APMG-International ISO/IEC 27001 (2022) Foundation ISO-IEC-27001-Foundation Exam Questions

Answer : A

Comprehensive and Detailed Explanation From Exact Extract ISO/IEC 27002:2022 standards:

Annex A in ISO/IEC 27001 refers directly to ISO/IEC 27002 for control guidance. In ISO/IEC 27002:2022, Clause 6.8 is titled:

''Information security event reporting -- Information security events should be reported through appropriate management channels as quickly as possible.''

This control ensures breaches, incidents, or suspected issues are reported for action. The other options (B, C, D) are not the exact titles in Annex A. The official title is Information security event reporting, confirming Answer: A.

Answer : C

Clause 6.1.2 (Information security risk assessment) requires organizations to ''define and apply an information security risk assessment process that... establishes and maintains information security risk criteria, including criteria for accepting risk.''

This means that acceptable levels of risk (risk acceptance criteria) must be explicitly defined. These criteria ensure consistent decision-making when evaluating whether identified risks need further treatment or can be tolerated.

Option A is incorrect because exclusions relate to the ISMS scope (Clause 4.3), not risk assessment planning. Option B is not a requirement; effectiveness of risk assessment methods is not required to be measured, though methods must be applied consistently. Option D is false---the standard clearly specifies required elements for risk assessment.

Thus, the correct answer is C: The criteria for acceptable levels of risk.

Answer : B

Clause 5.1 (Leadership and Commitment) requires top management to demonstrate leadership by:

''ensuring the information security policy and the information security objectives are established and are compatible with the strategic direction of the organization;''

''ensuring the integration of the ISMS requirements into the organization's processes;''

''ensuring that the resources needed for the ISMS are available;''

Among the options, the one explicitly mandated is ensuring that information security objectives are established. Risk assessments (C) and implementing audit actions (D) are responsibilities of management but not the direct leadership evidence required in Clause 5.1. Communicating interested party feedback (A) is relevant but not specifically cited as leadership evidence. Thus, the verified answer is B.

Answer : D

Clause 7.3 (Awareness) requires:

''Persons doing work under the organization's control shall be aware of: (a) the information security policy; (b) their contribution to the effectiveness of the ISMS, including the benefits of improved information security performance; (c) the implications of not conforming with the ISMS requirements.''

This applies not only to employees but also contractors and external parties under the organization's control. Competence (B) requires having skills, training, and experience, while Communication (C) covers defining communication processes (Clause 7.4). Nonconformity and corrective action (A) is part of Clause 10 (Improvement).

Therefore, the specific requirement that ensures contractors are made aware of the information security policies is found in Clause 7.3 Awareness. Correct answer: D.

Answer : A

Clause 9.1 requires:

''The organization shall evaluate the information security performance and the effectiveness of the information security management system.''

This is the central purpose of monitoring, measurement, analysis, and evaluation. Competence (B) is covered under Clause 7.2. Monitoring use of assets (C) and outsourced processes (D) may be done, but they are not the formal purpose described in the standard. Instead, performance evaluation ensures the ISMS continues to meet intended outcomes and supports continual improvement.

Thus, the verified purpose is A: To evaluate information security performance.

Answer : A

Comprehensive and Detailed Explanation From Exact Extract ISO/IEC 27001:2022 standards and certification guidance:

Before a certification audit can begin, the scope of the ISMS must be clearly defined and agreed with the Certification Body. ISO/IEC 27001 Clause 4.3 requires: ''The scope shall be available as documented information.''

Certification Bodies require this scope statement to plan audit duration, resources, and coverage. Only after the scope is agreed does the Stage 1 audit begin, which reviews documented information and readiness. Stage 2 focuses on implementation and effectiveness. Evidence of corrective actions (C) is checked at Stage 2 if issues were identified earlier. Records provision (D) occurs during Stage 2, not first.

Thus, the first step in preparing for certification is A: Agreeing the scope of the ISMS with the Certification Body auditor.

Answer : A

Comprehensive and Detailed Explanation From Exact Extract ISO/IEC 27002:2022 standards:

Annex A.5.36 (Compliance with policies, rules and standards for information security) requires:

''Compliance with the organization's information security policies, rules and standards for information security should be regularly reviewed.''

This directly matches option A. Option B refers to contractual compliance, which is part of supplier management controls (Annex A.5.19). Option C relates to Annex A.5.7 (Contact with authorities). Option D refers to asset return controls (Annex A.5.9).

Thus, the correct answer is A.