader of each process.
Which of these statements do you agree with?
An audit team should be selected, considering the academic knowledge required to achieve the objectives.
An audit team should be selected, considering the degree of commitment to achieve the objectives.
An audit team should be selected, considering the competence required to achieve the objectives.
An audit team should be selected, considering the skills needed to achieve the objectives.
During a visit to the physical facilities the auditor finds that the PCs have different dates and times. Which control in Annex A of ISO IEC 27001:2022 has not been properly implemented?
8.17.
8.14.
5.2.
5.1.
The following aspects should be considered when determining the need for internal and external communications about the ISMS:
On what to communicate.
How to communicate.
When to communicate.
All of the above.
Your boss asks you to expedite reports while you are traveling, so you use airport and hotel Wi-Fi with local storage and cloud synchronization. Which control in Annex A of ISO IEC 27001:2022 is not correctly met?
7.9
5.10.
7.11.
5.1.
According to ISO 19011:2018, audit criteria are:
A set of requirements used as a reference against which objective evidence is compared.
Only known to the Company's senior management and the auditor.
Detailed by the auditor in conjunction with the Company and the audited process.
They are related in detail in the audit report.
In the morning hours people were asked to work from home by connecting from a secure VPN, since there was no electricity supply in the Company. Unfortunately, the DATACENTER where sensitive information is stored was connected to a UPS that failed within two hours of being turned on and mission critical activities could not be carried out. The company's penalties were large because it had ensured that the availability was 99.7%. What is the control of ANNEX A of ISO IEC 27001:2022 that most applies to this case?
5.1.
6.3.
7.2.
8.14.
Regarding documented information, ISO 27001:2022 indicates it may include:
A. Documented information of external origin, determined by the organization as necessary for the planning and operation of the information security management system.
B. Documented information required by the information security management system and by this international regulation.
C. Documented information that the organization has determined is necessary for the effectiveness of the information security management system.
D. All of the above.
During a security audit, it was found that the organization did not have a clear policy for managing access rights to sensitive information. Which control in Annex A of ISO IEC 27001:2022 is most relevant to this issue?
9.4
9.3
9.2
9.1
What is the primary purpose of conducting a risk assessment as per ISO 27001:2022?
To identify vulnerabilities in the information security management system.
To ensure compliance with legal requirements.
To evaluate the organization's overall performance.
To determine the effectiveness of security controls.
Which of the following is a key benefit of implementing an Information Security Management System (ISMS) according to ISO 27001:2022?
Increased operational costs.
Reduced employee productivity.
Limited access to information.
Improved stakeholder confidence.
What is the main objective of establishing an information security policy within an organization?
To limit access to sensitive data.
To increase the number of employees.
To reduce operational costs.
To ensure compliance with regulations.
What is a key requirement for the documentation of the Information Security Management System (ISMS) as per ISO 27001:2022?
It should include personal opinions of the management.
It must be accessible only to senior management.
It should be regularly reviewed and updated.
It must be stored in a physical format only.
Which of the following statements regarding ISO/IEC 27004 is correct?
ISO/IEC 27004 provides guidelines to help organizations in evaluating the ISMS performance
Organizations can obtain certification against ISO/IEC 27004
ISO/IEC 27004 does NOT elaborate on what and when to monitor and measure
What is the main purpose of control 6.1 Screening of Annex A of ISO/IEC 27001?
To protect the organization’s interests as part of the process of any changes in employment
To ensure that employees and contractors are aware of and fulfil their information security responsibilities
To ensure that all personnel are eligible and suitable for their roles
Among others, what must organizations do, to comply with clause 7.5.1 Documented information of ISO/IEC 27001?
Develop a comprehensive database for the control of the documented information, storing all records in an encrypted format
Develop a guide for the control of the documented information that is accessible only by the top management
Develop a procedure for the control of the documented information
