CSC ISO 27001 Controls 5

Question 1

ISO 27001's Annex A control A.6.1.2 requires segregation of duties. Which scenario BEST demonstrates a violation of this control?

Accepted Answer

A system administrator both requests and approves privileged access for themselves

Answer

Segregation of duties means no single individual should control all phases of a critical process; a sysadmin self-approving privileged access is a direct violation.

Question 2

Which ISO 27001 Annex A control addresses the requirement to protect organizational information accessed or processed by teleworkers?

Accepted Answer

A.6.2.2 Teleworking

Answer

A.6.2.2 Teleworking requires a policy and supporting security measures to protect information accessed, processed, or stored at teleworking sites.

Question 3

During a management review, leadership discovers the ISMS objectives have not been met. According to ISO 27001 Clause 10, what must the organization do?

Accepted Answer

Take corrective actions to address nonconformities and improve the ISMS

Answer

Clause 10.1 Nonconformity and Corrective Action requires the organization to react to nonconformity and take action to eliminate causes and prevent recurrence.

Question 4

What is the main objective of Annex A control A.18.2 (Information Security Reviews)?

Accepted Answer

To verify compliance of information processing with security policies and standards

Answer

A.18.2 Information Security Reviews requires that the ISMS and its implementation be reviewed independently to ensure compliance with policies and standards.

Question 5

A company processes credit card data and must comply with PCI DSS in addition to ISO 27001. How should the organization handle both frameworks?

Accepted Answer

Use ISO 27001 as the base ISMS framework and map PCI DSS requirements to applicable controls

Answer

Best practice is to use ISO 27001 as the overarching framework and map additional regulatory requirements like PCI DSS to the corresponding controls to reduce duplication.

(CSC) Cybersecurity Compliance Certification Practice Test

(CSC) Cybersecurity Compliance Certification Practice Test

CSC ISO 27001 Controls 5