ISO 27000 Foundation Certification Prior Knowledge 3

Question 1

Which of the following is an example of an administrative (organizational) control in information security?

Accepted Answer

Implementing an acceptable use policy

Answer

Administrative controls are policy-based measures like acceptable use policies that govern how people interact with information.

Question 2

In ISO 27000, what is meant by 'residual risk'?

Accepted Answer

Risk that remains after controls have been applied

Answer

Residual risk is the remaining level of risk after risk treatment controls have been implemented.

Question 3

Which of the four risk treatment options involves sharing the risk with another party?

Accepted Answer

Risk transfer

Answer

Risk transfer (also called risk sharing) involves passing the financial or operational impact of a risk to another party, such as an insurer.

Question 4

What does 'integrity' mean as a core property of information security?

Accepted Answer

Information is accurate and has not been improperly altered

Answer

Integrity ensures that information remains accurate and complete, and is only modified by authorized processes.

Question 5

Which role is typically responsible for approving the information security policy in an ISO 27001-aligned organization?

Accepted Answer

Top management

Answer

ISO 27001 requires top management to approve and demonstrate commitment to the information security policy.

ISO 27000 Foundation Certification Practice Test