ISO 27000 Foundation Certification ISMS Implementation and Operation 3

Question 1

Which of the following best describes 'documented information' in the context of ISO 27001 ISMS operation?

Accepted Answer

Information that must be controlled and maintained, in any format or media

Answer

ISO 27001 uses 'documented information' broadly to mean any information that must be controlled, whether electronic, paper, or other media.

Question 2

During ISMS operation, why is it important to retain documented information as evidence of results?

Accepted Answer

To provide objective evidence that ISMS processes were performed as planned

Answer

Retained documented information provides objective evidence during audits that ISMS activities were carried out and controls are functioning.

Question 3

What is the correct sequence when an organization identifies a new threat during ISMS operation?

Accepted Answer

Assess the risk, update the risk register, and treat accordingly

Answer

New threats must be assessed for risk impact, logged in the risk register, and addressed through the risk treatment process.

Question 4

How does ISO 27001 define 'competence' in the context of ISMS personnel?

Accepted Answer

The ability to apply knowledge and skills to achieve intended results

Answer

Competence means having the necessary education, training, or experience to perform information security roles effectively.

Question 5

Which scenario best illustrates the ISMS 'awareness' requirement under ISO 27001 Clause 7.3?

Accepted Answer

All persons doing work under the organization's control understand the ISMS policy and their contribution to it

Answer

Clause 7.3 requires that all workers understand the policy, their role in achieving ISMS objectives, and the implications of non-conformity.

ISO 27000 Foundation Certification Practice Test