I85PREP
⌘ K
EXIN ISFS study materials
EXIN ISFS study resources

EXIN ISFS practice questions

One question at a time. Build your EXIN ISFS understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Information security fundamentals and ISO/IEC 27001

Within the ISO/IEC 27001 family of standards, which document provides guidance on the information security management system requirements themselves rather than on supporting controls?

  1. ISO/IEC 27002
  2. ISO/IEC 27005
  3. ISO/IEC 27000
  4. ISO/IEC 27001 Correct answer.

Explanation

ISO/IEC 27001 is the requirements standard against which an ISMS can be audited and certified, containing the mandatory clauses and Annex A control set. The companion documents give guidance, code of practice or terminology rather than certifiable requirements.

Question 2Information security fundamentals and ISO/IEC 27001

An organization defines an ISMS scope that covers only its payment processing department. Which statement best reflects the ISO/IEC 27001 requirement on scoping?

  1. The scope must be documented and justified, considering internal and external issues and interfaces with other parties Correct answer.
  2. The scope must exclude any outsourced processes to remain certifiable
  3. The scope may be left implicit as long as management reviews the ISMS
  4. The scope must always cover the entire organization regardless of business structure

Explanation

ISO/IEC 27001 clause 4.3 requires the organization to determine the boundaries and applicability of the ISMS, and to document the scope with justification, taking into account external and internal issues and interfaces with third parties. There is no rule forcing full-organization scope, and outsourced processes must be addressed rather than excluded.

Question 3Information security fundamentals and ISO/IEC 27001

In ISO/IEC 27001 terminology, what is the primary purpose of the Statement of Applicability?

  1. To record which Annex A controls are applicable, why, and whether they are implemented Correct answer.
  2. To document the financial budget allocated to information security
  3. To list every employee who has access to the information systems
  4. To provide the audit schedule for the certification body

Explanation

The Statement of Applicability documents the necessary controls, the justification for inclusion or exclusion of each Annex A control, and whether each is implemented. It is a key auditable record linking risk treatment to the chosen controls.

Question 4Information security fundamentals and ISO/IEC 27001

An information security manager notices that a risk treatment plan has been approved but no owner has been assigned to the residual risk. Which ISO/IEC 27001 principle does this most directly violate?

  1. Controls must be selected exclusively from Annex A
  2. All risks must be eliminated before certification
  3. Risk assessments must be performed only by external auditors
  4. Risk owners should accept accountability for residual risk Correct answer.

Explanation

ISO/IEC 27001 expects risk ownership and accountability for the acceptance of residual risk, with the decision recorded. Eliminating all risks is neither required nor realistic, and risk assessment is an internal responsibility.

Question 5Information security fundamentals and ISO/IEC 27001

Which statement best describes the relationship between ISO/IEC 27001 clauses 4 to 10 and the Annex A controls?

  1. The management system clauses are mandatory, and Annex A controls are selected through risk treatment Correct answer.
  2. Annex A controls are mandatory in full, and clauses 4 to 10 are optional guidance
  3. Both parts are optional and chosen freely by the organization
  4. Clauses 4 to 10 apply only to certified bodies, while Annex A applies to suppliers

Explanation

The main body clauses define the mandatory ISMS requirements, while Annex A provides a control reference from which applicable controls are selected and justified. Organizations may exclude Annex A controls with justification but must implement the management system clauses.

Question 6Information security fundamentals and ISO/IEC 27001

Which of the following is the clearest example of an information security incident rather than a weakness?

  1. A password policy that permits eight-character passwords
  2. A server room without a documented access log
  3. A phishing email that successfully tricked an employee into revealing credentials Correct answer.
  4. An employee who has not yet completed security awareness training

Explanation

An incident is an actual or suspected event that has compromised or may compromise information security, such as successful credential theft through phishing. The other options describe vulnerabilities or non-conformities rather than an event that has occurred.

Question 7Information security fundamentals and ISO/IEC 27001

Which trio correctly expresses the classic confidentiality, integrity and availability triad?

  1. Confidentiality means information is accessible only to authorized parties, integrity means it is accurate and complete, availability means it is accessible when needed Correct answer.
  2. Confidentiality means data is encrypted, integrity means data is backed up, availability means data is archived
  3. Confidentiality means access is logged, integrity means access is approved, availability means access is fast
  4. Confidentiality means data is anonymous, integrity means data is compressed, availability means data is replicated

Explanation

The CIA triad defines confidentiality as authorized access only, integrity as accuracy and completeness, and availability as timely access by authorized users. Encryption, backup and logging are example measures that may support these properties, not definitions of them.

Question 8Information security fundamentals and ISO/IEC 27001

A hospital must ensure patient records remain readable for decades even as storage media change. Which property of information security does this requirement most directly emphasize?

  1. Non-repudiation
  2. Availability Correct answer.
  3. Confidentiality
  4. Integrity

Explanation

Long-term readability and access to records when needed is fundamentally about availability of information over time. Integrity concerns accuracy, confidentiality concerns authorized disclosure, and non-repudiation concerns proof of origin or action.

Question 9Information security fundamentals and ISO/IEC 27001

Which statement correctly distinguishes a threat from a vulnerability?

  1. A threat is a potential cause of an incident, while a vulnerability is a weakness that can be exploited Correct answer.
  2. A threat is a legal requirement, while a vulnerability is a contractual obligation
  3. A threat is a weakness in a system, while a vulnerability is an attacker's motive
  4. A threat is a control failure, while a vulnerability is an audit finding

Explanation

In ISO terminology a threat is a potential cause of an unwanted incident, whereas a vulnerability is a weakness that a threat can exploit. Risk arises from the combination of threat, vulnerability and impact.

Question 10Information security fundamentals and ISO/IEC 27001

An organization uses a risk matrix with likelihood and impact axes. A risk with high impact but very low likelihood is assessed as medium. Which statement about this outcome is most accurate?

  1. The assessed level reflects the combination of likelihood and impact, and the organization decides whether treatment is needed Correct answer.
  2. The risk can be ignored because low likelihood means it will never occur
  3. The risk level cannot be valid until an external auditor confirms it
  4. The risk must always be transferred to an insurer regardless of cost

Explanation

Risk level derives from combining likelihood and impact, and the organization then decides on treatment based on its risk criteria. Low likelihood does not mean impossibility, and treatment options should be chosen on cost-benefit grounds rather than by fixed rule.

Question 11Information security fundamentals and ISO/IEC 27001

Which action best describes risk treatment according to ISO/IEC 27001?

  1. Performing a penetration test once per year
  2. Listing all assets without evaluating their value
  3. Selecting and implementing controls to modify risk, then determining residual risk Correct answer.
  4. Delegating all security decisions to the IT department

Explanation

Risk treatment involves choosing appropriate options and implementing controls so that residual risk falls within the organization's risk acceptance criteria. Asset inventory and testing may support the process but are not treatment itself.

Question 12Information security fundamentals and ISO/IEC 27001

Which of the following best illustrates the principle of least privilege?

  1. A support engineer receives temporary elevated access only for a specific approved task Correct answer.
  2. Access rights are granted based on seniority alone
  3. Every employee receives administrator rights to avoid support requests
  4. Shared administrator accounts are used to simplify auditing

Explanation

Least privilege means granting only the access necessary for a task, for the time required, and no more. Broad administrator rights, seniority-based grants and shared accounts all conflict with least privilege and accountability.

Question 13Information security fundamentals and ISO/IEC 27001

What is the main security purpose of segregation of duties?

  1. To prevent one person from both committing and concealing an error or fraud Correct answer.
  2. To speed up approval of financial transactions
  3. To ensure all staff share the same access rights
  4. To reduce the number of employees needed in a department

Explanation

Segregation of duties splits critical tasks so that no single individual controls an entire process, reducing the chance of error or fraud going undetected. It is a detective and preventive control, not a staffing or efficiency measure.

Question 14Information security fundamentals and ISO/IEC 27001

An employee receives a phone call from someone claiming to be from the IT helpdesk and is asked for their password to fix a problem. Which control area does this scenario primarily test?

  1. Physical perimeter security
  2. Capacity management
  3. Business continuity planning
  4. Social engineering awareness and verification procedures Correct answer.

Explanation

This is a social engineering attempt exploiting human trust, and the correct response is to verify identity through established procedures and never disclose passwords. Physical security, continuity and capacity management address different risk areas.

Question 15Information security fundamentals and ISO/IEC 27001

Which statement best describes the role of a business impact analysis in an ISMS context?

  1. It defines the disciplinary process for security violations
  2. It replaces the need for a risk assessment entirely
  3. It identifies critical business processes and the consequences of their disruption to set recovery priorities Correct answer.
  4. It lists all software licenses held by the organization

Explanation

A business impact analysis determines which processes are critical and what the consequences of disruption are, informing recovery objectives such as RTO and RPO. It complements rather than replaces risk assessment.

Question 16Information security fundamentals and ISO/IEC 27001

An organization stores backup tapes in an unmarked cabinet in a shared office corridor. Which two information security properties are most directly put at risk?

  1. Confidentiality and integrity only
  2. Integrity and non-repudiation
  3. Availability and accountability only
  4. Confidentiality and availability Correct answer.

Explanation

Unsecured backups risk unauthorized access to data, affecting confidentiality, and risk loss or damage of the only recoverable copies, affecting availability. Integrity may also be affected but the two most direct concerns are confidentiality and availability.

Question 17Information security fundamentals and ISO/IEC 27001

Which of the following is the most appropriate first step when an organization begins implementing an ISMS under ISO/IEC 27001?

  1. Outsource the entire security function
  2. Certify the organization immediately
  3. Understand the organization's context and interested parties, then define the ISMS scope Correct answer.
  4. Purchase security technology for all departments

Explanation

Clause 4 requires understanding the internal and external context and the needs of interested parties before defining scope and establishing the ISMS. Technology purchases and certification are later steps that depend on this foundation.

Question 18Information security fundamentals and ISO/IEC 27001

Which statement about documented information in ISO/IEC 27001 is correct?

  1. It is optional for all clauses except certification
  2. It must be destroyed after each management review
  3. It includes records and documents that must be created, updated and controlled as required by the standard Correct answer.
  4. It refers only to paper documents kept in a filing cabinet

Explanation

Documented information covers both documents and records required for the effectiveness of the ISMS, and must be controlled in terms of availability, protection and retention. It is not limited to paper or to optional items.

Question 19Information security fundamentals and ISO/IEC 27001

During a management review, top management examines audit results, risk status and incidents. Which ISO/IEC 27001 clause does this activity correspond to?

  1. Clause 10 Improvement
  2. Clause 6 Planning
  3. Clause 5 Leadership
  4. Clause 9 Performance evaluation Correct answer.

Explanation

Management review is part of clause 9, performance evaluation, alongside monitoring, measurement and internal audit. Leadership, planning and improvement cover different requirements of the management system.

Question 20Information security fundamentals and ISO/IEC 27001

Which activity is an example of a corrective action rather than a preventive action in an ISMS?

  1. Conducting security awareness training for new staff
  2. Scanning for vulnerabilities before any incident occurs
  3. Reviewing the risk register quarterly
  4. Investigating the root cause of a malware infection and changing procedures to stop it recurring Correct answer.

Explanation

Corrective action responds to a nonconformity or incident that has occurred, addressing root cause to prevent recurrence. Preventive activities are taken to avoid incidents before they happen.

Question 21Information security fundamentals and ISO/IEC 27001

An organization decides that a specific Annex A control is not applicable. What does ISO/IEC 27001 require in this situation?

  1. The excluded control is deleted from the standard for that organization
  2. The control must still be implemented without exception
  3. The decision and its justification must be recorded in the Statement of Applicability Correct answer.
  4. The organization must seek approval from the certification body before excluding it

Explanation

Exclusions are permitted but must be justified and documented in the Statement of Applicability so that auditors and management can see the rationale. Certification bodies assess the justification but do not pre-approve exclusions.

Question 22Information security fundamentals and ISO/IEC 27001

Which of the following best describes an asset in the context of information security management?

  1. Anything that has value to the organization and therefore requires protection Correct answer.
  2. Only data stored in databases
  3. Only intangible items such as brand reputation
  4. Only physical servers located in a data centre

Explanation

An asset is anything of value to the organization, including information, systems, people, services and reputation. Limiting the definition to one category leads to gaps in protection.

Question 23Information security fundamentals and ISO/IEC 27001

A supplier is granted remote access to a production system. Which ISO/IEC 27001 aligned practice is most appropriate before access is granted?

  1. Grant full administrator rights so the supplier can work independently
  2. Allow access without logging to protect supplier privacy
  3. Rely on verbal assurances from the supplier's sales representative
  4. Assess the supplier risk, agree security requirements in a contract, and define access conditions Correct answer.

Explanation

Supplier relationships require agreed security requirements, risk consideration and controlled access conditions. Broad rights, verbal assurances and unlogged access all undermine accountability and control.

Question 24Information security fundamentals and ISO/IEC 27001

Which statement best explains why information security awareness is a management system element rather than a one-off event?

  1. Competence and awareness must be maintained and evaluated over time to support the ISMS's effectiveness Correct answer.
  2. A single annual email satisfies all awareness requirements permanently
  3. Awareness is a legal formality with no effect on risk
  4. Awareness is only relevant for IT staff

Explanation

ISO/IEC 27001 requires that persons doing work under the organization's control are competent and aware of the policy and their contribution to the ISMS, which requires ongoing maintenance and evaluation. Awareness applies to all staff and directly influences human-related risk.

Question 25Information security fundamentals and ISO/IEC 27001

Which of the following situations most clearly represents a nonconformity during an ISO/IEC 27001 audit?

  1. An employee asks a question about the security policy
  2. The organization uses a risk matrix that differs from another company's matrix
  3. A control is implemented differently from the previous year but still meets requirements
  4. A required documented procedure has not been implemented and no records exist to show the activity occurred Correct answer.

Explanation

A nonconformity is the failure to fulfil a requirement, such as not implementing a required process or lacking evidence of it. Asking questions, using alternative compliant methods and choosing a different risk matrix are not nonconformities.

Question 26Information security fundamentals and ISO/IEC 27001

Which ISO/IEC 27001 document states the scope of the ISMS and is a mandatory part of the documented information?

  1. The information security policy
  2. The Statement of Applicability
  3. The risk treatment plan
  4. The ISMS scope statement Correct answer.

Explanation

ISO/IEC 27001 requires the organization to define and document the boundaries and applicability of the ISMS in a scope statement. The Statement of Applicability lists controls and justification, not the system boundaries. The scope statement is therefore the document that records what the ISMS covers.

Question 27Information security fundamentals and ISO/IEC 27001

In ISO/IEC 27001, which clause covers leadership and commitment of top management to the ISMS?

  1. Clause 5 Correct answer.
  2. Clause 10
  3. Clause 8
  4. Clause 4

Explanation

Clause 5 of ISO/IEC 27001 addresses leadership, including top management commitment, the information security policy and assignment of roles and responsibilities. Clause 4 covers context, clause 8 covers operation and clause 10 covers improvement. Leadership commitment is therefore placed in clause 5.

Question 28Information security fundamentals and ISO/IEC 27001

Which Annex A control theme in ISO/IEC 27001:2022 deals with controls such as physical entry and protection against physical threats?

  1. People controls
  2. Physical controls Correct answer.
  3. Organizational controls
  4. Technological controls

Explanation

ISO/IEC 27001:2022 groups Annex A controls into four themes, and physical controls cover physical entry security and protection of equipment and premises. People controls cover personnel-related matters, organizational controls cover policies and processes, and technological controls cover technical measures. Physical protection therefore belongs to the physical theme.

Question 29Information security fundamentals and ISO/IEC 27001

Which statement describes the purpose of an information security policy in an ISMS?

  1. It replaces the need for risk assessment activities
  2. It records the results of internal audits
  3. It provides management direction and commitment to information security Correct answer.
  4. It lists every technical configuration setting for servers

Explanation

The information security policy expresses top management direction, commitment and objectives for information security. It is a high-level governing document rather than a technical configuration list or an audit record. It does not remove the need for risk assessment, which remains a required process.

Question 30Information security fundamentals and ISO/IEC 27001

What does the 'Plan' phase of the PDCA cycle correspond to in an ISMS?

  1. Implementing and operating the ISMS controls
  2. Monitoring and reviewing ISMS performance
  3. Maintaining and improving the ISMS
  4. Establishing the ISMS, including risk assessment and risk treatment Correct answer.

Explanation

In the PDCA model, Plan covers establishing the ISMS, including defining policy, objectives, risk assessment and risk treatment. Do covers implementation and operation, Check covers monitoring and review, and Act covers maintenance and improvement. Establishing the system therefore belongs to Plan.

Question 31Information security fundamentals and ISO/IEC 27001

Which term describes the level of risk that remains after risk treatment has been applied?

  1. Inherent risk
  2. Residual risk Correct answer.
  3. Risk appetite
  4. Risk criteria

Explanation

Residual risk is the risk that remains once treatment options have been implemented and evaluated. Inherent risk refers to risk before treatment, while risk appetite and risk criteria are decision parameters. ISO/IEC 27001 requires the organization to determine residual risk and compare it with risk criteria.

Question 32Information security fundamentals and ISO/IEC 27001

Which of the following is an example of an organizational control in the ISO/IEC 27001:2022 Annex A structure?

  1. Cabling security
  2. Screening of candidates before employment Correct answer.
  3. Management of technical vulnerabilities
  4. Use of privileged access rights

Explanation

Organizational controls cover management processes, including personnel screening before employment and during employment. Privileged access rights and technical vulnerability management are technological controls, while cabling security is a physical control. Screening therefore falls under the organizational theme.

Question 33Information security fundamentals and ISO/IEC 27001

What is the primary purpose of an internal audit within an ISO/IEC 27001 ISMS?

  1. To replace management review meetings
  2. To provide evidence that no security incidents have occurred during the year
  3. To certify the organization against ISO/IEC 27001
  4. To determine whether the ISMS conforms to the organization's own requirements and to ISO/IEC 27001 Correct answer.

Explanation

Internal audits are conducted to determine whether the ISMS conforms to the organization's own requirements and to the standard's requirements, and whether it is effectively implemented and maintained. Certification is performed by external certification bodies, not internal auditors. Internal audit also does not substitute for management review.

Question 34Information security fundamentals and ISO/IEC 27001

An organization defines an acceptable use policy for email and requires new staff to sign it during onboarding. Which Annex A theme does this control belong to?

  1. Technological controls
  2. Physical controls
  3. Organizational controls Correct answer.
  4. People controls

Explanation

Acceptable use of assets and rules for information transfer are organizational controls because they are management rules that apply across the organization. People controls concern the workforce lifecycle such as screening and awareness, and technological controls concern technical measures. A signed acceptable use policy is therefore an organizational control.

Question 35Information security fundamentals and ISO/IEC 27001

A risk assessment identifies that a database contains personal data and that an unpatched server could expose it. Which element of the risk assessment is the unpatched server?

  1. A threat
  2. An impact
  3. A vulnerability Correct answer.
  4. A control objective

Explanation

A vulnerability is a weakness that can be exploited by a threat, and missing patches on a server is a classic weakness. The threat would be an actor or event such as an attacker or malware, while impact describes the consequence if the risk materializes. The unpatched server is therefore the vulnerable element.

Question 36Information security fundamentals and ISO/IEC 27001

An organization decides to transfer part of its risk by purchasing cyber insurance. Which risk treatment option has been applied?

  1. Risk retention
  2. Risk modification
  3. Risk sharing Correct answer.
  4. Risk avoidance

Explanation

Risk sharing, also called risk transfer, involves sharing risk with another party such as an insurer or supplier. Risk modification reduces risk through controls, avoidance removes the activity, and retention accepts the remaining risk. Insurance is the standard example of risk sharing.

Question 37Information security fundamentals and ISO/IEC 27001

Which item is the best example of documented information that ISO/IEC 27001 requires to be retained as evidence of a process having been performed?

  1. An informal chat message about a project idea
  2. Records from monitoring and measurement activities Correct answer.
  3. A vendor marketing brochure
  4. A blank template for a risk register

Explanation

ISO/IEC 27001 requires documented information as evidence of results achieved, for example records of monitoring, measurement, analysis and evaluation. A blank template is only a form and does not evidence performance. Marketing material and informal messages are not required evidence of ISMS processes.

Question 38Information security fundamentals and ISO/IEC 27001

During a risk assessment, a team scores a risk using likelihood and consequence scales and then compares the result with the organization's risk criteria. What is this step called?

  1. Risk communication
  2. Risk evaluation Correct answer.
  3. Risk identification
  4. Risk analysis

Explanation

Risk evaluation compares the results of risk analysis with established risk criteria to decide whether the risk is acceptable or requires treatment. Risk identification finds risks, and risk analysis develops understanding of them. Comparing against criteria is the evaluation step.

Question 39Information security fundamentals and ISO/IEC 27001

An organization wants to ensure that only approved software can run on workstations. Which Annex A control area is most directly relevant?

  1. Access control
  2. Data masking
  3. Configuration management Correct answer.
  4. Malware protection

Explanation

Configuration management includes establishing and maintaining secure configurations, such as an approved software baseline that restricts what can run. Malware protection addresses malicious code rather than software approval, and access control governs who may use resources. Restricting software to an approved list is therefore a configuration control.

Question 40Information security fundamentals and ISO/IEC 27001

A company has a policy requiring backups, but no records exist to show that backups were actually tested for restoration. Which ISO/IEC 27001 requirement is most clearly unmet?

  1. Defining the scope of the ISMS
  2. Conducting management review at planned intervals
  3. Providing awareness training to all staff
  4. Retaining documented information as evidence of process performance Correct answer.

Explanation

ISO/IEC 27001 requires documented information as evidence that processes were performed as planned, and backup testing is a process that should leave records. Without test records the organization cannot demonstrate the control operated. The other options concern different requirements that are not directly evidenced by backup testing.

Question 41Information security fundamentals and ISO/IEC 27001

Which statement best explains the relationship between an information security event and an information security incident?

  1. Every event is an incident because events always harm the organization
  2. An incident is a single event that has been classified as a threat
  3. An incident is an event or series of events that could lead to or has led to loss or disruption Correct answer.
  4. Events and incidents are identical terms used interchangeably in ISO/IEC 27001

Explanation

ISO/IEC 27000 defines an incident as a single or series of unwanted or unexpected information security events that have a significant probability of compromising business operations and threatening information security. An event is any observable occurrence, so only some events escalate to incidents. The two terms are therefore not interchangeable.

Question 42Information security fundamentals and ISO/IEC 27001

An organization's risk assessment shows that a legacy application cannot be patched. Management decides to keep the application because the business depends on it, and records the decision with justification. Which treatment option and requirement does this illustrate?

  1. Risk modification, requiring the application to be replaced
  2. Risk sharing, requiring a third party to accept liability
  3. Risk retention, requiring the decision to be justified and recorded Correct answer.
  4. Risk avoidance, requiring the application to be shut down

Explanation

Keeping an unpatched application while accepting the associated risk is risk retention, and ISO/IEC 27001 requires treatment decisions and their justification to be documented. Avoidance would mean stopping the activity, sharing would involve another party, and modification would mean applying controls to reduce the risk. The recorded acceptance therefore illustrates retention.

Question 43Information security fundamentals and ISO/IEC 27001

Which activity best demonstrates the 'Check' phase of the PDCA cycle in an ISMS?

  1. Reviewing monitoring results against ISMS objectives Correct answer.
  2. Deploying a new firewall rule set
  3. Writing the information security policy for the first time
  4. Assigning a new risk owner to a register entry

Explanation

The Check phase covers monitoring, measurement, analysis and evaluation of ISMS performance against objectives and criteria. Writing policy and deploying controls belong to Plan and Do, and assigning a risk owner is an operational planning activity. Reviewing monitoring results is therefore a Check activity.

Question 44Information security fundamentals and ISO/IEC 27001

A certification body's auditor finds that the organization's Statement of Applicability lists a control as applied, but no implementation evidence exists. What is the most accurate characterization?

  1. An observation with no significance, because the SoA is only a planning document
  2. An opportunity for improvement, because no incident has occurred
  3. A nonconformity, because the documented claim is not supported by evidence Correct answer.
  4. A risk acceptance, because the control was listed as applied

Explanation

A Statement of Applicability must accurately reflect which controls are applied, and a claim without supporting evidence indicates the requirement is not fulfilled. This is a nonconformity rather than a mere observation. The absence of incidents does not demonstrate that a control is implemented.

Question 45Information security fundamentals and ISO/IEC 27001

Which pair of Annex A control themes in ISO/IEC 27001:2022 contains controls addressing supplier relationships and business continuity?

  1. Physical controls and technological controls
  2. Organizational controls and technological controls Correct answer.
  3. People controls and organizational controls
  4. People controls and physical controls

Explanation

Supplier relationships and business continuity are both organizational controls, while technological controls include areas such as backup and logging that support continuity. People and physical themes address workforce and premises matters respectively. The correct pairing therefore includes organizational and technological themes.

Question 46Information security fundamentals and ISO/IEC 27001

An organization sets an ISMS objective to reduce the number of phishing-related incidents by 30 percent within a year and assigns responsibility to the security manager. Which ISO/IEC 27001 clause requirement does this best illustrate?

  1. Information security objectives must be measurable, monitored and assigned Correct answer.
  2. Internal audits must be performed at least once per quarter
  3. All information security risks must be eliminated within one year
  4. Management review must be held monthly

Explanation

ISO/IEC 27001 requires information security objectives to be measurable where practicable, monitored, communicated and supported by plans that assign responsibility. The example sets a measurable target and a named owner. The standard does not require elimination of all risk, nor does it prescribe quarterly audits or monthly management reviews.

Question 47Information security fundamentals and ISO/IEC 27001

Which statement best explains why ISO/IEC 27001 requires a risk treatment plan in addition to the Statement of Applicability?

  1. The plan replaces the risk assessment, while the SoA replaces the risk register
  2. The plan describes how chosen treatments will be implemented, while the SoA records which controls are applied and why Correct answer.
  3. The plan is optional, while the SoA is mandatory for certification
  4. The plan records which controls are excluded, while the SoA records the treatment schedule

Explanation

The risk treatment plan describes how the selected treatment options will be implemented, including responsibilities and expected outcomes. The Statement of Applicability records which Annex A controls are necessary and justifies inclusions and exclusions. Both documents are required and serve different purposes.

Question 48Information security fundamentals and ISO/IEC 27001

An organization outsources payroll processing to a provider. Which combination of ISO/IEC 27001 aligned activities best addresses the associated supplier risk?

  1. Relying on the provider's public reputation and annual marketing claims
  2. Transferring all responsibility for payroll data to the provider
  3. Excluding payroll from the ISMS scope to avoid supplier risk
  4. Defining security requirements in the agreement and monitoring supplier performance Correct answer.

Explanation

Supplier risk is addressed by agreeing information security requirements in the contract and monitoring the supplier's performance against them. Responsibility for information security cannot be fully transferred to a supplier, and the organization remains accountable. Excluding payroll from scope would misrepresent the ISMS boundaries rather than manage the risk.

Question 49Information security fundamentals and ISO/IEC 27001

An auditor notes that the risk assessment was performed once at ISMS establishment and has not been repeated since, although the business environment has changed substantially. Which requirement is most directly violated?

  1. Risk assessment must produce identical results each time
  2. Risk assessment must be performed by an external party
  3. Risk assessment must cover only IT systems
  4. Risk assessment must be repeated at planned intervals or when significant change occurs Correct answer.

Explanation

ISO/IEC 27001 requires risk assessment to be performed at planned intervals or when significant changes are proposed or occur, and results to be retained as documented information. A single assessment at establishment does not satisfy this ongoing requirement. The standard does not require external assessors, identical results or an IT-only scope.

Question 50Information security fundamentals and ISO/IEC 27001

A manager argues that because the organization has never suffered a data breach, its ISMS controls must be effective. Which reasoning flaw is most relevant to ISO/IEC 27001 monitoring and evaluation?

  1. Absence of incidents is not sufficient evidence of effectiveness; performance must be monitored and measured Correct answer.
  2. Incident counts are the sole required measurement, so other metrics should be ignored
  3. Controls are effective only if they are technological, so organizational controls cannot be evaluated
  4. Effectiveness can only be proven by external certification, so internal monitoring is unnecessary

Explanation

ISO/IEC 27001 requires the organization to determine what needs to be monitored and measured and to evaluate information security performance and ISMS effectiveness. The absence of incidents may reflect luck or poor detection rather than effective controls. Monitoring and measurement provide positive evidence that controls operate as intended.