What is the name of the control clause used to control information security breaches within Annex A of ISO/IEC 27001?
Answer(s): A
Comprehensive and Detailed Explanation From Exact Extract ISO/IEC 27002:2022 standards:Annex A in ISO/IEC 27001 refers directly to ISO/IEC 27002 for control guidance. In ISO/IEC 27002:2022, Clause 6.8 is titled:“Information security event reporting – Information security events should be reported through appropriate management channels as quickly as possible.”This control ensures breaches, incidents, or suspected issues are reported for action. The other options (B, C, D) are not the exact titles in Annex A. The official title is Information security event reporting, confirming Answer(s): A.
Identify the missing word(s) in the following sentence.When planning the ISMS, the organization is specifically required to plan actions to address risks and opportunities and how to [ ? ] these actions.
Answer(s): D
Clause 6.1.1 (Planning) states:“The organization shall plan:d) actions to address these risks and opportunities; and e) how to:integrate and implement the actions into its ISMS processes; and evaluate the effectiveness of these actions.”This confirms the missing words are “evaluate the effectiveness of”. Communication (A), applying resources (B), and improving effectiveness (C) are important concepts elsewhere but not the direct requirement stated in this clause.
Who determines the number of days required for a certification audit?
Answer(s): B
Certification audits are carried out by Certification Bodies (CBs), not the organization itself. ISO/IEC 27001 requires external certification audits to be independent, impartial, and objective. According to ISO/IEC 27006 (Requirements for bodies providing audit and certification of ISMS), the Certification Body determines the audit duration and number of audit days based on factors such as organizational size, complexity, scope, and risk environment. This ensures consistency across organizations and prevents manipulation by the auditee. ISO/IEC 27001 Clause 9.2 and 9.3 address internal audit and management review, but the determination of certification audit days is outside the organization’s control; it rests solely with the accredited Certification Body auditors. Thus, Answer(s): B is correct, as the CB’s external auditor formally calculates and assigns the audittime.
Which ISMS documentation is part of the minimum scope of documented information required to be managed and controlled?
Clause 7.5 (Documented Information) specifies that organizations must maintain documentation necessary for the effectiveness of the ISMS. Additionally, Clause 9.3 (Management Review) requires “records of decisions related to continual improvement opportunities” as an output of management review. This is a core requirement and forms part of the documented information that must be retained and controlled. Third-party materials (B), budgets (C), and cross-reference statements to other ISO standards (D) are not required by ISO/IEC 27001. Only documents that directly demonstrate compliance, decision-making, and continual improvement are mandated. Therefore, the verified minimum required documentation includes records of management review decisions related to continual improvement, confirming Answer(s): A.
To whom are the information security policies required to be communicated, according to the control in Annex A of ISO/IEC 27001?
Comprehensive and Detailed Explanation From Exact Extract ISO/IEC 27002:2022 standards:Annex A.5.1 (Policies for information security) clearly specifies:“Information security policy and topic-specific policies should be defined, approved by management, published, communicated to and acknowledged by relevant personnel and relevant interested parties…”This means the communication obligation is not limited to top management (A) or only ISMS staff (B), nor does it stop at employees only (C). Instead, ISO/IEC 27001/27002 mandate a broader scope: all relevant personnel and relevant interested parties must be informed. This ensures both internal stakeholders (employees, contractors, temporary staff) and external interested parties (suppliers, partners, regulators, customers, etc.) receive the right policy communications where applicable. Therefore, the correct and verified answer is D.
Which International Standard can be used to implement an integrated management system with ISO/IEC 27001?
ISO/IEC 27013 provides specific guidance on the integration of ISO/IEC 27001 (Information Security Management) and ISO/IEC 20000-1 (IT Service Management). It offers practical advice for organizations seeking a unified management system approach. While ISO/IEC 27003 (A) provides guidance on ISMS implementation, it does not address integration. ISO 9001 (C) is the Quality Management Standard and can be integrated, but the specific standard designed for integrating 27001 with ITSM is ISO/IEC 27013.Therefore, the correct answer is B: ISO/IEC 27013, as it is explicitly published for this purpose.
Which action must top management take to provide evidence of its commitment to the establishment, operation and improvement of the ISMS?
Clause 5.1 (Leadership and Commitment) requires top management to demonstrate leadership by:“ensuring the information security policy and the information security objectives are established and are compatible with the strategic direction of the organization;”“ensuring the integration of the ISMS requirements into the organization’s processes;”“ensuring that the resources needed for the ISMS are available;”Among the options, the one explicitly mandated is ensuring that information security objectives are established. Risk assessments (C) and implementing audit actions (D) are responsibilities of management but not the direct leadership evidence required in Clause 5.1. Communicating interested party feedback (A) is relevant but not specifically cited as leadership evidence. Thus, the verified answer is B.
Which information is required to be included in the Statement of Applicability?
Clause 6.1.3 (d) requires that the organization “produce a Statement of Applicability that contains the necessary controls (see Annex A), and justification for inclusions, whether they are implemented or not, and the justification for exclusions.”This is the defining requirement of the SoA: it documents which Annex A controls are relevant, which are implemented, and the justification for inclusion/exclusion. While the ISMS scope (A) is documented in Clause 4.3, and risk evaluation criteria (C) are defined in Clause 6.1.2, these do not belong in the SoA. The SoA does not describe the full risk assessment approach (B); that is part of the risk assessment methodology. Therefore, the mandatory requirement for the SoA is justification for including (or excluding) each information security control.
Share your comments for APMG International ISO-IEC-27001-Foundation exam with other users:
i gave the amazon dva-c02 tests today and passed. very helpful.
there is an incorrect word in the problem statement. for example, in question 1, there is the word "speci c". this is "specific. in the other question, there is the word "noti cation". this is "notification. these mistakes make this site difficult for me to use.
passed my az-120 certification exam today with 90% marks. studied using the dumps highly recommended to all.
i need it, plz make it available
q47: intrusion prevention system is the correct answer, not patch management. by definition, there are no patches available for a zero-day vulnerability. the way to prevent an attacker from exploiting a zero-day vulnerability is to use an ips.
this is simple but tiugh as well
questão 4, segundo meu compilador local e o site https://www.jdoodle.com/online-java-compiler/, a resposta correta é "c" !
its very useful
i mastered my skills and aced the comptia 220-1102 exam with a score of 920/1000. i give the credit to for my success.
real questions
very helpful assessments
hi there, i would like to get dumps for this exam
i studied for the microsoft azure az-204 exam through it has 100% real questions available for practice along with various mock tests. i scored 900/1000.
please upload 1z0-1072-23 exam dups
i was hoping if you could please share the pdf as i’m currently preparing to give the exam.
i am looking for oracle 1z0-116 exam
where we can get the answer to the questions
nice questions
question 129 is completely wrong.
i need dump
love the site.
can you please upload it back?
could you please re-upload this exam? thanks a lot!
great about shared quiz
goood helping
pay attention to questions. they are very tricky. i waould say about 80 to 85% of the questions are in this exam dump.
wish you would allow more free questions
great simulation
very g inood
q35 should be a
sap c_ts450_2021
ecellent materil for unserstanding
good so far
Keeping this site free takes real effort. We constantly battle automated scraping and unauthorized content copying. A quick account helps us protect the community and keep the site free.
To continue studying for your ISO-IEC-27001-Foundation, please sign in or create a free account.