I85PREP
⌘ K
ISO 27001 Internal Auditor study materials
ISO 27001 Internal Auditor study resources

ISO 27001 Internal Auditor practice questions

One question at a time. Build your ISO 27001 Internal Auditor understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Fundamental concepts and principles of information security

In ISO/IEC 27001 terms, what does the CIA triad refer to?

  1. Confidentiality, Integrity and Availability Correct answer.
  2. Control, Implementation and Assessment
  3. Certification, Improvement and Accreditation
  4. Compliance, Inspection and Audit

Explanation

The CIA triad is the foundational model of information security: confidentiality keeps information from unauthorized disclosure, integrity keeps it accurate and complete, and availability ensures it is accessible to authorized users when needed. ISO/IEC 27001 controls are organized around these three properties.

Question 2Fundamental concepts and principles of information security

An internal auditor is told that a server room has a fire suppression system and badge-controlled doors. Which property of information security do these controls most directly support?

  1. Integrity
  2. Confidentiality
  3. Non-repudiation
  4. Availability Correct answer.

Explanation

Physical protections such as fire suppression and access-controlled doors primarily protect the continued operation of systems and data, which is availability. Badge control also has a confidentiality angle, but the fire suppression element makes availability the dominant and most defensible answer.

Question 3Fundamental concepts and principles of information security

Which statement best describes the relationship between an information security policy and an information security objective?

  1. A policy applies only to external parties, while an objective applies only to employees.
  2. A policy expresses management intent and direction, while an objective is a measurable result to be achieved. Correct answer.
  3. A policy is a measurable target, while an objective is a statement of management intent.
  4. A policy and an objective are synonyms and may be used interchangeably in the standard.

Explanation

In ISO/IEC 27001 the top-level policy states management's intent and direction for information security. Objectives translate that intent into measurable outcomes that the management system is expected to achieve and monitor.

Question 4Fundamental concepts and principles of information security

Which of the following is the best example of an asset in an information security management system?

  1. A risk treatment option
  2. An audit finding
  3. A customer database stored on a shared server Correct answer.
  4. A nonconformity report

Explanation

An asset is anything that has value to the organization and therefore requires protection, such as information, systems, people, and facilities. A customer database is a clear information asset. Risk options, findings, and nonconformities are management artifacts, not assets.

Question 5Fundamental concepts and principles of information security

In risk terminology, what is the difference between a threat and a vulnerability?

  1. A threat is always internal, while a vulnerability is always external.
  2. A threat is a potential cause of an incident, while a vulnerability is a weakness that can be exploited. Correct answer.
  3. A threat is a weakness in a control, while a vulnerability is a potential cause of harm.
  4. A threat is measured in currency, while a vulnerability is measured in time.

Explanation

A threat is a potential cause of an unwanted incident, such as an attacker or malware. A vulnerability is a weakness in an asset or control that a threat could exploit. Keeping these distinct is essential when assessing risk.

Question 6Fundamental concepts and principles of information security

Which term describes the level of risk that an organization is willing to accept in pursuit of its objectives?

  1. Risk register
  2. Inherent risk
  3. Risk appetite Correct answer.
  4. Residual risk

Explanation

Risk appetite is the amount and type of risk an organization is willing to accept. It guides decisions about whether risk treatment is needed. Residual risk is what remains after treatment, and inherent risk is the level before controls.

Question 7Fundamental concepts and principles of information security

What is the primary purpose of applying the principle of least privilege?

  1. To guarantee that backups are taken at regular intervals
  2. To reduce the cost of software licensing across the organization
  3. To limit access rights to only what is required for a user's tasks Correct answer.
  4. To ensure every employee can access all systems during an emergency

Explanation

Least privilege restricts access rights to the minimum necessary for a person or process to perform its function. This reduces the attack surface and the impact of compromised accounts. It is a core access control principle in ISO/IEC 27001.

Question 8Fundamental concepts and principles of information security

Which statement about defense in depth is correct?

  1. It layers multiple independent controls so that failure of one does not expose the asset completely. Correct answer.
  2. It relies on a single strong control to protect all assets.
  3. It eliminates the need for risk assessment.
  4. It applies only to physical security of data centers.

Explanation

Defense in depth uses multiple overlapping controls across people, process, and technology so that a single failure does not lead to compromise. It complements, rather than replaces, risk assessment. The approach spans physical, technical, and administrative layers.

Question 9Fundamental concepts and principles of information security

During an audit, an auditor finds that a risk assessment was performed once when the ISMS was established and has not been repeated. Which principle of the ISMS is most clearly violated?

  1. Risk assessment should be repeated at planned intervals and when significant changes occur Correct answer.
  2. Risk assessment should be documented in a single language
  3. Risk assessment should always result in a residual risk of zero
  4. Risk assessment should only be performed by external consultants

Explanation

ISO/IEC 27001 requires risk assessment to be performed at planned intervals and when significant changes are proposed or occur. A one-time assessment cannot reflect evolving threats and business conditions. Reviewing it periodically keeps the ISMS current.

Question 10Fundamental concepts and principles of information security

A control that reduces the likelihood of an incident is best described as which type of control?

  1. Corrective
  2. Preventive Correct answer.
  3. Compensating
  4. Detective

Explanation

Preventive controls act before an incident to stop it from occurring, thereby reducing likelihood. Detective controls identify incidents after they happen, and corrective controls restore conditions afterwards. Reducing likelihood is the hallmark of prevention.

Question 11Fundamental concepts and principles of information security

Which of the following best illustrates the concept of segregation of duties?

  1. One administrator both approves and executes all financial payments
  2. All staff share a single administrative account
  3. The person who requests a payment is different from the person who approves it Correct answer.
  4. The same team develops and tests its own code without review

Explanation

Segregation of duties divides critical tasks among different people so that no single individual can complete a sensitive transaction alone. Separating the requester from the approver reduces the risk of error and fraud. This is a key organizational control.

Question 12Fundamental concepts and principles of information security

An auditor observes that the organization stores backup tapes in the same room as the production servers. Which security property is most directly undermined?

  1. Availability Correct answer.
  2. Integrity
  3. Confidentiality
  4. Accountability

Explanation

Keeping backups in the same location as production means a single event, such as fire or flood, could destroy both primary and backup data. That directly threatens availability of information. Geographic separation of backups is a standard resilience measure.

Question 13Fundamental concepts and principles of information security

Which statement correctly distinguishes an incident from an event in information security?

  1. An event is always malicious, while an incident is always accidental
  2. An event is any observable occurrence, while an incident is an event that indicates a possible breach of security Correct answer.
  3. Events and incidents are identical and the terms are interchangeable
  4. An incident is a single occurrence, while an event is a series of incidents

Explanation

An event is any observable occurrence in a system or network, most of which are benign. An incident is an event, or series of events, that indicates a possible security breach or failure of controls. The distinction matters for incident reporting and response.

Question 14Fundamental concepts and principles of information security

What is the main purpose of classifying information?

  1. To reduce the number of employees who can access the intranet
  2. To ensure that protection is proportionate to the value and sensitivity of the information Correct answer.
  3. To satisfy software licensing requirements
  4. To eliminate the need for access control lists

Explanation

Information classification assigns levels based on sensitivity and value so that handling and protection measures can be applied proportionately. It helps ensure that sensitive information receives stronger controls than public information. Classification is a foundation for access control and handling rules.

Question 15Fundamental concepts and principles of information security

Which of the following best describes the concept of residual risk?

  1. The risk that exists before any controls are applied
  2. The risk that remains after risk treatment has been applied Correct answer.
  3. The risk that is accepted by the board without documentation
  4. The risk that is transferred to a third party

Explanation

Residual risk is what remains after controls and treatment decisions have been implemented. Auditors compare residual risk against the organization's risk appetite to judge whether further treatment is needed. It is distinct from inherent risk, which exists before controls.

Question 16Fundamental concepts and principles of information security

An organization encrypts customer records at rest and in transit. Which security property is this control primarily intended to protect?

  1. Confidentiality Correct answer.
  2. Availability
  3. Non-repudiation
  4. Integrity

Explanation

Encryption protects information from being read by unauthorized parties, both when stored and when transmitted. That directly supports confidentiality. Integrity and availability are supported by other mechanisms such as hashing, backups, and redundancy.

Question 17Fundamental concepts and principles of information security

In the context of ISO/IEC 27001, what is an interested party?

  1. Any external auditor certified by an accreditation body
  2. A person or organization that can affect, be affected by, or perceive itself to be affected by a decision or activity Correct answer.
  3. A supplier that has signed a non-disclosure agreement
  4. Only the organization's shareholders

Explanation

An interested party is any person or organization that can affect, be affected by, or perceive itself to be affected by a decision or activity. This includes customers, regulators, employees, and suppliers. Identifying them helps determine ISMS requirements and expectations.

Question 18Fundamental concepts and principles of information security

Which statement best captures the principle of accountability in information security?

  1. Access rights are granted permanently once approved
  2. All users share a common administrator account for convenience
  3. Actions on systems can be attributed to a specific individual or entity Correct answer.
  4. Audit logs are optional and may be deleted at any time

Explanation

Accountability means that actions can be traced back to the responsible individual or entity, typically through unique identities and audit logging. This deters misuse and supports investigation. Shared accounts and deleted logs undermine accountability.

Question 19Fundamental concepts and principles of information security

An auditor notes that a risk treatment plan lists a control but no owner and no target date. Which aspect of risk treatment is weakest?

  1. The assignment of responsibility and scheduling for implementation Correct answer.
  2. The selection of the risk assessment methodology
  3. The identification of threats
  4. The classification of information assets

Explanation

A risk treatment plan must specify who is responsible and when the treatment will be completed so that it can be tracked and verified. Without an owner and target date, implementation cannot be managed or audited effectively. This is a common gap in treatment planning.

Question 20Fundamental concepts and principles of information security

Which of the following best describes the purpose of an information security management system (ISMS)?

  1. To replace the need for technical security controls
  2. To provide a systematic framework for managing information security risks and obligations Correct answer.
  3. To serve as a one-time certification project
  4. To guarantee that no security incidents will ever occur

Explanation

An ISMS is a systematic approach of policies, processes, and controls for managing information security risk and meeting obligations. It is a continuing management system, not a guarantee against incidents. It complements technical controls rather than replacing them.

Question 21Fundamental concepts and principles of information security

A threat actor exploits a known software flaw for which a patch has been available for months. Which weakness most likely contributed to this outcome?

  1. The organization conducted a business impact analysis
  2. The organization used strong encryption for data at rest
  3. The organization implemented segregation of duties in finance
  4. The organization applied patch management inconsistently Correct answer.

Explanation

Unpatched software is a vulnerability, and inconsistent patch management allows known flaws to remain exploitable. The scenario describes a failure to remediate a known weakness in a timely manner. Patch management is a key preventive control.

Question 22Fundamental concepts and principles of information security

An organization decides to purchase cyber insurance to cover potential losses from security incidents. Which risk treatment option does this represent?

  1. Risk avoidance
  2. Risk modification
  3. Risk transfer Correct answer.
  4. Risk retention

Explanation

Purchasing insurance transfers some of the financial consequence of risk to a third party. Avoidance eliminates the activity, modification reduces the risk, and retention accepts it. Insurance is a classic example of transfer.

Question 23Fundamental concepts and principles of information security

An auditor finds that a control designed to detect unauthorized changes relies on logs that are stored on the same server being monitored and are writable by system administrators. What is the most significant weakness?

  1. The control should have been classified as corrective rather than detective
  2. The control cannot reliably detect or evidence tampering because the evidence can be altered by those it monitors Correct answer.
  3. The control duplicates an existing preventive control
  4. The control uses too much storage capacity on the server

Explanation

If administrators can modify the logs on the monitored system, they can erase evidence of unauthorized changes, undermining the detective control and its evidentiary value. Logs should be protected and sent to a separate, restricted system. This preserves integrity and accountability.

Question 24Fundamental concepts and principles of information security

Two controls are proposed for the same risk: one reduces likelihood and one reduces impact. How should the auditor interpret this in relation to risk?

  1. Neither control affects risk because risk is fixed once assessed
  2. The control reducing impact always makes the other control redundant
  3. Only the control reducing likelihood matters because impact cannot be managed
  4. Both can lower the overall risk level, since risk depends on both likelihood and consequence Correct answer.

Explanation

Risk is commonly understood as a function of the likelihood of an event and its consequences. Controls that reduce either dimension lower the overall risk level. Auditors should recognize that both types of control contribute to bringing risk within appetite.

Question 25Fundamental concepts and principles of information security

An organization treats a risk by outsourcing a service to a supplier, believing the risk is now the supplier's problem. Which principle should the auditor apply?

  1. Supplier risk never needs to be documented in the ISMS
  2. The organization retains accountability for risk arising from external parties and must manage supplier relationships Correct answer.
  3. Outsourcing always eliminates the organization's responsibility for the risk
  4. Risk transfer removes the need for monitoring supplier performance

Explanation

Outsourcing can transfer or share some risk, but the organization remains accountable for the information it entrusts to suppliers. ISO/IEC 27001 requires controls for supplier relationships, including monitoring and review. The auditor should verify that supplier risk is managed, not assumed away.

Question 26Fundamental concepts and principles of information security

In ISO/IEC 27001 terms, which statement correctly expresses the relationship between confidentiality, integrity and availability?

  1. They apply only to electronically stored data and not to information held on paper or spoken in meetings.
  2. They are alternative approaches, so an organization selects only one of them for its ISMS scope.
  3. They are ranked in strict order of importance, with confidentiality always taking precedence over the other two.
  4. They are three separate properties that must each be considered when protecting information, and a control may support more than one of them at the same time. Correct answer.

Explanation

Confidentiality, integrity and availability are the three core information security properties, and ISO/IEC 27001 requires the organization to consider them together when defining controls. A single control can serve several properties; for example, access control supports confidentiality while backup and logging support availability and integrity. None of them is universally ranked above the others, and the properties apply to information in any form.

Question 27Fundamental concepts and principles of information security

An auditor reviews an access request showing that a finance analyst was granted read access to the payroll database to help close the annual accounts. Which information security principle does the auditor primarily assess when questioning whether this access should persist after the close?

  1. Defense in depth, because several layers of control should protect the payroll database.
  2. Least privilege, because access should be limited to what the task requires for as long as it is required. Correct answer.
  3. Availability, because payroll data must remain accessible during the audit.
  4. Non-repudiation, because the analyst must be unable to deny having viewed the records.

Explanation

Least privilege means granting only the access necessary to perform a defined task, and the principle also implies that such access should be time-bound or removed when the need ends. Temporary access granted for a specific activity should therefore be reviewed and revoked once that activity is complete. The other properties concern availability, proof of action and layered protection, none of which addresses the persistence of excessive rights.

Question 28Fundamental concepts and principles of information security

An auditor examines how the organization identifies and evaluates threats, vulnerabilities and potential consequences in order to decide how information assets should be protected. Which activity is the auditor examining?

  1. Configuration baseline management
  2. Incident triage and escalation
  3. Information security risk assessment Correct answer.
  4. Business continuity exercising

Explanation

Risk assessment is the process of identifying risks to information and information processing by analyzing threats and vulnerabilities and evaluating potential consequences, which then informs the selection of controls. ISO/IEC 27001 requires this process to be defined and applied consistently. Continuity exercising, baseline management and incident triage are operational activities that may follow from or support risk decisions but do not themselves determine protection needs.

Question 29Fundamental concepts and principles of information security

An organization states that only staff in the procurement team may approve new suppliers, and that the same person who approves a supplier must not also perform the supplier's security review. Which pair of concepts does this arrangement most directly combine?

  1. Need-to-know and data minimization
  2. Segregation of duties and authorization limits Correct answer.
  3. Asset ownership and acceptable use
  4. Availability and redundancy

Explanation

Segregation of duties separates conflicting responsibilities so that no single person can complete a sensitive process alone, while authorization limits define who is permitted to approve a given action. Restricting supplier approval to the procurement team and separating approval from security review combines both ideas. Need-to-know, redundancy, asset ownership and acceptable use address different concerns such as access on a need basis, resilience, accountability for assets and rules for use.

Question 30Information security management system (ISMS)

An internal auditor is planning an ISO/IEC 27001 audit of the ISMS scope. Which document must define the boundaries and applicability of the information security management system?

  1. The risk treatment plan
  2. The information security policy
  3. The Statement of Applicability
  4. The scope statement of the ISMS Correct answer.

Explanation

Clause 4.3 requires the organization to determine the boundaries and applicability of the ISMS and to make a scope statement available as documented information. The scope statement establishes what is inside and outside the management system, which frames every later audit activity.

Question 31Information security management system (ISMS)

During an internal audit, an auditor finds that top management reviewed the ISMS but no record of the management review exists. How should the auditor treat this finding?

  1. As a minor issue only if a security incident has already occurred
  2. As an observation only, because management review is a voluntary activity
  3. As not applicable, because internal audit cannot verify management activities
  4. As a nonconformity, because documented information of management review results is required Correct answer.

Explanation

Clause 9.3 requires management review at planned intervals, and clause 7.5 requires retaining documented information as evidence of results. Absence of the record means the auditor cannot verify the review occurred, which is a nonconformity against the standard's documentation requirement.

Question 32Information security management system (ISMS)

Which characteristic distinguishes an ISMS internal audit from a third-party certification audit?

  1. The internal audit is performed by the organization itself or on its behalf, while certification is performed by an external body Correct answer.
  2. The internal audit can ignore the Statement of Applicability
  3. The internal audit does not need defined audit criteria
  4. The internal audit must always use a different version of ISO/IEC 27001

Explanation

Clause 9.2 describes internal audits as conducted by the organization or on its behalf, whereas certification audits are performed by an independent certification body. Both types still require defined criteria and evidence-based evaluation.

Question 33Information security management system (ISMS)

An organization's risk assessment identifies a risk but the risk treatment plan shows no selected option. Which clause requirement is most directly unfulfilled?

  1. Clause 7.4, which requires internal communication of risks
  2. Clause 6.1.3, which requires a risk treatment plan and approval of residual risk Correct answer.
  3. Clause 8.1, which requires operational planning and control
  4. Clause 9.1, which requires monitoring and measurement

Explanation

Clause 6.1.3 requires the organization to formulate a risk treatment plan that selects appropriate treatment options and to obtain approval of residual risks by risk owners. A risk without a selected treatment option directly contradicts this requirement.

Question 34Information security management system (ISMS)

What is the primary purpose of the Statement of Applicability in an ISO/IEC 27001 audit?

  1. To list all security incidents recorded in the last year
  2. To describe the organization's security awareness training content
  3. To record which Annex A controls are applicable, why, and whether they are implemented Correct answer.
  4. To define the audit programme and schedule

Explanation

Clause 6.1.3 requires a Statement of Applicability that identifies the necessary controls, justifies inclusion or exclusion, and records implementation status. Auditors use it to test the completeness and consistency of the risk treatment decisions.

Question 35Information security management system (ISMS)

An auditor is checking whether the ISMS addresses interested parties. Which clause should the auditor reference?

  1. Clause 6.2, which requires information security objectives
  2. Clause 10.1, which requires continual improvement
  3. Clause 5.1, which requires leadership commitment
  4. Clause 4.2, which requires determining relevant interested parties and their requirements Correct answer.

Explanation

Clause 4.2 requires the organization to determine interested parties relevant to the ISMS and the requirements of those parties. Audit evidence would include analysis of legal, regulatory, and contractual requirements affecting information security.

Question 36Information security management system (ISMS)

Which outcome is expected from the internal audit process under clause 9.2?

  1. A revised Statement of Applicability signed by the auditor
  2. A certification decision issued by the audit team
  3. A report of audit results communicated to relevant management Correct answer.
  4. A list of disciplinary actions for employees

Explanation

Clause 9.2 requires the organization to retain documented information as evidence of the audit programme and audit results, and results must be reported to relevant management. Internal auditors do not make certification decisions or personnel disciplinary rulings.

Question 37Information security management system (ISMS)

An auditor reviews a risk assessment and finds it was performed but never repeated since the initial certification three years ago. Which requirement is most relevant?

  1. Clause 6.1.2, which requires risk assessment at planned intervals or when significant change occurs Correct answer.
  2. Clause 5.2, which requires a communicated policy
  3. Clause 7.5.2, which requires documented information to be created and updated
  4. Clause 9.2.2, which requires an audit programme

Explanation

Clause 6.1.2 requires information security risk assessments to be performed at planned intervals or when significant changes are proposed or occur. A three-year-old assessment with no planned repetition suggests the interval requirement is not being met.

Question 38Information security management system (ISMS)

An auditor finds that a firewall rule allowing broad inbound access was changed without a documented approval. Which Annex A control area is most directly implicated?

  1. A.6, people controls relating to screening and awareness
  2. A.7, physical controls relating to secure areas
  3. A.8, technological controls relating to change management and network security Correct answer.
  4. A.5, organizational controls relating to policies and responsibilities

Explanation

Firewall rule changes are technological controls addressed under Annex A.8, particularly change management and network security controls. The absence of documented approval indicates a weakness in the change management process for technology infrastructure.

Question 39Information security management system (ISMS)

An auditor is sampling access reviews for a critical application. Which evidence best demonstrates that access rights are periodically reviewed?

  1. Quarterly review records showing reviewer identity, decisions, and removal of inappropriate rights Correct answer.
  2. An access control policy signed by the CISO two years ago
  3. A screenshot of the user administration console
  4. A training slide deck describing access review procedures

Explanation

Evidence of periodic access review should show who performed the review, when, what decisions were made, and that inappropriate access was removed. A policy or procedure description alone does not demonstrate that the review activity actually occurred.

Question 40Information security management system (ISMS)

During an audit, a manager states that risk owners approve residual risks verbally. What should the auditor do first?

  1. Accept the statement and close the audit
  2. Immediately raise a major nonconformity without further investigation
  3. Report the issue to the certification body
  4. Seek documented evidence of approval, since clause 6.1.3 requires approval of residual risk by risk owners Correct answer.

Explanation

Auditors must verify statements with objective evidence rather than accepting assertions. Clause 6.1.3 requires risk owners to approve the risk treatment plan and residual risks, so the auditor should look for records demonstrating that approval.

Question 41Information security management system (ISMS)

Which pair of records best demonstrates compliance with clause 7.2 on competence?

  1. A job description and an organizational chart
  2. A signed confidentiality agreement
  3. A list of all employees and their hire dates
  4. Records of required competence, training completed, and evaluation of training effectiveness Correct answer.

Explanation

Clause 7.2 requires determining necessary competence, ensuring persons are competent, and retaining documented information as evidence of competence, including training and evaluation of effectiveness. Hire dates and job descriptions alone do not demonstrate competence.

Question 42Information security management system (ISMS)

An auditor observes that the ISMS risk register lists risks but no risk owners are assigned. Which conclusion is most defensible?

  1. Accountability for risk treatment is unclear, contrary to the requirement for risk owners to approve residual risk Correct answer.
  2. Risk owners are only needed for high risks
  3. The register should be deleted and rebuilt from scratch
  4. The risk register is complete because risks are identified

Explanation

Clause 6.1.3 requires risk owners to approve the risk treatment plan and accept residual risks, which presupposes identified ownership. Without assigned owners, accountability for treatment and acceptance is not established.

Question 43Information security management system (ISMS)

An organization outsources payroll processing to a supplier. Which audit focus is most appropriate for the ISMS internal auditor?

  1. Verifying the supplier's own internal audit reports only
  2. Reviewing supplier agreements, monitoring activities, and controls over supplier access to information Correct answer.
  3. Auditing the supplier's financial statements
  4. Confirming the supplier's marketing materials are accurate

Explanation

Annex A.5.19 to A.5.22 address supplier relationships, including agreements, monitoring, and management of supplier access and change. The auditor should examine how the organization governs and monitors the supplier rather than auditing the supplier's unrelated operations.

Question 44Information security management system (ISMS)

An auditor finds that information security objectives are stated in the policy but have no measurable targets or assigned responsibility. Which clause is most directly relevant?

  1. Clause 10.2, which requires correction of nonconformities
  2. Clause 6.2, which requires objectives to be measurable, monitored, communicated, and updated Correct answer.
  3. Clause 8.2, which requires information security risk assessment
  4. Clause 5.3, which requires defined roles and authorities

Explanation

Clause 6.2 requires information security objectives to be consistent with policy, measurable where practicable, monitored, communicated, and updated as appropriate. Objectives without targets or ownership do not meet these planning requirements.

Question 45Information security management system (ISMS)

Which situation best illustrates a nonconformity with clause 8.1 on operational planning and control?

  1. A risk assessment was updated after a new system was deployed
  2. A security policy was communicated to all staff
  3. A management review was held on schedule
  4. A documented backup procedure exists but backups are performed inconsistently with no oversight Correct answer.

Explanation

Clause 8.1 requires the organization to plan, implement, and control processes needed to meet ISMS requirements, including criteria and control of outsourced or inconsistent processes. A procedure that exists but is not consistently followed and controlled indicates a failure of operational control.

Question 46Information security management system (ISMS)

An auditor is evaluating the audit programme. Which element is required by clause 9.2.2?

  1. The programme must consider the importance of processes and results of previous audits Correct answer.
  2. The programme must be kept confidential from management
  3. The programme must be approved by the certification body
  4. The programme must use only external auditors

Explanation

Clause 9.2.2 requires the audit programme to consider the importance of processes, changes affecting the organization, and the results of previous audits. This risk-based planning ensures audit effort is directed where it matters most.

Question 47Information security management system (ISMS)

An auditor finds that a corrective action for a previously identified nonconformity was recorded but the root cause was never analysed. Which clause requirement is unmet?

  1. Clause 9.3, which requires management review inputs
  2. Clause 6.1.1, which requires considering external and internal issues
  3. Clause 10.2, which requires evaluating the need for action to eliminate the cause of a nonconformity Correct answer.
  4. Clause 7.5.3, which requires control of documented information

Explanation

Clause 10.2 requires the organization to react to nonconformities, evaluate the need for action to eliminate the root cause, implement action, review effectiveness, and retain documented information. Recording an action without root cause analysis fails the cause-elimination requirement.

Question 48Information security management system (ISMS)

An auditor reviewing incident management finds that incidents are logged but no post-incident review is performed. Which Annex A control theme is most relevant?

  1. A.8.11, covering data masking
  2. A.7.4, covering physical security monitoring
  3. A.5.24 to A.5.28, covering incident management planning, response, and learning Correct answer.
  4. A.6.3, covering awareness and training

Explanation

Annex A.5.24 to A.5.28 address incident management planning, preparation, assessment, response, and learning from incidents. A missing post-incident review indicates a weakness in the learning-from-incidents element of that control set.

Question 49Information security management system (ISMS)

An auditor is assessing whether the ISMS context analysis is adequate. Which evidence is most relevant?

  1. A copy of the network diagram
  2. An analysis of internal and external issues relevant to information security and their effect on the ISMS Correct answer.
  3. A summary of helpdesk ticket volumes
  4. A list of all IT assets and their serial numbers

Explanation

Clause 4.1 requires determining external and internal issues relevant to the organization's purpose and that affect its ability to achieve intended ISMS outcomes. Evidence should show this analysis and its linkage to ISMS planning.

Question 50Information security management system (ISMS)

An auditor interviews staff and finds that several cannot explain how to report a suspected security event. Which conclusion is most appropriate?

  1. An observation that can be ignored because no incident occurred
  2. A nonconformity against awareness and reporting obligations, since personnel must be aware of their contribution and reporting duties Correct answer.
  3. A nonconformity against physical security controls
  4. No issue, because reporting procedures are only relevant to IT staff

Explanation

Clause 7.3 requires persons doing work under the organization's control to be aware of the information security policy, their contribution to the ISMS, and the implications of not conforming. Annex A.6.3 and incident reporting controls further require staff to know how to report events promptly.