ISO 27000 Foundation Certification Information Security 5

Question 1

A hacker sends a deceptive email pretending to be the CEO to trick an employee into transferring funds. This is an example of which attack type?

Accepted Answer

Social engineering / phishing

Answer

Phishing/social engineering attacks manipulate people into divulging information or performing actions by impersonating trusted entities.

Question 2

Which of the following best describes 'risk appetite' in an information security context?

Accepted Answer

The amount and type of risk an organization is willing to accept

Answer

Risk appetite is the amount and type of risk that an organization is willing to pursue or accept in pursuit of its objectives.

Question 3

Under ISO 27001, what must an organization do when a nonconformity is identified?

Accepted Answer

Take corrective action to eliminate the cause and prevent recurrence

Answer

Clause 10.1 requires organizations to react to nonconformities and take corrective action to prevent recurrence.

Question 4

What is the main difference between ISO/IEC 27001 and ISO/IEC 27002?

Accepted Answer

27001 specifies ISMS requirements; 27002 provides guidance on implementing controls

Answer

ISO 27001 is the certifiable requirements standard, while ISO 27002 is a supporting guide with best-practice control implementation advice.

Question 5

Which of the following is an administrative (managerial) information security control?

Accepted Answer

Security awareness training programs

Answer

Administrative controls are policies, procedures, and training programs that govern people's behavior and organizational processes.

ISO 27000 Foundation Certification Practice Test