Question 1 of 10 · Fundamental principles and concepts of an information security management system
What is residual risk?
Residual risk is what remains after treatment and must be accepted by risk owners. Inherent risk is before treatment, and transfer or removal are treatments.
Question 2 of 10 · Information security management system requirements
What does the information security policy provide?
The policy sets direction and commitment for the ISMS.
Question 3 of 10 · Planning of an ISMS implementation based on ISO/IEC 27001
Why should planning consider legal and contractual requirements?
Legal, regulatory and contractual requirements are interested-party requirements and also an Annex A control area (5.31). They are not optional, deferred or automatic.
Question 4 of 10 · Implementation of an ISMS based on ISO/IEC 27001
What does control 7.4, physical security monitoring, require?
Control 7.4 requires continuous monitoring, such as alarms and video, for unauthorized physical access. The distractors are weak or partial.
Question 5 of 10 · Monitoring and measurement of an ISMS based on ISO/IEC 27001
Why should monitoring results be analyzed, not just collected?
Clause 9.1 requires analysis and evaluation to judge performance and effectiveness. Collection alone does not.
Question 6 of 10 · Continual improvement of an ISMS based on ISO/IEC 27001
What is continual improvement in the ISMS?
Clause 10 requires continual improvement of the ISMS.
Question 7 of 10 · Preparation for an ISMS certification audit
What can happen if an organization fails to maintain its ISMS after certification?
Certification bodies can suspend or withdraw certificates for serious or persistent nonconformities or failure to allow surveillance. ISO itself does not fine organizations.
Question 8 of 10 · Fundamental principles and concepts of an information security management system
What does ISO/IEC 27001 specify?
ISO/IEC 27001 states requirements for an ISMS, not prescriptive methods or products.
Question 9 of 10 · Information security management system requirements
What is the role of interested parties' requirements in the ISMS?
Interested parties' relevant requirements shape the ISMS.
Question 10 of 10 · Planning of an ISMS implementation based on ISO/IEC 27001
What is the first step in identifying information security risks under an asset-based approach?
Asset-based identification starts with assets and owners, then threats, vulnerabilities and consequences. Insurance, the SoA and audit dates come later.
0 of 10
Fundamental principles and concepts of an information security management system
Information security management system requirements
Planning of an ISMS implementation based on ISO/IEC 27001
Implementation of an ISMS based on ISO/IEC 27001
Monitoring and measurement of an ISMS based on ISO/IEC 27001
Continual improvement of an ISMS based on ISO/IEC 27001
Preparation for an ISMS certification audit
Which domains cost you the points? Members see a breakdown by domain and a study plan built from it.