ISO 27000 Foundation Certification Information Security Incident Management

Question 1

According to ISO 27000, what is an information security event?

Accepted Answer

An identified occurrence indicating a possible breach of information security policy

Answer

Any action taken by a user on a computer system

Answer

A confirmed successful attack on an organization's information assets

Answer

A planned maintenance activity that temporarily affects information systems

Question 2

How does ISO 27000 distinguish an information security incident from an information security event?

Accepted Answer

An incident is an event assessed to have a significant probability of compromising business operations

Answer

Events are external threats; incidents are caused by internal actors

Answer

Events are minor occurrences; incidents always result in confirmed data loss

Answer

There is no distinction — the terms are interchangeable in ISO 27000

Question 3

What is the correct order of the first three phases in a typical information security incident response lifecycle?

Accepted Answer

Detection and Identification → Containment → Eradication and Recovery

Answer

Containment → Detection → Eradication

Answer

Eradication → Identification → Recovery

Answer

Notification → Analysis → Containment

Question 4

What is the purpose of triage in information security incident management?

Accepted Answer

To prioritize incidents based on their severity and potential business impact

Answer

To assign financial costs to each reported incident

Answer

To notify law enforcement about confirmed security breaches

Answer

To restore affected systems to normal operation as quickly as possible

Question 5

Which of the following is an example of a containment action during incident response?

Accepted Answer

Isolating compromised systems from the network to prevent further spread

Answer

Identifying the root cause of the incident through forensic analysis

Answer

Notifying affected customers about the breach under GDPR obligations

Answer

Updating security policies and procedures after the incident is resolved

Question 6

What is the primary purpose of conducting a post-incident review?

Accepted Answer

To identify lessons learned and improve future incident prevention and response

Answer

To assign blame and disciplinary action to responsible employees

Answer

To calculate and document the full financial loss from the incident

Answer

To satisfy mandatory regulatory reporting requirements after a breach

Question 7

Which ISO standard specifically provides guidance on information security incident management?

Accepted Answer

ISO 27035

Answer

ISO 27001

Answer

ISO 27005

Answer

ISO 27017