ISO 27000 Foundation Certification ISO 27000 Foundation Certification MCQ 4

Question 1

What is the scope of ISO 27001 certification?

Accepted Answer

It is defined by the organization and may cover part or all of the organization

Answer

The organization defines the ISMS scope, which can include specific departments, locations, or processes rather than the whole organization.

Question 2

In ISO 27000, which of the following is an example of a 'physical' security control?

Accepted Answer

Locked server room with badge access

Answer

Physical controls protect assets through tangible means such as locked doors, security cameras, and physical access badges.

Question 3

What does 'information security' protect according to ISO 27000?

Accepted Answer

The confidentiality, integrity, and availability of information

Answer

ISO 27000 defines information security as the preservation of confidentiality, integrity, and availability of information.

Question 4

Which document formally authorizes the start of a risk treatment plan under ISO 27001?

Accepted Answer

Risk treatment plan approved by top management

Answer

The risk treatment plan, approved by top management, formally documents how identified risks will be treated and by whom.

Question 5

What is the difference between a threat and a threat agent in ISO 27000?

Accepted Answer

A threat is the potential for harm; a threat agent is the entity that exploits a vulnerability

Answer

A threat is the potential cause of an incident, while the threat agent is the specific individual, group, or force that carries out the threat.

ISO 27000 Foundation Certification Practice Test