ISO 27000 Foundation Certification Information Security 2

Question 1

According to ISO 27000, what is the primary purpose of an Information Security Management System (ISMS)?

Accepted Answer

To provide a systematic approach to managing sensitive information

Answer

An ISMS provides a systematic, risk-based approach to managing sensitive company information so it remains secure.

Question 2

Which ISO/IEC standard specifically provides requirements for establishing and maintaining an ISMS?

Accepted Answer

ISO/IEC 27001

Answer

ISO/IEC 27001 specifies the requirements for establishing, implementing, maintaining, and continually improving an ISMS.

Question 3

In information security, what does 'non-repudiation' ensure?

Accepted Answer

A party cannot deny having performed an action

Answer

Non-repudiation ensures that a party cannot deny the authenticity of their signature or the sending of a message.

Question 4

What is the term for any weakness in a system that could be exploited by a threat?

Accepted Answer

Vulnerability

Answer

A vulnerability is a weakness in a system, process, or control that could be exploited by a threat source.

Question 5

Which of the following best describes 'residual risk'?

Accepted Answer

Risk that remains after controls have been implemented

Answer

Residual risk is the remaining risk after risk treatment measures have been applied.

ISO 27000 Foundation Certification Practice Test