I85PREP
⌘ K
ISO 27001 Foundation study materials
ISO 27001 Foundation study resources

ISO 27001 Foundation practice questions

One question at a time. Build your ISO 27001 Foundation understanding.

First 50 of 199 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Information security management system (ISMS) fundamentals and the ISO/IEC 27001 standard

What is the primary purpose of an Information Security Management System (ISMS) as defined by ISO/IEC 27001?

  1. To certify individual security products against a fixed technical checklist
  2. To guarantee that no security incidents will ever occur
  3. To provide a systematic approach for managing sensitive information and protecting its confidentiality, integrity and availability Correct answer.
  4. To replace national legislation on data protection with international rules

Explanation

An ISMS is a systematic, risk-based management framework for protecting information assets across the organization. It establishes policies, objectives and processes rather than certifying products or promising zero incidents.

Question 2Information security management system (ISMS) fundamentals and the ISO/IEC 27001 standard

Which document type in ISO/IEC 27001 expresses the organization's overall intentions and direction for information security?

  1. The Statement of Applicability
  2. The information security policy Correct answer.
  3. The internal audit report
  4. The risk treatment plan

Explanation

The information security policy is the top-level statement of intent and direction, providing the framework for setting security objectives. Other documents operationalize that policy but do not express overall intent.

Question 3Information security management system (ISMS) fundamentals and the ISO/IEC 27001 standard

In ISO/IEC 27001, what does the Statement of Applicability (SoA) primarily document?

  1. The complete inventory of hardware serial numbers
  2. The necessary controls, justification for inclusion or exclusion, and their implementation status Correct answer.
  3. The contractual penalties for security breaches
  4. The list of employees authorized to access the data center

Explanation

The SoA lists the controls the organization deems necessary, explains why each Annex A control is included or excluded, and states whether it is implemented. It is a required documented output of risk treatment.

Question 4Information security management system (ISMS) fundamentals and the ISO/IEC 27001 standard

Which three properties make up the core information security objectives commonly referenced in ISO/IEC 27001?

  1. Authentication, authorization, accounting
  2. Confidentiality, integrity, availability Correct answer.
  3. Redundancy, resilience, recovery
  4. Scalability, portability, maintainability

Explanation

Confidentiality, integrity and availability are the three foundational security properties the ISMS aims to preserve. The other triples describe software quality or access-control concepts.

Question 5Information security management system (ISMS) fundamentals and the ISO/IEC 27001 standard

What is the purpose of a risk assessment in an ISMS?

  1. To assign blame for past security incidents
  2. To list every software license held by the organization
  3. To identify, analyze and evaluate information security risks against defined criteria Correct answer.
  4. To record the results of the most recent penetration test only

Explanation

Risk assessment systematically identifies risks, analyzes their likelihood and impact, and evaluates them against risk criteria to prioritize treatment. It is broader than any single test result.

Question 6Information security management system (ISMS) fundamentals and the ISO/IEC 27001 standard

Which ISO/IEC 27001 clause covers leadership and the commitment of top management to the ISMS?

  1. Clause 4
  2. Clause 8
  3. Clause 5 Correct answer.
  4. Clause 10

Explanation

Clause 5 addresses leadership, requiring top management to demonstrate commitment and establish the information security policy. The other clauses cover context, operation and improvement respectively.

Question 7Information security management system (ISMS) fundamentals and the ISO/IEC 27001 standard

What does 'continual improvement' mean in the context of an ISMS?

  1. Adding new security tools whenever budget allows
  2. Increasing the number of documented procedures regardless of value
  3. Replacing the entire ISMS every year
  4. Recurring activity to enhance performance of the management system over time Correct answer.

Explanation

Continual improvement is an ongoing, deliberate process of enhancing ISMS suitability, adequacy and effectiveness. It is measured by outcomes, not by volume of tools or documents.

Question 8Information security management system (ISMS) fundamentals and the ISO/IEC 27001 standard

Which of the following best describes an 'information asset' in an ISMS?

  1. Only physical servers owned by the organization
  2. Any item that has value to the organization and requires protection Correct answer.
  3. Any employee with administrator rights
  4. Only data stored in cloud services

Explanation

An information asset is anything of value to the organization that supports information processing or storage, including data, systems, people and facilities. Restricting the definition to hardware or cloud data is too narrow.

Question 9Information security management system (ISMS) fundamentals and the ISO/IEC 27001 standard

An organization identifies a risk and decides to purchase cyber insurance to transfer the financial impact. Which risk treatment option has been applied?

  1. Risk avoidance
  2. Risk retention
  3. Risk transfer Correct answer.
  4. Risk modification (mitigation)

Explanation

Transferring risk to a third party, such as through insurance or contracts, is risk transfer. Avoidance eliminates the activity, modification reduces likelihood or impact, and retention accepts the risk.

Question 10Information security management system (ISMS) fundamentals and the ISO/IEC 27001 standard

During a risk assessment, an analyst multiplies the likelihood of a threat exploiting a vulnerability by the magnitude of resulting impact. What is being calculated?

  1. The audit nonconformity count
  2. The inherent risk level before treatment Correct answer.
  3. The control maturity score
  4. The residual risk after controls

Explanation

Combining likelihood and impact yields a risk level, typically the inherent risk before additional controls are applied. Residual risk is what remains after treatment.

Question 11Information security management system (ISMS) fundamentals and the ISO/IEC 27001 standard

A company applies a control and then re-evaluates the risk, finding it is now within its risk acceptance criteria. What is this remaining level of risk called?

  1. Systemic risk
  2. Residual risk Correct answer.
  3. Inherent risk
  4. Absolute risk

Explanation

Residual risk is the risk that remains after controls have been applied. Inherent risk is the level before treatment.

Question 12Information security management system (ISMS) fundamentals and the ISO/IEC 27001 standard

Which activity is required in the 'Check' phase of the Plan-Do-Check-Act cycle for an ISMS?

  1. Defining the scope of the ISMS
  2. Establishing the information security policy
  3. Implementing the risk treatment plan
  4. Monitoring, measuring and reviewing ISMS performance Correct answer.

Explanation

The Check phase involves monitoring, measurement, internal audit and management review to verify performance. Scope definition, policy and implementation belong to Plan and Do.

Question 13Information security management system (ISMS) fundamentals and the ISO/IEC 27001 standard

An organization wants to obtain independent confirmation that its ISMS conforms to ISO/IEC 27001. Which activity provides this?

  1. A vulnerability scan of external systems
  2. A third-party certification audit Correct answer.
  3. A first-party internal audit
  4. A second-party supplier assessment

Explanation

Certification is performed by an independent, accredited third-party certification body that audits the ISMS against the standard. Internal audits are first-party, and supplier assessments are second-party.

Question 14Information security management system (ISMS) fundamentals and the ISO/IEC 27001 standard

What is the main purpose of an internal audit within an ISMS?

  1. To replace the need for management review
  2. To market the organization's security posture to customers
  3. To determine whether the ISMS conforms to the organization's own requirements and the standard Correct answer.
  4. To discipline employees who violate the security policy

Explanation

Internal audits provide objective evidence that the ISMS conforms to planned arrangements, the standard's requirements and the organization's own criteria. They are not disciplinary or marketing tools.

Question 15Information security management system (ISMS) fundamentals and the ISO/IEC 27001 standard

A security team discovers that a control is failing to meet its intended outcome. According to ISO/IEC 27001, what should the organization do?

  1. Immediately terminate the responsible employee
  2. Remove the control from the Statement of Applicability
  3. Ignore it until the next scheduled certification audit
  4. Take action to control and correct the nonconformity and address its cause Correct answer.

Explanation

Nonconformities must be addressed by controlling and correcting them and, where applicable, eliminating the root cause to prevent recurrence. Removing a control or waiting for an audit does not resolve the issue.

Question 16Information security management system (ISMS) fundamentals and the ISO/IEC 27001 standard

Which of the following is a documented information requirement of ISO/IEC 27001?

  1. Evidence of competence of persons doing work affecting information security Correct answer.
  2. A copy of every competitor's security policy
  3. The personal home addresses of all employees
  4. A list of every email sent by staff

Explanation

The standard requires documented evidence of competence for personnel whose work affects information security performance. The other items are not required and may raise privacy concerns.

Question 17Information security management system (ISMS) fundamentals and the ISO/IEC 27001 standard

A risk owner is assigned for a newly identified risk. What is the primary responsibility of the risk owner?

  1. To write the organization's marketing materials
  2. To accept accountability for managing the risk and ensuring treatment is effective Correct answer.
  3. To conduct the external certification audit
  4. To perform the technical configuration of all controls

Explanation

A risk owner is accountable for ensuring the risk is managed and that treatment remains effective. Technical implementation may be delegated to others.

Question 18Information security management system (ISMS) fundamentals and the ISO/IEC 27001 standard

Which statement best describes the relationship between ISO/IEC 27001 and ISO/IEC 27002?

  1. 27002 specifies certification requirements, while 27001 is guidance only
  2. 27001 applies only to governments, while 27002 applies to companies
  3. 27001 specifies requirements for an ISMS, while 27002 provides guidance on information security controls Correct answer.
  4. Both are identical documents with different titles

Explanation

ISO/IEC 27001 contains auditable requirements for establishing an ISMS, whereas ISO/IEC 27002 provides implementation guidance for controls. They are complementary, not identical or audience-restricted.

Question 19Information security management system (ISMS) fundamentals and the ISO/IEC 27001 standard

An organization defines the internal and external issues relevant to its ISMS and the needs of interested parties. Which clause of ISO/IEC 27001 does this satisfy?

  1. Clause 4, context of the organization Correct answer.
  2. Clause 6, planning
  3. Clause 7, support
  4. Clause 9, performance evaluation

Explanation

Clause 4 requires understanding the organization's context, including internal and external issues and interested party requirements. Planning, support and performance evaluation are addressed by other clauses.

Question 20Information security management system (ISMS) fundamentals and the ISO/IEC 27001 standard

An ISMS scope statement should primarily define what?

  1. The organizational and technical boundaries to which the ISMS applies Correct answer.
  2. The names of employees who will be audited
  3. The list of all security technologies the organization plans to buy
  4. The exact wording of every security procedure

Explanation

The scope establishes the boundaries and applicability of the ISMS, including interfaces and dependencies with external parties. It is not a technology shopping list or a personnel roster.

Question 21Information security management system (ISMS) fundamentals and the ISO/IEC 27001 standard

A manager argues that because a control is listed in Annex A, it must be implemented in every organization. How should an ISMS practitioner respond?

  1. Agree, since Annex A controls are mandatory in their entirety
  2. Explain that Annex A controls are selected through risk assessment and justified in the SoA Correct answer.
  3. Explain that Annex A controls only apply to financial institutions
  4. Recommend implementing only controls that require no budget

Explanation

Annex A is a reference set of controls; organizations select those necessary based on risk assessment and document justification in the SoA. Exclusions are permitted with rationale.

Question 22Information security management system (ISMS) fundamentals and the ISO/IEC 27001 standard

Two organizations have identical IT infrastructure but different risk appetites. How does this most likely affect their ISMS risk treatment decisions?

  1. They will implement exactly the same controls because the technology is identical
  2. The organization with lower risk appetite will generally accept fewer risks and apply stricter controls Correct answer.
  3. Risk appetite has no bearing on control selection
  4. Both must implement every Annex A control regardless of appetite

Explanation

Risk appetite defines how much risk an organization is willing to accept, so a lower appetite typically leads to more stringent treatment. Identical infrastructure does not produce identical treatment decisions.

Question 23Information security management system (ISMS) fundamentals and the ISO/IEC 27001 standard

An organization outsources a critical service and the auditor finds that supplier-related risks were never assessed. Which requirement is most directly unmet?

  1. Competence of internal auditors
  2. Calibration of monitoring equipment
  3. Management of risks associated with suppliers and external parties Correct answer.
  4. Physical security of the organization's own offices

Explanation

ISO/IEC 27001 requires that risks associated with external parties and suppliers be identified and managed within the ISMS risk process. The other items are unrelated to supplier risk.

Question 24Information security management system (ISMS) fundamentals and the ISO/IEC 27001 standard

A certification body finds a nonconformity during a surveillance audit. What is the typical consequence if the organization fails to address it within the agreed timeframe?

  1. The standard is amended for all users
  2. The nonconformity is converted into an opportunity
  3. The certification may be suspended or withdrawn Correct answer.
  4. The organization automatically passes the audit

Explanation

Unresolved nonconformities can lead to suspension or withdrawal of certification because conformity can no longer be demonstrated. Passing automatically or amending the standard is not how certification works.

Question 25Information security management system (ISMS) fundamentals and the ISO/IEC 27001 standard

An organization treats a risk but later finds the residual risk exceeds its acceptance criteria. What is the most appropriate next step?

  1. Discontinue all ISMS monitoring activities
  2. Accept the risk without further action because treatment was already applied
  3. Re-evaluate and apply additional or different treatment until the risk meets criteria Correct answer.
  4. Remove the risk from the risk register to avoid reporting it

Explanation

If residual risk remains above the acceptance criteria, further treatment is needed and the risk must be re-evaluated. Removing risks from the register or halting monitoring undermines the ISMS.

Question 26Information security management system (ISMS) fundamentals and the ISO/IEC 27001 standard

What is the primary purpose of an Information Security Management System (ISMS) according to ISO/IEC 27001?

  1. To guarantee that an organization will never experience a security breach
  2. To provide a systematic approach to managing sensitive information and ensuring its confidentiality, integrity, and availability Correct answer.
  3. To replace the need for legal and regulatory compliance activities
  4. To specify the exact technical controls required for securing all information assets

Explanation

An ISMS is a systematic approach to managing information security risks, ensuring the confidentiality, integrity, and availability of information. It does not guarantee absolute security, nor does it prescribe specific technical controls; it is a management framework.

Question 27Information security management system (ISMS) fundamentals and the ISO/IEC 27001 standard

Which document typically defines the boundaries and applicability of an ISMS?

  1. The information security policy
  2. The risk treatment plan
  3. The ISMS scope statement Correct answer.
  4. The Statement of Applicability

Explanation

The scope statement defines the boundaries and applicability of the ISMS, specifying which parts of the organization and which information assets are covered. The Statement of Applicability lists controls, the risk treatment plan details how risks will be treated, and the information security policy sets high-level direction.

Question 28Information security management system (ISMS) fundamentals and the ISO/IEC 27001 standard

Which of the following best describes the relationship between ISO/IEC 27001 and ISO/IEC 27002?

  1. ISO/IEC 27001 specifies requirements for an ISMS, while ISO/IEC 27002 provides guidance on information security controls. Correct answer.
  2. ISO/IEC 27001 and ISO/IEC 27002 are identical standards with different titles.
  3. ISO/IEC 27001 is for IT departments, while ISO/IEC 27002 is for executive management.
  4. ISO/IEC 27001 provides a code of practice for controls, while ISO/IEC 27002 specifies certification requirements.

Explanation

ISO/IEC 27001 contains the requirements against which an ISMS can be certified, while ISO/IEC 27002 offers guidance on selecting and implementing information security controls. They are complementary but distinct standards.

Question 29Information security management system (ISMS) fundamentals and the ISO/IEC 27001 standard

What is the purpose of the Statement of Applicability (SoA) in an ISMS?

  1. To list all employees and their security responsibilities
  2. To document the selected controls and justify their inclusion or exclusion Correct answer.
  3. To record the results of internal audits
  4. To provide a summary of the risk assessment methodology

Explanation

The SoA is a document that lists the controls selected from Annex A (or other sources) and provides justification for their inclusion or exclusion, along with their implementation status. It is a key requirement of ISO/IEC 27001.

Question 30Information security management system (ISMS) fundamentals and the ISO/IEC 27001 standard

Which of the following is a mandatory document required by ISO/IEC 27001?

  1. A training schedule
  2. An asset inventory
  3. A business continuity plan
  4. A risk treatment plan Correct answer.

Explanation

ISO/IEC 27001 explicitly requires a risk treatment plan as documented information. While business continuity plans, asset inventories, and training schedules may be necessary to support controls, they are not universally mandatory documents under the standard.

Question 31Information security management system (ISMS) fundamentals and the ISO/IEC 27001 standard

What is the primary role of top management in an ISMS according to ISO/IEC 27001?

  1. To conduct internal audits
  2. To perform technical vulnerability assessments
  3. To manage the day-to-day operation of security controls
  4. To demonstrate leadership and commitment by ensuring the ISMS is integrated into the organization's processes Correct answer.

Explanation

ISO/IEC 27001 requires top management to demonstrate leadership and commitment, including integrating ISMS requirements into the organization's processes and ensuring resources are available. Operational tasks like audits and vulnerability assessments are typically delegated.

Question 32Information security management system (ISMS) fundamentals and the ISO/IEC 27001 standard

Which of the following best describes 'risk appetite' in the context of an ISMS?

  1. The likelihood that a risk will occur
  2. The total number of risks identified in a risk assessment
  3. The process of identifying and assessing risks
  4. The amount and type of risk that an organization is willing to pursue or retain Correct answer.

Explanation

Risk appetite is the amount and type of risk that an organization is willing to pursue or retain. It guides decision-making on risk treatment and acceptance.

Question 33Information security management system (ISMS) fundamentals and the ISO/IEC 27001 standard

What is the main objective of the 'Act' phase in the Plan-Do-Check-Act (PDCA) cycle for an ISMS?

  1. To implement the risk treatment plan
  2. To take corrective actions and improve the ISMS Correct answer.
  3. To monitor and measure ISMS performance
  4. To establish the ISMS scope and policy

Explanation

The 'Act' phase focuses on taking corrective actions based on the results of monitoring and audits, and on continually improving the ISMS. Implementation occurs in 'Do', monitoring in 'Check', and establishment in 'Plan'.

Question 34Information security management system (ISMS) fundamentals and the ISO/IEC 27001 standard

An organization is determining the scope of its ISMS. Which of the following should be considered as part of the scope definition?

  1. The marketing plan for new products
  2. The financial performance of the organization
  3. The organization's overall business strategy
  4. The external and internal issues relevant to the ISMS Correct answer.

Explanation

When defining the ISMS scope, the organization must consider external and internal issues, as well as the needs and expectations of interested parties. Business strategy, financial performance, and marketing plans are not direct inputs to scope definition.

Question 35Information security management system (ISMS) fundamentals and the ISO/IEC 27001 standard

During a risk assessment, an organization identifies a risk and decides to implement a new control to reduce it. This is an example of which risk treatment option?

  1. Risk avoidance
  2. Risk transfer
  3. Risk mitigation Correct answer.
  4. Risk acceptance

Explanation

Implementing a control to reduce risk is risk mitigation (or reduction). Avoidance would mean not undertaking the activity, transfer would involve sharing the risk (e.g., insurance), and acceptance would mean retaining the risk without further action.

Question 36Information security management system (ISMS) fundamentals and the ISO/IEC 27001 standard

An organization has identified a risk that exceeds its risk acceptance criteria. According to ISO/IEC 27001, what must the organization do?

  1. Ignore the risk because it is within the risk appetite
  2. Immediately report the risk to the certification body
  3. Document the risk in the risk register without further action
  4. Implement controls to treat the risk and produce a Statement of Applicability Correct answer.

Explanation

When a risk exceeds acceptance criteria, the organization must treat it by selecting and implementing appropriate controls, and document the selected controls in the Statement of Applicability. Reporting to the certification body is not required, and ignoring or merely documenting the risk is insufficient.

Question 37Information security management system (ISMS) fundamentals and the ISO/IEC 27001 standard

Which of the following is an example of an internal interested party for an ISMS?

  1. A customer
  2. A supplier
  3. An employee Correct answer.
  4. A regulatory body

Explanation

Interested parties can be internal or external. Employees are internal interested parties, while regulators, suppliers, and customers are external.

Question 38Information security management system (ISMS) fundamentals and the ISO/IEC 27001 standard

What is the purpose of a risk treatment plan?

  1. To record the results of internal audits
  2. To list all identified risks without any treatment decisions
  3. To document the selected risk treatment options and the controls to implement Correct answer.
  4. To define the ISMS scope and boundaries

Explanation

The risk treatment plan documents the selected risk treatment options, the controls chosen to implement them, and other necessary actions. It is a key input for implementing the ISMS.

Question 39Information security management system (ISMS) fundamentals and the ISO/IEC 27001 standard

Which of the following best describes a 'nonconformity' in the context of an ISMS?

  1. A planned activity that has not yet been implemented
  2. A risk that has been accepted
  3. A failure to meet a requirement Correct answer.
  4. An opportunity for improvement

Explanation

A nonconformity is the failure to meet a requirement specified in the standard or the organization's own ISMS requirements. It requires corrective action.

Question 40Information security management system (ISMS) fundamentals and the ISO/IEC 27001 standard

An organization is implementing an ISMS and wants to ensure it complies with ISO/IEC 27001. Which of the following is a mandatory requirement for the 'Performance evaluation' clause?

  1. Monitoring, measurement, analysis, and evaluation of information security performance Correct answer.
  2. Implementing an intrusion detection system
  3. Performing a business impact analysis
  4. Conducting a penetration test

Explanation

ISO/IEC 27001 requires organizations to monitor, measure, analyze, and evaluate information security performance and the effectiveness of the ISMS. Penetration tests, business impact analyses, and intrusion detection systems are controls or techniques that may support this but are not mandatory requirements of the clause.

Question 41Information security management system (ISMS) fundamentals and the ISO/IEC 27001 standard

What is the purpose of a management review in an ISMS?

  1. To conduct a detailed technical audit of security controls
  2. To ensure the continuing suitability, adequacy, and effectiveness of the ISMS Correct answer.
  3. To perform a risk assessment for the coming year
  4. To approve the risk treatment plan for the first time

Explanation

Management review is a periodic activity where top management reviews the ISMS to ensure its continuing suitability, adequacy, and effectiveness. It considers inputs such as audit results and performance metrics, and makes decisions on improvement.

Question 42Information security management system (ISMS) fundamentals and the ISO/IEC 27001 standard

Which of the following is an example of an 'interested party' that may have requirements relevant to an ISMS?

  1. A shareholder
  2. A regulatory authority Correct answer.
  3. A trade union
  4. A competitor

Explanation

Interested parties are those that can affect, be affected by, or perceive themselves to be affected by a decision or activity. Regulatory authorities often impose legal requirements that the ISMS must address. Competitors, shareholders, and trade unions may have interests but are not typically considered in the context of ISMS requirements unless they impose specific obligations.

Question 43Information security management system (ISMS) fundamentals and the ISO/IEC 27001 standard

An organization decides to exclude a control from Annex A in its Statement of Applicability. What must the organization do?

  1. Document the exclusion in the risk treatment plan only
  2. Provide a justification for the exclusion Correct answer.
  3. Implement a compensating control from another standard
  4. Obtain approval from the certification body

Explanation

The Statement of Applicability must include justification for inclusions and exclusions of controls. This ensures transparency and demonstrates that the decision was based on risk assessment.

Question 44Information security management system (ISMS) fundamentals and the ISO/IEC 27001 standard

Which of the following best describes the concept of 'residual risk'?

  1. The risk that remains after risk treatment Correct answer.
  2. The risk that is transferred to a third party
  3. The risk that is accepted without treatment
  4. The risk that has not been identified

Explanation

Residual risk is the risk remaining after risk treatment measures have been applied. It is distinct from inherent risk (before treatment) and from transferred or accepted risk, which are treatment options.

Question 45Information security management system (ISMS) fundamentals and the ISO/IEC 27001 standard

An organization is updating its ISMS and wants to ensure continual improvement. Which of the following is a key activity for continual improvement?

  1. Establishing measurable information security objectives
  2. Identifying and acting on opportunities for improvement Correct answer.
  3. Conducting regular risk assessments
  4. Implementing all Annex A controls

Explanation

Continual improvement involves identifying opportunities for improvement and implementing actions to enhance the ISMS. While risk assessments and objectives are important, they are not the primary focus of continual improvement.

Question 46Information security management system (ISMS) fundamentals and the ISO/IEC 27001 standard

What is the purpose of an internal audit program in an ISMS?

  1. To perform technical vulnerability scanning
  2. To identify and punish employees who violate security policies
  3. To replace the need for external certification audits
  4. To provide assurance that the ISMS conforms to the organization's own requirements and the standard Correct answer.

Explanation

Internal audits provide assurance that the ISMS conforms to planned arrangements and the requirements of ISO/IEC 27001, and that it is effectively implemented and maintained. They are not for punishment, do not replace external audits, and are not technical scans.

Question 47Information security management system (ISMS) fundamentals and the ISO/IEC 27001 standard

An organization has a risk that is within its risk acceptance criteria. What is the most appropriate action according to ISO/IEC 27001?

  1. Accept the risk and document the decision Correct answer.
  2. Avoid the risk by ceasing the activity
  3. Treat the risk to reduce it further
  4. Transfer the risk to a third party

Explanation

If a risk is within the organization's risk acceptance criteria, it can be accepted. The decision should be documented, and the risk should be monitored. Further treatment is not necessary unless circumstances change.

Question 48Information security management system (ISMS) fundamentals and the ISO/IEC 27001 standard

Which of the following best describes the relationship between the ISMS and the organization's business processes?

  1. The ISMS should be integrated with the organization's business processes Correct answer.
  2. The ISMS should operate independently of business processes
  3. The ISMS should only cover IT processes
  4. The ISMS should replace existing business processes

Explanation

ISO/IEC 27001 emphasizes that the ISMS should be integrated into the organization's business processes. This ensures that information security is part of everyday operations and supports the organization's objectives.

Question 49Information security management system (ISMS) fundamentals and the ISO/IEC 27001 standard

An organization is considering whether to implement a control from Annex A. What should primarily guide this decision?

  1. The cost of the control
  2. The popularity of the control among peers
  3. The recommendation of the IT department
  4. The risk assessment and risk treatment process Correct answer.

Explanation

The selection of controls should be based on the risk assessment and risk treatment process. Controls are chosen to mitigate identified risks, not based on cost, popularity, or departmental preference alone.

Question 50Information security management system (ISMS) fundamentals and the ISO/IEC 27001 standard

How does ISO/IEC 27001 address the concept of 'outsourcing' or 'supplier relationships'?

  1. It requires organizations to assess and manage risks associated with suppliers and third parties Correct answer.
  2. It prohibits outsourcing of any information security functions
  3. It requires all suppliers to be certified to ISO/IEC 27001
  4. It excludes supplier relationships from the ISMS scope

Explanation

ISO/IEC 27001 requires organizations to manage risks associated with suppliers and third parties that affect information security. It does not prohibit outsourcing, require supplier certification, or exclude suppliers from the ISMS scope.