Information Security Flashcards
7 cards from real ISO 27000 Foundation Certification practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Information Security flashcards as text
How is a "asset" defined in ISO/IEC 27000?
Answer: Anything that is of value to the organization
In ISO/IEC 27000, an 'asset' is broadly defined as anything that has value to the organization and therefore needs to be protected. This comprehensive definition includes not only tangible items like hardware and buildings but also intangible assets such as information, software, intellectual property, reputation, and even people. The goal is to identify and protect all elements crucial to the organization's operations and success.
Which of the following, as described in Annex A, are ISO 27001 control sets?
Answer: All of the above
Annex A of ISO 27001 provides a comprehensive list of information security controls that organizations can implement as part of their Information Security Management System (ISMS). This annex covers various domains, including Information security policies, Asset management, Access control, and many others. Therefore, all the options listed are indeed categories of controls found within Annex A.
What exactly does PDCA mean?
Answer: Plan, Do, Check, Act
PDCA stands for Plan, Do, Check, Act. It is a widely recognized iterative four-step management method used for the control and continuous improvement of processes and products. This cycle helps organizations systematically identify problems, implement solutions, monitor their effectiveness, and then standardize or adjust processes for ongoing improvement, forming a core principle in quality management.
Which of the following now poses a threat to several organizations?
Answer: All of the above
Information security threats are diverse and constantly evolving, impacting organizations in various ways. Fraud, unauthorized access, and loss of information are all significant and common risks that can compromise the confidentiality, integrity, and availability of an organization's assets. Therefore, all these options represent valid threats that organizations must address through robust information security measures.
All of the above
Answer: Provides terms and definitions commonly used in ISO/IEC 27001
ISO/IEC 27000 serves as the foundational standard within the ISO 27000 family. Its primary purpose is to provide an overview of the information security management system (ISMS) standards and, crucially, to define the terms and definitions commonly used across these standards, including ISO/IEC 27001. This ensures a consistent understanding and application of terminology for anyone working with information security management systems.
Which clause of ISO/IEC 27001 deals with operational planning and control?
Answer: 8.1
Clause 8 of ISO/IEC 27001 is dedicated to 'Operation.' Specifically, Clause 8.1, titled 'Operational planning and control,' requires organizations to plan, implement, and control the processes necessary to meet information security requirements. This clause ensures that information security considerations are integrated into the day-to-day operations and processes of the organization.
Which clause of ISO/IEC 27001 deals with remedial action?
Answer: 10.1
Clause 10 of ISO/IEC 27001 focuses on 'Improvement.' Within this clause, 10.1 addresses 'Nonconformity and corrective action,' which directly deals with remedial actions. It mandates that organizations identify nonconformities, take action to control and correct them, and manage their consequences, ensuring continuous improvement of the ISMS.