PECB Certified ISO/IEC 27001 Lead Implementer Practice Test

PECB Certified ISO/IEC 27001 Lead Implementer Practice Test practice questions, page 5 of 12, with answer review and explanations.

Question 21

An organization documented each security control that it implemented by describing their functions in detail. Is this compliant with ISO/IEC 27001?

  1. No, the standard requires to document only the operation of processes and controls, so no description of each security control is needed
  2. No, because the documented information should have a strict format, including the date, version number and author identification
  3. Yes, but documenting each security control and not the process in general will make it difficult to review the documented information

Question 22

Which security controls must be implemented to comply with ISO/IEC 27001?

  1. Those designed by the organization only
  2. Those included in the risk treatment plan
  3. Those listed in Annex A of ISO/IEC 27001, without any exception

Question 23

What is the main purpose of Annex A 7.1 Physical security perimeters of ISO/IEC 27001?

  1. To prevent unauthorized physical access, damage, and interference to the organization’s information and other associated assets
  2. To maintain the confidentiality of information that is accessible by personnel or external parties
  3. To ensure access to information and other associated assets is defined and authorized

Question 24

An organization wants to enable the correlation and analysis of security-related events and other recorded data and to support investigations into information security incidents. Which control should it implement?

  1. Use of privileged utility programs
  2. Clock synchronization
  3. Installation of software on operational systems

Question 25

The incident management process of an organization enables them to prepare for and respond to information security incidents. In addition, the organization has procedures in place for assessing information security events. According to ISO/IEC 27001, what else must an incident management process include?

  1. Processes for using knowledge gained from information security incidents
  2. Establishment of two information security incident response teams
  3. Processes for handling information security incidents of suppliers as defined in their agreements