I85PREP
⌘ K
ISO/IEC 27002 Foundation study materials
ISO/IEC 27002 Foundation study resources

ISO/IEC 27002 Foundation practice questions

One question at a time. Build your ISO/IEC 27002 Foundation understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Fundamental principles and concepts of information security, cybersecurity, and privacy

In ISO/IEC 27000-series vocabulary, what does the term 'information security' primarily describe?

  1. Preservation of confidentiality, integrity and availability of information Correct answer.
  2. Guarantee that information systems will never be breached
  3. Compliance with national data protection legislation
  4. Protection of physical assets such as buildings and vehicles

Explanation

The vocabulary standard defines information security as the preservation of confidentiality, integrity and availability of information, noting that other properties such as authenticity, accountability, non-repudiation and reliability may also be involved. It is a property-based definition rather than a promise of absolute protection or a legal compliance status.

Question 2Fundamental principles and concepts of information security, cybersecurity, and privacy

Which property of information is violated when data is altered accidentally during an unverified system migration?

  1. Integrity Correct answer.
  2. Confidentiality
  3. Non-repudiation
  4. Availability

Explanation

Integrity means information is accurate and complete and has not been changed in an unauthorised or unintended way, so accidental alteration during migration is an integrity failure. Availability concerns timely access and confidentiality concerns disclosure to unauthorised parties.

Question 3Fundamental principles and concepts of information security, cybersecurity, and privacy

How does ISO/IEC 27000-series vocabulary distinguish 'information security' from 'cybersecurity'?

  1. Cybersecurity applies only to classified government networks
  2. Cybersecurity is a broader concept that fully contains information security
  3. Information security covers all forms of information, while cybersecurity focuses on protecting cyberspace and its interconnected systems Correct answer.
  4. The two terms are defined as exact synonyms with no distinction

Explanation

Information security is defined around preserving properties of information in general, whatever its form or medium. Cybersecurity is defined around preserving properties of information in cyberspace, which is characterised by interconnected networks and the people, processes and technologies involved.

Question 4Fundamental principles and concepts of information security, cybersecurity, and privacy

In ISO/IEC 27000-series vocabulary, what is an 'information asset'?

  1. A software licence held by the organisation
  2. Only data stored in electronic databases
  3. A hardware device listed in the fixed asset register
  4. Anything that has value to a person or organisation in the context of information Correct answer.

Explanation

An asset is anything that has value to an organisation, and information assets include information itself plus the people, processes, systems and other components that support it. Limiting the concept to databases or hardware misses the breadth of the definition.

Question 5Fundamental principles and concepts of information security, cybersecurity, and privacy

What does the term 'risk' mean in the ISO/IEC 27000-series vocabulary?

  1. The number of vulnerabilities found in a penetration test
  2. The total cost of all security controls deployed
  3. The effect of uncertainty on objectives, expressed as a combination of consequences and their likelihood Correct answer.
  4. The certainty that a threat will occur within a year

Explanation

Risk is defined as the effect of uncertainty on objectives, and in security terms it is usually analysed as a combination of the consequences of an event and the associated likelihood of occurrence. It is not a single count such as vulnerability numbers or control spend.

Question 6Fundamental principles and concepts of information security, cybersecurity, and privacy

An organisation decides to purchase cyber insurance rather than remove a vulnerability. Which risk treatment option has been applied?

  1. Risk retention
  2. Risk modification
  3. Risk avoidance
  4. Risk sharing Correct answer.

Explanation

Risk treatment options in the ISO/IEC 27000-series include avoiding, modifying, sharing and retaining risk. Transferring part of the financial consequence to an insurer is risk sharing, even though some residual risk usually remains with the organisation.

Question 7Fundamental principles and concepts of information security, cybersecurity, and privacy

Which statement best describes 'residual risk' in an information security management context?

  1. Risk that has been fully eliminated by controls
  2. Risk arising only from third-party suppliers
  3. Risk that remains after risk treatment has been applied Correct answer.
  4. Risk identified before any controls are considered

Explanation

Residual risk is what remains once treatment options have been selected and implemented. It must be compared with the risk acceptance criteria and formally accepted by the appropriate authority, because treatment rarely reduces risk to zero.

Question 8Fundamental principles and concepts of information security, cybersecurity, and privacy

What is the primary purpose of an information security policy according to ISO/IEC 27002 guidance?

  1. To replace the need for risk assessment
  2. To document the technical configuration of each server
  3. To list the names of employees who have been disciplined
  4. To provide management direction and support for information security in line with business requirements Correct answer.

Explanation

The policy topic expects top management to define direction and support for security in accordance with business requirements and relevant laws and regulations. It is a governance instrument, not a technical configuration record, and it does not substitute for risk assessment.

Question 9Fundamental principles and concepts of information security, cybersecurity, and privacy

Which pair correctly matches an information security principle with its meaning?

  1. Need-to-know - all staff may access all information once employed
  2. Separation of duties - no single person controls a transaction from start to finish Correct answer.
  3. Least privilege - every user is granted administrator rights for convenience
  4. Defence in depth - relying on a single strong control

Explanation

Separation of duties divides tasks and privileges so that no one person can complete a critical process alone, reducing the chance of error or fraud. The other pairings invert the principles they claim to describe.

Question 10Fundamental principles and concepts of information security, cybersecurity, and privacy

What does 'privacy' mean when defined as a property in the ISO/IEC 27000-series vocabulary?

  1. A synonym for information security in all contexts
  2. The right of an organisation to monitor employee communications without notice
  3. The obligation to publish all personal data held by an organisation
  4. Freedom from intrusion into the private life or affairs of an individual Correct answer.

Explanation

Privacy is defined as freedom from intrusion into the private life or affairs of an individual, and information privacy concerns the protection of personally identifiable information. It is related to, but distinct from, information security.

Question 11Fundamental principles and concepts of information security, cybersecurity, and privacy

Which statement best captures the relationship between information security and privacy?

  1. Privacy is achieved automatically once confidentiality controls are deployed
  2. Information security and privacy are mutually exclusive objectives
  3. Information security supports privacy, but privacy also requires lawful and fair handling of personal data Correct answer.
  4. Privacy applies only to paper records held by governments

Explanation

Security controls such as access control and encryption help protect personal data, but privacy additionally demands principles such as lawfulness, fairness, purpose limitation and transparency. Security is therefore a necessary but not sufficient enabler of privacy.

Question 12Fundamental principles and concepts of information security, cybersecurity, and privacy

A retailer collects customer email addresses for order delivery and later uses the same list for unrelated marketing without any new basis. Which privacy principle is most directly undermined?

  1. Availability
  2. Purpose limitation Correct answer.
  3. Non-repudiation
  4. Capacity management

Explanation

Purpose limitation requires personal data to be collected for specified, explicit and legitimate purposes and not used incompatibly with those purposes. Reusing delivery data for unrelated marketing without a proper basis breaches that principle.

Question 13Fundamental principles and concepts of information security, cybersecurity, and privacy

Under privacy principles, what does 'data minimisation' require?

  1. Collecting and processing only personal data that is adequate, relevant and necessary for the stated purpose Correct answer.
  2. Deleting all personal data within 24 hours of collection
  3. Storing all data indefinitely in case it becomes useful
  4. Encrypting data with the longest possible key length

Explanation

Data minimisation limits collection and processing to what is adequate, relevant and necessary for the specified purpose. It is about scope of data, not about encryption strength or a fixed retention period.

Question 14Fundamental principles and concepts of information security, cybersecurity, and privacy

Which statement reflects the concept of 'defence in depth' in information security?

  1. Multiple independent layers of controls are deployed so that a failure in one is mitigated by others Correct answer.
  2. Security relies mainly on user awareness training alone
  3. All controls must be identical to simplify management
  4. A single perimeter firewall is sufficient if it is correctly configured

Explanation

Defence in depth layers preventive, detective and corrective controls across people, processes and technology, so that no single control failure leads directly to compromise. Redundancy and diversity of controls are central to the concept.

Question 15Fundamental principles and concepts of information security, cybersecurity, and privacy

What is the role of 'top management' in an information security management system as emphasised in the ISO/IEC 27000-series?

  1. Personally configuring every security device
  2. Demonstrating leadership and commitment by establishing policy and ensuring resources Correct answer.
  3. Delegating all security decisions permanently to an external auditor
  4. Approving each individual user access request

Explanation

Top management is expected to provide leadership and commitment through policy, roles, resources and integration of security into business processes. Operational tasks such as device configuration and individual access approvals are delegated.

Question 16Fundamental principles and concepts of information security, cybersecurity, and privacy

Which of the following best describes an 'event' as distinct from an 'incident' in the ISO/IEC 27000-series vocabulary?

  1. The two terms are interchangeable in all standards
  2. An event is any occurrence of a particular set of circumstances, while an incident is an event that indicates a possible breach of security Correct answer.
  3. An event is a documented policy, while an incident is a control
  4. An event is always malicious, while an incident is always accidental

Explanation

An information security event is an identified occurrence indicating a possible breach of security policy or failure of controls, while an information security incident is a single or series of unwanted events with significant probability of compromising business operations. The vocabulary treats events as the broader category.

Question 17Fundamental principles and concepts of information security, cybersecurity, and privacy

Why is 'accountability' important as a supporting property of information security?

  1. It encrypts all data at rest automatically
  2. It ensures that actions can be attributed to an entity and that responsibility can be established Correct answer.
  3. It removes the need for logging and monitoring
  4. It guarantees that information is always available during outages

Explanation

Accountability means responsibility for actions can be assigned to an entity, which is why identification, authentication and logging support it. It does not itself provide availability or encryption, and it depends on records rather than replacing them.

Question 18Fundamental principles and concepts of information security, cybersecurity, and privacy

What does 'authenticity' mean as an information property in the ISO/IEC 27000-series?

  1. The property that information has not been disclosed
  2. The property that an entity is what it claims to be Correct answer.
  3. The property that a system performs at expected speed
  4. The property that information is accessible when required

Explanation

Authenticity is the property that an entity is what it claims to be, and it is validated through authentication mechanisms. It is distinct from availability, confidentiality and performance characteristics.

Question 19Fundamental principles and concepts of information security, cybersecurity, and privacy

An organisation classifies information and applies handling rules according to sensitivity. Which security objective does information classification primarily serve?

  1. Guaranteeing that no data is ever lost
  2. Eliminating the need for access control
  3. Ensuring that information is protected in proportion to its value and sensitivity Correct answer.
  4. Reducing the number of employees in the organisation

Explanation

Classification assigns information to categories so that appropriate protection and handling rules are applied consistently and proportionately. It informs access control and handling rather than replacing them, and it cannot guarantee that loss never occurs.

Question 20Fundamental principles and concepts of information security, cybersecurity, and privacy

Which statement correctly describes the concept of 'vulnerability' in risk analysis?

  1. A person who deliberately attacks a system
  2. Any event that has already caused a financial loss
  3. A weakness of an asset or control that could be exploited by one or more threats Correct answer.
  4. The amount of money budgeted for security

Explanation

A vulnerability is a weakness in an asset or control that a threat can exploit, and risk arises from the interaction of assets, threats and vulnerabilities. A realised loss is an incident consequence, and an attacker is a threat source.

Question 21Fundamental principles and concepts of information security, cybersecurity, and privacy

Which combination best explains why confidentiality alone does not ensure information security?

  1. Because information must also remain accurate and accessible when needed, alongside other properties such as authenticity and accountability Correct answer.
  2. Because confidentiality is irrelevant to personal data
  3. Because integrity controls replace confidentiality controls entirely
  4. Because availability always matters more than confidentiality

Explanation

Information security rests on multiple properties, principally confidentiality, integrity and availability, with supporting properties such as authenticity, accountability, non-repudiation and reliability. Protecting only against disclosure leaves alteration and disruption unaddressed.

Question 22Fundamental principles and concepts of information security, cybersecurity, and privacy

A hospital must keep patient records available to clinicians at all times while restricting disclosure to authorised staff. Which analysis best reflects the C-I-A balance involved?

  1. Confidentiality should be abandoned so that records are always accessible
  2. Integrity is irrelevant to patient records
  3. Availability and confidentiality must both be addressed, with controls tuned to clinical need and legal obligations Correct answer.
  4. Availability should be ignored because confidentiality is more important

Explanation

The scenario requires simultaneous attention to availability for care delivery and confidentiality for privacy obligations, with integrity also essential for safe clinical decisions. Mature security management balances these properties according to business and legal context rather than maximising one at the expense of others.

Question 23Fundamental principles and concepts of information security, cybersecurity, and privacy

Which statement best distinguishes 'risk criteria' from 'risk appetite' in information security management?

  1. The two terms are synonyms in the ISO/IEC 27000-series
  2. Risk criteria apply only to suppliers, while risk appetite applies only to employees
  3. Risk appetite is a technical control, while risk criteria are a legal requirement
  4. Risk criteria are the terms of reference for evaluating risk significance, while risk appetite is the amount of risk an organisation is willing to accept Correct answer.

Explanation

Risk criteria define the terms of reference used to evaluate the significance of risk, including thresholds and scales. Risk appetite describes the amount and type of risk an organisation is willing to pursue or retain, and it informs acceptance decisions.

Question 24Fundamental principles and concepts of information security, cybersecurity, and privacy

Which statement correctly reflects the principle that information security should be proportionate to risk?

  1. The strongest available controls should always be deployed regardless of cost or context
  2. Controls should be identical in every organisation regardless of sector
  3. Controls should be selected and sized according to the assessed risk and the value of the information Correct answer.
  4. Controls should be chosen only on the basis of vendor market share

Explanation

Proportionate security means selecting controls based on assessed risk, asset value and business context, so that cost and effort are justified. Uniformly maximal controls ignore context, while choosing on vendor popularity is not a risk-based rationale.

Question 25Fundamental principles and concepts of information security, cybersecurity, and privacy

Which statement best explains why 'non-repudiation' is a supporting property rather than a core C-I-A property?

  1. It replaces integrity as the main property of information
  2. It supports the ability to prove that an action or event occurred, complementing confidentiality, integrity and availability Correct answer.
  3. It guarantees that systems will never fail
  4. It applies only to paper-based transactions

Explanation

Non-repudiation provides assurance that a party cannot deny having performed an action, typically through evidence such as digital signatures and audit logs. It complements the core C-I-A properties rather than replacing any of them, and it is not limited to paper records.

Question 26Fundamental principles and concepts of information security, cybersecurity, and privacy

In ISO/IEC 27000-series terminology, which statement best defines 'information security'?

  1. Compliance with all applicable legal and regulatory requirements
  2. Ability to restore systems after a disruptive event
  3. Protection of personal data against unlawful processing
  4. Preservation of confidentiality, integrity and availability of information Correct answer.

Explanation

The ISO/IEC 27000-series defines information security as the preservation of confidentiality, integrity and availability of information. Privacy protection, recovery capability and legal compliance are related concerns but are not the definition itself.

Question 27Fundamental principles and concepts of information security, cybersecurity, and privacy

Which statement best describes 'cybersecurity' as used in the ISO/IEC 27000-series?

  1. Safeguarding of people, society, organisations and states against cyber threats Correct answer.
  2. Application of a risk management process to physical assets
  3. Protection of personal data against unlawful processing
  4. Preservation of confidentiality, integrity and availability of information

Explanation

Cybersecurity is defined in the ISO/IEC 27000-series as the safeguarding of people, society, organisations and states against cyber threats. It is broader than information security because it explicitly includes societal and state-level concerns.

Question 28Fundamental principles and concepts of information security, cybersecurity, and privacy

Which term in the ISO/IEC 27000-series vocabulary refers to the property of information being accessible and usable upon demand by an authorised entity?

  1. Availability Correct answer.
  2. Integrity
  3. Authenticity
  4. Confidentiality

Explanation

Availability is the property of being accessible and usable upon demand by an authorised entity. Integrity concerns accuracy and completeness, confidentiality concerns limiting access, and authenticity concerns the validity of claimed identity.

Question 29Fundamental principles and concepts of information security, cybersecurity, and privacy

In the ISO/IEC 27000-series, which statement best describes 'confidentiality'?

  1. Information is not made available or disclosed to unauthorised individuals, entities or processes Correct answer.
  2. Information is protected against accidental loss or corruption
  3. Information is accurate, complete and protected against unauthorised modification
  4. Information is accessible and usable upon demand by an authorised entity

Explanation

Confidentiality is the property that information is not made available or disclosed to unauthorised individuals, entities or processes. The other options describe integrity and availability properties rather than confidentiality.

Question 30Fundamental principles and concepts of information security, cybersecurity, and privacy

An organisation is selecting risk treatment options for an identified information security risk. Which option involves transferring the risk to another party?

  1. Accepting the risk because the cost of treatment exceeds the potential loss
  2. Purchasing a cyber insurance policy that covers losses from the risk Correct answer.
  3. Deciding not to proceed with the activity that creates the risk
  4. Applying additional access controls to reduce the likelihood of the risk

Explanation

Risk transfer shifts the financial consequences of a risk to another party, such as an insurer. Reducing likelihood through controls is risk mitigation, accepting the risk is retention, and avoiding the activity is risk avoidance.

Question 31Fundamental principles and concepts of information security, cybersecurity, and privacy

Which statement best describes the relationship between an 'information security event' and an 'information security incident'?

  1. An incident is any event that is logged, while an event is only a serious incident
  2. Events and incidents are synonyms and are used interchangeably in the ISO/IEC 27000-series
  3. An event is always a confirmed incident that has caused actual damage
  4. An incident is an event or series of events that could lead to harm and requires response Correct answer.

Explanation

An information security event is an identified occurrence indicating a possible breach of security, while an incident is an event or series of events that could lead to or has led to harm and requires response. Not every event becomes an incident.

Question 32Fundamental principles and concepts of information security, cybersecurity, and privacy

Which statement best describes the role of 'top management' in an information security management system according to ISO/IEC 27000-series guidance?

  1. Top management provides direction, demonstrates leadership and ensures resources are available Correct answer.
  2. Top management personally performs technical security testing and incident response
  3. Top management approves only the annual security budget and nothing else
  4. Top management delegates all information security decisions to the IT department

Explanation

Top management is expected to provide leadership and direction, establish the information security policy and objectives, and ensure resources are available for the ISMS. Operational security tasks are delegated to competent staff.

Question 33Fundamental principles and concepts of information security, cybersecurity, and privacy

An organisation applies several independent layers of security controls so that if one control fails, another still protects the information. Which principle does this illustrate?

  1. Defence in depth Correct answer.
  2. Separation of duties
  3. Need to know
  4. Least privilege

Explanation

Defence in depth uses multiple independent layers of controls so that a single failure does not expose the information. Least privilege, separation of duties and need to know are access control principles, not layered protection.

Question 34Fundamental principles and concepts of information security, cybersecurity, and privacy

Which statement best describes 'privacy' as defined in the ISO/IEC 27000-series?

  1. Ability of an entity to be held accountable for its actions
  2. Protection of information against unauthorised modification
  3. Freedom from intrusion into the private life or affairs of an individual Correct answer.
  4. Preservation of confidentiality, integrity and availability of information

Explanation

Privacy is defined as freedom from intrusion into the private life or affairs of an individual, including protection of personal information. Confidentiality, integrity and accountability are related concepts but do not define privacy.

Question 35Fundamental principles and concepts of information security, cybersecurity, and privacy

An organisation processes personal data only for the purposes for which it was collected and does not reuse it for unrelated purposes. Which privacy principle does this reflect?

  1. Accuracy
  2. Data minimisation
  3. Storage limitation
  4. Purpose specification and use limitation Correct answer.

Explanation

Purpose specification and use limitation require that personal data be collected for specified purposes and not used for incompatible purposes. Data minimisation concerns the amount collected, storage limitation concerns retention time, and accuracy concerns correctness.

Question 36Fundamental principles and concepts of information security, cybersecurity, and privacy

Which statement best distinguishes 'information security' from 'privacy' in the ISO/IEC 27000-series?

  1. Information security protects all information, while privacy focuses on personal information and individual rights Correct answer.
  2. Privacy and information security are identical and always impose the same requirements
  3. Privacy is concerned only with physical access to premises, while information security is concerned with data
  4. Information security applies only to personal data, while privacy applies to all organisational data

Explanation

Information security protects the confidentiality, integrity and availability of all information, whereas privacy concerns the protection of personal information and the rights of individuals. Privacy therefore imposes additional obligations beyond security.

Question 37Fundamental principles and concepts of information security, cybersecurity, and privacy

A vulnerability has been identified in a web application. Which statement best describes what a 'vulnerability' is in this context?

  1. The likelihood that a threat will exploit a weakness
  2. A weakness that could be exploited by a threat Correct answer.
  3. The potential for loss or damage when a threat exploits a weakness
  4. An occurrence that indicates a possible breach of security

Explanation

A vulnerability is a weakness that can be exploited by one or more threats. Likelihood and impact describe risk, and an occurrence indicating a possible breach is an event.

Question 38Fundamental principles and concepts of information security, cybersecurity, and privacy

Which statement best describes 'residual risk'?

  1. The risk that is transferred to a third party through a contract
  2. The risk that exists before any controls are implemented
  3. The risk that remains after risk treatment has been applied Correct answer.
  4. The risk that is accepted by top management without analysis

Explanation

Residual risk is the risk remaining after risk treatment options have been applied and controls implemented. Inherent risk is the risk before treatment, and transferred risk is one treatment option.

Question 39Fundamental principles and concepts of information security, cybersecurity, and privacy

An organisation defines that risks with a high likelihood and high impact must be treated before any medium-risk items. Which concept does this statement describe?

  1. Risk register
  2. Risk owner
  3. Risk criteria Correct answer.
  4. Risk appetite

Explanation

Risk criteria are the terms of reference against which the significance of risk is evaluated, including thresholds and prioritisation rules. Risk appetite is the amount of risk an organisation is willing to accept, and a risk register records risks.

Question 40Fundamental principles and concepts of information security, cybersecurity, and privacy

A hospital must keep patient records available to clinicians at all times while restricting disclosure to authorised staff. Which security objective combination does this requirement illustrate?

  1. Confidentiality and non-repudiation
  2. Availability and confidentiality Correct answer.
  3. Integrity and non-repudiation
  4. Authenticity and accountability

Explanation

Keeping records available to clinicians reflects availability, while restricting disclosure to authorised staff reflects confidentiality. Integrity, authenticity and non-repudiation address accuracy, identity validity and proof of action rather than these two requirements.

Question 41Fundamental principles and concepts of information security, cybersecurity, and privacy

Which statement best explains why 'non-repudiation' is considered a supporting property rather than a core confidentiality, integrity and availability property?

  1. It is a legal term with no relationship to information security
  2. It replaces integrity because it guarantees that data cannot be modified
  3. It supports the ability to prove that an action or event occurred, which underpins trust in the other properties Correct answer.
  4. It is only relevant to physical security and not to information systems

Explanation

Non-repudiation provides evidence that an action or event occurred so that it cannot later be denied, which supports trust in confidentiality, integrity and availability. It does not replace any of the core properties.

Question 42Fundamental principles and concepts of information security, cybersecurity, and privacy

An organisation applies information security controls that are commensurate with the value of the assets and the level of risk. Which principle does this reflect?

  1. Information security should be applied only after an incident
  2. Information security should be proportionate to risk Correct answer.
  3. Information security should rely on a single control
  4. Information security should be independent of business objectives

Explanation

The principle of proportionality requires that the effort and cost of controls be balanced against the value of the assets and the level of risk. Controls that are excessive or insufficient both fail this principle.

Question 43Fundamental principles and concepts of information security, cybersecurity, and privacy

Which statement best describes 'accountability' as a supporting property of information security?

  1. Information is not disclosed to unauthorised entities
  2. Responsibility for actions and decisions can be demonstrated and traced to an entity Correct answer.
  3. Information is accessible and usable upon demand by an authorised entity
  4. An entity is what it claims to be

Explanation

Accountability is the property that responsibility for actions and decisions can be demonstrated and traced to an entity. The other options describe availability, confidentiality and authenticity respectively.

Question 44Fundamental principles and concepts of information security, cybersecurity, and privacy

A company classifies information according to sensitivity and applies handling rules based on the classification. Which security objective is primarily supported by this practice?

  1. Confidentiality Correct answer.
  2. Non-repudiation
  3. Availability
  4. Authenticity

Explanation

Classification and handling rules primarily protect confidentiality by ensuring that information is disclosed only to those authorised to receive it. Availability, non-repudiation and authenticity are supported by other controls.

Question 45Fundamental principles and concepts of information security, cybersecurity, and privacy

Which statement best explains why confidentiality alone does not ensure information security?

  1. Confidentiality controls are always technical and never administrative
  2. Confidentiality is only relevant to personal data
  3. Confidentiality always implies integrity and availability
  4. Information may be confidential but inaccurate or unavailable when needed Correct answer.

Explanation

Confidentiality protects against unauthorised disclosure but says nothing about accuracy, completeness or timely access. Without integrity and availability, information may be confidential yet still unreliable or inaccessible.

Question 46Fundamental principles and concepts of information security, cybersecurity, and privacy

Which statement best describes 'authenticity' as an information property in the ISO/IEC 27000-series?

  1. The property that information is accurate and complete
  2. The property that information is not disclosed to unauthorised entities
  3. The property that an entity is what it claims to be Correct answer.
  4. The property that an action cannot be denied later

Explanation

Authenticity is the property that an entity is what it claims to be, and it also applies to the origin of information. Confidentiality, integrity and non-repudiation are distinct properties.

Question 47Fundamental principles and concepts of information security, cybersecurity, and privacy

An organisation receives a security alert about a possible breach. It investigates and confirms that no breach occurred. How should this alert be classified in ISO/IEC 27000-series terms?

  1. A risk because it could have caused harm
  2. A vulnerability because it revealed a weakness
  3. An information security incident because it was reported
  4. An information security event that did not become an incident Correct answer.

Explanation

An event is an identified occurrence indicating a possible breach of security. If investigation shows no actual breach requiring response, it remains an event rather than becoming an incident.

Question 48Fundamental principles and concepts of information security, cybersecurity, and privacy

An organisation decides to accept a risk rather than implement a control. Which condition makes this decision most consistent with ISO/IEC 27000-series risk management principles?

  1. The risk is within the organisation's risk appetite and the decision is documented and reviewed Correct answer.
  2. The risk is accepted permanently and never reviewed again
  3. The risk is hidden from top management to avoid unnecessary concern
  4. The risk is accepted without any assessment of likelihood or impact

Explanation

Risk acceptance is appropriate when the risk falls within the organisation's risk appetite and the decision is documented, communicated and subject to review. Acceptance without assessment or review is not consistent with risk management principles.

Question 49Fundamental principles and concepts of information security, cybersecurity, and privacy

Which statement best explains why 'availability' can conflict with 'confidentiality' in control design?

  1. Availability controls always reduce confidentiality to zero
  2. Availability and confidentiality are unrelated and never interact
  3. Confidentiality controls always improve availability
  4. Measures that make information widely accessible can increase the risk of unauthorised disclosure Correct answer.

Explanation

Availability and confidentiality can pull in opposite directions: making information more accessible to legitimate users can also increase exposure to unauthorised parties. Control design must balance the two properties according to risk.

Question 50Fundamental principles and concepts of information security, cybersecurity, and privacy

Which statement best explains why 'need to know' and 'least privilege' are related but not identical principles?

  1. Least privilege applies only to physical access, while need to know applies only to logical access
  2. Need to know limits access based on the information required for a task, while least privilege limits rights to the minimum necessary to perform the task Correct answer.
  3. Need to know and least privilege are identical and can be used interchangeably
  4. Need to know applies only to personal data, while least privilege applies only to system accounts

Explanation

Need to know focuses on restricting access to information that a person requires for a task, while least privilege focuses on granting the minimum rights necessary to perform the task. They are complementary but address different dimensions of access.