I85PREP
⌘ K
ISO 27035 LIM study materials
ISO 27035 LIM study resources

ISO 27035 LIM practice questions

One question at a time. Build your ISO 27035 LIM understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Fundamental principles and concepts of information security incident management

In ISO/IEC 27035, which term describes a single occurrence that indicates a possible breach of information security and should be assessed before being treated as an incident?

  1. Vulnerability
  2. Information security incident
  3. Information security event Correct answer.
  4. Threat

Explanation

ISO/IEC 27035 distinguishes an event (an observable occurrence indicating a possible security breach) from an incident, which is confirmed to have actual negative consequences for the organization. Events are the raw input to detection and triage, and only some are escalated to incidents.

Question 2Fundamental principles and concepts of information security incident management

According to the ISO/IEC 27035 incident management process, which phase directly follows 'detection and reporting'?

  1. Assessment and decision Correct answer.
  2. Post-incident review
  3. Eradication and recovery
  4. Lessons learned

Explanation

The process flows from detection and reporting into assessment and decision, where the organization judges whether the event is an incident and how to respond. Eradication, recovery, and lessons learned come later in the sequence.

Question 3Fundamental principles and concepts of information security incident management

What is the primary purpose of an incident response plan within an ISO/IEC 27035-aligned management system?

  1. To replace the need for a risk assessment programme
  2. To guarantee that no security incident can ever occur
  3. To define structured, repeatable actions and responsibilities for handling incidents Correct answer.
  4. To document only the technical configuration of firewalls

Explanation

An incident response plan establishes roles, responsibilities, communication paths, and structured steps so incidents are handled consistently. It is a preparedness mechanism, not a guarantee against incidents and not a substitute for risk management.

Question 4Fundamental principles and concepts of information security incident management

Which group is typically responsible for coordinating the overall response to a significant information security incident under ISO/IEC 27035?

  1. The internal audit function
  2. The incident response team Correct answer.
  3. The marketing team
  4. The procurement department

Explanation

ISO/IEC 27035 assigns coordination of incident handling to a designated incident response team with defined roles and authority. Other functions may support, but they do not own the coordination of response.

Question 5Fundamental principles and concepts of information security incident management

In ISO/IEC 27035 terminology, what is a 'near miss' in the context of information security incidents?

  1. A planned security test without authorization
  2. An event that could have led to harm but was prevented or did not result in impact Correct answer.
  3. A confirmed criminal act against the organization
  4. An incident that has already caused major data loss

Explanation

A near miss is an event that had the potential to become an incident but was intercepted or produced no actual adverse consequence. Capturing near misses is valuable because it exposes weaknesses before real harm occurs.

Question 6Fundamental principles and concepts of information security incident management

Which statement best reflects the relationship between information security incident management and the organization's overall risk management?

  1. Incident management removes the need to identify risks proactively
  2. Incident management operates entirely independently of risk management
  3. Risk management is only performed after every incident is closed
  4. Incident management feeds information back into risk assessment and treatment Correct answer.

Explanation

Lessons learned from incidents reveal whether existing controls and risk assessments were adequate, feeding back into risk treatment. This feedback loop is a core principle of the ISO/IEC 27035 approach.

Question 7Fundamental principles and concepts of information security incident management

What does the 'lessons learned' activity in ISO/IEC 27035 aim to achieve?

  1. Assigning blame to individual employees
  2. Reducing the number of staff in the incident response team
  3. Replacing technical controls with administrative procedures
  4. Identifying root causes and improving future prevention and response Correct answer.

Explanation

Lessons learned focuses on understanding what happened, why, and how controls and procedures can be improved. Its purpose is organizational learning and improvement, not attributing personal fault.

Question 8Fundamental principles and concepts of information security incident management

Which of the following is an example of an information security event rather than a confirmed incident?

  1. A verified ransomware encryption of a production file server
  2. A confirmed exfiltration of customer records to an external host
  3. A single failed login attempt recorded in an authentication log Correct answer.
  4. An authenticated attacker deleting a production database

Explanation

A single failed login is an observable occurrence that may or may not indicate a real breach, so it is an event requiring assessment. The other options describe confirmed adverse outcomes that are incidents.

Question 9Fundamental principles and concepts of information security incident management

An analyst receives a report of unusual outbound traffic. Before declaring an incident, what should the analyst do first according to ISO/IEC 27035?

  1. Assess the event to determine whether it constitutes an incident and its severity Correct answer.
  2. Delete the affected logs to preserve privacy
  3. Disable the entire corporate network without assessment
  4. Immediately notify the media about a possible breach

Explanation

The assessment and decision phase requires evaluating the event's validity and potential impact before committing response resources. Premature escalation or destructive actions can cause harm and lose evidence.

Question 10Fundamental principles and concepts of information security incident management

Why does ISO/IEC 27035 emphasize establishing communication channels and escalation paths before incidents occur?

  1. To reduce the need for any documentation
  2. To guarantee that incidents are never reported externally
  3. To allow staff to bypass the incident response team
  4. To ensure timely, coordinated response and accurate information flow during high-pressure events Correct answer.

Explanation

Predefined channels and escalation paths reduce confusion and delay when an incident unfolds, supporting coordinated action. They also help ensure the right people and, where required, external parties receive accurate information.

Question 11Fundamental principles and concepts of information security incident management

A company wants to classify incidents by severity. Which approach is most consistent with ISO/IEC 27035?

  1. Use a single severity level for every incident
  2. Base severity only on which employee reported the incident
  3. Assign severity randomly to spread workload
  4. Define severity levels using criteria such as business impact, scope, and data sensitivity Correct answer.

Explanation

Severity classification should be criteria-based, reflecting business impact, the number of systems or users affected, and the sensitivity of data involved. This drives proportionate response and escalation.

Question 12Fundamental principles and concepts of information security incident management

During an incident, a responder wants to shut down a compromised server to stop the attack. What consideration does ISO/IEC 27035 highlight before taking such action?

  1. Ensuring the action is performed by the marketing team
  2. Choosing the action that generates the most media attention
  3. Waiting until all employees have left the building
  4. Balancing containment against the potential loss of volatile evidence Correct answer.

Explanation

Containment decisions must weigh stopping the harm against preserving evidence that may be needed for investigation and legal purposes. Volatile data such as memory contents can be lost on shutdown.

Question 13Fundamental principles and concepts of information security incident management

Which activity belongs to the preparation phase of incident management under ISO/IEC 27035?

  1. Eradicating malware from affected hosts
  2. Conducting the post-incident review meeting
  3. Recovering services from backups
  4. Establishing an incident response policy, team, and supporting tools Correct answer.

Explanation

Preparation builds the capability before incidents: policy, roles, plans, tools, and training. Eradication, recovery, and reviews are executed later in the lifecycle.

Question 14Fundamental principles and concepts of information security incident management

Why does ISO/IEC 27035 promote a culture where employees report suspected incidents without fear of punishment?

  1. Early reporting shortens detection time and limits damage Correct answer.
  2. It guarantees employees will never make mistakes
  3. It allows the organization to skip incident assessment
  4. It removes the need for technical monitoring controls

Explanation

A no-blame reporting culture encourages fast disclosure, which reduces the window in which attackers operate and limits impact. It complements, rather than replaces, technical detection and assessment.

Question 15Fundamental principles and concepts of information security incident management

An organization experiences a phishing campaign. Which action best represents the 'detection and reporting' phase?

  1. Writing the final lessons learned report
  2. Restoring mailboxes from backup after cleanup
  3. Updating the risk register months later
  4. Users and tools flagging the suspicious emails and notifying the incident response team Correct answer.

Explanation

Detection and reporting covers identifying the suspicious activity and routing it to the response team. Restoration, reporting documents, and risk register updates belong to later phases.

Question 16Fundamental principles and concepts of information security incident management

Which of the following best describes the role of indicators of compromise (IOCs) in ISO/IEC 27035-aligned incident management?

  1. They replace the need for an incident response policy
  2. They are used solely to train new employees
  3. They are only relevant after an incident is fully closed
  4. They help detect and confirm malicious activity during assessment Correct answer.

Explanation

IOCs such as known malicious hashes or IP addresses support detection and help analysts confirm whether observed events represent real incidents. They are technical aids within the broader process, not a substitute for governance.

Question 17Fundamental principles and concepts of information security incident management

A responder discovers that an incident involves personal data. What does ISO/IEC 27035 suggest regarding external parties?

  1. Follow defined procedures to determine legal and regulatory notification obligations Correct answer.
  2. Avoid informing any authority under all circumstances
  3. Immediately publish all details on the corporate website
  4. Delegate the decision entirely to the affected customer

Explanation

Incident handling should include procedures for evaluating legal, regulatory, and contractual notification duties, often in coordination with legal counsel. Notification decisions follow defined criteria rather than improvisation.

Question 18Fundamental principles and concepts of information security incident management

Which statement best captures the principle of proportionality in incident response?

  1. Response should be based on the seniority of the reporter
  2. Every incident warrants full organizational shutdown
  3. Response should always be minimal regardless of impact
  4. Response effort and disruption should match the severity and impact of the incident Correct answer.

Explanation

Proportionality means scaling the response to the assessed severity so that low-impact events do not trigger excessive disruption and high-impact incidents receive sufficient resources. It depends on severity, not on who reported the event.

Question 19Fundamental principles and concepts of information security incident management

What distinguishes the 'eradication' activity from 'containment' in the ISO/IEC 27035 response process?

  1. Eradication is performed before any detection occurs
  2. Containment removes the root cause, while eradication only limits spread
  3. Containment limits spread, while eradication removes the root cause from affected systems Correct answer.
  4. Both terms mean permanently disabling the network

Explanation

Containment stops the incident from spreading or causing further damage, whereas eradication eliminates the underlying cause such as malware or an exploited vulnerability. They are sequential but distinct objectives.

Question 20Fundamental principles and concepts of information security incident management

An organization's incident log shows repeated low-severity events that individually cause no harm. Why might ISO/IEC 27035 still encourage analyzing them?

  1. Analyzing them removes the need for severity classification
  2. They are only useful for public relations
  3. Patterns across events may reveal a developing or systemic threat Correct answer.
  4. Low-severity events are legally required to be ignored

Explanation

Aggregating and correlating events can expose trends, such as a slow reconnaissance campaign, that are not obvious from any single event. This supports earlier detection and preventive action.

Question 21Fundamental principles and concepts of information security incident management

A response team wants to test its incident management capability. Which approach aligns with ISO/IEC 27035 preparation and improvement principles?

  1. Conducting exercises and simulations, then updating plans based on findings Correct answer.
  2. Waiting for a real major incident to reveal weaknesses
  3. Testing only the technical tools and never the procedures
  4. Avoiding any testing to prevent staff anxiety

Explanation

Exercises and simulations validate plans, roles, and communications before a real incident, and their findings should feed plan updates. Testing both technical and procedural elements gives a realistic picture of readiness.

Question 22Fundamental principles and concepts of information security incident management

Which scenario best illustrates the difference between an incident and a vulnerability under ISO/IEC 27035?

  1. An unpatched server is a vulnerability; an attacker exploiting it to gain access is an incident Correct answer.
  2. Both the unpatched server and the exploitation are vulnerabilities
  3. An unpatched server is an incident; an attacker exploiting it is a vulnerability
  4. Both the unpatched server and the exploitation are incidents

Explanation

A vulnerability is a weakness or exposure, such as missing patches, while an incident is a realized adverse event, such as unauthorized access resulting from exploitation. The framework treats them as distinct concepts managed through linked processes.

Question 23Fundamental principles and concepts of information security incident management

An incident is contained and services restored, but the root cause remains unknown. What does ISO/IEC 27035 imply about closing the incident?

  1. Closure should account for unresolved root cause, since recurrence risk remains and follow-up is needed Correct answer.
  2. Root cause analysis is optional and unrelated to improvement
  3. The incident should be deleted from records to avoid audit findings
  4. Closure is automatic once services are restored, regardless of root cause

Explanation

Restoring service does not necessarily resolve the underlying weakness, so closure decisions should consider residual risk and required follow-up actions. Recording the outcome and outstanding actions supports accountability and improvement.

Question 24Fundamental principles and concepts of information security incident management

Why does ISO/IEC 27035 treat incident management as a continual improvement cycle rather than a one-time project?

  1. Because improvement cycles eliminate the need for preparation
  2. Because regulations require annual team photographs
  3. Because incidents never actually occur
  4. Threats, systems, and lessons evolve, so plans and controls must be periodically reviewed and updated Correct answer.

Explanation

The threat landscape, technology estate, and organizational context change continuously, so plans, roles, and controls must be revisited using feedback from incidents and exercises. This is why the framework positions incident management within a management system with continual improvement.

Question 25Fundamental principles and concepts of information security incident management

Which pairing of ISO/IEC 27035 phase and its main outcome is correct?

  1. Recovery - initial identification of suspicious events
  2. Preparation - eradication of active malware
  3. Lessons learned - documented improvements to prevent recurrence Correct answer.
  4. Detection and reporting - final closure of the incident

Explanation

The lessons learned phase produces documented findings and improvement actions to reduce recurrence. The other pairings mismatch each phase with an activity belonging elsewhere in the lifecycle.

Question 26Fundamental principles and concepts of information security incident management

In ISO/IEC 27035 incident management, what is the primary purpose of the 'detection and reporting' phase?

  1. To identify and report information security incidents as early as possible Correct answer.
  2. To eliminate the root cause of incidents
  3. To apply patches to vulnerable systems
  4. To restore affected services to normal operation

Explanation

The detection and reporting phase focuses on identifying events that may be incidents and reporting them promptly so that response actions can be initiated. It does not involve restoring services or eradicating root causes, which belong to later phases.

Question 27Fundamental principles and concepts of information security incident management

Which document produced during incident management typically records the chronological details of an incident, including actions taken and evidence collected?

  1. A statement of applicability
  2. An incident log or incident record Correct answer.
  3. A risk assessment report
  4. A business impact analysis

Explanation

ISO/IEC 27035 emphasizes maintaining an incident log or record that captures the timeline, actions, and evidence for each incident. This record supports response coordination, evidence handling, and later review.

Question 28Fundamental principles and concepts of information security incident management

According to ISO/IEC 27035, which of the following best describes an 'information security incident'?

  1. A policy that defines acceptable use of assets
  2. A combination of events that may lead to or constitute a security breach Correct answer.
  3. A single event that indicates a possible breach of security
  4. A vulnerability that has not yet been exploited

Explanation

ISO/IEC 27035 defines an information security incident as a combination of events that may lead to or constitute a security breach. A single event is typically an 'event' until assessed as an incident, and a vulnerability is a weakness, not an incident.

Question 29Fundamental principles and concepts of information security incident management

An organization wants to ensure that its incident management process includes a step to determine whether an event is actually an incident. Which activity from ISO/IEC 27035 does this describe?

  1. Incident closure
  2. Incident triage or assessment Correct answer.
  3. Incident eradication
  4. Post-incident review

Explanation

Triage or assessment is the activity where reported events are evaluated to determine whether they qualify as incidents and to assign priority. Closure, review, and eradication occur later in the process.

Question 30Fundamental principles and concepts of information security incident management

Which of the following is a key benefit of integrating incident management with the organization's overall risk management process?

  1. It guarantees that no incidents will occur
  2. It allows incident data to inform risk assessments and control improvements Correct answer.
  3. It eliminates the need for a separate incident response team
  4. It ensures that all incidents are treated as risks

Explanation

ISO/IEC 27035 promotes using incident information to update risk assessments and improve controls, creating a feedback loop. This integration helps prioritize risks based on actual incidents rather than only theoretical analysis.

Question 31Fundamental principles and concepts of information security incident management

During an incident, the response team must decide whether to isolate affected systems. Which principle from ISO/IEC 27035 should guide this decision?

  1. Containment actions should balance the need to limit damage with the need to preserve evidence and maintain business continuity Correct answer.
  2. Containment should only be performed after eradication
  3. Containment is optional and depends on the team's preference
  4. Containment should always be performed immediately

Explanation

ISO/IEC 27035 emphasizes that containment measures must consider both the spread of the incident and the potential impact on business operations and evidence preservation. A balanced approach is required rather than automatic or arbitrary action.

Question 32Fundamental principles and concepts of information security incident management

An organization is defining roles and responsibilities for its incident management capability. According to ISO/IEC 27035, which of the following is most important to establish?

  1. A single person who handles all incidents alone
  2. That all employees are responsible for incident response
  3. Clear assignment of authority and communication paths for incident handling Correct answer.
  4. That the IT department is solely responsible for incident management

Explanation

ISO/IEC 27035 stresses the need for defined roles, responsibilities, and authority for incident management, including clear communication and escalation paths. This ensures coordinated and effective response.

Question 33Fundamental principles and concepts of information security incident management

After an incident is resolved, ISO/IEC 27035 requires a post-incident activity. Which of the following best describes the purpose of this activity?

  1. To identify improvements to the incident management process and controls Correct answer.
  2. To publicly disclose the incident details
  3. To assign blame to the individuals involved
  4. To immediately close all related tickets without further analysis

Explanation

The post-incident activity, often called lessons learned, aims to review the incident and identify weaknesses in processes and controls so they can be improved. It is not about blame or immediate closure without analysis.

Question 34Fundamental principles and concepts of information security incident management

An organization experiences a data breach that affects customer personal data. According to ISO/IEC 27035, what is the most appropriate action regarding external parties?

  1. Delegate notification to the IT department without management involvement
  2. Avoid notifying anyone to prevent reputational damage
  3. Follow the organization's communication plan and legal requirements for notifying affected parties and authorities Correct answer.
  4. Notify all customers immediately without assessing the scope

Explanation

ISO/IEC 27035 emphasizes that incident response should include communication with external parties as required by law and organizational policy, based on an assessment of the incident. This ensures compliance and appropriate transparency.

Question 35Information security incident management process based on ISO/IEC 27035

In the ISO/IEC 27035 incident management process, which phase immediately follows 'Detection and Reporting'?

  1. Recovery
  2. Lessons Learned
  3. Eradication
  4. Assessment and Decision Correct answer.

Explanation

The standard sequence moves from detecting and reporting an information security event to assessing it and deciding whether it qualifies as an incident requiring response. Only after that decision are response, recovery and post-incident activities undertaken.

Question 36Information security incident management process based on ISO/IEC 27035

What is the primary purpose of the 'Detection and Reporting' phase in ISO/IEC 27035?

  1. To restore affected services to normal operation
  2. To permanently remove the root cause of a confirmed incident
  3. To document agreed improvements after an incident is closed
  4. To identify information security events and communicate them to the responsible point of contact Correct answer.

Explanation

This phase concerns noticing information security events through monitoring or user reports and passing them promptly to the designated contact. It does not itself contain response, recovery or improvement work, which belong to later phases.

Question 37Information security incident management process based on ISO/IEC 27035

Which activity belongs to the 'Assessment and Decision' phase rather than to incident response?

  1. Applying containment measures to limit spread
  2. Notifying regulators of a confirmed breach
  3. Classifying the reported event and deciding whether it constitutes an incident Correct answer.
  4. Collecting forensic evidence from affected hosts

Explanation

Assessment and decision is about triage: evaluating the reported event against criteria and deciding whether it is an incident and how severe it is. Containment, evidence collection and notification are actions taken once that decision has been made.

Question 38Information security incident management process based on ISO/IEC 27035

In ISO/IEC 27035 terminology, what distinguishes an 'information security incident' from an 'information security event'?

  1. An incident is an event reported by external parties rather than internal staff
  2. An incident is an event that has already caused financial loss only
  3. An incident is an event, or series of events, that has been assessed as having actual or potential significant negative impact Correct answer.
  4. An incident is any event logged by a security tool regardless of impact

Explanation

The standard treats events as the broad class of observable occurrences, while an incident is an event or set of events assessed as having actual or potential significant negative impact on the organisation. The distinction rests on assessed significance, not on the source of the report or on realised financial loss.

Question 39Information security incident management process based on ISO/IEC 27035

An analyst receives a report of unusual outbound traffic from a finance workstation. According to ISO/IEC 27035, what should happen first?

  1. Assess the event against defined criteria to decide whether it is an incident and assign a severity Correct answer.
  2. Immediately wipe and rebuild the workstation
  3. Send a breach notification to the data protection authority
  4. Convene a lessons-learned meeting

Explanation

Reported events must be triaged through assessment and decision so that response effort is proportionate and justified. Destroying evidence, notifying externally or reviewing lessons before confirming an incident would be premature.

Question 40Information security incident management process based on ISO/IEC 27035

Which of the following is the best example of a preventive control supporting the incident management process?

  1. A patch management programme that removes exploitable vulnerabilities before incidents arise Correct answer.
  2. A post-incident report template
  3. A documented escalation matrix for on-call responders
  4. A SIEM rule that raises an alert on suspicious authentication

Explanation

Preventive controls reduce the likelihood of incidents occurring, and vulnerability and patch management is a classic example. Alerts, escalation paths and report templates support detection or response rather than prevention.

Question 41Information security incident management process based on ISO/IEC 27035

Within the response phase, what is the purpose of containment?

  1. To limit the spread and impact of the incident while response actions proceed Correct answer.
  2. To identify and eliminate the underlying cause of the incident
  3. To return systems to their pre-incident state
  4. To determine whether the event meets the incident criteria

Explanation

Containment aims to stop an incident from expanding and to protect unaffected assets so that investigation and eradication can proceed safely. Eradication removes the cause, recovery restores services, and assessment decides whether an incident exists at all.

Question 42Information security incident management process based on ISO/IEC 27035

Why does ISO/IEC 27035 emphasise preserving evidence during incident response?

  1. Because evidence collection replaces the need for containment
  2. Because evidence supports root-cause analysis, disciplinary or legal action, and defensible conclusions Correct answer.
  3. Because evidence is only relevant when law enforcement is involved
  4. Because evidence must always be shared publicly after an incident

Explanation

Preserving evidence protects the organisation's ability to investigate accurately and to support any legal, regulatory or HR proceedings that follow. It complements containment and recovery rather than replacing them, and it matters even when no external authority is engaged.

Question 43Information security incident management process based on ISO/IEC 27035

What is the main role of an incident response team defined under ISO/IEC 27035?

  1. To own the organisation's entire risk register
  2. To approve the organisation's information security policy
  3. To coordinate the organisation's response to incidents according to agreed roles and procedures Correct answer.
  4. To perform all internal audits of the information security management system

Explanation

The incident response team is a defined group with assigned roles and responsibilities that coordinates detection, assessment, response and review activities. Policy approval, audit and enterprise risk ownership sit with other governance bodies.

Question 44Information security incident management process based on ISO/IEC 27035

An organisation wants to test its incident response capability without risking production systems. Which ISO/IEC 27035-aligned activity is most appropriate?

  1. Reviewing the incident policy document only
  2. Waiting for a real incident to see how the team performs
  3. Conducting an exercise or simulation based on a realistic incident scenario Correct answer.
  4. Disabling logging to reduce noise during the test

Explanation

The standard supports planning and exercising response capability so that roles, communications and procedures are validated before a real incident occurs. Document review alone does not test operational readiness, and waiting for a real incident is not a test.

Question 45Information security incident management process based on ISO/IEC 27035

Which set of participants should typically be represented in incident communication planning under ISO/IEC 27035?

  1. Internal technical and management stakeholders plus relevant external parties such as regulators, customers and law enforcement Correct answer.
  2. Only external regulators
  3. Only the IT operations team
  4. Only the public relations department

Explanation

Communication planning must cover both internal escalation and external obligations, since incidents often require coordinated messaging to management, customers, regulators and possibly law enforcement. Restricting communication to a single group leaves key stakeholders uninformed.

Question 46Information security incident management process based on ISO/IEC 27035

What is the key output of the 'Lessons Learned' phase in ISO/IEC 27035?

  1. A confirmed severity rating for the incident
  2. An initial triage decision on the reported event
  3. A containment strategy for the affected systems
  4. Documented findings and agreed improvements that feed back into the incident management process Correct answer.

Explanation

Lessons learned captures what worked, what failed and what should change, producing recommendations that improve future prevention and response. Severity ratings, containment and triage decisions are outputs of earlier phases.

Question 47Information security incident management process based on ISO/IEC 27035

During an incident, a responder wants to shut down a compromised server immediately. What consideration does ISO/IEC 27035 suggest before such an action?

  1. Whether shutting down will destroy volatile evidence and whether containment can be achieved another way Correct answer.
  2. Whether the marketing team has approved the outage
  3. Whether the incident has already been closed
  4. Whether the server vendor has been notified

Explanation

Response actions should be chosen with awareness of their effect on evidence and business operations, so volatile data is captured where feasible and less destructive containment options are considered. Vendor, marketing or closure status are not the governing criteria.

Question 48Information security incident management process based on ISO/IEC 27035

Which statement best describes how ISO/IEC 27035 relates incident management to the wider information security management system?

  1. Incident management replaces the need for risk assessment
  2. Incident management is performed only by external service providers
  3. Incident management is an optional add-on unrelated to the management system
  4. Incident management is a core operational process within the management system, subject to continual improvement Correct answer.

Explanation

Incident management operates inside the information security management system and is improved through the same plan-do-check-act cycle, with lessons learned feeding back into risk treatment and controls. It does not replace risk assessment and is not restricted to external providers.

Question 49Information security incident management process based on ISO/IEC 27035

What does an incident severity classification scheme primarily enable in the ISO/IEC 27035 process?

  1. Permanent removal of all vulnerabilities from the estate
  2. Proportionate escalation and allocation of resources according to assessed impact Correct answer.
  3. Elimination of the need for post-incident review
  4. Automatic legal immunity for the organisation

Explanation

Severity classification lets the organisation match response effort, escalation level and seniority of involvement to the assessed impact of an incident. It does not remove vulnerabilities, confer legal protection or make reviews unnecessary.

Question 50Information security incident management process based on ISO/IEC 27035

A third-party supplier discovers a breach affecting data the organisation entrusted to it. What does ISO/IEC 27035 suggest about handling such externally originating incidents?

  1. The organisation should ignore the event because the supplier owns the systems
  2. The organisation should include supplier-reported events in its incident process and coordinate response through agreed communication channels Correct answer.
  3. The organisation should wait until the supplier publishes a public report
  4. The organisation should immediately terminate the contract without investigation

Explanation

Incidents arising in the supply chain still affect the organisation's information and must be handled through its process, with coordination and information sharing agreed in advance. Ignoring, reacting contractually without investigation or waiting passively all delay necessary response.