ISO 27000 Foundation Certification ISMS Implementation and Operation 4

Question 1

What distinguishes an 'information security objective' from a general security policy statement?

Accepted Answer

Objectives are specific, measurable targets aligned with the security policy

Answer

Information security objectives must be measurable (where practical), consistent with the policy, and monitored for progress.

Question 2

During ISMS implementation, who holds ultimate accountability for accepting residual risk?

Accepted Answer

Top management or designated risk owners

Answer

Risk owners, approved by top management, are accountable for accepting residual risk after treatment options have been applied.

Question 3

What does the ISMS 'Plan-Do-Check-Act' cycle emphasize during the 'Do' phase?

Accepted Answer

Implementing and operating the ISMS controls as planned

Answer

The 'Do' phase involves executing the plans made in 'Plan,' putting controls, processes, and procedures into practice.

Question 4

Which of the following is a valid risk treatment option under ISO 27001?

Accepted Answer

Risk modification through applying security controls

Answer

ISO 27001 risk treatment options include modification (applying controls), avoidance, sharing/transfer, and retention — not elimination or creation.

Question 5

A new employee joins a department that processes confidential customer data. What ISMS onboarding step is most critical?

Accepted Answer

Providing information security awareness training before granting data access

Answer

New employees must receive security awareness training aligned to their role before handling sensitive information, per ISO 27001 Clause 7.3.

ISO 27000 Foundation Certification Practice Test