ISO 27000 Foundation Certification Information Security 4

Question 1

Which ISO/IEC 27000-series standard provides guidance on information security controls (the code of practice)?

Accepted Answer

ISO/IEC 27002

Answer

ISO/IEC 27002 provides guidance and best practice recommendations for implementing information security controls.

Question 2

An employee accidentally emails a confidential client list to the wrong recipient. Which CIA property has been compromised?

Accepted Answer

Confidentiality

Answer

Confidentiality is breached when sensitive information is disclosed to unauthorized parties, even accidentally.

Question 3

In the context of ISO 27001, what is meant by 'continual improvement' of the ISMS?

Accepted Answer

Ongoing activities to enhance ISMS performance over time

Answer

Continual improvement means systematically enhancing ISMS effectiveness based on audit results, incidents, and performance metrics.

Question 4

What is the purpose of an internal audit in an ISO 27001-certified organization?

Accepted Answer

To confirm the ISMS conforms to requirements and is effectively implemented

Answer

Internal audits verify that the ISMS meets the organization's own requirements and ISO 27001 requirements and is effectively maintained.

Question 5

Which term describes a potential cause of an unwanted incident that may harm an organization's assets?

Accepted Answer

Threat

Answer

ISO 27000 defines a threat as a potential cause of an unwanted incident which may result in harm to a system or organization.

ISO 27000 Foundation Certification Practice Test