FREE ISO 27000 Foundation Controls & Compliance Questions and Answers

Question 1

An organization is conducting an internal audit of its ISMS.
The auditor discovers that the incident response plan, while documented, has not been tested in the past year, despite a policy requiring annual testing.
Which aspect of ISO 27001's Clause 9 (Performance Evaluation) is primarily being addressed by this finding?

Accepted Answer

Monitoring, measurement, analysis, and evaluation.

Answer

Internal audit program management.

Answer

Management review process.

Answer

Nonconformity and corrective action.

Question 2

Which of the following is a key purpose of the 'Statement of Applicability (SoA)' in the context of ISO 27001?

Accepted Answer

To list the controls from Annex A that have been selected and justified, and to explain the exclusion of others.

Answer

To document the organization's overall information security policy.

Answer

To describe the methodology used for information security risk assessment.

Answer

To define the scope and boundaries of the Information Security Management System (ISMS).

Question 3

During a management review meeting, the CEO expresses concern about the high number of phishing attempts targeting employees, despite awareness training being in place. The CISO presents data showing that while overall awareness has improved, a specific department consistently falls victim. What is the most appropriate next step according to ISO 27001's continual improvement process (Clause 10)?

Accepted Answer

Initiate a nonconformity, identify the root cause of the specific department's vulnerability, and implement corrective actions.

Answer

Immediately suspend all email communication for the affected department.

Answer

Document the concern in the management review minutes and schedule a follow-up for next year.

Answer

Re-issue the same awareness training materials to all employees, emphasizing the importance of diligence.

Question 4

Which of the following best describes the primary objective of a 'control' in the context of information security and ISO 27001?

Accepted Answer

To modify or maintain information security risks.

Answer

To identify all potential information security risks.

Answer

To eliminate all information security vulnerabilities.

Answer

To define the scope of the Information Security Management System (ISMS).

Question 5

An organization relies heavily on a third-party vendor for its payroll processing. According to ISO 27001, what control area primarily addresses the information security risks associated with this relationship?

Accepted Answer

A.15 Supplier relationships.

Answer

A.5 Information security policies.

Answer

A.8 Asset management.

Answer

A.17 Information security aspects of business continuity management.

Question 6

To demonstrate conformity with ISO 27001, an organization must maintain documented information. Which of the following is an example of 'documented information' required by the standard?

Accepted Answer

Evidence of competence for persons performing work under the ISMS's control.

Answer

A list of all employees' personal interests.

Answer

Minutes from the annual company picnic.

Answer

Informal chat logs between IT support staff.