All Modules

Question 1

Owns information security, approves the policy?

Answer 1

Management

Question 2

Are responsible for their own processes, risks and countermeasures

Answer 2

Departments

Question 3

Has a role with respect to the organisation’s information security stance

Answer 3

Everyone

Question 4

Coordinates tasks to deliver project

Answer 4

Project Team

Question 5

Identify and evaluate risks

Answer 5

Risk assessors

Question 6

Coordinate controls to mitigate risks and accept residual risk.

Answer 6

Risk owners

Question 7

Set of interrelated or interacting activities that use inputs to deliver an intended result

Answer 7

process

Question 8

Specified way to carry out an activity or a process

Answer 8

Procedure (can be documented or not)

Question 9

Document stating results achieved or providing evidence of activities performed

Answer 9

Record

Question 10

Mandatory requirements of what does need to be documented in ISO 27001

Answer 10

• Scope (4.3)
• Information security policy (5.2 e)
• Information security risk assessment process (6.1.2)
• Statement of Applicability.
• Information security objectives. (6.2)
• Evidence of competence (7.2)
• Results of information security risk assessments (8.2)
• Results of information security risk treatment (8.3)
• Evidence of the information security performance monitoring and measurement results (9.1)
• Internal audit programme(s) and the audit results (9.2.2)

Question 11

Action taken to eliminate the cause of a nonconformity.

Answer 11

Corrective action

Question 12

Immediate action to eliminate a detected nonconformity

Answer 12

Correction

Question 13

Size and complexity of an ISMS should be customised to the organisation?
True or false

Answer 13

True

Question 14

Management system documentation should include the company names of the service providers?
True or False

Answer 14

False

Question 15

Documents go through five stages as part of their lifecycle
True or False

Answer 15

True

Written
Reviewed and reworked
Approved
Distributed
Archived

Question 16

Processes can be split into as many different documents as needed
True or False?

Answer 16

True

Question 17

Documents should require more than one person to authorise amendments.
True or False

Answer 17

False

Question 18

You should wait to publish management system documents just before an audit
True or False

Answer 18

False
Publish as soon as signed off

Question 19

Every process and procedure should include who does what, where and when.
True or False

Answer 19

True

Question 20

What are the parts of the RACI matrix?

Answer 20

Responsible
Accountable
Consulted
Informed

The RACI matrix applies to all processes

Question 21

Policies and objectives should be consistent with organisational objectives
True or False

Answer 21

True

Question 22

The management system should be integrated into business processes.
True or False

Answer 22

True

Question 23

Policies should never be shared with people outside the organisation
True or False

Answer 23

False

Question 24

The scope doesn’t need to include remote workers.
True or False

Answer 24

False

Question 25

CEO support is crucial to having an effective ISMS.
True or False

Answer 25

True

Question 26

The information security policy must include information security objectives.
True or False

Answer 26

True

Question 27

Which of these should be determined in the scope? (select all that apply.)
A - Supplers
B - Outsourced functions or processes
C - External and Internal issues for the organisation and its context.
D - Requirements of interested parties.

Answer 27

B C D

Question 28

SMART

Question 29

The four options for risk decision are?

Answer 29

Terminate
Tolerate
Treat
Transfer

Question 30

ISMS Principals (9)

Answer 30

1 Awareness
2 Assignment of responsibility
3 Incorporating management commitment and the interests of stakeholders
4 Enhancing societal values
5 Controls proportional to risks
6 Security as an essential element of networks and systems
7 Active prevention and detection of incidents
8 Comprehensive approach to information security management
9 continual reassessment and improvement

Question 31

Standard

Answer 31

A specification to which something can conform