I85PREP
⌘ K
ISO 27001 LI study materials
ISO 27001 LI study resources

ISO 27001 LI practice questions

One question at a time. Build your ISO 27001 LI understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Fundamental concepts and principles of information security and the initiation of an ISMS implementation

Which information security property is preserved when information is not made available or disclosed to unauthorized individuals, entities or processes?

  1. Confidentiality Correct answer.
  2. Availability
  3. Integrity
  4. Non-repudiation

Explanation

Confidentiality is defined in ISO/IEC 27000 as the property that information is not made available or disclosed to unauthorized individuals, entities or processes. The other properties address correctness, accessibility and proof of origin rather than disclosure.

Question 2Fundamental concepts and principles of information security and the initiation of an ISMS implementation

Which term describes a potential cause of an unwanted incident that may result in harm to a system or organization?

  1. Risk
  2. Threat Correct answer.
  3. Vulnerability
  4. Impact

Explanation

A threat is a potential cause of an unwanted incident, whereas a vulnerability is a weakness that can be exploited by one or more threats. Risk combines the consequences of an event with its likelihood, and impact is one component of consequence.

Question 3Fundamental concepts and principles of information security and the initiation of an ISMS implementation

Which document records the Annex A controls an organization has selected and justifies why each remaining control is excluded?

  1. Statement of Applicability Correct answer.
  2. Information security policy
  3. Risk treatment plan
  4. Risk assessment report

Explanation

ISO/IEC 27001 clause 6.1.3 requires a Statement of Applicability that lists the necessary controls, justifies inclusions and exclusions, and records whether each control is implemented. It is the link between the risk assessment and the implemented control set.

Question 4Fundamental concepts and principles of information security and the initiation of an ISMS implementation

What is the main purpose of defining the scope of the ISMS?

  1. To assign an owner to each identified risk
  2. To set the ISMS boundaries and applicability Correct answer.
  3. To record all legal requirements that apply
  4. To list every asset owned by the organization

Explanation

Clause 4.3 requires the organization to determine the boundaries and applicability of the ISMS to establish its scope. The scope statement identifies what the management system covers, including interfaces and dependencies with external parties.

Question 5Fundamental concepts and principles of information security and the initiation of an ISMS implementation

In ISO/IEC 27001:2022, Annex A organizes its controls into how many themes?

  1. Seven
  2. Four Correct answer.
  3. Five
  4. Three

Explanation

The 2022 revision groups 93 controls into four themes: organizational, people, physical and technological. This replaced the previous 14-clause structure of Annex A.

Question 6Fundamental concepts and principles of information security and the initiation of an ISMS implementation

According to ISO/IEC 27000, information security is the preservation of which set of properties?

  1. Confidentiality, accuracy and traceability
  2. Integrity, accountability and authenticity
  3. Availability, resilience and privacy
  4. Confidentiality, integrity and availability Correct answer.

Explanation

ISO/IEC 27000 defines information security as the preservation of confidentiality, integrity and availability of information. Other properties such as authenticity, accountability, non-repudiation and reliability may also be involved.

Question 7Fundamental concepts and principles of information security and the initiation of an ISMS implementation

In ISO/IEC 27000 vocabulary, risk is usually expressed as a combination of which two factors?

  1. Threat capability and control cost
  2. Vulnerability count and audit findings
  3. Asset value and insurance cover
  4. Consequences of an event and its likelihood Correct answer.

Explanation

Risk is commonly expressed as the combination of the consequences of an event and the associated likelihood of occurrence. This is why risk assessment methods rate likelihood and impact separately before combining them.

Question 8Fundamental concepts and principles of information security and the initiation of an ISMS implementation

Under ISO/IEC 27001 clause 4.2, what must the organization determine about interested parties?

  1. Their audit schedule for the coming year
  2. Their preferred risk treatment options
  3. Their financial contribution to the ISMS budget
  4. Their relevant requirements and which of these will be addressed Correct answer.

Explanation

The organization must determine interested parties relevant to the ISMS and the requirements of these interested parties that are relevant to information security. It then decides which of those requirements will be addressed by the ISMS.

Question 9Fundamental concepts and principles of information security and the initiation of an ISMS implementation

A server holding customer records has no assigned owner, so nobody is responsible for its protection. Which principle does this most directly violate?

  1. Segregation of duties
  2. Defence in depth
  3. Accountability for assets Correct answer.
  4. Availability

Explanation

Assets should have a defined owner who is accountable for their protection and for maintaining appropriate controls. Without ownership, protection duties are undefined and cannot be enforced or reviewed.

Question 10Fundamental concepts and principles of information security and the initiation of an ISMS implementation

Which assessment expresses the level of risk before any controls are applied?

  1. Risk treatment
  2. Residual risk assessment
  3. Inherent risk assessment Correct answer.
  4. Control monitoring

Explanation

Inherent risk reflects the level of risk in the absence of controls, and it is compared with residual risk to judge how much treatment reduces exposure. Residual risk is what remains after treatment has been applied.

Question 11Fundamental concepts and principles of information security and the initiation of an ISMS implementation

Top management's risk appetite is used primarily to make which decision?

  1. Define the ISMS budget for the year
  2. Determine how many Annex A controls to implement
  3. Judge whether a level of risk can be accepted Correct answer.
  4. Set the audit frequency for suppliers

Explanation

Risk appetite expresses the amount and type of risk an organization is willing to pursue or retain, and risk acceptance criteria operationalize it. Risk owners use these criteria to decide whether a residual risk may be accepted or requires further treatment.

Question 12Fundamental concepts and principles of information security and the initiation of an ISMS implementation

At the start of an ISMS implementation, a gap analysis is performed mainly to do what?

  1. Calculate the total cost of the ISMS implementation project
  2. Produce the final certification audit report for the registrar
  3. Compare current practice with the standard's requirements Correct answer.
  4. Identify which employees will be transferred to the security team

Explanation

A gap analysis compares the organization's existing arrangements with the requirements of ISO/IEC 27001 to establish a baseline and prioritize implementation work. It is a planning input performed before the ISMS is built out, not an audit conclusion.

Question 13Fundamental concepts and principles of information security and the initiation of an ISMS implementation

ISO/IEC 27001 clause 5 requires top management to demonstrate leadership by doing what?

  1. Approving each individual risk treatment action
  2. Chairing every risk assessment workshop
  3. Delegating all ISMS decisions to the CISO
  4. Ensuring the policy aligns with the strategic direction Correct answer.

Explanation

Top management must ensure the information security policy and objectives are compatible with the organization's strategic direction. This is one of several leadership requirements in clause 5.1 that cannot be fully delegated.

Question 14Fundamental concepts and principles of information security and the initiation of an ISMS implementation

In the context of an ISMS, the Plan-Do-Check-Act cycle is best described as what?

  1. A model of continual improvement Correct answer.
  2. A taxonomy of security incidents
  3. A method for certifying products
  4. A technique for encrypting data at rest

Explanation

PDCA is the continual improvement model applied to the ISMS: plan establishes the system, do implements and operates it, check monitors and reviews it, and act maintains and improves it. It structures the lifecycle rather than any specific technical activity.

Question 15Fundamental concepts and principles of information security and the initiation of an ISMS implementation

An organization must control documented information required by its ISMS. What does this primarily involve?

  1. Storing every ISMS record for a fixed minimum of seven years
  2. Publishing all documents on the corporate intranet
  3. Controlling creation, distribution, access and retention Correct answer.
  4. Restricting documents to the security team only

Explanation

Clause 7.5 requires documented information to be controlled with respect to availability, suitability and adequacy of protection, covering distribution, access, retrieval, use, retention and disposal. Retention periods are set by the organization based on its own obligations, not by the standard.

Question 16Fundamental concepts and principles of information security and the initiation of an ISMS implementation

Digitally signing an email message primarily provides which property?

  1. Confidentiality
  2. Availability
  3. Scalability
  4. Non-repudiation Correct answer.

Explanation

A digital signature binds the signer to the message and supports non-repudiation, along with integrity verification. It does not, by itself, prevent others from reading the message.

Question 17Fundamental concepts and principles of information security and the initiation of an ISMS implementation

A system administrator holds full administrative rights on all servers. Which change best reflects the principle of least privilege?

  1. Share the administrator account among the team
  2. Grant only the rights needed for each task, reviewed regularly Correct answer.
  3. Remove all administrator accounts from the organization
  4. Require administrators to change passwords every week

Explanation

Least privilege means users receive only the access necessary for their assigned tasks, for the period required, with periodic review. It reduces the blast radius of misuse or compromise without eliminating necessary administrative capability.

Question 18Fundamental concepts and principles of information security and the initiation of an ISMS implementation

An organization layers preventive, detective and corrective controls across people, processes and technology. This illustrates which concept?

  1. Single point of failure
  2. Segregation of duties
  3. Risk transference
  4. Defence in depth Correct answer.

Explanation

Defence in depth uses multiple, diverse layers of controls so that the failure of one layer does not leave the asset unprotected. Combining preventive, detective and corrective controls is the practical expression of this principle.

Question 19Fundamental concepts and principles of information security and the initiation of an ISMS implementation

When ISO/IEC 27001 certification is issued, what does it certify?

  1. That every Annex A control is fully effective
  2. That all products are free of vulnerabilities
  3. That the ISMS conforms to the standard Correct answer.
  4. That no security incidents will occur

Explanation

Certification confirms that the organization's ISMS conforms to the requirements of ISO/IEC 27001 and is operated as described. It is not a guarantee about the absence of incidents, product quality or the absolute effectiveness of every control.

Question 20Fundamental concepts and principles of information security and the initiation of an ISMS implementation

Which statement best distinguishes a vulnerability from a risk?

  1. A vulnerability is always technical; a risk is always business-related
  2. A vulnerability is a potential cause; a risk is a weakness
  3. A vulnerability is measured in money; a risk is measured in days
  4. A vulnerability is a weakness that may be exploited; a risk is the effect of uncertainty Correct answer.

Explanation

A vulnerability is a weakness in an asset or control that one or more threats can exploit, while risk is the effect of uncertainty on objectives. Risk therefore depends on threat, vulnerability, likelihood and consequence together.

Question 21Fundamental concepts and principles of information security and the initiation of an ISMS implementation

Which statement about residual risk is most accurate?

  1. Residual risk is recorded only when a control fails
  2. Residual risk is always zero once controls are implemented
  3. Residual risk should be evaluated against the risk acceptance criteria Correct answer.
  4. Residual risk is only relevant for outsourced processes

Explanation

After treatment, risk owners compare the remaining risk with the agreed risk acceptance criteria to decide whether it can be accepted or needs further treatment. Residual risk is rarely zero because controls reduce rather than eliminate risk.

Question 22Fundamental concepts and principles of information security and the initiation of an ISMS implementation

How does a risk owner differ from an asset owner?

  1. The risk owner maintains the asset inventory and configuration
  2. The risk owner performs technical patching of the asset
  3. The risk owner is accountable for managing the risk and its treatment Correct answer.
  4. The risk owner approves the ISMS scope statement

Explanation

A risk owner has the authority and accountability to manage a particular risk, including approving and monitoring its treatment. An asset owner is accountable for a specific asset, including its classification and protection requirements.

Question 23Fundamental concepts and principles of information security and the initiation of an ISMS implementation

An organization decides that Annex A control 8.11 (data masking) is not applicable. What does ISO/IEC 27001 require?

  1. Nothing, because Annex A controls are optional
  2. A formal waiver signed by the certification auditor
  3. Justification recorded in the Statement of Applicability Correct answer.
  4. A separate risk assessment for each excluded control

Explanation

Clause 6.1.3 requires the Statement of Applicability to justify why a necessary control is included and why an excluded control is not applicable. Exclusions are permitted but must be reasoned and documented rather than silent.

Question 24Fundamental concepts and principles of information security and the initiation of an ISMS implementation

ISO/IEC 27001 shares a harmonized structure with other management system standards. What is the main benefit of this?

  1. It removes the need for risk assessment
  2. It replaces the need for Annex A controls
  3. It guarantees mutual recognition of certificates
  4. It eases integration with other management systems Correct answer.

Explanation

The harmonized structure uses common clause numbering and core text, which makes it simpler to integrate an ISMS with management systems such as quality or business continuity. It does not change the substantive security requirements.

Question 25Fundamental concepts and principles of information security and the initiation of an ISMS implementation

Clause 9.1 requires the organization to determine what needs to be monitored and measured. Which approach best meets this requirement?

  1. Measure only incidents that reach the media
  2. Define metrics, methods, timing and analysis responsibilities Correct answer.
  3. Record every event and review the logs annually
  4. Rely on the certification auditor to set the metrics

Explanation

Clause 9.1 requires determination of what is to be monitored and measured, the methods, when to perform monitoring and measurement, who analyses the results and when. This turns performance evaluation into a planned, repeatable activity.

Question 26Fundamental concepts and principles of information security and the initiation of an ISMS implementation

In ISO/IEC 27000 vocabulary, which description best matches a threat?

  1. Any information or related asset that the organization regards as having value to its business
  2. The combination of the likelihood of an unwanted event and its consequence for the organization
  3. A potential cause of an unwanted incident that may harm the organization Correct answer.
  4. A weakness in an asset or control that one or more sources can exploit to cause harm

Explanation

A threat is a potential cause of an unwanted incident; it becomes dangerous only when it can exploit a vulnerability. The standard keeps threat, vulnerability, risk and asset as separate concepts so that each can be analysed and treated differently.

Question 27Fundamental concepts and principles of information security and the initiation of an ISMS implementation

ISO/IEC 27001 clause 6.1.3 refers to risk treatment options. Which set correctly names those options?

  1. Modify, retain, avoid and share Correct answer.
  2. Plan, implement, check and improve
  3. Identify, analyse, evaluate and report
  4. Prevent, detect, correct and recover

Explanation

Risk treatment options are to modify the risk with controls, retain it within the acceptance criteria, avoid the activity that creates it, or share it with another party such as an insurer. These four choices come directly from the risk treatment requirements of the standard.

Question 28Fundamental concepts and principles of information security and the initiation of an ISMS implementation

Under ISO/IEC 27000 vocabulary, which statement best describes an information security incident?

  1. Unwanted or unexpected events with a significant probability of compromising business operations Correct answer.
  2. Any unscheduled outage of an IT service, regardless of its cause or business impact
  3. An occurrence that indicates a possible breach of information security or a failure of controls
  4. A confirmed legal breach that the organization must report to a supervisory authority

Explanation

An incident is a single event or series of unwanted events that has a significant probability of compromising business operations and threatening information security. The first option describes an information security event, which is a wider and less severe category that may or may not escalate into an incident.

Question 29Fundamental concepts and principles of information security and the initiation of an ISMS implementation

An organization is documenting the scope of its ISMS. According to ISO/IEC 27001 clause 4.3, which input is required?

  1. The budget that top management has approved for the coming financial year
  2. The names of the suppliers that hold the organization's confidential data
  3. External and internal issues and relevant interested party requirements Correct answer.
  4. The set of Annex A controls that the organization intends to implement

Explanation

Clause 4.3 requires the scope to take account of the external and internal issues identified under clause 4.1, the requirements of interested parties identified under clause 4.2, and the interfaces and dependencies between the organization's own activities and those performed by others.

Question 30Fundamental concepts and principles of information security and the initiation of an ISMS implementation

Why must an organization define risk criteria as part of its risk assessment methodology?

  1. To replace the need for a Statement of Applicability during surveillance audits
  2. To establish risk acceptance levels and the way assessments are performed and evaluated Correct answer.
  3. To ensure that every identified risk is eliminated before certification is granted
  4. To satisfy the certification body's preference for a particular quantitative method

Explanation

Clause 6.1.2 requires the organization to define and apply risk criteria covering risk acceptance and the criteria for performing risk assessments, so that results are consistent and comparable over time. These criteria are chosen by the organization itself, not imposed by a certification body.

Question 31Fundamental concepts and principles of information security and the initiation of an ISMS implementation

ISO/IEC 27001 clause 6.2 requires information security objectives to be established at relevant functions and levels. Which characteristic must those objectives have?

  1. They must be measurable, monitored and available as documented information Correct answer.
  2. They must be restricted to staff who work inside the information security function
  3. They must be expressed only in financial terms so that they can be budgeted for
  4. They must be approved each year by the certification body that issued the certificate

Explanation

Clause 6.2 requires objectives to be consistent with the information security policy, measurable where practicable, monitored, communicated and updated, and kept as documented information. It also requires plans describing what will be done, with which resources, by whom, by when and how results will be evaluated.

Question 32Fundamental concepts and principles of information security and the initiation of an ISMS implementation

Which statement correctly separates risk assessment from risk treatment in ISO/IEC 27001?

  1. Risk assessment is performed once at the point of certification, while risk treatment is repeated on an annual basis thereafter
  2. Risk assessment is the activity that selects controls, while risk treatment is the activity that verifies those controls are working effectively
  3. Risk assessment identifies, analyses and evaluates risk; risk treatment selects and applies options to modify it Correct answer.
  4. Risk assessment is the responsibility of the internal audit function, while risk treatment belongs to top management alone

Explanation

The standard splits clause 6.1.2 (risk assessment: identification, analysis and evaluation against criteria) from clause 6.1.3 (risk treatment: selecting options and determining necessary controls). Monitoring and review of both are required, so neither is a one-off certification activity.

Question 33Fundamental concepts and principles of information security and the initiation of an ISMS implementation

A company outsources payroll to a provider and contractually transfers the associated risk. What remains true under ISO/IEC 27001?

  1. The organization no longer needs to monitor the provider once the contract is signed
  2. The provider automatically becomes the risk owner in the organization's ISMS
  3. The organization remains accountable and must still monitor the risk and the provider's performance Correct answer.
  4. The risk can be removed from the risk register because a third party now bears it

Explanation

Risk sharing, including insurance and outsourcing, changes who bears part of the consequence but not the organization's accountability for the outsourced process. The risk stays in the register, keeps a designated risk owner inside the organization, and supplier performance must be monitored and reviewed.

Question 34Fundamental concepts and principles of information security and the initiation of an ISMS implementation

After completing risk assessment and risk treatment, an organization prepares its Statement of Applicability. What is the primary purpose of this document?

  1. It certifies that the organization has achieved an acceptable level of residual risk
  2. It lists every risk that has been fully eliminated from the organization's risk register
  3. It records which Annex A controls are implemented or excluded, with justification for each decision Correct answer.
  4. It replaces the risk treatment plan as soon as top management has formally approved the security budget

Explanation

The Statement of Applicability is derived from the risk treatment results and records the necessary controls, whether each is implemented, and the justification for inclusion or exclusion. It is mandatory documented information and gives auditors the traceability between risks, treatment decisions and controls.

Question 35Planning the implementation of an ISMS based on ISO/IEC 27001

When defining the scope of its ISMS, an organization is required to take into account which of the following?

  1. The audit findings from the previous certification cycle of the company
  2. A complete inventory of every information asset held by the organization
  3. The full set of control objectives listed against every Annex A control
  4. Context issues and relevant interested party requirements Correct answer.

Explanation

Clause 4.3 requires the boundaries and applicability of the ISMS to be determined with reference to the external and internal issues identified under clause 4.1 and the requirements of interested parties identified under clause 4.2. The resulting scope must then be maintained as documented information.

Question 36Planning the implementation of an ISMS based on ISO/IEC 27001

What is the main output of determining the interested parties relevant to the ISMS?

  1. A schedule of internal audits for the coming year
  2. A list of suppliers that must be audited annually
  3. A set of requirements the organization must consider for its ISMS Correct answer.
  4. A register of legal and regulatory obligations only

Explanation

Clause 4.2 requires the organization to determine the interested parties relevant to the ISMS and the requirements of those parties that are relevant to information security. Those requirements then feed into the scope, the policy and the risk criteria.

Question 37Planning the implementation of an ISMS based on ISO/IEC 27001

Which statement describes what ISO/IEC 27001 requires of the ISMS policy?

  1. It must be approved annually by the risk owners of each business unit
  2. It must list every Annex A control the organization has implemented
  3. It must be documented and communicated within the organization Correct answer.
  4. It must be reviewed by an external certification body before release

Explanation

Clause 5.2 requires the policy to be appropriate to the organization's purpose, to include commitments to satisfy applicable requirements and to continual improvement, and to be maintained as documented information, communicated internally and made available to interested parties as appropriate.

Question 38Planning the implementation of an ISMS based on ISO/IEC 27001

ISO/IEC 27001 requires the risk assessment process to establish which two sets of criteria?

  1. Asset depreciation rates and replacement cost thresholds
  2. Business impact tolerances and recovery time objectives
  3. Control testing frequency and sampling confidence levels
  4. Risk acceptance criteria and criteria for performing risk assessments Correct answer.

Explanation

Clause 6.1.2 requires the organization to define risk acceptance criteria and criteria for performing information security risk assessments. Together these set the scales for likelihood and impact, the way risks are evaluated, and the thresholds at which a risk may be accepted.

Question 39Planning the implementation of an ISMS based on ISO/IEC 27001

The risk assessment process must be designed so that repeated assessments produce which outcome?

  1. Identical control sets across every business unit
  2. Results that are free from any identified residual risk
  3. Consistent, valid and comparable results Correct answer.
  4. Quantified monetary exposure values for each risk

Explanation

Clause 6.1.2 requires the process to ensure that repeated information security risk assessments produce consistent, valid and comparable results. Without this property, risk levels cannot be compared over time or across different parts of the scope.

Question 40Planning the implementation of an ISMS based on ISO/IEC 27001

Which content is required in a Statement of Applicability?

  1. The budget allocated to each risk treatment activity in the plan
  2. A copy of every procedure that is referenced by the ISMS documentation
  3. The name of the external auditor who will test each of the controls
  4. Justification for included controls and for excluded Annex A controls Correct answer.

Explanation

Clause 6.1.3 requires the Statement of Applicability to list the necessary controls with justification for their inclusion, to state whether each is implemented, and to give justification for excluding any Annex A control. It is a decision record, not a repository of procedures.

Question 41Planning the implementation of an ISMS based on ISO/IEC 27001

Who is required to approve the risk treatment plan and accept the residual risks?

  1. The risk owners Correct answer.
  2. The certification body
  3. The internal audit function
  4. Top management acting as a single body

Explanation

Clause 6.1.3 requires the organization to obtain the risk owners' approval of the risk treatment plan and their acceptance of the residual risks. Risk owners are the people or entities with the accountability and authority to manage a particular risk.

Question 42Planning the implementation of an ISMS based on ISO/IEC 27001

A risk owner wants to accept a risk whose level exceeds the thresholds set in the risk acceptance criteria. How should this be handled to remain consistent with ISO/IEC 27001?

  1. It is acceptable, provided that the accepted risk is removed from the risk register
  2. It is acceptable, because risk owners have unlimited authority over their risks
  3. It requires the internal auditor to repeat the risk assessment
  4. It requires an approved, documented exception with the risk monitored Correct answer.

Explanation

Risk acceptance criteria define the boundaries within which residual risk may be accepted; a decision that goes beyond them exceeds the authority delegated by those criteria. Such a decision must be escalated, explicitly authorised, recorded and kept under review, otherwise the criteria lose their meaning and results stop being comparable.

Question 43Planning the implementation of an ISMS based on ISO/IEC 27001

Which action best demonstrates top management leadership of the ISMS as required by ISO/IEC 27001?

  1. Delegating all information security decisions to the IT department
  2. Signing the certification contract on behalf of the organization
  3. Integrating ISMS requirements into business processes Correct answer.
  4. Chairing every risk assessment workshop in person

Explanation

Clause 5.1 expects top management to ensure the ISMS is integrated into the organization's processes, that policy and objectives are established, and that resources are provided. Leadership is judged by how far security is embedded in normal business activity.

Question 44Planning the implementation of an ISMS based on ISO/IEC 27001

Which characteristic do information security objectives need to have under ISO/IEC 27001?

  1. They must be identical at every organizational level
  2. They must be measurable where practicable Correct answer.
  3. They must be approved by the certification body
  4. They must be expressed in monetary terms

Explanation

Clause 6.2 requires objectives to be consistent with the policy, measurable where practicable, to take into account applicable requirements and risk assessment results, and to be monitored, communicated, updated and retained as documented information.

Question 45Planning the implementation of an ISMS based on ISO/IEC 27001

What is the main purpose of a gap analysis at the start of an ISMS implementation?

  1. To identify unmet requirements and the work needed to close them Correct answer.
  2. To select the certification body and agree the audit dates
  3. To produce the Statement of Applicability for certification
  4. To calculate the residual risk of every existing control

Explanation

A gap analysis compares the current state of the management system and its controls with the requirements of ISO/IEC 27001, so that the implementation plan can target the shortfalls. It informs scope, risk work and project sequencing rather than replacing them.

Question 46Planning the implementation of an ISMS based on ISO/IEC 27001

Which of the following is documented information explicitly required by ISO/IEC 27001?

  1. A training calendar for all staff
  2. An inventory of every software licence
  3. A business continuity plan
  4. The Statement of Applicability Correct answer.

Explanation

Clause 6.1.3 requires the Statement of Applicability as documented information, alongside items such as the scope, the policy, the results of risk assessment and treatment, and the security objectives. The other examples may be useful but are not mandated in that form by the standard.

Question 47Planning the implementation of an ISMS based on ISO/IEC 27001

On what basis must the organization judge the competence of people whose work affects information security performance?

  1. Length of service with the organization
  2. Appropriate education, training or experience Correct answer.
  3. Completion of an annual security awareness module
  4. Membership of a professional security association

Explanation

Clause 7.2 requires competence to be determined on the basis of appropriate education, training or experience, with action taken where competence is lacking and documented information retained as evidence.

Question 48Planning the implementation of an ISMS based on ISO/IEC 27001

After determining the controls it needs, what comparison must the organization make with Annex A?

  1. It must map each Annex A control to a corresponding clause of the standard
  2. It must implement every Annex A control mentioned in a related industry code of practice
  3. It must verify that no necessary control has been omitted Correct answer.
  4. It must delete Annex A controls that are not referenced in its risk treatment plan

Explanation

Clause 6.1.3 requires the organization to compare the controls it has determined against those in Annex A in order to verify that no necessary control has been omitted. Annex A is a reference set of commonly used controls, while selection remains driven by the risk assessment and treatment results.

Question 49Planning the implementation of an ISMS based on ISO/IEC 27001

Which activity is most appropriate to carry out first when planning an ISMS implementation?

  1. Conducting the first internal audit
  2. Selecting a certification body
  3. Defining the context and the ISMS scope Correct answer.
  4. Implementing all of the controls listed in Annex A

Explanation

Understanding the organization's context, interested parties and scope determines what the ISMS must cover and which risks it must address. Control selection, internal audit and certification all follow from that foundation.

Question 50Planning the implementation of an ISMS based on ISO/IEC 27001

Which statement about the resources needed for the ISMS is correct under ISO/IEC 27001?

  1. Resources are the exclusive responsibility of the risk owners
  2. Only human resources are considered part of the ISMS resources
  3. Resource needs are determined solely by the annual IT budget cycle
  4. Top management must ensure that ISMS resources are available Correct answer.

Explanation

Clause 5.1 requires top management to ensure the resources needed for the ISMS are available, and clause 7.1 requires the organization to determine and provide them. Resources cover people, tools, information and infrastructure, not budgets or headcount alone.