I85PREP
⌘ K
ISO/IEC 27002 Manager study materials
ISO/IEC 27002 Manager study resources

ISO/IEC 27002 Manager practice questions

One question at a time. Build your ISO/IEC 27002 Manager understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Fundamental principles and concepts of information security, cybersecurity, and privacy

In ISO/IEC 27000-series vocabulary, what does the term 'information security' primarily describe?

  1. The physical protection of data centres against fire and flood
  2. The encryption of all data at rest and in transit
  3. The preservation of confidentiality, integrity and availability of information Correct answer.
  4. The compliance of an organisation with national data-protection statutes

Explanation

The ISO/IEC 27000 vocabulary defines information security as the preservation of confidentiality, integrity and availability of information, noting that other properties such as authenticity, accountability, non-repudiation and reliability may also be involved. Physical protection, legal compliance and encryption are means or subsets rather than the definition itself.

Question 2Fundamental principles and concepts of information security, cybersecurity, and privacy

A payroll system correctly restricts access to authorised staff, but a rounding error causes every payslip to be overstated by 10%. Which core property of information is primarily affected?

  1. Integrity Correct answer.
  2. Non-repudiation
  3. Confidentiality
  4. Availability

Explanation

Integrity concerns the accuracy and completeness of information and its processing. A systematic calculation error makes the payslip data inaccurate even though access control is intact, so integrity is the property directly compromised.

Question 3Fundamental principles and concepts of information security, cybersecurity, and privacy

How does ISO/IEC 27000-series vocabulary distinguish 'cybersecurity' from 'information security'?

  1. Cybersecurity applies only to government systems, while information security applies to private firms
  2. The two terms are defined as exact synonyms with no scope difference
  3. Cybersecurity is a narrower term limited to encryption algorithms and key management
  4. Cybersecurity focuses on safeguarding information in cyberspace, including the interconnected networks and the information on them Correct answer.

Explanation

The vocabulary describes cybersecurity as the safeguarding of information in cyberspace, where cyberspace is the interconnected network of systems and the information residing in it. Information security is the broader preservation of information properties regardless of medium, so the two concepts overlap but are not identical.

Question 4Fundamental principles and concepts of information security, cybersecurity, and privacy

An organisation holds customer records in a database that is fully backed up nightly, access-controlled and accurate. A privacy review nevertheless finds a problem. Which statement best explains why information security alone did not satisfy the privacy requirement?

  1. Privacy requires that personal data be collected and used only for legitimate, specified purposes, which CIA protection does not guarantee Correct answer.
  2. Availability is irrelevant to privacy, so the nightly backup was wasted effort
  3. Privacy applies only to paper records, so the database was out of scope
  4. Backups cannot protect confidentiality, so the data was effectively unprotected

Explanation

Privacy is about the proper handling of personally identifiable information, including lawful and specified purpose, consent and minimisation, not merely protecting it from unauthorised access or loss. Data can be perfectly secure under the CIA properties and still be collected or used in ways that breach privacy principles.

Question 5Fundamental principles and concepts of information security, cybersecurity, and privacy

Which pairing correctly describes the relationship between an 'asset', a 'threat' and a 'vulnerability' in ISO/IEC 27000-series terminology?

  1. A threat exploits a vulnerability, which may lead to harm to an asset Correct answer.
  2. A vulnerability is a type of asset that has no owner
  3. A threat is a weakness in an asset that a vulnerability can remove
  4. An asset exploits a vulnerability to create a threat

Explanation

A threat is a potential cause of an unwanted incident, a vulnerability is a weakness that can be exploited by one or more threats, and an asset is anything of value to the organisation. Risk arises where a threat can exploit a vulnerability and thereby affect an asset.

Question 6Fundamental principles and concepts of information security, cybersecurity, and privacy

A risk assessment concludes that a web application has a high likelihood of SQL injection and a high business impact, but the fix requires a vendor patch due in three months. Which immediate treatment is most consistent with ISO/IEC 27002 guidance on risk treatment options?

  1. Apply compensating controls such as input validation and a web application firewall while the patch is pending Correct answer.
  2. Transfer the risk to the vendor by contract and stop monitoring the application
  3. Terminate the entire web service permanently to eliminate the risk
  4. Retain the risk unchanged and take no action until the vendor patch arrives

Explanation

Risk treatment options include modifying, retaining, avoiding and sharing risk, and modification can be achieved through compensating controls when the primary fix is unavailable. Applying layered mitigations reduces likelihood and impact without waiting for the patch or abandoning the service.

Question 7Fundamental principles and concepts of information security, cybersecurity, and privacy

In the CIA triad, which scenario is an example of an availability failure rather than a confidentiality or integrity failure?

  1. A clerk emails a customer list to the wrong recipient
  2. A database record is altered without authorisation
  3. A ransomware attack encrypts files and authorised users can no longer open them Correct answer.
  4. A backup tape is stolen from an unsecured vehicle

Explanation

Availability means information and systems are accessible and usable on demand by authorised users. Ransomware that locks legitimate users out of their files disrupts access, which is an availability impact, even though it originates from a malicious attack.

Question 8Fundamental principles and concepts of information security, cybersecurity, and privacy

Which statement best captures the 'defence in depth' principle as used in ISO/IEC 27002?

  1. Selecting the single strongest control available and relying on it completely
  2. Duplicating identical controls in the same location to double their strength
  3. Applying controls only after an incident has been detected
  4. Layering independent controls so that the failure of one does not immediately expose the asset Correct answer.

Explanation

Defence in depth means deploying multiple layers of controls across people, processes and technology so that a single control failure does not lead directly to compromise. The layers should be complementary rather than identical duplicates.

Question 9Fundamental principles and concepts of information security, cybersecurity, and privacy

An organisation decides that the residual risk from a legacy system is acceptable because the cost of additional controls exceeds the potential loss. Which risk treatment option has been chosen?

  1. Risk avoidance
  2. Risk sharing
  3. Risk retention Correct answer.
  4. Risk modification

Explanation

Risk retention means accepting the remaining risk, for example when the cost of further treatment outweighs the benefit. The decision should be documented and reviewed, but it is still a deliberate acceptance rather than an oversight.

Question 10Fundamental principles and concepts of information security, cybersecurity, and privacy

Which of the following best describes the role of an 'information owner' in ISO/IEC 27002 terms?

  1. The external auditor who certifies the information security management system
  2. The software vendor that supplied the database platform
  3. The person who performs daily backups and restores of the information
  4. The person or entity accountable for the information and its classification and access rules Correct answer.

Explanation

The information owner is accountable for a defined set of information, typically deciding its classification and who may access it. Operational tasks such as backups are usually delegated to custodians, who act on the owner's instructions.

Question 11Fundamental principles and concepts of information security, cybersecurity, and privacy

A company stores customer data in a cloud service. Under the shared responsibility model, which statement is most accurate?

  1. Responsibility disappears because the data is no longer on company premises
  2. The cloud provider assumes all information security responsibility once data is uploaded
  3. The customer retains accountability for classifying its data and configuring access, while the provider secures the underlying infrastructure Correct answer.
  4. Only the provider's certification body is responsible for data protection

Explanation

Outsourcing infrastructure does not outsource accountability. The customer remains responsible for how its data is classified, accessed and used, while the provider is responsible for the security of the platform it operates, as set out in the agreement.

Question 12Fundamental principles and concepts of information security, cybersecurity, and privacy

Which statement best explains why information classification is a foundational control in ISO/IEC 27002?

  1. It provides a basis for handling, access and protection requirements proportionate to sensitivity Correct answer.
  2. It guarantees that classified information can never be lost
  3. It is required only for information held in paper form
  4. It replaces the need for a risk assessment

Explanation

Classification assigns information to categories that indicate its sensitivity and value, which then drives consistent handling rules, access decisions and protection levels. It is an input to risk-based protection rather than a substitute for it.

Question 13Fundamental principles and concepts of information security, cybersecurity, and privacy

What is the primary purpose of an access control policy based on the 'need-to-know' principle?

  1. To grant every employee access to all information so that work is never blocked
  2. To make access decisions solely on the basis of seniority
  3. To ensure that access rights are never reviewed after they are granted
  4. To limit access to information to those who require it for their assigned duties Correct answer.

Explanation

Need-to-know restricts access to information strictly required to perform a defined task, reducing exposure and limiting the impact of a compromised account. Access rights should also be reviewed regularly, which is consistent with least privilege.

Question 14Fundamental principles and concepts of information security, cybersecurity, and privacy

An employee receives a convincing email asking them to confirm their password by replying. Which control objective is most directly supported by training staff to recognise and report this attempt?

  1. Reducing the likelihood of social engineering leading to credential compromise Correct answer.
  2. Ensuring compliance with software licensing terms
  3. Increasing the availability of the email server
  4. Improving the accuracy of financial reporting

Explanation

Social engineering exploits human trust rather than technical flaws, so awareness and reporting help people recognise manipulation and avoid disclosing credentials. This reduces the likelihood that a phishing attempt succeeds.

Question 15Fundamental principles and concepts of information security, cybersecurity, and privacy

Which statement best distinguishes 'event' from 'incident' in ISO/IEC 27000-series terminology?

  1. An event is an occurrence indicating a possible breach of security, while an incident is a confirmed unwanted or unexpected event with significant probability of compromising operations Correct answer.
  2. Events are recorded only by automated tools, while incidents are recorded only by staff
  3. An event is always malicious, whereas an incident may be accidental
  4. An incident is a single occurrence, whereas an event is a series of incidents

Explanation

An information security event indicates that a security policy may have been breached or a control may have failed, whereas an information security incident is an event or series of events that is confirmed and has a significant probability of compromising business operations and information security. Not every event escalates to an incident.

Question 16Fundamental principles and concepts of information security, cybersecurity, and privacy

A risk assessment rates a threat as high likelihood and high impact. According to ISO/IEC 27002, what should determine the level of controls applied?

  1. The number of employees in the department that owns the asset
  2. The preference of the individual system administrator
  3. The age of the hardware on which the information is stored
  4. The organisation's risk acceptance criteria and the assessed level of risk Correct answer.

Explanation

Controls should be selected and proportionate to the assessed risk, taking into account the organisation's risk acceptance criteria and the cost of implementation relative to the benefit. Personal preference or asset age are not sound bases for control selection.

Question 17Fundamental principles and concepts of information security, cybersecurity, and privacy

Which of the following best describes the concept of 'least privilege'?

  1. Access rights are assigned once at onboarding and never changed
  2. Users are granted only the access necessary to perform their assigned tasks, for only as long as needed Correct answer.
  3. Privileges are shared among a team to reduce the number of accounts
  4. Users are given administrative rights so they can solve their own problems quickly

Explanation

Least privilege means granting the minimum access rights required for a role and only for the period needed, which limits the damage a compromised or misused account can cause. It is closely linked to need-to-know and regular access review.

Question 18Fundamental principles and concepts of information security, cybersecurity, and privacy

An organisation wants to demonstrate that it manages information security through a systematic, risk-based management system. Which concept does this describe?

  1. A list of technical controls applied uniformly to all systems
  2. A one-off penetration test of the corporate network
  3. An information security management system following the Plan-Do-Check-Act cycle Correct answer.
  4. A disaster recovery plan stored in a safe

Explanation

An information security management system establishes policy, objectives and processes, and it uses continual improvement through the Plan-Do-Check-Act cycle. A single test, a control list or a stored plan is an element within such a system rather than the system itself.

Question 19Fundamental principles and concepts of information security, cybersecurity, and privacy

Which statement best explains why 'segregation of duties' reduces risk?

  1. It ensures that a single person cannot both commit and conceal an error or fraud Correct answer.
  2. It removes the need for audit logging
  3. It guarantees that no insider threat can exist
  4. It allows one trusted administrator to hold all privileged accounts

Explanation

Segregation of duties divides critical tasks among different people so that no single individual controls an entire process. This makes it harder to perpetrate and conceal errors or fraudulent acts without collusion.

Question 20Fundamental principles and concepts of information security, cybersecurity, and privacy

Which of the following is the best example of a preventive control?

  1. Requiring multi-factor authentication before granting access Correct answer.
  2. Reviewing audit logs after an incident has occurred
  3. Restoring data from backup after a deletion
  4. Investigating a reported phishing email

Explanation

Preventive controls stop an event from occurring or reduce its likelihood before it happens. Requiring multi-factor authentication blocks unauthorised access attempts, whereas log review and investigation are detective and restoration is corrective.

Question 21Fundamental principles and concepts of information security, cybersecurity, and privacy

Which statement best describes the relationship between 'information security' and 'privacy' as concepts in the ISO/IEC 27000 family?

  1. Privacy concerns the proper handling of personally identifiable information, and information security provides controls that help protect it Correct answer.
  2. They are identical because both concern keeping data secret
  3. Information security is a subset of privacy and adds no distinct requirements
  4. Privacy applies only to marketing activities, while information security applies to all data

Explanation

Privacy addresses whether personal information is collected, used and shared appropriately, while information security provides the confidentiality, integrity and availability controls that protect it. Security is a necessary but not sufficient condition for privacy.

Question 22Fundamental principles and concepts of information security, cybersecurity, and privacy

A threat actor gains access to a system by exploiting an unpatched vulnerability. Which element of the risk model does the missing patch represent?

  1. The impact
  2. The vulnerability Correct answer.
  3. The asset
  4. The threat

Explanation

A vulnerability is a weakness in an asset or control that can be exploited by one or more threats. An unpatched software flaw is a classic example of such a weakness, distinct from the threat actor and from the resulting impact.

Question 23Fundamental principles and concepts of information security, cybersecurity, and privacy

Which statement best explains the principle of 'privacy by design'?

  1. Privacy considerations are embedded into systems and processes from the outset rather than added afterwards Correct answer.
  2. Privacy requirements are addressed only after a data breach has been reported
  3. Privacy settings are left entirely to the discretion of end users
  4. Privacy is achieved by storing all personal data indefinitely

Explanation

Privacy by design means building privacy protections into the design of systems, processes and products from the beginning. Retrofitting controls after deployment is usually costlier and less effective than designing for privacy from the start.

Question 24Fundamental principles and concepts of information security, cybersecurity, and privacy

An organisation outsources a payroll function to a supplier. Which statement best reflects ISO/IEC 27002 guidance on supplier relationships?

  1. Information security requirements and responsibilities should be agreed with the supplier and monitored over the life of the relationship Correct answer.
  2. The supplier's internal controls are outside the organisation's interest once the contract is signed
  3. The organisation can assume the supplier secures data identically to its own standards without any agreement
  4. Supplier security is relevant only during the procurement phase

Explanation

Supplier relationships require agreed information security requirements, responsibilities and reporting, and these should be managed and reviewed throughout the relationship. Accountability for the outsourced information remains with the organisation.

Question 25Fundamental principles and concepts of information security, cybersecurity, and privacy

Which statement best describes the purpose of 'security awareness, education and training' in an information security programme?

  1. It is a one-time activity performed only during employee induction
  2. It equips people to recognise and respond appropriately to security risks in their daily work Correct answer.
  3. It replaces technical controls such as firewalls and access management
  4. It transfers legal liability for incidents from the organisation to individual employees

Explanation

Awareness, education and training build the knowledge and behaviour needed for people to handle information securely and to report concerns. They complement technical controls and must be maintained through regular refresher activities.

Question 26Fundamental principles and concepts of information security, cybersecurity, and privacy

In ISO/IEC 27000-series vocabulary, which term describes the combination of assets, threats, and vulnerabilities that could lead to harm, expressed as the potential for loss or damage when a threat exploits a vulnerability?

  1. Risk Correct answer.
  2. Incident
  3. Control
  4. Event

Explanation

Risk is defined as the effect of uncertainty on objectives, and in information security terms it captures the potential for loss when a threat exploits a vulnerability of an asset. It combines likelihood and consequence rather than describing a single occurrence or a safeguard.

Question 27Fundamental principles and concepts of information security, cybersecurity, and privacy

Which statement best describes 'confidentiality' as one of the core information security properties?

  1. Information is available to authorised users when required
  2. Information is accessible only to those authorised to have access Correct answer.
  3. Information is accurate and complete whenever it is used
  4. Information is retained for the period required by law

Explanation

Confidentiality concerns ensuring that information is not made available or disclosed to unauthorised individuals, entities, or processes. It is about restricting disclosure, not about accuracy, timeliness of access, or retention periods.

Question 28Fundamental principles and concepts of information security, cybersecurity, and privacy

An organisation's internal audit team reports directly to the board and never performs the operational security tasks it reviews. Which information security principle does this arrangement illustrate?

  1. Least privilege
  2. Defence in depth
  3. Segregation of duties Correct answer.
  4. Need-to-know access

Explanation

Segregation of duties separates conflicting responsibilities so that no single person controls both the execution and the review of a process. Independence of audit from operations reduces the chance that errors or fraud go undetected.

Question 29Fundamental principles and concepts of information security, cybersecurity, and privacy

Which statement best explains what an 'asset' means in the context of information security risk management?

  1. Any measure that modifies risk
  2. Any potential cause of an unwanted incident
  3. Anything that has value to the organisation and therefore requires protection Correct answer.
  4. Any weakness in a system that a threat could exploit

Explanation

An asset is anything that has value to the organisation, including information, systems, people, and facilities. Risk assessment identifies threats and vulnerabilities against such assets to determine exposure.

Question 30Fundamental principles and concepts of information security, cybersecurity, and privacy

Which statement best describes the concept of 'vulnerability' in the ISO/IEC 27000-series risk model?

  1. The probability that a threat occurs
  2. A weakness of an asset or control that a threat can exploit Correct answer.
  3. The result of an unwanted event affecting confidentiality
  4. A potential source of harm to an asset

Explanation

A vulnerability is a weakness in an asset or control that could be exploited by one or more threats. It is distinct from the threat itself and from the likelihood that the threat materialises.

Question 31Fundamental principles and concepts of information security, cybersecurity, and privacy

Which statement best distinguishes 'authentication' from 'authorisation' in access control?

  1. Authentication is a preventive control; authorisation is a corrective control
  2. Authentication verifies identity; authorisation determines what that identity may do Correct answer.
  3. Authentication applies only to people; authorisation applies only to systems
  4. Authentication determines permissions; authorisation verifies identity

Explanation

Authentication establishes that a claimed identity is genuine, while authorisation decides which resources and actions that verified identity is permitted to access. The two are sequential steps in access enforcement.

Question 32Fundamental principles and concepts of information security, cybersecurity, and privacy

Which statement best describes 'accountability' as an information security principle?

  1. Actions affecting information can be attributed to a specific identity Correct answer.
  2. Systems are duplicated to avoid single points of failure
  3. Information is encrypted while stored and transmitted
  4. Access rights are reviewed by management periodically

Explanation

Accountability means that entities can be held responsible for their actions, which requires that activities be traceable to an identified individual or process. Logging and unique user identities are typical enablers.

Question 33Fundamental principles and concepts of information security, cybersecurity, and privacy

An organisation classifies information as public, internal, confidential, and restricted, and applies handling rules to each level. Which principle does this practice directly support?

  1. Ensuring continuous availability through redundancy
  2. Eliminating the need for user awareness training
  3. Applying protection proportionate to the value and sensitivity of information Correct answer.
  4. Establishing a single sign-on capability

Explanation

Classification assigns information to categories so that handling and protection can be matched to sensitivity and value. This supports proportionate, risk-based treatment rather than uniform controls.

Question 34Fundamental principles and concepts of information security, cybersecurity, and privacy

An organisation maintains a register that lists each information asset, its owner, its location, and its classification. Which control objective does this register primarily serve?

  1. Ensuring that physical entry to data centres is logged
  2. Ensuring assets associated with information are identified and an inventory is maintained Correct answer.
  3. Ensuring that malware is detected at the network perimeter
  4. Ensuring that backups are tested regularly

Explanation

An asset inventory establishes what information and associated assets exist, who owns them, and where they are, which underpins risk assessment and control selection. Without it, protection cannot be scoped or assigned.

Question 35Fundamental principles and concepts of information security, cybersecurity, and privacy

A supplier's contract states that it will notify the organisation of any security incident within 24 hours and permit audit visits. Which concept do these clauses primarily implement?

  1. Capacity management for supplier systems
  2. Segregation of development and production environments
  3. Encryption of data in transit
  4. Governance of supplier relationships through agreed security requirements Correct answer.

Explanation

Supplier security is managed by agreeing, documenting, and monitoring requirements in contracts and service agreements. Notification and audit rights are mechanisms for maintaining oversight of the supplier's security posture.

Question 36Fundamental principles and concepts of information security, cybersecurity, and privacy

Which statement best explains why 'need-to-know' and 'least privilege' are related but distinct concepts?

  1. Least privilege concerns physical access, while need-to-know concerns logical access
  2. Least privilege applies only to privileged administrators, while need-to-know applies to all staff
  3. Least privilege is a detective control, while need-to-know is a preventive control
  4. Least privilege limits permissions to what a task requires, while need-to-know limits access to information a person requires to perform that task Correct answer.

Explanation

Least privilege is about granting the minimum set of permissions needed to perform a function, whereas need-to-know is about restricting access to specific information to those who require it. They are complementary but operate at different levels of granularity.

Question 37Fundamental principles and concepts of information security, cybersecurity, and privacy

An organisation introduces a policy requiring that all privileged actions be logged and reviewed weekly by a person who does not hold privileged access. Which combination of principles does this arrangement best illustrate?

  1. Integrity supported by checksums
  2. Accountability supported by segregation of duties Correct answer.
  3. Confidentiality supported by encryption
  4. Availability supported by redundancy

Explanation

Logging privileged actions creates a trace that attributes activity to an identity, which is accountability. Having a non-privileged reviewer examine the logs separates execution from oversight, which is segregation of duties.

Question 38Fundamental principles and concepts of information security, cybersecurity, and privacy

Which statement best describes the concept of 'residual risk'?

  1. The risk that remains after controls have been applied and treatment decisions made Correct answer.
  2. The risk that is too small to be recorded in the risk register
  3. The risk that exists before any controls are considered
  4. The risk that is transferred entirely to an insurer

Explanation

Residual risk is what remains once risk treatment has been implemented and its effectiveness assessed. Management accepts or further treats this remaining exposure, which is why it must be documented and monitored.

Question 39Fundamental principles and concepts of information security, cybersecurity, and privacy

A phishing email is delivered to a mailbox but is quarantined by a mail filter before the user opens it. In ISO/IEC 27000-series terms, which statement best characterises what occurred?

  1. A security event was detected and handled, and it need not be classified as an incident Correct answer.
  2. An availability failure occurred because the message was blocked
  3. A privacy breach occurred because the email was inspected
  4. A security incident occurred because a phishing email was delivered

Explanation

An event is an identified occurrence of a set of circumstances, and it becomes an incident only when it actually or potentially compromises security. A blocked phishing attempt that was contained may be logged as an event without escalating to an incident.

Question 40Fundamental principles and concepts of information security, cybersecurity, and privacy

Which statement best explains the relationship between 'threat' and 'threat actor'?

  1. A threat is an incident that has occurred, and a threat actor is the person who reports it
  2. A threat is a risk score, and a threat actor is the auditor who calculates it
  3. A threat is a weakness, and a threat actor is the control that mitigates it
  4. A threat is a potential cause of an unwanted incident, and a threat actor is the entity that may realise it Correct answer.

Explanation

A threat is a potential source of harm, such as malware, fire, or an intruder, while a threat actor is the specific entity, such as a criminal group or insider, that could carry it out. Risk assessment considers both the nature of the threat and the capability of the actor.

Question 41Fundamental principles and concepts of information security, cybersecurity, and privacy

A privacy programme requires that personal data be collected only for specified, explicit, and legitimate purposes and not further processed in a way incompatible with those purposes. Which privacy principle does this describe?

  1. Purpose limitation Correct answer.
  2. Integrity and confidentiality
  3. Storage limitation
  4. Data minimisation

Explanation

Purpose limitation constrains processing to the purposes specified at collection and prohibits incompatible secondary use. It is distinct from minimisation, which concerns the amount of data collected, and from storage limitation, which concerns retention duration.

Question 42Fundamental principles and concepts of information security, cybersecurity, and privacy

Which statement best explains why privacy and information security are related but not identical disciplines?

  1. Security protects the confidentiality, integrity, and availability of information, while privacy additionally governs whether and why personal data should be processed at all Correct answer.
  2. Security applies only to personal data, while privacy applies only to corporate data
  3. Security is a legal obligation, while privacy is a purely technical standard
  4. Security and privacy are identical because both require encryption of all data

Explanation

Information security focuses on protecting information properties such as confidentiality, integrity, and availability. Privacy is broader in that it also addresses lawful and fair processing, purpose specification, and the rights of individuals, so a secure system can still be an unlawful one.

Question 43Fundamental principles and concepts of information security, cybersecurity, and privacy

An organisation defines a formal 'acceptable use' policy for information assets and requires staff to acknowledge it. Which purpose does this control primarily serve?

  1. Guaranteeing that all staff will comply with the policy
  2. Replacing the need for technical access controls
  3. Transferring legal liability for misuse to employees
  4. Setting expectations for how assets may be used and reducing misuse by making obligations explicit Correct answer.

Explanation

Acceptable use policies communicate permitted and prohibited use of information and assets, and acknowledgement evidences that expectations were set. They reduce, but cannot guarantee, misuse and do not substitute for technical enforcement.

Question 44Fundamental principles and concepts of information security, cybersecurity, and privacy

Which statement best describes the role of 'top management' in an information security management system according to ISO/IEC 27001 and the guidance in ISO/IEC 27002?

  1. Top management reviews only financial risk and not information security risk
  2. Top management personally performs technical vulnerability scans
  3. Top management provides direction, approves policy, and ensures resources and responsibilities are assigned Correct answer.
  4. Top management delegates all security accountability to the IT department

Explanation

Leadership establishes the information security policy, integrates security into business processes, and ensures that roles, responsibilities, and resources are provided. Accountability for the management system remains with top management even when tasks are delegated.

Question 45Fundamental principles and concepts of information security, cybersecurity, and privacy

An organisation defines a 'security awareness' programme for all staff and a separate 'education' programme for security specialists. Which statement best describes the difference?

  1. Awareness builds general understanding of security expectations, while education develops deeper knowledge and skills for specialist roles Correct answer.
  2. Awareness is mandatory, while education is optional for all staff
  3. Awareness concerns technical controls, while education concerns physical controls
  4. Awareness is delivered once at induction, while education replaces the need for training

Explanation

Awareness activities create general understanding of security expectations and acceptable behaviour across the workforce. Education and training build the deeper competence required by staff who perform security-related roles, so the audiences and depth differ.

Question 46Fundamental principles and concepts of information security, cybersecurity, and privacy

A company plans a new customer analytics platform and, before any data is collected, documents the purposes of processing, the data fields required, and the retention period. Which concept does this practice best reflect?

  1. Business continuity management
  2. Vulnerability management
  3. Privacy by design, embedding privacy requirements early in system development Correct answer.
  4. Incident response planning

Explanation

Privacy by design means that privacy requirements are identified and built into systems and processes from the outset rather than added afterwards. Documenting purpose, data fields, and retention before collection is a classic early-stage embedding of privacy controls.

Question 47Fundamental principles and concepts of information security, cybersecurity, and privacy

An organisation identifies a legal obligation to retain transaction records for seven years and aligns its retention schedule and disposal controls accordingly. Which concept does this best illustrate?

  1. Compliance obligations driving information handling and retention requirements Correct answer.
  2. Availability achieved through redundancy
  3. Integrity achieved through cryptographic hashing
  4. Confidentiality achieved through access restriction

Explanation

Legal, statutory, regulatory, and contractual requirements are identified and translated into internal handling and retention rules. Disposal must be controlled so that records are neither destroyed too early nor kept beyond legal need.

Question 48Fundamental principles and concepts of information security, cybersecurity, and privacy

An organisation defines a clear desk and clear screen policy for its offices. Which risk does this control most directly reduce?

  1. Loss of availability of the network during a power failure
  2. Corruption of data during transmission between sites
  3. Failure of a supplier to meet contractual obligations
  4. Unauthorised disclosure of information to persons who happen to be present in the workspace Correct answer.

Explanation

Clear desk and clear screen practices reduce the chance that sensitive information on paper, media, or displays is observed or taken by unauthorised persons. The control addresses confidentiality in the physical and on-screen environment.

Question 49Fundamental principles and concepts of information security, cybersecurity, and privacy

An organisation decides to reduce the likelihood of a threat by patching a vulnerable server, and separately decides to reduce the impact of a possible outage by holding spare hardware. Which statement best describes these two decisions?

  1. Both are risk identification activities because vulnerabilities were found
  2. Both are risk monitoring activities because controls must be reviewed
  3. Both are risk acceptance decisions because controls were chosen
  4. Both are risk treatment options, one reducing likelihood and the other reducing consequence Correct answer.

Explanation

Risk treatment modifies risk, and it can act on either the likelihood of the event or its consequences. Patching reduces the chance of exploitation, while spares reduce the impact if failure occurs.

Question 50Fundamental principles and concepts of information security, cybersecurity, and privacy

A manager argues that because a system holds no personal data, privacy requirements do not apply to it. Which statement is the most accurate response in ISO/IEC 27002 terms?

  1. Information security requirements still apply to the system because they protect all information assets, while privacy obligations depend on whether personal data is processed Correct answer.
  2. The manager is correct because privacy and security are the same discipline
  3. The manager is correct because security applies only where personal data exists
  4. The system should be decommissioned because privacy cannot be assessed

Explanation

Information security protects the confidentiality, integrity, and availability of all information of value to the organisation, not only personal data. Privacy obligations are triggered by the processing of personal data, so the two assessments are separate and can both apply independently.