I85PREP
⌘ K
ISO 27032 LCM study materials
ISO 27032 LCM study resources

ISO 27032 LCM practice questions

One question at a time. Build your ISO 27032 LCM understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Cybersecurity fundamentals and concepts (ISO/IEC 27032 framework)

In ISO/IEC 27032, the term 'Cyberspace' is defined primarily as which of the following?

  1. The complex environment resulting from the interaction of people, software and services on the Internet by means of technology devices and networks connected to it, which does not exist in any physical form Correct answer.
  2. The set of physical network cables, routers and switches owned by a telecommunications operator
  3. The collection of all cryptographic algorithms approved for government use
  4. Any information system accredited under a national critical infrastructure protection scheme

Explanation

ISO/IEC 27032 treats Cyberspace as an abstract, non-physical environment arising from interactions among people, software and services over interconnected networks. The definition deliberately emphasizes interaction and lack of physical form rather than hardware ownership or accreditation status, which is why the framework addresses stakeholders beyond a single organization's boundary.

Question 2Cybersecurity fundamentals and concepts (ISO/IEC 27032 framework)

According to the ISO/IEC 27032 structure, how does Cybersecurity relate to Information Security?

  1. Cybersecurity is a subset of physical security and does not address information
  2. Cybersecurity and Information Security are treated as identical terms with no distinction
  3. Information Security is a subset of Cybersecurity and depends on it entirely
  4. Cybersecurity is a distinct discipline that builds on Information Security while focusing on the protection of cyberspace from attacks Correct answer.

Explanation

ISO/IEC 27032 positions Cybersecurity as a discipline that relies on Information Security foundations such as the ISO/IEC 27001 management system but extends beyond them to address attacks originating in and through cyberspace. The two are related but not interchangeable, and neither is simply contained within the other in the standard's model.

Question 3Cybersecurity fundamentals and concepts (ISO/IEC 27032 framework)

Which of the following best describes the role of 'Cybersecurity' as a stakeholder activity in the ISO/IEC 27032 provider–user–government model?

  1. An activity that replaces the need for an information security management system
  2. An activity performed solely by national governments to regulate the Internet
  3. An activity limited to the physical guarding of data centres
  4. An activity that addresses the protection of information and systems in cyberspace across providers, users and governments Correct answer.

Explanation

The framework recognizes that cybersecurity is a shared responsibility cutting across providers, users and governments, because cyberspace spans organizational boundaries. Each stakeholder group contributes controls and coordination, and none can secure cyberspace alone.

Question 4Cybersecurity fundamentals and concepts (ISO/IEC 27032 framework)

ISO/IEC 27032 identifies several 'foundational' security domains that Cybersecurity depends upon. Which pairing of foundational domain to its focus is correct?

  1. Critical Information Infrastructure Protection (CIIP) - protection of information infrastructures whose disruption would harm society Correct answer.
  2. Information security - protection of employees' personal vehicles
  3. Network security - protection of physical premises from unauthorized entry
  4. Internet security - protection of paper records in archives

Explanation

CIIP in the framework concerns protecting information infrastructures whose failure or compromise would seriously affect society, the economy or public safety. The other foundational domains address logical and network threats, not physical premises, paper archives or vehicles.

Question 5Cybersecurity fundamentals and concepts (ISO/IEC 27032 framework)

The ISO/IEC 27032 framework lists 'Internet security', 'network security', 'information security' and 'CIIP' as related domains. What is the primary reason the standard draws these distinctions?

  1. To show that each domain addresses different assets and threats, so controls must be coordinated rather than duplicated Correct answer.
  2. To justify outsourcing all controls to a managed service provider
  3. To assign legal liability for breaches to a single named vendor
  4. To replace national legislation with a single international cybersecurity law

Explanation

The distinctions help practitioners recognize that each domain protects different assets against different threat actors, so their controls must be aligned and coordinated. The framework is a guidance document, not a liability, outsourcing or legislative instrument.

Question 6Cybersecurity fundamentals and concepts (ISO/IEC 27032 framework)

Which statement best captures how ISO/IEC 27032 treats 'Cybersecurity' as compared with 'Internet security'?

  1. Cybersecurity addresses attacks that occur in cyberspace, of which Internet security is one related but narrower domain Correct answer.
  2. Internet security is broader than Cybersecurity because it includes physical mail
  3. Internet security and Cybersecurity are exactly the same concept and are used interchangeably
  4. Cybersecurity concerns only attacks on web browsers, whereas Internet security covers all networks

Explanation

The framework treats Internet security as one of the related domains that supports cybersecurity, while cybersecurity addresses attacks in the broader non-physical environment. Internet security is therefore a contributing domain rather than a synonym or a broader concept.

Question 7Cybersecurity fundamentals and concepts (ISO/IEC 27032 framework)

In the ISO/IEC 27032 threat taxonomy, which of the following is an example of a 'social engineering' attack?

  1. An attacker impersonating a helpdesk technician to persuade a user to reveal a password Correct answer.
  2. A malicious file that encrypts data and demands payment
  3. A flood of SYN packets that exhausts a server's connection table
  4. A weakness in a cryptographic library caused by a coding error

Explanation

Social engineering manipulates people into disclosing information or performing actions, typically through impersonation and persuasion. The other options describe technical attacks or vulnerabilities rather than manipulation of human trust.

Question 8Cybersecurity fundamentals and concepts (ISO/IEC 27032 framework)

An organization wants to align its activity with the ISO/IEC 27032 concept of 'Cybersecurity readiness'. Which action best reflects that concept?

  1. Waiting for a security incident before defining any response roles
  2. Purchasing the newest firewall model without changing any processes
  3. Restricting all internet access so that no external communication is possible
  4. Establishing coordinated capabilities, roles and procedures across stakeholders to prevent, detect and respond to cyberspace attacks Correct answer.

Explanation

Readiness in the framework means having coordinated capabilities, defined roles and tested procedures so that cyberspace attacks can be prevented, detected and handled. It is a governance and coordination concept, not a product purchase or a purely reactive stance.

Question 9Cybersecurity fundamentals and concepts (ISO/IEC 27032 framework)

Which of the following is the clearest example of a 'technical vulnerability' as the term is used in the ISO/IEC 27032 threat discussion?

  1. A competitor who launches a denial-of-service attack
  2. An unpatched software flaw that allows remote code execution Correct answer.
  3. An employee who deliberately sells customer data
  4. A flood that damages a data centre

Explanation

A technical vulnerability is a weakness in software or systems that an attacker could exploit, such as an unpatched flaw enabling remote code execution. The other options describe a malicious insider, an external attacker and a natural hazard, which are threat sources or events rather than technical weaknesses.

Question 10Cybersecurity fundamentals and concepts (ISO/IEC 27032 framework)

The ISO/IEC 27032 framework recommends that organizations coordinate cybersecurity activities with other stakeholders. Which practice best demonstrates this coordination principle for an application service provider?

  1. Sharing agreed incident information with customers and relevant authorities through defined channels Correct answer.
  2. Requiring customers to sign waivers that remove all provider responsibility
  3. Publishing all internal vulnerability reports on a public website
  4. Refusing to communicate with customers about security matters to avoid liability

Explanation

Coordination involves exchanging relevant information, such as incident notifications, with customers and authorities through agreed channels so that response is timely and consistent. This supports joint management of cyberspace risk without exposing sensitive internal details indiscriminately.

Question 11Cybersecurity fundamentals and concepts (ISO/IEC 27032 framework)

Which of the following best describes 'Critical Information Infrastructure Protection' (CIIP) in the ISO/IEC 27032 context?

  1. Protecting the cryptographic keys used only for internal testing
  2. Protecting information infrastructures whose disruption would have serious impact on society, the economy or public safety Correct answer.
  3. Protecting the personal devices of individual employees
  4. Protecting only the marketing website of a company

Explanation

CIIP focuses on information infrastructures whose failure or compromise would seriously affect society, the economy or public safety, which is why it involves governments and cross-sector coordination. It is not limited to individual devices or a single company's website.

Question 12Cybersecurity fundamentals and concepts (ISO/IEC 27032 framework)

A bank experiences a distributed denial-of-service attack that disrupts online services. Under the ISO/IEC 27032 framework, which classification best fits this event?

  1. A physical security incident
  2. A cryptographic key compromise
  3. A social engineering incident
  4. A cyberspace attack affecting availability Correct answer.

Explanation

A DDoS attack is a cyberspace attack whose primary impact is loss of availability of online services. It is not a physical, social engineering or cryptographic key event, so classifying it as a cyberspace availability attack best matches the framework.

Question 13Cybersecurity fundamentals and concepts (ISO/IEC 27032 framework)

Which of the following is the most accurate description of the relationship between ISO/IEC 27032 and ISO/IEC 27001?

  1. ISO/IEC 27001 and ISO/IEC 27032 are mutually exclusive and cannot be used together
  2. ISO/IEC 27032 provides guidance on cybersecurity that complements the information security management system requirements in ISO/IEC 27001 Correct answer.
  3. ISO/IEC 27032 is a certification scheme that audits ISO/IEC 27001 controls
  4. ISO/IEC 27032 replaces ISO/IEC 27001 for all organizations operating online

Explanation

ISO/IEC 27032 offers guidance specifically on cybersecurity and builds on the information security management approach established in ISO/IEC 27001. It complements rather than replaces or audits the management system standard.

Question 14Cybersecurity fundamentals and concepts (ISO/IEC 27032 framework)

The ISO/IEC 27032 framework discusses 'cyberspace security' alongside 'information security'. Why does the standard stress that cybersecurity cannot be achieved by a single organization acting alone?

  1. Because only governments own all the computers connected to the Internet
  2. Because cybersecurity controls are optional in all legal systems
  3. Because information security is illegal for private companies
  4. Because cyberspace spans multiple providers, users and jurisdictions, so threats and responses cross organizational boundaries Correct answer.

Explanation

Cyberspace is inherently interconnected, so providers, users and governments must coordinate across organizational and national boundaries to manage threats and incidents. No single entity controls the whole environment, which is the rationale for shared responsibility.

Question 15Cybersecurity fundamentals and concepts (ISO/IEC 27032 framework)

Which of the following best describes a 'cyber attack' in the ISO/IEC 27032 sense?

  1. A scheduled backup that completes successfully
  2. A routine software update that changes a user interface
  3. Any accidental power outage in a data centre
  4. A deliberate attempt to exploit cyberspace to compromise the confidentiality, integrity or availability of information or systems Correct answer.

Explanation

A cyber attack is a deliberate action exploiting cyberspace to compromise information or systems, typically affecting confidentiality, integrity or availability. Accidental outages, routine updates and successful backups are not attacks because they lack deliberate exploitation.

Question 16Cybersecurity fundamentals and concepts (ISO/IEC 27032 framework)

A small retailer wants to apply ISO/IEC 27032 guidance but has limited resources. Which approach is most consistent with the framework?

  1. Outsource all responsibility and assume the provider handles every risk
  2. Implement every possible control simultaneously regardless of risk
  3. Prioritize controls based on assessed risk and coordinate with key external parties such as payment providers and ISPs Correct answer.
  4. Ignore cybersecurity because the framework only applies to governments

Explanation

The framework promotes risk-based prioritization and coordination with stakeholders who affect the organization's cyberspace exposure, such as payment providers and connectivity suppliers. This is feasible for smaller organizations and reflects shared responsibility.

Question 17Cybersecurity fundamentals and concepts (ISO/IEC 27032 framework)

Which of the following best characterizes the ISO/IEC 27032 treatment of 'malware' as a threat category?

  1. Malware is only a concern for home users and not for organizations
  2. Malware refers exclusively to hardware faults
  3. Malware is a legal term for software that has not been licensed
  4. Malware is any software designed to cause harm, such as viruses, worms or ransomware, and is a cyberspace threat Correct answer.

Explanation

Malware denotes software intentionally designed to cause harm, including viruses, worms and ransomware, and it is one of the cyberspace threats the framework addresses. It is distinct from hardware faults and from licensing issues.

Question 18Cybersecurity fundamentals and concepts (ISO/IEC 27032 framework)

In the ISO/IEC 27032 framework, why is 'information sharing' among stakeholders considered valuable for cybersecurity?

  1. It guarantees that no future attack will succeed
  2. It removes the need for any internal security controls
  3. It enables earlier detection and more effective response to threats that cross organizational boundaries Correct answer.
  4. It allows organizations to eliminate all risk permanently

Explanation

Threats often affect multiple organizations at once, so sharing indicators and incident information helps stakeholders detect attacks earlier and respond more effectively. Sharing supports but never replaces internal controls and cannot eliminate risk entirely.

Question 19Cybersecurity fundamentals and concepts (ISO/IEC 27032 framework)

Which of the following best describes the ISO/IEC 27032 notion of a 'stakeholder' in cyberspace?

  1. Any party with an interest in or influence over cyberspace security, including providers, users and governments Correct answer.
  2. Only the attacker who initiates an incident
  3. Only the insurance company that covers cyber losses
  4. Only the organization that owns the affected server

Explanation

The framework uses a broad stakeholder concept covering providers, users and governments, because all of them have interests in and influence over cyberspace security. Limiting the term to a single party misses the shared-responsibility model.

Question 20Cybersecurity fundamentals and concepts (ISO/IEC 27032 framework)

An organization detects that an attacker used stolen credentials to access a cloud service. Which ISO/IEC 27032-relevant control area is most directly implicated?

  1. Office furniture procurement
  2. Identity and access management, including authentication and credential protection Correct answer.
  3. Physical perimeter fencing
  4. Paper document shredding

Explanation

Stolen credentials point to weaknesses in authentication and credential handling, which fall under identity and access management. Strengthening authentication, monitoring and credential protection directly addresses this attack path.

Question 21Cybersecurity fundamentals and concepts (ISO/IEC 27032 framework)

Which statement best reflects the ISO/IEC 27032 view of the role of governments in cyberspace security?

  1. Governments should ban all use of the Internet to prevent attacks
  2. Governments contribute through legislation, coordination, CIIP and incident response at national level Correct answer.
  3. Governments have no role because cyberspace is privately owned
  4. Governments should operate every commercial network

Explanation

In the framework, governments contribute by setting legal frameworks, coordinating stakeholders, protecting critical information infrastructure and supporting national incident response. They do not own or operate all networks, nor can they eliminate the Internet.

Question 22Cybersecurity fundamentals and concepts (ISO/IEC 27032 framework)

Which of the following best explains why ISO/IEC 27032 emphasizes 'trust' and 'confidence' among cyberspace participants?

  1. Because confidence guarantees that all data is accurate
  2. Because trust eliminates the need for technical controls
  3. Because participants will only transact and share information online if they have confidence that risks are managed Correct answer.
  4. Because trust is only relevant to marketing campaigns

Explanation

Cyberspace activity depends on participants having confidence that risks are adequately managed, which encourages online transactions and information exchange. Trust complements technical controls but does not replace them or guarantee data accuracy.

Question 23Cybersecurity fundamentals and concepts (ISO/IEC 27032 framework)

A company wants to classify an incident where an attacker exploited a known, unpatched server flaw to gain access. Which combination of ISO/IEC 27032 concepts best applies?

  1. A social engineering attack with no technical element
  2. A physical hazard causing accidental damage
  3. A cryptographic algorithm failure with no attacker involvement
  4. A technical vulnerability exploited by a cyber attack Correct answer.

Explanation

An unpatched flaw is a technical vulnerability, and deliberate exploitation of it is a cyber attack. The scenario involves both a weakness and an attacker, so classifying it as a technical vulnerability exploited by an attack is accurate.

Question 24Cybersecurity fundamentals and concepts (ISO/IEC 27032 framework)

Which of the following is the most accurate statement about the scope of ISO/IEC 27032?

  1. It certifies individual security professionals
  2. It prescribes criminal penalties for cyber attackers
  3. It provides guidance on cybersecurity, including the roles of stakeholders and the relationship to related security domains Correct answer.
  4. It specifies detailed technical configurations for every firewall product

Explanation

ISO/IEC 27032 is guidance addressing cybersecurity concepts, stakeholder roles and relationships to related domains such as Internet security and CIIP. It does not prescribe product configurations, certify individuals or set criminal penalties.

Question 25Cybersecurity fundamentals and concepts (ISO/IEC 27032 framework)

An organization's risk assessment shows that a supplier's compromise could disrupt its own services. Which ISO/IEC 27032-aligned response is most appropriate?

  1. Rely solely on the supplier's verbal assurance of security
  2. Apply supply-chain risk management, including contractual security requirements and incident notification arrangements Correct answer.
  3. Terminate all supplier relationships immediately regardless of criticality
  4. Assume the supplier will never be attacked and take no action

Explanation

Because cyberspace risk extends across organizational boundaries, the framework supports managing supplier risk through contractual requirements, assurance activities and agreed incident notification. This addresses shared exposure without abandoning necessary relationships.

Question 26Cybersecurity fundamentals and concepts (ISO/IEC 27032 framework)

In ISO/IEC 27032, which term describes the interconnected digital environment in which communication and transactions occur, and whose security the standard addresses?

  1. The public switched telephone network
  2. Cyberspace Correct answer.
  3. The corporate intranet
  4. The Internet

Explanation

ISO/IEC 27032 defines cyberspace as the complex environment resulting from the interaction of people, software and services on the Internet by means of technology devices and networks connected to it, which does not exist in any physical form. The standard deliberately uses 'cyberspace' rather than 'the Internet' to encompass all interconnected digital interactions, including those beyond traditional internet infrastructure.

Question 27Cybersecurity fundamentals and concepts (ISO/IEC 27032 framework)

According to ISO/IEC 27032, which of the following is a key characteristic that distinguishes cybersecurity from information security?

  1. Cybersecurity is primarily concerned with the confidentiality, integrity, and availability of information.
  2. Cybersecurity addresses the protection of the interconnected environment and its users, including non-information assets and interactions. Correct answer.
  3. Cybersecurity applies only to information held in electronic form within an organization.
  4. Cybersecurity focuses on protecting information assets regardless of their location or format.

Explanation

ISO/IEC 27032 explains that information security traditionally protects information assets, while cybersecurity extends to the protection of the cyberspace environment itself, including people, processes, and non-information assets that interact in that environment. The standard emphasizes that cybersecurity is not merely a subset of information security but addresses the broader ecosystem of interconnected systems and stakeholders.

Question 28Cybersecurity fundamentals and concepts (ISO/IEC 27032 framework)

In the ISO/IEC 27032 threat taxonomy, which category describes attacks that exploit human behavior to gain unauthorized access or information?

  1. Social engineering Correct answer.
  2. Denial-of-service
  3. Technical vulnerabilities
  4. Malware

Explanation

ISO/IEC 27032 identifies social engineering as a threat category that relies on psychological manipulation of people to divulge confidential information or perform actions that compromise security. It is distinct from technical vulnerabilities, malware, and denial-of-service, which exploit technical weaknesses or resources rather than human behavior.

Question 29Cybersecurity fundamentals and concepts (ISO/IEC 27032 framework)

An organization wants to improve its cybersecurity posture by following ISO/IEC 27032 guidance on readiness. Which action best aligns with the standard's concept of cybersecurity readiness?

  1. Conducting regular risk assessments and establishing incident response capabilities involving multiple stakeholders. Correct answer.
  2. Implementing only technical controls such as firewalls and intrusion detection systems.
  3. Focusing exclusively on compliance with legal and regulatory requirements.
  4. Outsourcing all cybersecurity responsibilities to a third-party service provider.

Explanation

ISO/IEC 27032 describes cybersecurity readiness as the ability to anticipate, withstand, and recover from cyber incidents, which requires a holistic approach including risk assessment, incident response planning, and coordination among stakeholders. Technical controls alone or mere compliance are insufficient; readiness involves preparation and collaboration across organizational boundaries.

Question 30Cybersecurity fundamentals and concepts (ISO/IEC 27032 framework)

Which of the following best exemplifies a technical vulnerability as defined in the ISO/IEC 27032 threat taxonomy?

  1. A virus that spreads through removable media.
  2. A misconfigured firewall that allows unauthorized access to an internal network. Correct answer.
  3. An employee falling for a phishing email and revealing a password.
  4. A distributed denial-of-service attack that floods a web server.

Explanation

ISO/IEC 27032 defines technical vulnerabilities as weaknesses in systems, software, or configurations that can be exploited by threats. A misconfigured firewall is a configuration weakness, whereas phishing, malware, and DDoS are threat events or attack types, not vulnerabilities themselves.

Question 31Cybersecurity fundamentals and concepts (ISO/IEC 27032 framework)

In the ISO/IEC 27032 framework, what is the primary purpose of coordinating cybersecurity activities with other stakeholders?

  1. To transfer legal liability for cyber incidents to third parties.
  2. To enable effective information sharing and collective response to cyber threats. Correct answer.
  3. To reduce the cost of security audits by standardizing on a single vendor.
  4. To ensure that all stakeholders use identical security technologies.

Explanation

ISO/IEC 27032 emphasizes that cyberspace involves multiple interdependent stakeholders, and coordination enables information sharing, joint incident response, and collective defense against threats that cross organizational boundaries. It does not require identical technologies, liability transfer, or vendor standardization.

Question 32Cybersecurity fundamentals and concepts (ISO/IEC 27032 framework)

Which statement best describes Critical Information Infrastructure Protection (CIIP) in the context of ISO/IEC 27032?

  1. CIIP focuses on safeguarding information infrastructures whose disruption would have serious impact on society and the economy. Correct answer.
  2. CIIP applies only to military and defense networks.
  3. CIIP is limited to the protection of government-owned information systems.
  4. CIIP is a synonym for corporate information security management.

Explanation

ISO/IEC 27032 defines CIIP as the protection of critical information infrastructures, which are those assets, systems, and networks essential to the functioning of society and the economy. It spans public and private sectors and is broader than corporate information security or military networks alone.

Question 33Cybersecurity fundamentals and concepts (ISO/IEC 27032 framework)

A financial institution experiences a DDoS attack that disrupts online banking services. Under ISO/IEC 27032, which category of threat does this represent?

  1. Malware
  2. Social engineering
  3. Denial-of-service Correct answer.
  4. Technical vulnerability

Explanation

ISO/IEC 27032 classifies denial-of-service as a threat that aims to make services unavailable by overwhelming them with traffic or requests. A DDoS attack is a distributed form of denial-of-service, distinct from vulnerabilities, social engineering, or malware.

Question 34Cybersecurity fundamentals and concepts (ISO/IEC 27032 framework)

How does ISO/IEC 27032 relate to ISO/IEC 27001?

  1. ISO/IEC 27032 is a technical standard for encryption algorithms, whereas ISO/IEC 27001 covers management processes.
  2. ISO/IEC 27032 provides guidance on cybersecurity, while ISO/IEC 27001 specifies requirements for an information security management system. Correct answer.
  3. ISO/IEC 27032 is an older version of ISO/IEC 27001 that has been superseded.
  4. ISO/IEC 27032 is a certification standard that replaces ISO/IEC 27001.

Explanation

ISO/IEC 27032 offers guidance on cybersecurity, focusing on the cyberspace environment and stakeholder collaboration, while ISO/IEC 27001 specifies requirements for establishing, implementing, maintaining, and continually improving an information security management system. They are complementary, not replacements or versions of each other.

Question 35Cybersecurity fundamentals and concepts (ISO/IEC 27032 framework)

Why does ISO/IEC 27032 distinguish between cyberspace security and information security?

  1. Because information security covers only paper records, while cyberspace security covers digital records.
  2. Because cyberspace security addresses the interconnected environment and its participants, while information security focuses on protecting information assets. Correct answer.
  3. Because information security is obsolete and no longer relevant.
  4. Because cyberspace security applies only to individuals, whereas information security applies only to organizations.

Explanation

ISO/IEC 27032 highlights that cyberspace security extends beyond the protection of information to include the security of the interconnected environment and the interactions of its participants, including non-information assets. Information security remains essential but is narrower in scope, focusing on information assets regardless of format.

Question 36Cybersecurity fundamentals and concepts (ISO/IEC 27032 framework)

Which of the following best describes a cyber attack in the ISO/IEC 27032 sense?

  1. A deliberate attempt to disrupt, damage, or gain unauthorized access to cyberspace assets. Correct answer.
  2. An accidental misconfiguration that exposes data.
  3. A natural disaster that damages network infrastructure.
  4. Any unauthorized access to a computer system.

Explanation

ISO/IEC 27032 defines a cyber attack as a deliberate, malicious act aimed at disrupting, damaging, or gaining unauthorized access to cyberspace assets. Accidental events or natural disasters are not cyber attacks because they lack intent.

Question 37Cybersecurity fundamentals and concepts (ISO/IEC 27032 framework)

A small retailer with limited resources wants to apply ISO/IEC 27032 guidance. Which approach is most consistent with the standard?

  1. Prioritize cybersecurity activities based on risk assessment and available resources, and seek external collaboration where beneficial. Correct answer.
  2. Implement all recommended controls simultaneously regardless of cost.
  3. Ignore the guidance because it is designed only for large enterprises.
  4. Delegate all cybersecurity decisions to an external vendor without oversight.

Explanation

ISO/IEC 27032 advocates a risk-based approach that allows organizations of all sizes to prioritize actions according to their risk profile and resources. Collaboration with external parties can help smaller organizations access expertise and information, while retaining responsibility.

Question 38Cybersecurity fundamentals and concepts (ISO/IEC 27032 framework)

How does ISO/IEC 27032 characterize malware within its threat taxonomy?

  1. As a countermeasure against cyber attacks.
  2. As a form of social engineering.
  3. As a type of technical vulnerability.
  4. As a category of threat that includes viruses, worms, and Trojan horses. Correct answer.

Explanation

ISO/IEC 27032 classifies malware as a threat category encompassing malicious software such as viruses, worms, and Trojan horses that can compromise systems. It is distinct from technical vulnerabilities (which are weaknesses) and social engineering (which exploits human behavior).

Question 39Cybersecurity fundamentals and concepts (ISO/IEC 27032 framework)

Why does ISO/IEC 27032 consider information sharing among stakeholders valuable for cybersecurity?

  1. It enables early warning of threats and coordinated response, improving collective resilience. Correct answer.
  2. It allows organizations to shift blame for incidents to others.
  3. It guarantees that no cyber attacks will occur.
  4. It eliminates the need for each organization to conduct its own risk assessment.

Explanation

ISO/IEC 27032 promotes information sharing because cyber threats often affect multiple parties, and timely sharing of threat intelligence and incident data enables early warning and coordinated response. It does not remove organizational responsibility for risk assessment or guarantee immunity from attacks.

Question 40Cybersecurity fundamentals and concepts (ISO/IEC 27032 framework)

In ISO/IEC 27032, which of the following best describes a stakeholder in cyberspace?

  1. Only users of social media platforms.
  2. Any individual or organization that has an interest or role in the cyberspace environment. Correct answer.
  3. Only government regulators.
  4. Only the owners of critical information infrastructure.

Explanation

ISO/IEC 27032 defines stakeholders broadly as individuals, organizations, and governments that interact with or have an interest in cyberspace, including users, service providers, and regulators. This broad definition supports the standard's emphasis on multi-stakeholder collaboration.

Question 41Cybersecurity policy, roles, and stakeholder coordination

Within the ISO 27032 cybersecurity framework, which document type establishes management's direction and intent for cybersecurity and is approved at the highest level of the organization?

  1. The cybersecurity policy Correct answer.
  2. The network topology diagram
  3. The asset inventory register
  4. The incident ticket log

Explanation

A cybersecurity policy is the top-level management statement of direction, principles and commitment, and it is approved by senior management so that lower-level standards and procedures can be derived from it. The other artifacts are operational or technical records that support the policy rather than establish it.

Question 42Cybersecurity policy, roles, and stakeholder coordination

In the ISO 27032 context, which statement best describes the relationship between a cybersecurity policy and supporting procedures?

  1. Procedures replace the policy once they are documented and approved
  2. Procedures are optional and are only written after an incident occurs
  3. Procedures translate policy requirements into step-by-step instructions for carrying out activities Correct answer.
  4. Procedures must be approved by external regulators before the policy is issued

Explanation

The policy states what must be achieved and why, while procedures describe how specific activities are performed to satisfy those requirements. This hierarchy keeps the policy stable while allowing operational detail to evolve.

Question 43Cybersecurity policy, roles, and stakeholder coordination

An organization adopts ISO 27032 guidance and must assign accountability for cybersecurity across business units. What is the most appropriate governance arrangement?

  1. Delegation of all cybersecurity decisions to the outsourced IT service desk
  2. A named senior owner with defined responsibilities and reporting lines to executive management Correct answer.
  3. Diffusion of responsibility across all staff without a designated owner
  4. Assignment of accountability to the internal audit function alone

Explanation

ISO 27032 emphasizes clear roles, responsibilities and accountability, which requires a designated owner with authority and a reporting channel to executive management. Diffuse or outsourced accountability leaves no one answerable for cyber risk decisions.

Question 44Cybersecurity policy, roles, and stakeholder coordination

Which group is the primary audience that a cybersecurity policy must address to be effective in an ISO 27032-aligned program?

  1. Only the board of directors
  2. Only third-party suppliers
  3. Only the information security team
  4. All personnel and relevant external parties whose actions affect the organization's information Correct answer.

Explanation

A cybersecurity policy applies to everyone whose activity can affect the protection of information, including employees, contractors and relevant external parties. Limiting communication to a single group leaves large parts of the risk surface unaddressed.

Question 45Cybersecurity policy, roles, and stakeholder coordination

A stakeholder map for a cybersecurity program shows that a regulator has high influence and high interest in the organization's cyber posture. What coordination approach fits this classification?

  1. Route all regulator contact through the marketing department
  2. Provide only the minimum legally required disclosure once a year
  3. Ignore the regulator because it is external to the organization
  4. Engage closely and proactively with regular, tailored reporting on compliance status Correct answer.

Explanation

Stakeholders with high influence and high interest require proactive, managed engagement with regular communication tailored to their concerns. This keeps regulatory expectations visible and reduces the risk of surprise enforcement action.

Question 46Cybersecurity policy, roles, and stakeholder coordination

Under ISO 27032, which role is typically accountable for ensuring that cybersecurity requirements are reflected in supplier contracts and service level agreements?

  1. The facilities manager responsible for building access
  2. The help desk analyst who closes supplier tickets
  3. The business owner of the relationship, supported by legal and security specialists Correct answer.
  4. The end user who consumes the supplier's service

Explanation

The relationship owner is accountable for the supplier arrangement, and legal and security specialists provide the contractual and technical requirements. This combines accountability with the expertise needed to specify cyber obligations.

Question 47Cybersecurity policy, roles, and stakeholder coordination

An organization wants to ensure its cybersecurity policy stays current. Which mechanism best supports this under an ISO 27032-aligned management approach?

  1. Replacement of the policy by the latest vendor product manual
  2. A one-time approval at project kickoff with no further review
  3. Scheduled periodic review with defined triggers such as major incidents or regulatory change Correct answer.
  4. Review only when a customer requests a copy of the policy

Explanation

Policies need a defined review cycle plus event-driven triggers so they remain aligned with the threat landscape, business changes and legal obligations. A single approval event leaves the policy to drift out of date.

Question 48Cybersecurity policy, roles, and stakeholder coordination

Which statement best captures the ISO 27032 position on sharing cybersecurity information with other organizations?

  1. Information sharing is prohibited because it always exposes confidential data
  2. Sharing is permitted only after a confirmed data breach has occurred
  3. Sharing is limited to publishing marketing material about security products
  4. Structured information sharing with trusted parties is encouraged to improve collective situational awareness Correct answer.

Explanation

ISO 27032 recognizes that cybersecurity depends on coordination across organizational boundaries, so structured sharing with trusted parties, such as CERTs and sector peers, improves collective awareness. The sharing must still be governed to protect sensitive information.

Question 49Cybersecurity policy, roles, and stakeholder coordination

A cybersecurity manager needs to obtain executive funding for a new monitoring capability. Which framing aligns best with ISO 27032 stakeholder coordination principles?

  1. Present cyber risk in business impact terms, tied to the organization's objectives and risk appetite Correct answer.
  2. Present only the technical specifications of the monitoring tools
  3. Delegate the funding request to a junior analyst without context
  4. Avoid mentioning risk because executives dislike negative information

Explanation

Executive stakeholders make decisions based on business impact and alignment with objectives and risk appetite, so cyber risk should be translated into those terms. Technical specifications alone do not convey why the investment matters.

Question 50Cybersecurity policy, roles, and stakeholder coordination

Which element is essential when defining a cybersecurity role in an ISO 27032-aligned program?

  1. An informal understanding that the role covers whatever comes up
  2. Documented responsibilities, authority and required competencies for the role Correct answer.
  3. A requirement that the role holder personally accept all residual risk
  4. A job title with no written description

Explanation

Effective role definition requires documented responsibilities, the authority to act, and the competencies needed to perform the work. This makes accountability enforceable and supports training and succession.