Free ISO 27000 Foundation Certification Prior Knowledge Questions and Answers

Question 1

Which of the following must be documented (in Clause 6) according to ISO 27001:2013?

Accepted Answer

Risk assessment

Answer

Clause 6 of ISO 27001:2013, 'Planning,' explicitly requires the organization to establish and maintain documented information for its information security risk assessment process and the results of the information security risk assessment. While risk treatment is also a critical part of the planning phase, the process and outcomes of the risk assessment itself are specifically mandated to be documented.

Question 2

Where in the standard is a reference to controls and control goals to be found?

Accepted Answer

Annex A

Answer

Annex A of ISO/IEC 27001 provides a comprehensive reference list of information security controls and control objectives. These controls are derived from ISO/IEC 27002 and serve as a guide for organizations to select and implement appropriate measures to address identified risks. Organizations must consider these controls when developing their Statement of Applicability.

Question 3

The management system's scope must be kept up to date as written information.

Accepted Answer

True

Answer

ISO 27001 requires that the scope of the Information Security Management System (ISMS) be defined and maintained as documented information. This ensures clarity regarding which parts of the organization, its processes, and information assets are covered by the ISMS. Keeping it up to date is crucial for the ISMS to remain relevant and effective.

Question 4

"The only emphasis of ISO 27001:2013 is the protection of personal information."

Accepted Answer

False

Answer

This statement is false. While the protection of personal information is often a critical aspect addressed by an ISMS, ISO 27001's scope is much broader. It aims to protect all types of information and information assets from a wide range of threats, ensuring confidentiality, integrity, and availability for the entire organization, not just personal data.

Question 5

What must the company create?

Accepted Answer

Statement of applicability

Answer

The Statement of Applicability (SoA) is a mandatory document under ISO 27001. It lists all controls from Annex A that are relevant to the organization's ISMS, along with justifications for their inclusion or exclusion, and a description of how they are implemented. This document demonstrates how the organization has addressed the identified risks and chosen its controls.

ISO 27000 Foundation Certification Practice Test

ISO 27000 Foundation Certification Practice Test

Free ISO 27000 Foundation Certification Prior Knowledge Questions and Answers