ISO 27000 Foundation Certification The PDCA Cycle 4

Question 1

In the PDCA model, what is the primary risk of skipping the 'Check' phase?

Accepted Answer

Ineffective controls may go undetected, leaving the organization exposed

Answer

Without Check phase activities, failed or ineffective controls are not identified, undermining the entire ISMS.

Question 2

An organization is implementing security awareness training as part of its risk treatment plan. This is an example of which PDCA phase?

Accepted Answer

Do

Answer

Implementing controls and programs defined in the risk treatment plan is a Do phase activity.

Question 3

Which of the following scenarios best represents a 'Plan' phase failure in an ISO 27001 ISMS?

Accepted Answer

Risk assessments do not consider all relevant assets

Answer

Incomplete risk assessment during the Plan phase leads to gaps in the risk treatment plan and unmitigated risks.

Question 4

What role does the Statement of Applicability (SoA) play in the PDCA cycle?

Accepted Answer

It is a Plan phase output that links Annex A controls to the risk treatment decisions

Answer

The SoA is created during the Plan phase to document which Annex A controls are applicable, included, or excluded and why.

Question 5

How does the PDCA cycle relate to the concept of 'risk-based thinking' in ISO/IEC 27001?

Accepted Answer

Risk assessment and treatment in the Plan phase drive all subsequent PDCA phases

Answer

Risk assessment in the Plan phase determines what controls to implement (Do), monitor (Check), and improve (Act).

ISO 27000 Foundation Certification Practice Test