I85PREP
⌘ K
ISO 27002 Lead Manager study materials
ISO 27002 Lead Manager study resources

ISO 27002 Lead Manager practice questions

One question at a time. Build your ISO 27002 Lead Manager understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Fundamental principles and concepts of information security, cybersecurity, and privacy

In ISO/IEC 27000-series vocabulary, which statement best distinguishes information security from cybersecurity?

  1. Information security and cybersecurity are defined as identical scopes with no distinction in the ISO vocabulary.
  2. Cybersecurity protects paper records and physical assets, while information security addresses only networked systems.
  3. Cybersecurity applies only to critical national infrastructure, while information security applies only to commercial enterprises.
  4. Information security protects all forms of information regardless of format, while cybersecurity focuses on protecting networks, systems and data in cyberspace. Correct answer.

Explanation

The ISO/IEC 27000 vocabulary treats information security as the preservation of confidentiality, integrity and availability of information in all its forms, including paper and human knowledge. Cybersecurity is the subset concerned with protecting information and systems in cyberspace, including networks and connected devices. The two overlap but are not identical in scope.

Question 2Fundamental principles and concepts of information security, cybersecurity, and privacy

Which trio of properties forms the core definition of information security in the ISO/IEC 27000 family?

  1. Authenticity, non-repudiation and accountability
  2. Privacy, consent and retention
  3. Confidentiality, integrity and availability Correct answer.
  4. Resilience, redundancy and recovery

Explanation

The ISO/IEC 27000 vocabulary defines information security primarily through confidentiality, integrity and availability, often extended by related properties such as authenticity, accountability, non-repudiation and reliability. These three remain the anchor properties against which controls are selected and assessed.

Question 3Fundamental principles and concepts of information security, cybersecurity, and privacy

An organisation stores customer contracts in a cloud repository. Which property is directly harmed if an unauthorised employee silently alters the payment terms in a stored contract?

  1. Integrity Correct answer.
  2. Non-repudiation
  3. Availability
  4. Confidentiality

Explanation

Integrity is the property of accuracy and completeness, so unauthorised modification of stored content damages it directly. Confidentiality concerns disclosure and availability concerns timely access, neither of which is the primary harm here. Non-repudiation relates to proving that an action occurred, not to the accuracy of the record itself.

Question 4Fundamental principles and concepts of information security, cybersecurity, and privacy

Which statement correctly characterises the relationship between an information security management system and the controls catalogued in ISO/IEC 27002?

  1. The management system and ISO/IEC 27002 are interchangeable terms for the same set of controls.
  2. ISO/IEC 27002 defines legal obligations, while the management system defines technical baselines only.
  3. ISO/IEC 27002 certifies the management system, while the management system provides the control catalogue.
  4. The management system is the governance and continual-improvement framework, while ISO/IEC 27002 provides implementation guidance for selecting and applying controls within it. Correct answer.

Explanation

The management system standard establishes requirements for establishing, operating and continually improving security governance. ISO/IEC 27002 is a guidance document that helps organisations choose and implement controls to treat risks within that system. Certification applies to the management system requirements, not to the guidance catalogue.

Question 5Fundamental principles and concepts of information security, cybersecurity, and privacy

A risk owner decides to accept a residual risk after controls are applied. Which statement best reflects the principle behind this decision?

  1. Risk acceptance is equivalent to transferring the risk to an insurer or supplier.
  2. Risk acceptance should only be made by the security team, since it understands the technical exposure.
  3. Risk acceptance removes the need to monitor the risk thereafter because the decision is final.
  4. Risk acceptance is a deliberate management decision that should be recorded and monitored, because accountability remains with the owner. Correct answer.

Explanation

Risk treatment options include acceptance, and acceptance is a management decision taken with authority and documented for governance. Because exposure persists, the accepted risk must still be monitored and reviewed as conditions change. Accountability stays with the risk owner rather than being delegated to the security function.

Question 6Fundamental principles and concepts of information security, cybersecurity, and privacy

Which description best matches the concept of defence in depth as applied in information security?

  1. Duplicating every control at two sites to satisfy availability targets
  2. Relying on a single strong perimeter control to keep all threats outside the network
  3. Encrypting all data so that no other control is required
  4. Layering multiple independent controls so that the failure of one does not leave an asset unprotected Correct answer.

Explanation

Defence in depth arranges preventive, detective and corrective controls in layers across people, process and technology. A single failed or bypassed layer should not expose the asset fully. The principle assumes controls can fail and that adversaries may defeat any one of them.

Question 7Fundamental principles and concepts of information security, cybersecurity, and privacy

The principle of least privilege is best described by which statement?

  1. Subjects receive only the access rights needed for their assigned tasks, for only as long as those tasks require them. Correct answer.
  2. Every user receives the same baseline access so that administration remains simple.
  3. Privileged access is granted permanently to senior staff because they are trusted.
  4. Access rights are reviewed only when an audit is scheduled.

Explanation

Least privilege limits rights and entitlements to the minimum necessary for the task and duration. It reduces the blast radius of error, misuse and compromised accounts. Reviews and time limits are mechanisms that keep the principle effective over time.

Question 8Fundamental principles and concepts of information security, cybersecurity, and privacy

Which statement correctly distinguishes a threat, a vulnerability and a risk?

  1. A vulnerability is a potential cause of an incident, a threat is a weakness, and risk is the control gap between them.
  2. A threat is a potential cause of an incident, a vulnerability is a weakness that can be exploited, and risk combines the likelihood of that exploitation with its impact. Correct answer.
  3. A risk is a potential cause of an incident, a threat is the resulting loss, and a vulnerability is the probability of that loss.
  4. A threat is a weakness in a control, a vulnerability is an attacker, and risk is the cost of remediation.

Explanation

In ISO vocabulary a threat is a potential cause of an unwanted incident, and a vulnerability is a weakness that a threat can exploit. Risk expresses the effect of uncertainty on objectives, combining likelihood of occurrence with consequence. Keeping these terms distinct is essential for consistent risk assessment.

Question 9Fundamental principles and concepts of information security, cybersecurity, and privacy

An organisation identifies that a legacy server cannot be patched. Which treatment response is most consistent with ISO/IEC 27002 risk treatment principles?

  1. Reclassify the finding as an accepted architectural feature so no further action is required.
  2. Ignore the finding because the vendor no longer supports the product.
  3. Disconnect the server permanently without assessing the business impact of that decision.
  4. Apply compensating controls such as network segmentation and enhanced monitoring, and record the residual risk for the risk owner. Correct answer.

Explanation

When a vulnerability cannot be removed, compensating and detective controls reduce likelihood or impact while the residual risk is documented and owned. The decision and its rationale should be traceable for governance. Simply reclassifying or ignoring the finding removes no exposure.

Question 10Fundamental principles and concepts of information security, cybersecurity, and privacy

Which statement best captures the relationship between information security and privacy in an ISO/IEC 27002 context?

  1. Information security is a subset of privacy because all information relates to individuals.
  2. Privacy requirements replace security risk assessment for systems that process personal data.
  3. Privacy is fully achieved once confidentiality controls are applied to personal data.
  4. Privacy protection relies on security controls such as access control and encryption, but privacy also requires lawful, fair and purpose-limited processing of personal data. Correct answer.

Explanation

Security is a necessary enabler of privacy, protecting personal data through confidentiality, integrity and availability controls. Privacy additionally imposes principles such as lawfulness, fairness, purpose limitation and data minimisation that security controls alone do not satisfy. The two disciplines are complementary rather than nested.

Question 11Fundamental principles and concepts of information security, cybersecurity, and privacy

Which of the following best describes the privacy principle of data minimisation?

  1. Collect as much personal data as possible in case it becomes useful later.
  2. Collect and retain only personal data that is adequate, relevant and necessary for the stated purpose. Correct answer.
  3. Anonymise all data immediately so that no privacy obligations apply.
  4. Retain all personal data indefinitely to support future audits.

Explanation

Data minimisation limits collection and retention to what is adequate, relevant and necessary for the specified purpose. It works together with purpose limitation and storage limitation to reduce privacy exposure. Keeping extra data increases risk without a justified need.

Question 12Fundamental principles and concepts of information security, cybersecurity, and privacy

Which activity best exemplifies a detective control rather than a preventive one?

  1. Enforcing a password complexity policy at account creation
  2. Encrypting backups before they leave the site
  3. Requiring badge access to enter a data centre
  4. Reviewing authentication logs to identify failed login patterns Correct answer.

Explanation

Detective controls identify and record events after or while they occur, enabling response. Log review and monitoring are classic detective measures. Preventive controls stop an event from happening in the first place.

Question 13Fundamental principles and concepts of information security, cybersecurity, and privacy

An organisation defines a maximum tolerable downtime of four hours for a payment service. Which concept does this value directly express?

  1. Service level credit threshold
  2. Mean time between failures
  3. Recovery time objective Correct answer.
  4. Recovery point objective

Explanation

The recovery time objective states the maximum acceptable time to restore a service after disruption. The recovery point objective instead describes tolerable data loss measured in time. Confusing the two leads to mismatched continuity and backup designs.

Question 14Fundamental principles and concepts of information security, cybersecurity, and privacy

Which statement best reflects the concept of need-to-know as it relates to access to information?

  1. Any manager may access any information about staff who report to them.
  2. Need-to-know applies only to classified government information, not to commercial organisations.
  3. Clearance level alone determines access to all information at or below that level.
  4. Access to information is granted only where a legitimate task requires it, even if the person holds a high general clearance. Correct answer.

Explanation

Need-to-know restricts access to those with a genuine task requirement, complementing clearance or role-based entitlement. Holding a senior position or a high clearance does not by itself justify access. The principle applies to any organisation handling sensitive information.

Question 15Fundamental principles and concepts of information security, cybersecurity, and privacy

Which statement best describes the role of security awareness, education and training within an information security programme?

  1. They are one-off events delivered only during induction.
  2. They are relevant only to the security team, not to other staff.
  3. They replace the need for technical controls once all staff are trained.
  4. They build human capability so that people recognise and respond to security obligations relevant to their roles, complementing technical and procedural controls. Correct answer.

Explanation

Awareness, education and training address the human element so that obligations are understood and incidents are recognised and reported. They complement technical and procedural controls rather than substituting for them. Effectiveness depends on being role-relevant and repeated over time.

Question 16Fundamental principles and concepts of information security, cybersecurity, and privacy

An attacker impersonates a helpdesk agent by phone to persuade a user to reset a password. Which threat category does this primarily represent?

  1. Privilege escalation through software exploit
  2. Social engineering Correct answer.
  3. Denial of service
  4. Supply chain compromise

Explanation

Social engineering manipulates people into disclosing information or performing actions that undermine security. The attack relies on human trust rather than technical exploitation. Controls such as verification procedures and awareness training target this threat.

Question 17Fundamental principles and concepts of information security, cybersecurity, and privacy

Which statement best explains why segregation of duties reduces the likelihood of undetected fraud?

  1. It guarantees that fraud cannot occur anywhere in the organisation.
  2. It removes the need for audit logging because responsibilities are separated.
  3. It applies only to financial systems and has no relevance to IT administration.
  4. It ensures that no single person can initiate, authorise and record a transaction, so collusion or oversight is needed to conceal misuse. Correct answer.

Explanation

Segregation of duties divides critical steps among different people so that one individual cannot complete a sensitive process alone. This increases the effort required to conceal misuse and improves detection. It is a deterrent and detective measure, not an absolute guarantee.

Question 18Fundamental principles and concepts of information security, cybersecurity, and privacy

Which statement best describes the concept of an attack surface in security architecture?

  1. The documented list of accepted risks owned by management.
  2. The number of security controls deployed in a network.
  3. The physical perimeter fence surrounding a data centre.
  4. The set of points where an adversary could interact with or attempt to enter a system, which should be minimised where feasible. Correct answer.

Explanation

The attack surface comprises the exposed interfaces and entry points an adversary could exploit, including services, accounts and APIs. Reducing unnecessary exposure lowers the number of paths an attacker can try. It is broader than physical perimeter and distinct from control inventory or risk registers.

Question 19Fundamental principles and concepts of information security, cybersecurity, and privacy

Which statement best explains the principle of secure by design in system development?

  1. Security testing is performed only once the system has gone live.
  2. Security controls are documented only when a regulator requests them.
  3. Security is delegated entirely to the operations team after handover.
  4. Security requirements and controls are considered from the earliest design stages rather than added after implementation. Correct answer.

Explanation

Secure by design integrates security requirements, threat modelling and control selection early, when change is cheapest. Retrofitting controls after implementation is costlier and often less effective. Operations still plays a role, but responsibility begins at design.

Question 20Fundamental principles and concepts of information security, cybersecurity, and privacy

A system processes health data. Which combination of properties and obligations best reflects the relationship between security and privacy for that system?

  1. Privacy obligations apply only to marketing data, not to health records.
  2. Confidentiality alone satisfies all privacy obligations for health data.
  3. Availability controls alone satisfy privacy obligations because records must be accessible.
  4. Confidentiality and integrity controls protect the data, while purpose limitation, consent or other lawful basis, and retention limits govern how it may be processed. Correct answer.

Explanation

Security properties protect health data against disclosure and alteration, but privacy law and principles additionally constrain why and how long the data may be processed. Lawful basis, purpose limitation and retention limits are privacy requirements distinct from security controls. Both sets of obligations must be met together.

Question 21Fundamental principles and concepts of information security, cybersecurity, and privacy

An organisation wants to reduce the risk of a single administrator holding keys to all encrypted backups. Which design choice best reflects the relevant security principles?

  1. Store all keys in a shared spreadsheet accessible to the IT team.
  2. Disable audit logging to protect the administrator's privacy.
  3. Give the administrator additional training and rely on professional integrity alone.
  4. Split key custody among several roles and require multiple approvals for recovery, applying least privilege and segregation of duties. Correct answer.

Explanation

Splitting key custody and requiring multiple approvals limits the power of any single individual and creates a check on misuse. This combines least privilege with segregation of duties and supports accountability. Relying on integrity alone leaves no technical or procedural safeguard.

Question 22Fundamental principles and concepts of information security, cybersecurity, and privacy

Which statement best explains the difference between an event and an information security incident in ISO/IEC 27000 vocabulary?

  1. An event is any identifiable occurrence in a system or network, while an incident is a single or series of unwanted events with significant probability of compromising business operations and threatening security. Correct answer.
  2. An incident is any logged occurrence, while an event is a confirmed breach.
  3. An event is always malicious, while an incident is always accidental.
  4. The terms are synonyms with no defined difference in the ISO vocabulary.

Explanation

An event is a broad category of identifiable occurrences, most of which are benign. An incident is a subset of unwanted events that has a significant likelihood of harming operations or security. Classification determines whether escalation and incident response are triggered.

Question 23Fundamental principles and concepts of information security, cybersecurity, and privacy

A supplier provides a cloud service that processes personal data. Which statement best reflects the security and privacy considerations an organisation should apply?

  1. Supplier assessment is unnecessary if the supplier holds any security certification.
  2. Outsourcing the processing transfers all accountability for the data to the supplier.
  3. The organisation retains accountability for the data, so it should assess supplier controls, define contractual security and privacy obligations, and monitor performance. Correct answer.
  4. Privacy obligations cease once data is transferred to the supplier's infrastructure.

Explanation

Outsourcing processing does not outsource accountability; the organisation remains responsible for how personal data is handled. Due diligence, contractual clauses and ongoing monitoring provide assurance that supplier controls are effective. Certifications offer useful evidence but do not remove the need for assessment.

Question 24Fundamental principles and concepts of information security, cybersecurity, and privacy

Which statement best explains why cryptography alone does not guarantee confidentiality in an organisation?

  1. Confidentiality also depends on key management, access control and endpoint security, because compromised keys or authorised misuse can expose plaintext. Correct answer.
  2. Confidentiality is achieved once data is encrypted at rest, regardless of key handling.
  3. Cryptography removes the need for access control because ciphertext cannot be read.
  4. Cryptography guarantees confidentiality only when algorithms are kept secret.

Explanation

Encryption protects data only while keys remain protected and access to plaintext is controlled. Weak key management, stolen credentials or endpoint compromise can bypass the cryptography entirely. Confidentiality therefore depends on complementary controls around keys, identities and devices.

Question 25Fundamental principles and concepts of information security, cybersecurity, and privacy

Which statement best describes the purpose of a statement of applicability in an information security management system?

  1. It is a public marketing document describing security commitments.
  2. It identifies the controls the organisation has selected, justifies inclusion or exclusion, and records their implementation status. Correct answer.
  3. It lists every control in the catalogue as mandatory without exception.
  4. It replaces the risk assessment by defining a fixed control baseline.

Explanation

The statement of applicability documents which controls are relevant after risk treatment, with justification for inclusions and exclusions. It provides traceability between risk assessment and implemented controls. It is an internal governance record, not a fixed universal baseline.

Question 26Fundamental principles and concepts of information security, cybersecurity, and privacy

In the vocabulary shared by ISO/IEC 27000-series standards, which statement accurately describes the relationship between an asset, a threat and a vulnerability?

  1. An asset is anything of value to the organisation, a threat is a potential cause of an unwanted incident, and a vulnerability is a weakness that a threat can exploit. Correct answer.
  2. An asset is a legal obligation, a threat is a regulator enforcing it, and a vulnerability is the gap between current practice and the obligation.
  3. An asset is a control already implemented, a threat is a weakness in that control, and a vulnerability is the harm that results when the control fails.
  4. An asset is a recorded risk, a threat is the likelihood of that risk occurring, and a vulnerability is the financial loss the organisation would suffer.

Explanation

The 27000-series vocabulary treats assets as things the organisation values, threats as potential causes of unwanted incidents, and vulnerabilities as weaknesses that allow a threat to affect an asset. Risk arises from the combination of threat, vulnerability and impact on the asset, which is why the three concepts are always assessed together.

Question 27Fundamental principles and concepts of information security, cybersecurity, and privacy

A team is classifying how strongly it can rely on a biometric fingerprint reader as an authentication factor. Which property of the factor is being assessed?

  1. Its availability, meaning the proportion of time the reader is online
  2. Its assurance, meaning how confidently the system can bind the credential to the legitimate individual Correct answer.
  3. Its interoperability, meaning whether the reader works with multiple vendors
  4. Its accountability, meaning whether the reader logs each authentication attempt

Explanation

Authentication assurance expresses how much confidence the verifier can place that the credential presented belongs to the claimed individual. Biometrics can strengthen assurance because they are harder to share than passwords, but assurance also depends on enrolment quality and liveness checks.

Question 28Fundamental principles and concepts of information security, cybersecurity, and privacy

Which statement best describes the concept of non-repudiation in information security?

  1. A receiver cannot read a message unless the sender shares a symmetric key with them
  2. A user cannot access a resource unless a manager has approved the request in advance
  3. A system cannot lose data because every transaction is written to two separate disks
  4. A sender cannot later deny having sent a message in a way that the receiver can verify to a third party Correct answer.

Explanation

Non-repudiation provides evidence, typically through digital signatures and trusted timestamps, that a specific action occurred and can be demonstrated to an independent party. It protects against later denial of origin or receipt rather than against unauthorised reading or data loss.

Question 29Fundamental principles and concepts of information security, cybersecurity, and privacy

An organisation must decide how long to retain customer transaction records. Which statement best reflects the privacy principle of storage limitation as expressed in ISO/IEC 27701 and related guidance?

  1. Records should be kept only as long as needed for the stated purpose or a legal retention obligation, then deleted or anonymised Correct answer.
  2. Records should be deleted as soon as the transaction completes, regardless of legal duties
  3. Records should be kept indefinitely so that any future investigation can be supported
  4. Records should be retained until the customer explicitly asks for them to be removed

Explanation

Storage limitation requires personal data to be kept no longer than necessary for the purpose for which it was collected, unless a law or regulation sets a retention period. Once the purpose or legal duty ends, the data should be securely deleted or irreversibly anonymised.

Question 30Fundamental principles and concepts of information security, cybersecurity, and privacy

A security manager is documenting how the organisation responds when a control fails to operate as intended. Which concept describes the residual level of risk that remains after controls have been applied?

  1. Risk capacity
  2. Residual risk Correct answer.
  3. Risk appetite
  4. Inherent risk

Explanation

Residual risk is what remains after existing controls are taken into account, and it is the figure management compares against the risk criteria. Inherent risk is the level before controls, while appetite and capacity describe how much risk the organisation is willing to or able to bear.

Question 31Fundamental principles and concepts of information security, cybersecurity, and privacy

An organisation wants to demonstrate that its information security controls are effective over time rather than merely documented. Which activity provides the strongest ongoing evidence?

  1. Recording the number of staff who attended the annual security briefing
  2. Listing all controls in the statement of applicability
  3. Collecting and analysing metrics from control operation, such as patch compliance and access review completion Correct answer.
  4. Publishing the information security policy on the intranet

Explanation

Performance evaluation relies on measurable indicators of whether controls actually operate as intended, such as patch compliance rates, review completion and incident trends. Documentation and attendance records show that activities happened, but not whether controls are effective.

Question 32Fundamental principles and concepts of information security, cybersecurity, and privacy

Which statement best explains why the CIA triad treats integrity differently from confidentiality?

  1. Integrity concerns only the encryption of data at rest, while confidentiality concerns data in transit
  2. Integrity concerns the accuracy and completeness of data and systems, while confidentiality concerns limiting disclosure to authorised parties Correct answer.
  3. Integrity concerns who is allowed to read data, while confidentiality concerns who is allowed to change it
  4. Integrity concerns the speed of data processing, while confidentiality concerns the storage medium used

Explanation

Integrity is about data and systems being accurate, complete and protected from unauthorised modification, whereas confidentiality is about preventing disclosure to unauthorised parties. They are separate properties, so a control that protects one does not automatically protect the other.

Question 33Fundamental principles and concepts of information security, cybersecurity, and privacy

A hospital wants to share a patient's record with a specialist clinic for treatment. Which privacy principle most directly governs whether the sharing is permissible without further consent?

  1. Purpose limitation, because the new use must be compatible with the purpose for which the data was collected Correct answer.
  2. Accuracy, because the record must be free of errors before it is shared
  3. Accountability, because the hospital must appoint a data protection officer
  4. Data portability, because the patient may request a machine-readable copy of the record

Explanation

Purpose limitation requires that personal data be used only for the purposes specified at collection or for compatible purposes, and treatment by another provider is often a compatible purpose. Portability, accountability and accuracy are separate principles that do not by themselves authorise a new disclosure.

Question 34Fundamental principles and concepts of information security, cybersecurity, and privacy

Which statement best explains the role of a security control objective in an ISMS based on ISO/IEC 27001 and ISO/IEC 27002?

  1. It states the outcome that a control or control set is intended to achieve, allowing the organisation to choose an appropriate implementation Correct answer.
  2. It records the name of the individual who is accountable for a specific risk
  3. It specifies the exact technical product the organisation must purchase to satisfy an audit finding
  4. It defines the maximum financial loss the organisation is prepared to accept from an incident

Explanation

Control objectives describe the intended outcome, such as ensuring access is restricted to authorised users, while the organisation selects how to achieve it. ISO/IEC 27002 provides implementation guidance rather than mandating specific products.

Question 35Fundamental principles and concepts of information security, cybersecurity, and privacy

An organisation discovers that a former employee's account still has active access three months after departure. Which combination of principles does this most directly violate?

  1. Separation of environments and change management
  2. Data minimisation and storage limitation
  3. Least privilege and defence in depth
  4. Need-to-know and timely revocation of access rights Correct answer.

Explanation

Access should be granted only where there is a current business need, and rights must be removed promptly when that need ends, such as at termination. A lingering account breaches both need-to-know and the requirement to revoke access in a timely manner.

Question 36Fundamental principles and concepts of information security, cybersecurity, and privacy

A supplier asks the organisation to confirm how it will protect data during a planned migration. Which statement best describes the concept of due care in this context?

  1. The organisation relies on the supplier's public marketing claims about security
  2. The organisation transfers all responsibility for the data to the supplier once the contract is signed
  3. The organisation takes reasonable, documented steps proportionate to the risk to protect the data during the migration Correct answer.
  4. The organisation postpones any risk assessment until the migration is complete

Explanation

Due care means acting reasonably and proportionately, with documented decisions, to protect assets under the organisation's responsibility. It requires assessing the migration risk and applying suitable safeguards rather than assuming the supplier or marketing material removes the obligation.

Question 37Fundamental principles and concepts of information security, cybersecurity, and privacy

Which statement best explains why an organisation should define risk criteria before evaluating identified information security risks?

  1. Criteria ensure that every risk receives the same treatment option regardless of its nature
  2. Criteria eliminate the need to record risks in a risk register
  3. Criteria provide a consistent basis for comparing risks and deciding which require treatment Correct answer.
  4. Criteria guarantee that no risk will exceed the organisation's appetite

Explanation

Risk criteria set out how significance is judged, including scales for likelihood and impact and thresholds for acceptance. Applying them consistently lets management compare dissimilar risks and prioritise treatment in line with objectives.

Question 38Fundamental principles and concepts of information security, cybersecurity, and privacy

An organisation is deciding whether a new cloud service may process personal data. Which sequence best reflects a privacy-by-design approach?

  1. Deploy the service, then conduct a privacy impact assessment if a complaint is received
  2. Collect all potentially useful data first so that future purposes are not constrained
  3. Ask the vendor to certify compliance, then rely on that certification without further analysis
  4. Identify the personal data and purposes, assess privacy risks, apply proportionate controls, and review them throughout operation Correct answer.

Explanation

Privacy by design embeds privacy considerations into the lifecycle: understand the data and purposes, assess risks, apply controls proportionate to those risks, and review them as the service evolves. Certification can be an input but does not replace the organisation's own assessment.

Question 39Fundamental principles and concepts of information security, cybersecurity, and privacy

Which statement best describes the difference between a vulnerability assessment and a penetration test?

  1. A vulnerability assessment exploits weaknesses, while a penetration test only lists them
  2. A vulnerability assessment identifies and reports weaknesses, while a penetration test attempts to exploit them to demonstrate real impact Correct answer.
  3. A vulnerability assessment covers networks, while a penetration test covers only applications
  4. A vulnerability assessment is performed only by external parties, while a penetration test is performed only internally

Explanation

A vulnerability assessment systematically identifies and reports known weaknesses, often using automated scanning. A penetration test goes further by simulating an attacker to exploit weaknesses and demonstrate the practical impact on the organisation.

Question 40Fundamental principles and concepts of information security, cybersecurity, and privacy

A manager argues that because a control is certified under a recognised scheme, no further monitoring is required. Which response best reflects sound information security governance?

  1. Certification guarantees that no incidents will occur for the duration of the certificate
  2. Certification transfers the organisation's risk to the certification body
  3. Certification replaces the need for internal audit because an external body has already reviewed the controls
  4. Certification provides point-in-time assurance, so the organisation must still monitor, measure and review controls as risks and operations change Correct answer.

Explanation

Certification gives evidence that controls conformed at the time of assessment, but the risk environment, technology and organisation change continuously. Governance therefore requires ongoing monitoring, measurement and review to confirm controls remain effective.

Question 41Information security management system (ISMS) and initiation of ISO/IEC 27002 information security controls implementation

In the ISO/IEC 27001 certified ISMS lifecycle, which activity establishes the organizational context, scope and leadership commitment before controls are selected?

  1. Initiating the ISMS and defining its scope and context Correct answer.
  2. Operating the selected controls and measuring performance
  3. Treating nonconformities and corrective actions
  4. Performing internal audit and management review

Explanation

The initiation phase establishes the organizational context, interested parties, ISMS scope and top management commitment, which then frame risk assessment and control selection. Operating, auditing and corrective action occur later in the Plan-Do-Check-Act cycle. Selecting controls before scope and context are defined leaves the control set unjustified.

Question 42Information security management system (ISMS) and initiation of ISO/IEC 27002 information security controls implementation

Which document primarily records the justification for including or excluding information security controls in an ISO/IEC 27001 ISMS?

  1. The Statement of Applicability Correct answer.
  2. The risk treatment plan
  3. The internal audit programme
  4. The business continuity plan

Explanation

The Statement of Applicability lists the controls from ISO/IEC 27002 that are relevant, states whether each is implemented, and gives justification for inclusion or exclusion. It links the risk assessment results to the chosen control set. The other documents serve different purposes and do not record control applicability.

Question 43Information security management system (ISMS) and initiation of ISO/IEC 27002 information security controls implementation

An organization is starting an ISO/IEC 27002 control implementation and has no prior risk assessment. What should be the logical first step before choosing controls?

  1. Commission an external penetration test
  2. Purchase a SIEM platform and configure alerting
  3. Draft the incident response procedure
  4. Identify information assets and assess information security risks Correct answer.

Explanation

ISO/IEC 27002 controls are selected to treat risks identified through a risk assessment, so assets, threats and vulnerabilities must be understood first. Tools, procedures and testing follow from the identified risk profile. Buying technology before assessing risk can produce controls that do not address actual exposures.

Question 44Information security management system (ISMS) and initiation of ISO/IEC 27002 information security controls implementation

What is the relationship between ISO/IEC 27001 and ISO/IEC 27002?

  1. 27002 specifies ISMS requirements; 27001 is a sector-specific checklist
  2. 27001 provides control guidance; 27002 specifies certification requirements
  3. 27001 specifies ISMS requirements; 27002 provides guidance on information security controls Correct answer.
  4. Both are certification standards with identical mandatory clauses

Explanation

ISO/IEC 27001 contains the auditable requirements for establishing, implementing, maintaining and improving an ISMS. ISO/IEC 27002 is a guidance standard that explains how to implement information security controls and is referenced by the Annex A control set. Certification is against 27001, not 27002.

Question 45Information security management system (ISMS) and initiation of ISO/IEC 27002 information security controls implementation

Which term describes the acceptable level of risk that an organization is willing to retain after treatment?

  1. Risk register
  2. Inherent risk
  3. Residual risk
  4. Risk appetite Correct answer.

Explanation

Risk appetite, also called risk tolerance or risk acceptance criteria, defines how much risk the organization is willing to accept in pursuit of its objectives. Residual risk is the risk remaining after treatment and should be compared against the appetite. Inherent risk is the level before controls are applied.

Question 46Information security management system (ISMS) and initiation of ISO/IEC 27002 information security controls implementation

Top management demonstrates leadership for the ISMS primarily by doing which of the following?

  1. Approving the purchase of security tools only
  2. Delegating all security decisions to the IT department
  3. Establishing the information security policy and assigning roles and responsibilities Correct answer.
  4. Reviewing individual firewall rules monthly

Explanation

ISO/IEC 27001 requires top management to establish the policy, ensure integration into business processes, provide resources and assign responsibilities. Delegating security entirely or focusing only on procurement fails to demonstrate leadership. Hands-on rule review is operational, not a leadership requirement.

Question 47Information security management system (ISMS) and initiation of ISO/IEC 27002 information security controls implementation

Which activity best reflects the Plan phase of the Plan-Do-Check-Act cycle applied to an ISMS?

  1. Operating controls and handling incidents
  2. Measuring control effectiveness and auditing
  3. Assessing risks, selecting controls and setting objectives Correct answer.
  4. Correcting nonconformities and improving

Explanation

The Plan phase covers establishing the ISMS, assessing risk, selecting and planning controls, and setting objectives. Do is implementation and operation, Check is monitoring, measurement and audit, and Act is corrective action and continual improvement.

Question 48Information security management system (ISMS) and initiation of ISO/IEC 27002 information security controls implementation

Why does ISO/IEC 27002 emphasize that controls should be proportionate to the organization's risk?

  1. Because regulators prohibit tailoring of control sets
  2. Because a control set copied from another organization may not fit this organization's risks Correct answer.
  3. Because the standard mandates a fixed minimum of 93 controls for every organization
  4. Because more controls always guarantee lower risk

Explanation

ISO/IEC 27002 is guidance, and its controls should be selected and tailored to the organization's own risk assessment and context. Copying another organization's control set may leave relevant risks untreated or impose unnecessary cost. Tailoring is expected, not prohibited, and control count is not a measure of security.

Question 49Information security management system (ISMS) and initiation of ISO/IEC 27002 information security controls implementation

During ISMS scoping, an organization excludes its cloud-hosted customer portal from the ISMS boundary while the portal processes customer personal data. What is the most significant consequence?

  1. The exclusion eliminates the organization's legal obligations for that data
  2. The risk assessment may omit material risks and the scope statement may be judged inadequate Correct answer.
  3. The portal automatically becomes compliant with ISO/IEC 27002
  4. The Statement of Applicability no longer requires justification entries

Explanation

Scope exclusions must be justified and cannot simply remove material risks or legal obligations from consideration. Excluding a system that processes customer personal data risks an incomplete risk assessment and an inadequate scope statement. Legal obligations still apply regardless of the ISMS boundary.

Question 50Information security management system (ISMS) and initiation of ISO/IEC 27002 information security controls implementation

An organization identifies a risk of unauthorized physical access to its server room. Which ISO/IEC 27002 control area is most directly relevant to treating this risk?

  1. Physical and environmental security Correct answer.
  2. Supplier relationships
  3. Incident management
  4. Cryptographic controls

Explanation

Physical and environmental security controls address physical access to facilities and equipment, including entry controls and protecting equipment from unauthorized access. Cryptography protects data confidentiality and integrity, supplier controls govern third parties, and incident management handles events after they occur.