NEW
Font size
WorksheetsDay#2B LA Certiprof
Total questions: 20
Worksheet time: 17mins
Which activity summarizes the ACT phase of the PDCA in an information security management system?
Monitor the ISMS.
Review the entire ISMS and issue findings.
Continuous improvement.
Internal audit and issue findings.
To comply with the requirement of ISO/EC 27001:2022 we must establish a program of internal audits that allow us to review the ISMS. What is the purpose of an audit program?
Obtain objective evidence and evaluate it objectively to determine the extent to which the audit criteria are met.
Ensure that all controls are aligned to the standard and check that the ISMS we have implemented complies with the wishes of top management.
Provide information on whether the ISMS meets the organization's own requirements for its ISMS as well as those of ISO/IEC 27001:2022.
Define the structure and responsibilities for planning, conducting, reporting and monitoring on individual audit activities to ensure appropriate scope, minimize impact on operations, and maintain required audit quality.
Executing processes, collecting records and evaluating the consequences on planned and unplanned changes as a result of the planning phase belong to which stage of the PDCA cycle?
Act.
Do.
Plan.
Check.
What is the purpose of incident management using control 5.26?
Information security incidents shall be responded to in accordance with documented procedures.
Always ensure that information security incident management is implemented given its global importance.
Comply with the requirements of ISO/IEC 27002.
Comply with the information security policy.
You are working as a Lead Auditor of ISO/IEC 27001:2022. You recommend evaluating the update of the current Statement of Applicability (SoA). Why is this update recommendation being made?
Because it is updated after each event.
Because the standard requires an update every 3 months.
Because risks are not eliminated.
Because risks are constantly evaluated and updated.
You have been consulted by a team working on the implementation of an ISMS. What document is produced after conducting a GAP analysis?
Action plan.
Audit checklist.
Statement of applicability.
Business case.
You are working as a Lead Auditor of ISO/IEC 27001:2022 in the role of an external consultant. Staff of the company you are working for consult you on what would be the requirements and conditions for defining the scope of the information security management system (ISMS). Select those that apply:
B. Consider the requirements and expectations of interested parties.
A. Consider the analysis of the organization's context (external and internal issues).
C. Define the scope only when you have selected the controls to implement and the SoA.
A and B correct
As the lead implementer of ISO/IEC 27001:2022, you recommend establishing a hierarchy of policies for the definition of information security policies. What are the levels you would recommend following?
A. High level, IS policy, specific policies.
B. Management and operational policies.
C. Combination of A and B.
D. None of the above.
What is the purpose of controlling the transfer of information using control 5.14?
Always ensure that the control is implemented given its global importance in the transfer of information that occurs naturally today.
The only valid purpose for implementing this control is to avoid non-compliance with legal obligations such as the personal data protection law.
Comply with the requirements of ISO/IEC 27002.
Establish information transfer rules, procedures or agreements for all types of transfer facilities within the organization and between the organization and other parties.
As Lead Auditor of ISO/IEC 27001:2022 you are commenting the definition of the information security policy. Some aspects to keep in mind are:
Understanding stakeholder needs and expectations.
Only internal needs because it is a business management system.
Only external needs because the aim is to protect customer and user information.
None of the above.
Control 5.9, Inventory of information and other associated assets, is considered:
1. Inventory.
2. Owners of the assets.
3. Information transfer.
Only 1 and 2 are correct.
Only 3 is correct.
Only 1 and 3 are correct.
All options are related to control.
What is the categorization of Annex A in ISO IEC 27001:2022?
Annex A divides the 93 controls into 4 themes: Political, Financial, Cultural and Legal.
Annex A divides the 93 controls into 4 themes: Organizational, People, Physical and Technological.
Annex A divides the 93 controls into 4 themes: Organizational, Human, Physical and Technological.
Annex A continues with the same structure of its predecessor ISO IEC 27001:2013.
The ISO/EC 27001:2022 standard establishes as a requirement, the need to define an Information Security Policy appropriate to the needs of the organization. Select the best answer that complements this definition.
Describes the strategic importance of the information security management system for the organization and shall be available as documented information.
It is a document that establishes in writing the "when" and "how" an organization plans to protect its information and information assets. The Information Security Policy is a living document, so it should be reviewed every six months to ensure that it is adequate to the needs.
Establishes the implementation and monitoring guide of the ISMS. The Information Security Policy must be protected to prevent all company employees from knowing about it.
A document that establishes in writing the "why" and "when" an organization plans to protect its information and information assets.
As a Lead ISMS Auditor you must evaluate a risk assessment and risk treatment process in compliance with clause 6 of ISO 27001:2022. In which standard is this process defined?
ISO 31000:2018.
ISO TEC 27002:2022.
ISO 19011:2018.
None of the above.
With the GAP analysis:
We build the business case, provides us with the reasons why an ISMS should be implemented and approximate the cost and effort to implement an ISMS.
The GAP analysis is expected to provide the current status of the information security practices implemented, i.e. the "gap" between the requirements of ISO/IEC 27001:2022 and the current practices will be known, in order to generate a gap closure plan.
We can obtain the approximate financial cost of gap closure.
The direct relationship between the previous and current state of the organization is established.
The objectives of an ISMS are associated with confidentiality, integrity and availability of information. Confidentiality is the property that refers to:
That the information can be accessed by the company's employees.
That the information can be accessible at all times.
Confidentiality does not refer to the authenticity and veracity of the information.
Property of the information whereby it is kept inaccessible and not disclosed to unauthorized individuals, entities or processes.
What are Information Security Objectives and what are they for?
The objectives of an ISMS are the information security objectives for confidentiality, integrity and availability of information.
Information security objectives help implement an organization's strategic goals and the information security policy.
Information security objectives also help to specify and measure the performance of information security controls and processes in accordance with the information security policy.
All of the above.
As a Lead Auditor you know that you can take this standard as a guide for the design and implementation of an Information Security Management System:
ISO 27003:2017.
ISO IEC 27002: 2022.
ISO 19011:2018.
None of the above.
You are working as a Lead Auditor of ISO/IEC 27001:2022 and review the definition of the information security policy. Some aspects that can be considered inputs for the security policy are the organization's purposes and objectives.
True.
False.
You are working as lead implementer of ISO/EC 27001:2022 and supporting the definition of the information security policy. Some aspects to keep in mind are:
Understanding stakeholder needs and expectations.
Internal needs.
External needs (e.g. customers and users).
All of the above.
