CSC ISO 27001 Controls 3

Question 1

Which ISO 27001 clause requires top management to demonstrate leadership and commitment to the ISMS?

Accepted Answer

Clause 5 – Leadership

Answer

Clause 5 Leadership requires top management to actively demonstrate commitment by establishing policy, assigning roles, and integrating ISMS requirements into business processes.

Question 2

An auditor finds that an organization's access reviews have not been performed for 18 months. Which Annex A control is most directly violated?

Accepted Answer

A.9.2.5 Review of user access rights

Answer

A.9.2.5 Review of User Access Rights requires asset owners to review user access rights at regular intervals.

Question 3

What distinguishes a 'residual risk' from an 'inherent risk' in ISO 27001 risk treatment?

Accepted Answer

Residual risk is the remaining risk after controls are applied; inherent risk is risk before controls

Answer

Inherent risk is the raw risk level before any controls; residual risk is what remains after implementing risk treatment measures.

Question 4

Under Annex A control A.11, which of the following is a physical security control?

Accepted Answer

Clear desk and clear screen policy

Answer

A.11.2.9 Clear Desk and Clear Screen Policy is a physical and environmental security control requiring sensitive information not be left unattended.

Question 5

Which ISO 27001 Annex A control requires organizations to establish formal procedures for managing information security incidents?

Accepted Answer

A.16.1.1 Responsibilities and procedures

Answer

A.16.1.1 Responsibilities and Procedures requires management responsibilities and procedures for quick, effective incident response.

(CSC) Cybersecurity Compliance Certification Practice Test

(CSC) Cybersecurity Compliance Certification Practice Test

CSC ISO 27001 Controls 3