Exin Information Security Management Professional based on ISO/IEC 27001 ISMP Exam Practice Test

The information security manager is writing the Information Security Management System (ISMS) documentation. The controls that are to be implemented must be described in one of the phases of the Plan-Do-

Check-Act (PDCA) cycle of the ISMS.

In which phase should these controls be described?

The information security architect of a large service provider advocates an open design of the security architecture, as opposed to a secret design.

What is her main argument for this choice?

In a company a personalized smart card is used for both physical and logical access control.

What is the main purpose of the person's picture on the smart card?

It is important that an organization is able to prove compliance with information standards and legislation. One of the most important areas is documentation concerning access management. This process contains a

number of activities including granting rights, monitoring identity status, logging, tracking access and removing rights. Part of these controls are audit trail records which may be used as evidence for both internal and

external audits.

What component of the audit trail is the most important for an external auditor?

A risk manager is asked to perform a complete risk assessment for a company.

What is the best method to identify most of the threats to the company?

In a company the IT strategy is migrating towards a Service Oriented Architecture (SOA) so that migrating to the cloud is better feasible in the future. The security architect is asked to make a first draft of the security

architecture.

Which elements should the security architect draft?

A security architect argues with the internal fire prevention team about the statement in the information security policy, that doors to confidential areas should be locked at all times. The emergency response team wants

to access to those areas in case of fire.

What is the best solution to this dilemma?