Transition 27001

Review 40 TRANSITION-27001 practice questions with answer explanations and community insights.

Question 1

According to ISO/IEC 27001, organizations must establish rules to control physical and logical access to information and other related assets based on:

  1. ICT continuity requirements
  2. Business continuity objectives
  3. Business and information security requirements

Question 2

Which statement regarding the difference between ISO/IEC 27001:2013 and ISO/IEC 27001:2022 is correct?

  1. ISO/IEC 27001:2013 focuses only on information security techniques, whereas ISO/IEC 27001:2022 focuses on cybersecurity and privacy protection
  2. ISO/IEC 27001:2013 provides requirements for establishing and implementing an ISMS, whereas ISO/IEC 27001:2022 provides guidelines for implementing ISMS requirements
  3. ISO/IEC 27001:2022 has been revised based on ISO/IEC 27002:2022 but both standards have the same structure and provide requirements for establishing, implementing, and continually improving an ISMS

Question 3

ISO/IEC 27001:2013 stated that organizations must establish processes needed to ensure the required level of continuity for information security during disruptions.Which control of Annex A of ISO/IEC 27001:2022 covers the previous control?

  1. Annex A 5.26 Response to information security incidents
  2. Annex A 5.29 Information security during disruption
  3. Annex A 5.30 ICT readiness for business continuity

Question 4

ISO/IEC 27001:2013 uses the term “comprehensive list of controls”, whereas ISO/IEC 27001:2022 uses the term “list of possible information security controls.”Does this change affect the requirements of the standard?

  1. Yes, the new version of the standard allows organizations to decide which controls will be implemented as they are not mandatory anymore
  2. No, this change affects the requirements specified in Annex A of ISO/IEC 27001:2013 but not in main clauses of the standard
  3. No, this is a technical revision which does not affect the content of clauses or requirements of ISO/IEC 27001:2013

Question 5

According to ISO/IEC 27001:2022, Annex A 5.36, how often are organizations required to review policies, rules, and standards for information security?

  1. Only when the ISMS is modified
  2. On a regular basis
  3. On a yearly basis
We are moving to a new platform

CertificationTest is being migrated. Some pages may be slow or briefly unavailable; everything will be back to normal within a few hours. If you run into any issue, email support@certificationtest.net.