ISO 27000 Foundation Certification Scope of the ISMS 2

Question 1

Which document formally records the boundaries and applicability of an organization's ISMS?

Accepted Answer

Scope statement

Answer

The ISMS scope statement is the document that formally defines the boundaries and applicability of the information security management system.

Question 2

An organization decides to exclude its HR department from the ISMS scope. What must it do according to ISO 27001?

Accepted Answer

Justify the exclusion and ensure it does not affect security obligations

Answer

ISO 27001 requires organizations to justify any exclusions and ensure those exclusions do not affect the ability to achieve intended outcomes or compliance obligations.

Question 3

Which of the following best describes an 'interested party' in the context of ISMS scope?

Accepted Answer

Any person or organization that can affect or be affected by the ISMS

Answer

Interested parties include any person or organization that can affect, be affected by, or perceive themselves to be affected by the ISMS.

Question 4

A company's ISMS scope includes its main office but not its remote data center operated by a third party. What risk does this create?

Accepted Answer

Information security risks from the data center may not be managed under the ISMS

Answer

Excluding a third-party data center means risks originating there are outside the ISMS framework, potentially leaving significant vulnerabilities unmanaged.

Question 5

Context of the organization, as required by ISO 27001 Clause 4, influences ISMS scope by identifying:

Accepted Answer

Internal and external issues relevant to information security

Answer

Clause 4 requires organizations to determine internal and external issues that are relevant to the ISMS purpose and that affect its ability to achieve intended outcomes.

ISO 27000 Foundation Certification Practice Test

ISO 27000 Foundation Certification Practice Test

ISO 27000 Foundation Certification Scope of the ISMS 2