ISO 27000 Foundation ISO 27000 Family of Standards Questions and Answers

Question 1

An information security manager is using Annex A of ISO/IEC 27001 to select appropriate controls.
For a specific control, such as 'A.5.23 Information security for use of cloud services', they require more detailed implementation guidance.
Which standard in the ISO 27000 family provides this detailed guidance for the controls listed in Annex A?

Accepted Answer

ISO/IEC 27002

Answer

ISO/IEC 27000

Answer

ISO/IEC 27005

Answer

ISO/IEC 27001

Question 2

The ISO 27001 standard is structured around the Plan-Do-Check-Act (PDCA) model for continual improvement. Which of the following clauses are primarily associated with the 'Check' phase of the cycle?

Accepted Answer

Clause 9 (Performance evaluation)

Answer

Clause 4 (Context of the organization) and Clause 5 (Leadership)

Answer

Clause 7 (Support) and Clause 8 (Operation)

Answer

Clause 10 (Improvement)

Question 3

As part of an ISO 27001 implementation, the Chief Executive Officer (CEO) of an organization publicly endorses the new information security policy and ensures that sufficient budget and personnel are allocated for the ISMS project. Which specific leadership responsibility from ISO 27001 is the CEO primarily demonstrating?

Accepted Answer

Ensuring the integration of ISMS requirements into the organization’s processes and providing necessary resources.

Answer

Conducting the detailed information security risk assessment.

Answer

Writing the specific procedures for access control.

Answer

Performing the daily backup and recovery operations.

Question 4

An organization is establishing its ISMS according to ISO 27001 and is determining its 'interested parties' as required by Clause 4.2. Which of the following would be the LEAST likely to be considered a relevant interested party with requirements pertinent to the ISMS?

Accepted Answer

A competitor company operating in the same market.

Answer

A government regulatory body that enforces data protection laws.

Answer

A major customer who requires security assurances in their service contract.

Answer

The company's shareholders who are concerned about business continuity.

Question 5

A multinational corporation has an established ISMS certified to ISO/IEC 27001. To comply with evolving global data privacy regulations, the company wants to enhance its ISMS to specifically manage and protect Personally Identifiable Information (PII). Which ISO 27000 family standard provides a framework for a Privacy Information Management System (PIMS) as an extension to an ISMS?

Accepted Answer

ISO/IEC 27701

Answer

ISO/IEC 27017

Answer

ISO/IEC 27032

Answer

ISO/IEC 27005

Question 6

According to the vocabulary defined in the ISO 27000 family, which statement BEST describes the relationship between a threat, a vulnerability, and an asset?

Accepted Answer

A threat is a potential cause of an incident that may harm an asset by exploiting a vulnerability.

Answer

A vulnerability is a potential cause of an incident that may result in harm to an asset.

Answer

A threat exploits an asset to cause harm to a vulnerability.

Answer

An asset is a weakness that can be exploited by a threat.