I85PREP
⌘ K
EXIN ISMP study materials
EXIN ISMP study resources

EXIN ISMP practice questions

One question at a time. Build your EXIN ISMP understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Information security management (domain structure not enumerated in retrieved source)

In information security management, what does the CIA triad represent?

  1. Compliance, Incident and Assessment
  2. Cryptography, Identity and Access
  3. Control, Inspection and Auditing
  4. Confidentiality, Integrity and Availability Correct answer.

Explanation

The CIA triad names the three core security objectives: confidentiality keeps data from unauthorized disclosure, integrity keeps it accurate and unaltered, and availability keeps it accessible to authorized users when needed. Almost every control in an ISMS can be justified by which of these objectives it protects.

Question 2Information security management (domain structure not enumerated in retrieved source)

What is the primary purpose of an Information Security Management System (ISMS)?

  1. To replace the need for technical security controls
  2. To document the IT department's daily operational tasks
  3. To manage information security risks in a systematic, continual-improvement cycle Correct answer.
  4. To guarantee that no security incident can ever occur

Explanation

An ISMS is a management framework that establishes, operates, monitors, reviews and improves information security through a risk-based, Plan-Do-Check-Act cycle. It structures how risks are identified and treated rather than promising that incidents never happen.

Question 3Information security management (domain structure not enumerated in retrieved source)

In risk terminology, what is the difference between a risk and an incident?

  1. They are synonyms and are used interchangeably in an ISMS
  2. A risk is a realized event; an incident is a possible future event
  3. A risk is the potential for harm from an event; an incident is an event that has actually occurred Correct answer.
  4. A risk applies only to suppliers; an incident applies only to employees

Explanation

Risk is the potential for loss, usually expressed as a combination of likelihood and impact, whereas an incident is a security event that has actually happened and requires response. Risk management looks forward; incident management reacts to what has occurred.

Question 4Information security management (domain structure not enumerated in retrieved source)

What does the principle of least privilege require?

  1. Users get only the access rights needed to perform their assigned tasks Correct answer.
  2. Access rights are granted permanently once approved
  3. Privileges are shared among team members to reduce administration
  4. Every user receives administrative rights for flexibility

Explanation

Least privilege means granting users and systems the minimum access necessary for their legitimate duties, and only for as long as needed. This limits the damage that a compromised account or a mistake can cause.

Question 5Information security management (domain structure not enumerated in retrieved source)

Which statement best describes the role of senior management in information security governance?

  1. They set direction, approve risk appetite and hold accountability for the ISMS Correct answer.
  2. They personally configure firewalls and patch servers
  3. They delegate all security decisions to the IT operations team
  4. They only sign the security policy once and then have no further role

Explanation

Governance assigns accountability to top management, who set the security direction, define risk appetite and ensure resources are available. They remain accountable even though operational tasks are delegated.

Question 6Information security management (domain structure not enumerated in retrieved source)

What is the main purpose of a business impact analysis (BIA) in continuity management?

  1. To test whether firewalls block malicious traffic
  2. To list all software licenses held by the organization
  3. To calculate the annual salary budget of the security team
  4. To identify critical processes and the consequences of their disruption Correct answer.

Explanation

A BIA identifies essential business processes and assesses the impact over time if they are disrupted, which drives recovery priorities and objectives. It underpins continuity and disaster recovery planning rather than technical network testing.

Question 7Information security management (domain structure not enumerated in retrieved source)

Which of the following is an example of an administrative (organizational) information security control?

  1. A documented acceptable use policy signed by employees Correct answer.
  2. An encrypted backup tape stored offsite
  3. A firewall rule blocking inbound traffic
  4. A biometric fingerprint reader

Explanation

Administrative controls are policies, procedures and people-related measures, and an acceptable use policy is a classic example. Firewalls, biometrics and encryption are technical controls.

Question 8Information security management (domain structure not enumerated in retrieved source)

What is the purpose of a security awareness, education and training programme?

  1. To transfer all security responsibility from management to end users
  2. To replace technical controls with human vigilance
  3. To build staff knowledge and behaviour so they recognize and reduce security risk Correct answer.
  4. To certify the organization against an international standard

Explanation

Awareness programmes aim to change knowledge and behaviour so employees avoid risky actions and report concerns, reducing human-related risk. They support technical and organizational controls rather than substituting for them.

Question 9Information security management (domain structure not enumerated in retrieved source)

A risk assessment finds a high likelihood and high impact for an unpatched public web server. Which treatment option is applied when the organization installs the missing patches and enables automatic updates?

  1. Risk mitigation (reduction) Correct answer.
  2. Risk transfer
  3. Risk avoidance
  4. Risk acceptance

Explanation

Patching reduces the likelihood of exploitation, which is risk mitigation. Avoidance would mean stopping the activity entirely, acceptance would mean tolerating it, and transfer would shift the financial consequence to another party.

Question 10Information security management (domain structure not enumerated in retrieved source)

An organization buys cyber-insurance to cover potential losses from a data breach. Which risk treatment option does this represent?

  1. Risk avoidance
  2. Risk reduction
  3. Risk transfer Correct answer.
  4. Risk retention

Explanation

Insurance transfers the financial consequence of a risk to a third party, which is risk transfer. The underlying risk of the breach still exists; only the financial burden is shared with the insurer.

Question 11Information security management (domain structure not enumerated in retrieved source)

What is the primary role of an asset owner in information security management?

  1. To perform daily backups of every server
  2. To configure network routers
  3. To audit the ISMS independently each year
  4. To make decisions about classification and protection of a specific asset Correct answer.

Explanation

The asset owner is accountable for a specific asset, deciding its classification and the appropriate level of protection. Custodians carry out the operational tasks such as backups and configuration.

Question 12Information security management (domain structure not enumerated in retrieved source)

An employee receives an email asking them to confirm their password via a link to a look-alike login page. What type of attack is this?

  1. Denial of service
  2. Privilege escalation
  3. Phishing Correct answer.
  4. SQL injection

Explanation

Phishing uses deceptive messages to trick recipients into revealing credentials or clicking malicious links. The look-alike login page is a typical credential-harvesting technique in phishing.

Question 13Information security management (domain structure not enumerated in retrieved source)

Why should security incidents be logged and reviewed even when they appear minor?

  1. Because logging is only needed to fill audit reports
  2. Because minor incidents never require any response
  3. Because patterns across minor events can reveal systemic weaknesses and precursors to major incidents Correct answer.
  4. Because logs eliminate the need for monitoring tools

Explanation

Reviewing incident records helps identify recurring causes, trends and early warning signs that may precede serious events. This supports continual improvement and preventive action.

Question 14Information security management (domain structure not enumerated in retrieved source)

What is the main difference between a vulnerability and a threat?

  1. A vulnerability is a person; a threat is a software bug
  2. A vulnerability is a weakness; a threat is a potential cause of harm that could exploit it Correct answer.
  3. A vulnerability always leads to an incident; a threat never does
  4. They mean the same thing in risk analysis

Explanation

A vulnerability is a weakness in an asset or control, while a threat is a potential source of harm such as an attacker or natural event. Risk arises when a threat can exploit a vulnerability and cause impact.

Question 15Information security management (domain structure not enumerated in retrieved source)

Which measure best supports the availability objective of the CIA triad?

  1. Requiring complex passwords
  2. Encrypting data at rest with strong keys
  3. Applying data classification labels
  4. Implementing redundant servers and tested backups Correct answer.

Explanation

Availability is about ensuring systems and data are accessible when needed, which redundancy and tested backups support by enabling recovery from failure. Encryption, classification and password rules primarily protect confidentiality or integrity.

Question 16Information security management (domain structure not enumerated in retrieved source)

What is the purpose of segregating duties in information security?

  1. To prevent one person from controlling all parts of a sensitive process Correct answer.
  2. To allow faster deployment by removing approvals
  3. To reduce the need for logging and monitoring
  4. To increase the number of people with full administrative access

Explanation

Segregation of duties splits sensitive tasks, such as requesting and approving payments or changes, so that no single person can perpetrate and conceal an error or fraud. It is a preventive organizational control.

Question 17Information security management (domain structure not enumerated in retrieved source)

A supplier will process personal data on the organization's behalf. Which action best reflects supplier security management?

  1. Assume the supplier is secure because it is well known
  2. Define security requirements and responsibilities in the contract and monitor compliance Correct answer.
  3. Give the supplier unrestricted access to all systems
  4. Rely solely on the supplier's marketing materials

Explanation

Supplier management requires specifying security and privacy obligations in agreements, assessing the supplier's controls and monitoring performance over the relationship. Responsibility cannot be assumed away by reputation.

Question 18Information security management (domain structure not enumerated in retrieved source)

What is the primary objective of a business continuity plan (BCP)?

  1. To prevent every possible disaster from occurring
  2. To document the organizational chart
  3. To replace the incident response process
  4. To ensure critical business functions can continue or be restored within acceptable timeframes Correct answer.

Explanation

A BCP sets out how critical functions will continue or be recovered within defined objectives such as recovery time and recovery point targets. It manages the consequences of disruption rather than preventing all disasters.

Question 19Information security management (domain structure not enumerated in retrieved source)

Which statement about the relationship between confidentiality, integrity and availability is most accurate?

  1. Only confidentiality matters for regulated data
  2. Controls may support one objective while affecting another, so trade-offs are managed Correct answer.
  3. Integrity is achieved solely by restricting access
  4. Availability is irrelevant once data is encrypted

Explanation

Security objectives interact: for example, very strict access controls may improve confidentiality but can hinder availability for legitimate users. Management must balance these trade-offs against business needs.

Question 20Information security management (domain structure not enumerated in retrieved source)

What is the key difference between a policy and a procedure in an ISMS?

  1. A policy states management intent and requirements; a procedure describes step-by-step how to meet them Correct answer.
  2. A procedure is approved by management; a policy is written by technicians only
  3. They are identical documents with different titles
  4. A policy is technical; a procedure is always legal

Explanation

Policies express management direction and mandatory requirements, while procedures translate them into detailed, repeatable steps. Policies are typically approved at a senior level, and procedures support consistent execution.

Question 21Information security management (domain structure not enumerated in retrieved source)

An organization discovers that a departed employee's account is still active. Which control failure does this most directly illustrate?

  1. Failure of the joiner-mover-leaver process Correct answer.
  2. Failure of the encryption key length
  3. Failure of the backup rotation schedule
  4. Failure of the physical access log

Explanation

Timely removal of access when staff leave is part of the joiner-mover-leaver lifecycle. A lingering active account shows that the leaver step was not executed or verified.

Question 22Information security management (domain structure not enumerated in retrieved source)

Which of the following best describes a corrective control?

  1. A control that restores systems or data after an incident Correct answer.
  2. A control that detects an event after it occurs
  3. A control that discourages potential attackers
  4. A control that prevents an event from occurring

Explanation

Corrective controls act after an event to restore normal operations, such as restoring data from backups or reimaging a compromised host. Preventive, detective and deterrent controls address other points in the timeline.

Question 23Information security management (domain structure not enumerated in retrieved source)

An organization classifies information as public, internal, confidential and restricted. A manager asks why classification is necessary. Which answer is most defensible?

  1. Classification removes the need for access control
  2. Classification is only needed for paper documents
  3. Classification ensures that protection effort and handling rules match the value and sensitivity of the information Correct answer.
  4. Classification guarantees that confidential data can never be leaked

Explanation

Classification lets the organization apply proportionate handling, access and protection rules according to sensitivity and value. It does not by itself guarantee that leaks never occur, and it applies to electronic as well as paper records.

Question 24Information security management (domain structure not enumerated in retrieved source)

A risk assessment team must decide how to treat a risk whose likelihood is low but whose potential impact is catastrophic. Which approach is most consistent with sound risk management?

  1. Evaluate the risk against the risk appetite and consider reduction, transfer or avoidance of the catastrophic consequence Correct answer.
  2. Ignore the risk because likelihood is low
  3. Automatically close the risk without management decision
  4. Accept the risk silently without recording it

Explanation

Low likelihood does not justify ignoring a catastrophic impact; the risk should be evaluated against the organization's risk appetite and treated appropriately. Catastrophic consequences often call for reduction, transfer or avoidance, and the decision must be documented.

Question 25Information security management (domain structure not enumerated in retrieved source)

During an internal audit, a finding shows that a required control is documented but staff are not following it. Which conclusion is most appropriate?

  1. The standard should be changed to match current practice without further analysis
  2. The finding can be ignored because documentation exists
  3. The control is effective because it is documented
  4. The control is ineffective in practice and requires corrective action Correct answer.

Explanation

A control's effectiveness depends on consistent operation, not merely on the existence of documentation. Non-compliance is a genuine finding that calls for root-cause analysis and corrective action.

Question 26Information security management (domain structure not enumerated in retrieved source)

Within an ISMS, what does the term 'information security governance' primarily describe?

  1. The direction, oversight and accountability arrangements set by top management for security Correct answer.
  2. The technical configuration of firewalls and intrusion detection systems
  3. The purchasing process for security hardware and licences
  4. The daily monitoring of security logs by the operations team

Explanation

Governance concerns the steering and accountability layer: who sets direction, who approves risk appetite, and who is answerable for security outcomes. It is distinct from operational execution such as configuring devices or reading logs, which are management and operational activities performed under that direction.

Question 27Information security management (domain structure not enumerated in retrieved source)

An organization states that 'access to production systems requires manager approval and multi-factor authentication'. In ISMS terminology, what is this statement?

  1. A work instruction describing each click in the approval tool
  2. A policy statement expressing a management requirement Correct answer.
  3. An audit finding
  4. A risk treatment plan

Explanation

A policy expresses management's requirements and expectations at a principle level, leaving implementation detail to standards and procedures. The statement sets a mandatory requirement without prescribing step-by-step actions, which is characteristic of policy.

Question 28Information security management (domain structure not enumerated in retrieved source)

Which pairing correctly matches an information security objective with the control theme that most directly supports it?

  1. Confidentiality - performing regular restoration tests of backups
  2. Confidentiality - restricting access on a need-to-know basis Correct answer.
  3. Integrity - adding redundant power supplies to servers
  4. Availability - encrypting data at rest with AES-256

Explanation

Confidentiality is about preventing unauthorised disclosure, and need-to-know access restriction directly limits who can see information. The other pairings attach controls to objectives they do not primarily serve, such as redundancy supporting availability rather than integrity.

Question 29Information security management (domain structure not enumerated in retrieved source)

What is the main purpose of maintaining a register of interested parties within an ISMS?

  1. To identify stakeholders, their security-relevant needs and the obligations the organization must meet Correct answer.
  2. To record the serial numbers of all security appliances
  3. To list every employee who has completed security awareness training
  4. To document which suppliers have signed non-disclosure agreements

Explanation

Interested parties are the stakeholders affected by or affecting the ISMS, such as regulators, customers, staff and suppliers. Understanding their needs and the resulting obligations feeds the scope, risk criteria and compliance requirements of the management system.

Question 30Information security management (domain structure not enumerated in retrieved source)

Which statement best describes the role of the ISMS scope statement?

  1. It lists the individual risks that have been assessed for each department
  2. It describes the technical architecture of the network perimeter
  3. It defines the boundaries and applicability of the management system, including interfaces with external parties Correct answer.
  4. It records the corrective actions taken after each audit

Explanation

The scope statement establishes what the management system covers and what it does not, including locations, processes, systems and dependencies on external providers. Clear boundaries are essential because risks, controls and audit activities are only meaningful relative to a defined scope.

Question 31Information security management (domain structure not enumerated in retrieved source)

A control is described as 'detective'. Which example fits that classification?

  1. A firewall rule that blocks traffic to a malicious IP address
  2. A signed acceptable use agreement collected at onboarding
  3. A backup restored after a disk failure
  4. A review of privileged account activity using automated log correlation Correct answer.

Explanation

Detective controls identify and record events after or while they occur, enabling a response; log correlation that surfaces suspicious privileged activity is exactly that. Blocking traffic is preventive, restoring a backup is corrective, and collecting signed agreements is preventive through deterrence and acknowledgment.

Question 32Information security management (domain structure not enumerated in retrieved source)

Why does an ISMS require documented information to be controlled?

  1. To increase the volume of records available for auditors
  2. To ensure the right people have access to current, approved versions and that obsolete versions are not used Correct answer.
  3. To satisfy the requirement that all documents be stored on paper
  4. To prevent staff from ever modifying any document

Explanation

Document control ensures documents and records are available where needed, protected, versioned and reviewed, so that people act on current approved information. Without it, staff may follow superseded procedures or auditors may see inconsistent evidence.

Question 33Information security management (domain structure not enumerated in retrieved source)

What does the principle of 'least privilege' require in practice?

  1. Access rights are granted permanently to reduce helpdesk workload
  2. Every user receives administrative rights so that incidents can be resolved quickly
  3. All users share a single account per department to simplify administration
  4. Users receive only the access necessary to perform their assigned tasks, for the time needed Correct answer.

Explanation

Least privilege limits rights to the minimum needed for the task and, ideally, for a limited period, which reduces the damage any single compromised account can cause. Shared or permanent broad access undermines accountability and expands the blast radius of misuse.

Question 34Information security management (domain structure not enumerated in retrieved source)

A risk owner has accepted a risk and recorded it in the risk register. What should happen next as part of ongoing risk management?

  1. The risk is removed from the register because it has been decided
  2. The risk and the effectiveness of its treatment are monitored and reviewed at defined intervals Correct answer.
  3. The risk is reclassified as an opportunity and closed
  4. The risk is transferred to the internal audit function

Explanation

Accepting a risk does not end the process; the risk remains owned and must be monitored because likelihood, impact and the effectiveness of controls change over time. Periodic review ensures the acceptance decision is still valid and triggers action if conditions deteriorate.

Question 35Information security management (domain structure not enumerated in retrieved source)

An organization wants to reduce the likelihood of successful phishing by making staff better at recognising suspicious messages. Which risk treatment approach does this represent?

  1. Risk retention
  2. Risk transfer
  3. Risk avoidance
  4. Risk modification through awareness and competence measures Correct answer.

Explanation

Awareness and training change human behaviour and thereby reduce the likelihood that a phishing attempt succeeds, which is risk modification (mitigation). Avoidance would mean removing the activity, transfer would shift financial consequences, and retention would mean accepting the exposure unchanged.

Question 36Information security management (domain structure not enumerated in retrieved source)

A security manager needs to demonstrate that the ISMS is achieving its intended outcomes. Which evidence is most appropriate?

  1. The number of pages in the information security policy
  2. A copy of the organisation chart showing the security department
  3. Measurements of defined security objectives compared against planned targets over time Correct answer.
  4. A list of all security products purchased in the last financial year

Explanation

Performance evaluation requires measurable objectives and monitoring results compared with planned targets, showing trends and whether outcomes are being achieved. Purchases, structure or document length indicate activity or inputs, not whether security performance is improving.

Question 37Information security management (domain structure not enumerated in retrieved source)

During an internal audit, an auditor samples access reviews and finds two were not performed. What is the most appropriate immediate classification of this result?

  1. A nonconformity requiring root cause analysis and corrective action Correct answer.
  2. A scope change for the ISMS
  3. An improvement opportunity to be deferred to the next management review only
  4. An observation with no follow-up needed because only two were missed

Explanation

A required control was not carried out as defined, so the finding is a nonconformity that must be corrected and investigated for root cause to prevent recurrence. Observations and improvement ideas apply where requirements are met but could be better; here a defined requirement was missed.

Question 38Information security management (domain structure not enumerated in retrieved source)

Which activity best demonstrates management commitment to the ISMS rather than merely supporting it?

  1. Approving the security budget once per year and delegating everything else
  2. Allowing the security team to define the risk appetite without executive input
  3. Chairing management review, setting security objectives and ensuring resources are assigned Correct answer.
  4. Forwarding security newsletters to all staff each month

Explanation

Leadership commitment is shown by active direction: setting objectives, providing resources, reviewing performance and being accountable for the system's effectiveness. Delegation of all responsibility, passive communication or abdicating risk appetite decisions fall short of that active role.

Question 39Information security management (domain structure not enumerated in retrieved source)

An organization is deciding how to structure its risk criteria. Which factor is most important to define up front?

  1. The number of pages allowed in the risk report
  2. The scales for likelihood and impact and the thresholds for acceptable risk Correct answer.
  3. The names of the individuals who will be audited next year
  4. The brand of the risk register software

Explanation

Risk criteria set out how likelihood and impact are rated and at what point a risk is unacceptable, which makes assessments consistent and comparable across the organisation. Tooling, reporting format and audit scheduling are downstream details that depend on these criteria.

Question 40Information security management (domain structure not enumerated in retrieved source)

What distinguishes a corrective action from a correction in incident and nonconformity handling?

  1. A correction fixes the immediate problem, while a corrective action addresses the underlying cause to prevent recurrence Correct answer.
  2. A correction requires management approval, while a corrective action does not
  3. A correction is documented, while a corrective action is verbal only
  4. A correction is always performed by auditors, while a corrective action is performed by IT

Explanation

The correction is the immediate fix, such as restoring a service or resetting an account, whereas corrective action examines root cause and changes the system so the problem does not happen again. Both should be recorded, and neither is tied to a specific job title.

Question 41Information security management (domain structure not enumerated in retrieved source)

An organization stores customer data in a cloud service. Which ISMS consideration applies even though the provider operates the infrastructure?

  1. The data automatically becomes public because it is off-premises
  2. The organization remains accountable for the security of its information and must manage the supplier relationship Correct answer.
  3. The provider's certifications remove all obligations from the organization
  4. The organization no longer needs to assess risks relating to that data

Explanation

Outsourcing operations does not outsource accountability: the organization must define supplier requirements, monitor performance and include the service in its risk assessment. Provider certifications provide assurance input but do not eliminate the customer's own obligations.

Question 42Information security management (domain structure not enumerated in retrieved source)

A manager asks why security roles and responsibilities must be documented and communicated. Which answer is most aligned with ISMS principles?

  1. So that people understand what is expected of them and accountability for security is clear across the organization Correct answer.
  2. So that job descriptions can be shortened
  3. So that blame can be assigned quickly after any incident
  4. So that the security department can reduce its headcount

Explanation

Clearly assigned roles ensure that security tasks are performed and that accountability is understood, which supports consistent operation of the ISMS. The purpose is clarity and effectiveness, not fault-finding or staff reduction.

Question 43Information security management (domain structure not enumerated in retrieved source)

Which set of items is most characteristic of the 'inputs' to a management review of the ISMS?

  1. The marketing plan, sales pipeline and competitor pricing
  2. The organisation's product roadmap only
  3. Audit results, risk assessment status, incident trends and feedback from interested parties Correct answer.
  4. Individual employee salary bands

Explanation

Management review draws on security performance information such as audit findings, changes to risks, incident statistics, nonconformities and stakeholder feedback. Commercial or HR data may be context but is not the defined substance of the security review.

Question 44Information security management (domain structure not enumerated in retrieved source)

An employee reports a suspected data leak. Which sequence best reflects sound incident management practice?

  1. Detect and log, assess and classify, contain, eradicate and recover, then review lessons learned Correct answer.
  2. Immediately dismiss the reporter to protect morale
  3. Ignore the report until a second employee confirms it
  4. Publish details on social media, then investigate, then inform the regulator

Explanation

Incident management follows a lifecycle: identification and logging, assessment and classification against severity criteria, containment to limit damage, eradication and recovery, and a post-incident review to improve. Premature disclosure or inaction undermines both containment and legal obligations.

Question 45Information security management (domain structure not enumerated in retrieved source)

What is the primary reason for defining a risk appetite in an ISMS?

  1. To guarantee that no security incident will occur
  2. To eliminate the need for a risk register
  3. To replace legal and regulatory obligations with internal preferences
  4. To provide a basis for deciding how much risk the organization is willing to accept in pursuit of its objectives Correct answer.

Explanation

Risk appetite states the amount and type of risk the organization is prepared to accept, giving decision-makers a consistent yardstick for treatment choices. It does not remove the need to record risks, prevent incidents, or override legal duties.

Question 46Information security management (domain structure not enumerated in retrieved source)

An organization finds that a control is technically in place but staff routinely bypass it because it slows their work. What is the most insightful analysis?

  1. The staff should be disciplined without further investigation
  2. The control's design conflicts with operational reality, so its effectiveness and the underlying process should be reviewed Correct answer.
  3. The control is fully effective because it exists in the configuration
  4. The control should be removed and the risk ignored

Explanation

A control that is consistently worked around provides little protection and signals a design or usability problem, or a culture issue, that must be addressed. Effectiveness depends on actual behaviour, so reviewing the process and the control design is more valuable than assuming compliance from configuration alone.

Question 47Information security management (domain structure not enumerated in retrieved source)

Two departments assess the same shared database risk and reach very different ratings. Which ISMS weakness does this most likely reveal?

  1. Inconsistent application of risk criteria and method across the organization Correct answer.
  2. Too few security tools deployed
  3. Overuse of documented procedures
  4. Excessive management review meetings

Explanation

Divergent ratings for the same risk usually indicate that likelihood and impact scales, or the method itself, are being applied inconsistently. Consistent criteria and calibration are what make risk results comparable and support prioritisation across the organisation.

Question 48Information security management (domain structure not enumerated in retrieved source)

A supplier reports a breach that may affect the organization's data. Which response best reflects the organization's accountability under its ISMS?

  1. Assume the supplier's certification means no further action is needed
  2. Wait for the supplier to publish a public statement before taking any internal action
  3. Terminate the contract immediately without assessing the impact
  4. Invoke the incident process, assess impact on the organization's information, and coordinate with the supplier and relevant authorities Correct answer.

Explanation

The organization remains accountable for its data, so it must run its own incident assessment, understand the impact, and coordinate notification and remediation with the supplier and any regulators. Passivity, reflexive termination or reliance on certification alone all fail to manage the actual exposure.

Question 49Information security management (domain structure not enumerated in retrieved source)

An ISMS has extensive documentation but no measurable objectives, and management review consists only of signing minutes. Which conclusion is most defensible?

  1. The ISMS needs more policies to become effective
  2. The ISMS is mature because documentation is comprehensive
  3. The ISMS risks being a paper exercise because performance is not measured or acted upon Correct answer.
  4. The ISMS is compliant because management signed the minutes

Explanation

A management system's value lies in achieving intended outcomes through measurement, review and improvement, not in the volume of documents. Without objectives and substantive review, there is no evidence of effectiveness and the system can drift into a compliance-only exercise.

Question 50Information security management (domain structure not enumerated in retrieved source)

A control owner proposes replacing a costly manual review with automated monitoring. What should the decision consider first?

  1. Whether the manual team will be upset by the change
  2. Whether the automation covers the same risk and produces reliable, auditable evidence Correct answer.
  3. Whether the tool has the most attractive user interface
  4. Whether the automation uses the newest available technology

Explanation

A control change must preserve or improve risk coverage and continue to produce trustworthy evidence that the control operates. Novelty, staff sentiment or interface appeal are secondary to whether the risk is still addressed and demonstrable.