Question 1

Identify the missing word(s) in the following control relating to the Policies for information security control. œInformation security policy and topic-specific policies should be defined, approved by management, [ ? ] and acknowledged by relevant personnel and relevant interested parties, and reviewed at planned intervals and if significant changes occur.

Options :

A : published

B : established and maintained

C : published, communicated to

D : communicated to

Answer: C

Question 2

When are the information security policies required to be reviewed, according to the Policies for information security control?

Options :

A : Every six months

B : Annually

C : According to a schedule defined by the Certification Body

D : At planned intervals and if significant changes occur

Answer: D

Question 3

Which International Standard can be used to implement an integrated management system with ISO/IEC 27001?

Options :

A : ISO/IEC 27003

B : ISO/IEC 27013

C : ISO 9001

D : None of the above

Answer: B

Question 4

Which benefit is NOT relevant by implementing an ISMS for an organization?

Options :

A : Information security compliance will increase stakeholder trust in the organization

B : Information security staff will be qualified to ISO/IEC 27001 Foundation level

C : Information security controls are tailored to suit the organization's specific circumstances

D : Information security risks are assessed and the probability and/or impact reduced

Answer: B

Question 5

Which action is a required response to an identified residual risk?

Options :

A : By default, it shall be controlled by information security awareness and training

B : Top management shall delegate its treatment to risk owners

C : It shall be reviewed by the risk owner to consider acceptance

D : The organization shall change practices to avoid the risk occurring

Answer: C

Free ISO-IEC-27001-Foundation Mock Exam – Practice Online Confidently

Buying Options: