What is the name of the control clause used to control information security breaches within Annex A of ISO/IEC 27001?
Answer(s): A
Comprehensive and Detailed Explanation From Exact Extract ISO/IEC 27002:2022 standards:Annex A in ISO/IEC 27001 refers directly to ISO/IEC 27002 for control guidance. In ISO/IEC 27002:2022, Clause 6.8 is titled:“Information security event reporting – Information security events should be reported through appropriate management channels as quickly as possible.”This control ensures breaches, incidents, or suspected issues are reported for action. The other options (B, C, D) are not the exact titles in Annex A. The official title is Information security event reporting, confirming Answer(s): A.
Identify the missing word(s) in the following sentence.When planning the ISMS, the organization is specifically required to plan actions to address risks and opportunities and how to [ ? ] these actions.
Answer(s): D
Clause 6.1.1 (Planning) states:“The organization shall plan:d) actions to address these risks and opportunities; and e) how to:integrate and implement the actions into its ISMS processes; and evaluate the effectiveness of these actions.”This confirms the missing words are “evaluate the effectiveness of”. Communication (A), applying resources (B), and improving effectiveness (C) are important concepts elsewhere but not the direct requirement stated in this clause.
Who determines the number of days required for a certification audit?
Answer(s): B
Certification audits are carried out by Certification Bodies (CBs), not the organization itself. ISO/IEC 27001 requires external certification audits to be independent, impartial, and objective. According to ISO/IEC 27006 (Requirements for bodies providing audit and certification of ISMS), the Certification Body determines the audit duration and number of audit days based on factors such as organizational size, complexity, scope, and risk environment. This ensures consistency across organizations and prevents manipulation by the auditee. ISO/IEC 27001 Clause 9.2 and 9.3 address internal audit and management review, but the determination of certification audit days is outside the organization’s control; it rests solely with the accredited Certification Body auditors. Thus, Answer(s): B is correct, as the CB’s external auditor formally calculates and assigns the audittime.
Which ISMS documentation is part of the minimum scope of documented information required to be managed and controlled?
Clause 7.5 (Documented Information) specifies that organizations must maintain documentation necessary for the effectiveness of the ISMS. Additionally, Clause 9.3 (Management Review) requires “records of decisions related to continual improvement opportunities” as an output of management review. This is a core requirement and forms part of the documented information that must be retained and controlled. Third-party materials (B), budgets (C), and cross-reference statements to other ISO standards (D) are not required by ISO/IEC 27001. Only documents that directly demonstrate compliance, decision-making, and continual improvement are mandated. Therefore, the verified minimum required documentation includes records of management review decisions related to continual improvement, confirming Answer(s): A.
To whom are the information security policies required to be communicated, according to the control in Annex A of ISO/IEC 27001?
Comprehensive and Detailed Explanation From Exact Extract ISO/IEC 27002:2022 standards:Annex A.5.1 (Policies for information security) clearly specifies:“Information security policy and topic-specific policies should be defined, approved by management, published, communicated to and acknowledged by relevant personnel and relevant interested parties…”This means the communication obligation is not limited to top management (A) or only ISMS staff (B), nor does it stop at employees only (C). Instead, ISO/IEC 27001/27002 mandate a broader scope: all relevant personnel and relevant interested parties must be informed. This ensures both internal stakeholders (employees, contractors, temporary staff) and external interested parties (suppliers, partners, regulators, customers, etc.) receive the right policy communications where applicable. Therefore, the correct and verified answer is D.
Which International Standard can be used to implement an integrated management system with ISO/IEC 27001?
ISO/IEC 27013 provides specific guidance on the integration of ISO/IEC 27001 (Information Security Management) and ISO/IEC 20000-1 (IT Service Management). It offers practical advice for organizations seeking a unified management system approach. While ISO/IEC 27003 (A) provides guidance on ISMS implementation, it does not address integration. ISO 9001 (C) is the Quality Management Standard and can be integrated, but the specific standard designed for integrating 27001 with ITSM is ISO/IEC 27013.Therefore, the correct answer is B: ISO/IEC 27013, as it is explicitly published for this purpose.
Which action must top management take to provide evidence of its commitment to the establishment, operation and improvement of the ISMS?
Clause 5.1 (Leadership and Commitment) requires top management to demonstrate leadership by:“ensuring the information security policy and the information security objectives are established and are compatible with the strategic direction of the organization;”“ensuring the integration of the ISMS requirements into the organization’s processes;”“ensuring that the resources needed for the ISMS are available;”Among the options, the one explicitly mandated is ensuring that information security objectives are established. Risk assessments (C) and implementing audit actions (D) are responsibilities of management but not the direct leadership evidence required in Clause 5.1. Communicating interested party feedback (A) is relevant but not specifically cited as leadership evidence. Thus, the verified answer is B.
Which information is required to be included in the Statement of Applicability?
Clause 6.1.3 (d) requires that the organization “produce a Statement of Applicability that contains the necessary controls (see Annex A), and justification for inclusions, whether they are implemented or not, and the justification for exclusions.”This is the defining requirement of the SoA: it documents which Annex A controls are relevant, which are implemented, and the justification for inclusion/exclusion. While the ISMS scope (A) is documented in Clause 4.3, and risk evaluation criteria (C) are defined in Clause 6.1.2, these do not belong in the SoA. The SoA does not describe the full risk assessment approach (B); that is part of the risk assessment methodology. Therefore, the mandatory requirement for the SoA is justification for including (or excluding) each information security control.
Share your comments for APMG International ISO-IEC-27001-Foundation exam with other users:
great job whoever put this together, for the greater good! thanks!
just started to view all questions for the exam
helpful material
hope for the best
will post exam has finished
really correct and good analyze!
excellent thanks a lot
will post once pass the cka exam
good content
q:32 answer has to be option c
nice questions
i really like the support team in this website. they are fast in communication and very helpful.
a good contemporary exam review
q23, its an array, isnt it? starts with [ and end with ]. its an array of objects, not object.
cool very helpfull
i just passed. this exam dumps is the same one from prepaway and examcollection. it has all the real test questions.
is this a valid prince2 practitioner dumps?
all are relatable questions
might help me to prepare for the exam
just paid and downlaod the 2 exams using the 50% sale discount. so far i was able to download the pdf and the test engine. all looks good.
i think it should be a,c. option d goes against the principle of building anything custom unless there are no work arounds available
very legible
is this exam accurate or helpful?
please upload dump, i have exam in 2 days
this is useful
question 232 answer should be perimeter not netowrk layer. wrong answer selected
hi team, could you please provide this dump ?
very helpful to clear the exam and understand the concept.
i think it is great that you are helping people when they need it. thanks.
cannot evaluate yet
a laptops wireless antenna is most likely located in the bezel of the lid
good examplae to learn basic
this is useful information
Keeping this site free takes real effort. We constantly battle automated scraping and unauthorized content copying. A quick account helps us protect the community and keep the site free.
To continue studying for your ISO-IEC-27001-Foundation, please sign in or create a free account.