ISO 27000 Foundation Certification Performance Evaluation and Improvement 4

Question 1

A company's ISMS management review reveals that its risk appetite has changed due to a merger. Which management review output addresses this?

Accepted Answer

Decisions related to any need for changes to the ISMS

Answer

ISO 27001 Clause 9.3 includes 'any need for changes to the ISMS' as a required output when strategic context changes like a merger occur.

Question 2

What does ISO 27004 primarily provide guidance on?

Accepted Answer

Monitoring, measurement, analysis, and evaluation of information security

Answer

ISO 27004 provides guidelines on how to assess the performance of an ISMS and the controls specified in ISO 27001 through monitoring and measurement.

Question 3

Which of the following is NOT a required input to management review under ISO 27001 Clause 9.3?

Accepted Answer

Competitor analysis and market positioning reports

Answer

ISO 27001 does not require competitor analysis as an input to management review — it focuses on ISMS performance, risk, and stakeholder feedback.

Question 4

An audit finding shows a control is documented but not actually practiced. This represents which type of nonconformity?

Accepted Answer

A process conformance failure

Answer

When a documented control exists but is not implemented in practice, this is a process conformance failure — the ISMS is not effectively implemented.

Question 5

How should an organization handle metrics that consistently show 100% target achievement?

Accepted Answer

Increase the target or evaluate whether the metric still provides meaningful insight

Answer

Metrics that always show 100% may be set too loosely and should be challenged to ensure they still provide meaningful performance insight.

ISO 27000 Foundation Certification Practice Test