ISO 27000 Foundation Certification Prior Knowledge 5

Question 1

In ISO 27000, what is the difference between a 'threat' and a 'threat actor'?

Accepted Answer

A threat is the potential cause of harm; a threat actor is the entity that exploits it

Answer

A threat is the potential cause of an unwanted incident, while a threat actor (or threat source) is the human or environmental entity that carries it out.

Question 2

Which of the following correctly describes 'confidentiality' in the CIA triad?

Accepted Answer

Ensuring information is not disclosed to unauthorized individuals or processes

Answer

Confidentiality means restricting information access so that only authorized individuals or systems can view it.

Question 3

What is the purpose of a Statement of Applicability (SoA) in ISO 27001?

Accepted Answer

To list controls selected from ISO 27002 and justify their inclusion or exclusion

Answer

The SoA documents which ISO 27002 controls have been selected, why others were excluded, and whether they are implemented.

Question 4

Which concept describes the degree to which an asset is exposed based on the likelihood of a threat exploiting a vulnerability?

Accepted Answer

Risk

Answer

Risk in ISO 27000 combines the likelihood of a threat exploiting a vulnerability with the potential impact on the organization.

Question 5

An employee accidentally deletes critical business records stored on a shared drive. Which CIA property is primarily affected?

Accepted Answer

Availability

Answer

Deleting data removes access to it, which directly impacts availability — the ability of authorized users to access information when needed.

ISO 27000 Foundation Certification Practice Test

ISO 27000 Foundation Certification Practice Test

ISO 27000 Foundation Certification Prior Knowledge 5