ISO 27000 Foundation Certification Information Security Incident Management 1 — Questions and Answers
Question 1: According to ISO 27000, what is an information security event?
- An identified occurrence indicating a possible breach of information security policy (Correct answer)
- Any action taken by a user on a computer system
- A confirmed successful attack on an organization's information assets
- A planned maintenance activity that temporarily affects information systems
Correct answer: An identified occurrence indicating a possible breach of information security policy
ISO 27000 defines an information security event as an identified occurrence of a system, service, or network state indicating a possible breach of policy, failure of controls, or a previously unknown security-relevant situation.
Question 2: How does ISO 27000 distinguish an information security incident from an information security event?
- Events are external threats; incidents are caused by internal actors
- An incident is an event assessed to have a significant probability of compromising business operations (Correct answer)
- Events are minor occurrences; incidents always result in confirmed data loss
- There is no distinction — the terms are interchangeable in ISO 27000
Correct answer: An incident is an event assessed to have a significant probability of compromising business operations
An information security incident is one or more unwanted or unexpected events that have a significant probability of compromising business operations and threatening information security, distinguishing it from a mere event.
Question 3: What is the correct order of the first three phases in a typical information security incident response lifecycle?
- Containment → Detection → Eradication
- Eradication → Identification → Recovery
- Detection and Identification → Containment → Eradication and Recovery (Correct answer)
- Notification → Analysis → Containment
Correct answer: Detection and Identification → Containment → Eradication and Recovery
Incident response begins with detecting and identifying the incident, then containing its spread, and then eradicating the cause and recovering affected systems.
Question 4: What is the purpose of triage in information security incident management?
- To assign financial costs to each reported incident
- To prioritize incidents based on their severity and potential business impact (Correct answer)
- To notify law enforcement about confirmed security breaches
- To restore affected systems to normal operation as quickly as possible
Correct answer: To prioritize incidents based on their severity and potential business impact
Triage involves assessing and prioritizing incidents so that the most critical ones receive immediate attention first, based on severity and potential business impact.
Question 5: Which of the following is an example of a containment action during incident response?
- Identifying the root cause of the incident through forensic analysis
- Notifying affected customers about the breach under GDPR obligations
- Isolating compromised systems from the network to prevent further spread (Correct answer)
- Updating security policies and procedures after the incident is resolved
Correct answer: Isolating compromised systems from the network to prevent further spread
Containment limits the spread and impact of an incident; isolating affected systems from the network is a classic containment technique that stops further damage.
Question 6: What is the primary purpose of conducting a post-incident review?
- To assign blame and disciplinary action to responsible employees
- To calculate and document the full financial loss from the incident
- To identify lessons learned and improve future incident prevention and response (Correct answer)
- To satisfy mandatory regulatory reporting requirements after a breach
Correct answer: To identify lessons learned and improve future incident prevention and response
Post-incident reviews (lessons learned sessions) aim to identify what worked well, what failed, and how processes and controls can be improved to prevent or better handle future incidents.
Question 7: Which ISO standard specifically provides guidance on information security incident management?
- ISO 27001
- ISO 27005
- ISO 27035 (Correct answer)
- ISO 27017
Correct answer: ISO 27035
ISO 27035 is the dedicated standard that provides guidelines for information security incident management, covering principles and processes for planning and responding to incidents.
ISO 27000 Foundation Certification Information Security Incident Management 1
According to ISO 27000, what is an information security event?