Certiprof ISO27001 Foundation - Exercise

According to ISO IEC 27001:2022 Clause 4.3, external and internal issues, interfaces and

dependencies must be considered to define the ISMS scope.

This statement is:

• True

• False

According to ISO IEC 27001:2022, the information security risk assessment process requires

identifying risk owners and establishing and maintaining information security risk criteria.

This statement is:

• True

• False

Which statement describes the benefits of an information security management system?

• An aid to management in structuring its approach to information security management.

• Enables organizations to properly manage disruptive incidents.

• Allows the organization to focus on containing the impact caused by information security incidents.

• An aid in the identification of nonconformities during audits.

Appointing at least two internal auditors for the information security system is described as a

critical success factor of an information security management system (ISMS). This statement is:

• Trus

• False

Implementing an effective information security awareness, training, and education program is

described as a critical success factor of an information security management system (ISMS).

This statement is:

• True

• False

ISO IEC 27001:2022 requires information security objectives to be part of:

• Internal audits.

• ISMS reviews.

• The information security policy.

• The SoA.

According to ISO IEC 27001:2022 in its clause 9.3 Management review, communicating the

importance of complying with the requirements of the ISMS is a top management responsibility

concerning the ISMS:

• True

• False

According to ISO IEC 27001:2022 in clause 5.1 Leadership and Commitment, how should top

management provide evidence of their commitment to the ISMS?

• A) Promoting continuous improvement.

• B) Directing and supporting people to contribute to the effectiveness of the information security

  management system.

• A & B are correct.

• None is requested by clause 5.1.

According to ISO IEC 27001:2022 in clause 9.3, the objective of the top management review of

the ISMS is to ensure its suitability, adequacy, and continuing effectiveness.

• True

• False

According to ISO IEC 27001:2022 the SoA must contain:

1. Evidence of senior management authorization of controls.

2. A list of the risks applicable to the organization.

3. The necessary controls with their justifications for inclusion and exclusion.

4. The information security policy.

• (A) Only 3.

• (B) 2 and 4.

• (C) Only 1.

• (D) All of correct