ISO 27000 Foundation Certification Information Security Incident Management 2

Question 1

What is a vulnerability as defined in the ISO 27000 vocabulary?

Accepted Answer

A weakness of an asset or control that can be exploited by one or more threats

Answer

A confirmed attack that has compromised an information asset

Answer

The complete absence of security controls in an ISMS

Answer

A type of malware specifically targeting ISO-certified organizations

Question 2

What is the primary role of a Computer Security Incident Response Team (CSIRT)?

Accepted Answer

To coordinate and manage the organization's response to information security incidents

Answer

To develop and maintain the organization's information security policies

Answer

To conduct regular penetration tests on organizational systems

Answer

To audit compliance with ISO 27001 certification requirements

Question 3

How should digital evidence collected during an incident investigation be handled?

Accepted Answer

Preserved in a manner that maintains its integrity and admissibility

Answer

Deleted securely once the incident is resolved to protect privacy

Answer

Shared publicly with the security community to help prevent similar incidents

Answer

Stored only in unencrypted digital format for ease of access by investigators

Question 4

Which phase of incident management involves removing the threat and restoring systems to normal operation?

Accepted Answer

Eradication and Recovery

Answer

Identification

Answer

Containment

Answer

Lessons Learned

Question 5

What is an escalation procedure in the context of incident management?

Accepted Answer

A defined path for elevating an incident to higher management or specialists when needed

Answer

A process for increasing security control stringency after a major incident

Answer

A method for encrypting and securing incident reports from unauthorized access

Answer

A technique used to prevent low-level incidents from escalating into major ones

Question 6

How does incident management relate to an organization's ISMS under ISO 27001?

Accepted Answer

Incident management is a required component of the ISMS covering response and improvement

Answer

Incident management is a separate discipline and does not form part of the ISMS

Answer

The ISMS only addresses prevention of incidents, not their management

Answer

Incident management replaces the need for a formal ISMS in smaller organizations

Question 7

What is the key benefit of classifying information security incidents by type and severity?

Accepted Answer

It helps organizations allocate appropriate resources and set response priorities

Answer

Classification is required only to meet legal and regulatory reporting obligations

Answer

Classification eliminates the need for formal incident reporting procedures

Answer

It determines which commercial software tool should be used for incident tracking