Principles & Concepts

Which trio of properties does ISO/IEC 27001 define as the objectives of information security?

• APrevention, detection and response
• BConfidentiality, integrity and availability✓
• CAuthentication, authorisation and accounting
• DPeople, process and technology

Answer: Information security in ISO/IEC 27001 is the preservation of confidentiality, integrity and availability of information. The other groupings are useful models, but they are not the definition the standard works from.

An organisation lists its buildings, its staff and its reputation on the same register as its customer database. Under ISO/IEC 27001, how should the relationship between information and assets be described?

• AAssets are a subset of information
• BOnly information counts as an asset for certification purposes
• CInformation is one class of asset among many✓
• DInformation and assets are two words for the same thing

Answer: An asset is anything of value to the organisation, which includes people, software, hardware, premises and reputation. Information is one class of asset within that, so collapsing the two loses the distinction the standard relies on.

A weakness in a system exists but nothing is capable of exploiting it. In ISO 27001 risk terms, what is the risk?

• AThe risk cannot be determined until a penetration test has confirmed it
• BThe risk is equal to the value of the asset the vulnerability sits on
• CThe risk is high, because an unpatched vulnerability is a risk in its own right
• DThere is no risk, because a vulnerability with no credible threat carries none✓

Answer: Risk arises where a threat can exploit a vulnerability to cause an impact. A vulnerability with no credible threat carries no risk, just as a severe threat against an asset with no vulnerability carries none. Both sides have to be present.

What is the correct order of the chain that produces a risk?

• AVulnerability, threat, risk, impact✓
• BImpact, risk, threat, vulnerability
• CRisk, vulnerability, threat, impact
• DThreat, impact, vulnerability, risk

Answer: A threat exploits a vulnerability, which gives rise to a risk, which realises an impact. Impact is what the event costs once it lands, so it sits at the end of the chain rather than the start.

Encryption is applied so that intercepted traffic cannot be read. Classified by control type rather than by nature, what kind of control is this?

• ARecovery
• BCorrective
• CPreventive✓
• DDetective

Answer: Control type, in ISO/IEC 27002:2022, describes how a control acts on an incident: preventive controls stop it occurring. Encryption also has a nature - technical - and both labels are true of the same control at once, which is a distinction the exam tests directly.

A log review that identifies an incident during or after it occurs is which functional class of control?

• APreventive
• BDetective✓
• CDeterrent
• DCompensating

Answer: Detective controls identify that something has happened, during or after the event. Preventive controls stop it occurring, and deterrent controls discourage the attempt in the first place.

Restoring a service from backup after an outage is which type of control, as ISO/IEC 27002:2022 classifies controls?

• ADetective
• BCorrective✓
• CPreventive
• DDeterrent

Answer: ISO/IEC 27002:2022 tags information backup (control 8.13) with the control type Corrective. The standard has three control types: preventive, detective and corrective. Recover is the backup control's cybersecurity concept, a separate attribute, and deterrent is not one of the standard's control types.

Additional monitoring is put in place on a legacy system because the intended control cannot be implemented. What is this control called?

• APreventive
• BCorrective
• CDeterrent
• DCompensating✓

Answer: A compensating control stands in for an impractical or unachievable control, providing comparable assurance by another route. It is defined by why it is there rather than by what it technically does.

A completed access-review form is filed after a quarterly review. Under ISO/IEC 27001, how should that form be treated?

• AAs a specification, because it defines the access requirement
• BAs a document, placed under version control and reissued each quarter
• CAs a record, retained and protected as evidence, not revised✓
• DAs uncontrolled information, since the review is complete

Answer: A record is evidence that something happened, so it is retained, protected and legible for its retention period and not amended. Documents state intent and are version-controlled and revised; the completed form is evidence of an event, so it is retained rather than reissued.

Which statement correctly distinguishes a document from a record in an ISMS?

• ADocuments are for internal use only, while records are the ones issued to interested parties
• BDocuments state intent and are revised; records evidence that something happened and are retained✓
• CDocuments are held electronically, while records must be retained on paper
• DDocuments are mandatory under Clause 7.5, while records are entirely optional

Answer: ISO/IEC 27001 uses the single umbrella term documented information for both, but the control applied differs: documents need approval and version control, while records need protection and a retention period.

Which document type states a measurable requirement that a control or product must meet?

• AA procedure
• BA guideline
• CA policy
• DA specification✓

Answer: A specification states requirements - the measurable bar. A policy states intent, a procedure states how work is done, and a guideline is discretionary rather than mandatory.

In the documented information hierarchy, which item is discretionary rather than mandatory?

• AGuideline✓
• BPolicy
• CProcedure
• DStandard

Answer: Policy, standard, procedure and baseline are mandatory once issued; only guidelines are discretionary. Baselines set the minimum rather than the maximum.

Which standard in the ISO/IEC 27000 family provides implementation guidance for the Annex A controls?

• AISO/IEC 27005
• BISO/IEC 27002✓
• CISO/IEC 27000
• DISO/IEC 27003

Answer: ISO/IEC 27002 gives implementation guidance for each Annex A control. ISO/IEC 27001 states the requirement; 27000 provides the vocabulary, 27003 guidance on the clauses, and 27005 guidance on information security risk management.

An implementation team needs the overview and vocabulary that the rest of the family relies on. Which standard should they consult?

• AISO/IEC 27001
• BISO/IEC 27004
• CISO/IEC 27002
• DISO/IEC 27000✓

Answer: ISO/IEC 27000 provides the overview and the vocabulary that the family shares, including the definitions the exam quotes. It is freely available, unlike most of the family.

Which standard covers monitoring, measurement, analysis and evaluation of an ISMS?

• AISO/IEC 27005
• BISO/IEC 27006
• CISO/IEC 27004✓
• DISO/IEC 27003

Answer: ISO/IEC 27004 addresses monitoring, measurement, analysis and evaluation, which supports Clause 9.1. ISO/IEC 27005 covers risk management, 27003 covers the clause requirements, and 27006 sets requirements for bodies that certify management systems.

Which is the only standard in the family against which an organisation can be certified?

• AISO/IEC 27001✓
• BISO/IEC 27002
• CISO/IEC 27005
• DISO/IEC 27000

Answer: ISO/IEC 27001 states the requirements and is the only one certified against. Everything else in the family is guidance, so an exam question asking which document to consult for how to implement a control points to 27002 every time.