ISO 27000 Foundation Certification Information Security Incident Management

Question 1

According to ISO 27000, what is an information security event?

Accepted Answer

An identified occurrence indicating a possible breach of information security policy

Answer

ISO 27000 defines an information security event as an identified occurrence of a system, service, or network state indicating a possible breach of policy, failure of controls, or a previously unknown security-relevant situation.

Question 2

How does ISO 27000 distinguish an information security incident from an information security event?

Accepted Answer

An incident is an event assessed to have a significant probability of compromising business operations

Answer

An information security incident is one or more unwanted or unexpected events that have a significant probability of compromising business operations and threatening information security, distinguishing it from a mere event.

Question 3

What is the correct order of the first three phases in a typical information security incident response lifecycle?

Accepted Answer

Detection and Identification → Containment → Eradication and Recovery

Answer

Incident response begins with detecting and identifying the incident, then containing its spread, and then eradicating the cause and recovering affected systems.

Question 4

What is the purpose of triage in information security incident management?

Accepted Answer

To prioritize incidents based on their severity and potential business impact

Answer

Triage involves assessing and prioritizing incidents so that the most critical ones receive immediate attention first, based on severity and potential business impact.

Question 5

Which of the following is an example of a containment action during incident response?

Accepted Answer

Isolating compromised systems from the network to prevent further spread

Answer

Containment limits the spread and impact of an incident; isolating affected systems from the network is a classic containment technique that stops further damage.

ISO 27000 Foundation Certification Practice Test

ISO 27000 Foundation Certification Practice Test

ISO 27000 Foundation Certification Information Security Incident Management