ISO 27000 Foundation ISMS Fundamentals and Vocabulary Questions and Answers — Questions and Answers
Question 1: According to ISO/IEC 27000, which of the following BEST defines 'information security'?
- The protection of information from a wide range of threats in order to ensure business continuity, minimize business risk, and maximize return on investments.
- The preservation of confidentiality, integrity, and availability of information; in addition, other properties, such as authenticity, accountability, non-repudiation, and reliability can also be involved. (Correct answer)
- A systematic approach to establishing, implementing, operating, monitoring, reviewing, maintaining, and improving an organization's information security to achieve business objectives.
- The process of preventing unauthorized access, use, disclosure, disruption, modification, inspection, recording, or destruction of information.
Correct answer: The preservation of confidentiality, integrity, and availability of information; in addition, other properties, such as authenticity, accountability, non-repudiation, and reliability can also be involved.
ISO/IEC 27000:2018 formally defines information security as the 'preservation of confidentiality, integrity and availability of information'. It also notes that other properties can be involved. The other options describe related concepts like the goal of an ISMS or general definitions of cybersecurity, but are not the specific definition from the standard.
Question 2: A financial services company is implementing an Information Security Management System (ISMS). They are currently identifying anything that has value to the organization, including customer data, proprietary software, and servers. In the context of ISO/IEC 27000, what is the correct term for these items?
- Controls
- Risks
- Assets (Correct answer)
- Vulnerabilities
Correct answer: Assets
ISO/IEC 27000 defines an 'asset' as anything that has value to the organization. This includes data, software, hardware, and services. Risks are the effect of uncertainty on objectives, vulnerabilities are weaknesses, and controls are measures that modify risk.
Question 3: Which standard in the ISO 27000 family provides the overview, fundamental principles, and vocabulary for an ISMS?
- ISO/IEC 27001
- ISO/IEC 27002
- ISO/IEC 27005
- ISO/IEC 27000 (Correct answer)
Correct answer: ISO/IEC 27000
ISO/IEC 27000 is the foundational standard in the series. It provides an overview of information security management systems and specifies the essential vocabulary (terms and definitions) used across the entire ISO 27000 family of standards.
Question 4: What is the primary purpose of an Information Security Management System (ISMS) as described in the ISO 27000 series?
- To guarantee the complete elimination of all information security incidents.
- To provide a systematic approach for establishing, implementing, maintaining, and continually improving information security. (Correct answer)
- To exclusively implement technical controls to prevent cyberattacks.
- To satisfy legal and regulatory requirements as the sole objective.
Correct answer: To provide a systematic approach for establishing, implementing, maintaining, and continually improving information security.
An ISMS is a systematic, risk-based approach to managing an organization's information security. It is a management framework that involves policies, processes, procedures, and controls to protect information assets, and it is based on a cycle of continual improvement (Plan-Do-Check-Act). While it helps satisfy requirements and implement controls, its primary purpose is the overall management system. Eliminating all incidents is not a realistic goal.
Question 5: A weakness in a system's security procedures, design, implementation, or internal controls that could be exploited by a threat source is known as a:
- Risk
- Consequence
- Vulnerability (Correct answer)
- Threat
Correct answer: Vulnerability
ISO/IEC 27000 defines a 'vulnerability' as a weakness of an asset or control that can be exploited by one or more threats. A threat is a potential cause of an incident, and a risk is the effect of uncertainty on objectives, often expressed as a combination of the consequences of an event and the associated likelihood of occurrence.
Question 6: Which of the following is NOT considered one of the three core properties of information security defined in the CIA triad within ISO/IEC 27000?
- Confidentiality
- Integrity
- Accountability (Correct answer)
- Availability
Correct answer: Accountability
The CIA triad, a fundamental concept in ISO/IEC 27000, stands for Confidentiality, Integrity, and Availability. While accountability is an important security principle, it is not one of the three core components of the triad itself as formally defined in the standard.
ISO 27000 Foundation ISMS Fundamentals and Vocabulary Questions and Answers
According to ISO/IEC 27000, which of the following BEST defines 'information security'?