CertiProf I27001F Exam Questions Instant Access

Question 1

What are the three main aspects of information security?

ADurability, auditability, confidentiality

BConfidentiality, integrity, availability

CConfidentiality, recoverability, integrity

DNon-repudiation, authenticity, accountability

Answer : B

The three fundamental properties of information security are confidentiality, integrity, and availability, often referred to as the CIA triad. Confidentiality means information is accessible only to authorized persons or entities. Integrity means safeguarding the accuracy and completeness of information. Availability means information and associated assets are accessible and usable when required. These principles are foundational within ISO/IEC 27001 and ISO/IEC 27002. Therefore, option B is correct.

=======

Question 2

What does ISO/IEC 27001:2022 require for the control of documented information?

AA person designated by top management with expertise to control documented information

BAcquisition of a set of information security tools for effective documented information control

CA consultancy to accurately perform documented information control

DAppropriate protection, for example, against loss of confidentiality, improper use, or loss of integrity

Answer : D

ISO/IEC 27001:2022 requires documented information to be controlled so that it is adequately protected. The standard specifically refers to protection from issues such as loss of confidentiality, improper use, and loss of integrity. It also requires documented information to be available and suitable for use where and when needed. The standard does not require a consultancy, specific tools, or a single designated expert to meet this requirement. Therefore, option D is correct.

Question 3

In the context of clause 6.1 actions to address risks and opportunities, the weakness of an asset or control that can be exploited by a threat is known as:

AThreat

BRisk

CVulnerability

DImpact

Answer : C

A vulnerability is a weakness of an asset, control, or other element that can be exploited by one or more threats. In information security risk assessment, vulnerabilities are considered together with threats, likelihood, and impact in order to understand and evaluate risk. A threat is a potential cause of an unwanted incident, while impact refers to the consequence. Therefore, option C is correct.

=======

Question 4

What does ISO/IEC 27001:2022 require in order for top management to demonstrate leadership and commitment with respect to the Information Security Management System?

AEnsuring that the information security policy and information security objectives are established and are compatible with the strategic direction of the organization

BHiring a consultancy to determine the best way to do it

CAppointing a volunteer to be responsible for the Information Security Management System

DNothing is required

Answer : A

ISO/IEC 27001:2022 requires top management to demonstrate leadership and commitment by ensuring that the information security policy and information security objectives are established and are compatible with the strategic direction of the organization. Top management must also integrate ISMS requirements into the organization's processes, ensure resources are available, support relevant roles, and promote continual improvement. The standard does not allow leadership accountability to be replaced by a consultant or a volunteer. Therefore, option A is correct.

=======

Question 5

What are the phases of the PDCA cycle?

APlan, Validate, Verify, Act

BPlan, Do, Check, Act

CPlan, Do, Verify, Assure

DPropose, Do, Validate, Act

Answer : B

The PDCA cycle stands for Plan, Do, Check, Act. It is a management model commonly associated with management systems, including the implementation and continual improvement of an ISMS. In the context of ISO/IEC 27001:2022, this logic supports planning the ISMS, implementing and operating it, monitoring and reviewing performance, and taking actions for continual improvement. Therefore, option B is correct.

=======

Question 6

During the operation of the ISMS, what is a requirement for information security objectives?

ADevelop improvement plans using ISO/IEC 27002 to achieve the information security objectives

BMaintain documented information about the objectives

CEnsure that the objectives are consistent with the information security policy

DEstablish objectives for relevant functions and levels

Answer : C

ISO/IEC 27001:2022 requires information security objectives to be established at relevant functions and levels, to be consistent with the information security policy, to be measurable if practicable, and to be monitored, communicated, and updated as appropriate. It also requires documented information on the objectives. Among the answer choices, option C is the best single answer because it expresses one of the core mandatory characteristics of the objectives. Even though options B and D are also requirements, the question asks for one answer only, and option C is the most fundamental wording in the set.

=======

Question 7

In the context of clause 6.1 actions to address risks and opportunities, what is defined as residual risk?

AEffect of uncertainty on objectives

BInformed decision to take a particular risk

CRisk remaining after risk treatment

DNone of the above

Answer : C

Residual risk is the risk that remains after risk treatment has been applied. In an ISMS, organizations assess risks, select treatment options, and implement controls or other measures to reduce risk to an acceptable level. Even after treatment, some level of risk may still remain, and that remaining portion is called residual risk. Therefore, option C is correct.

=======

CertiProf Certified ISO/IEC 27001:2022 Foundation I27001F Exam Questions