Information Security Flashcards
7 cards from real ISO 27000 Foundation Certification practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Information Security flashcards as text
According to ISO 27000, what is the primary purpose of an Information Security Management System (ISMS)?
Answer: To provide a systematic approach to managing sensitive information
An ISMS provides a systematic, risk-based approach to managing sensitive company information so it remains secure.
Which ISO/IEC standard specifically provides requirements for establishing and maintaining an ISMS?
Answer: ISO/IEC 27001
ISO/IEC 27001 specifies the requirements for establishing, implementing, maintaining, and continually improving an ISMS.
In information security, what does 'non-repudiation' ensure?
Answer: A party cannot deny having performed an action
Non-repudiation ensures that a party cannot deny the authenticity of their signature or the sending of a message.
What is the term for any weakness in a system that could be exploited by a threat?
Answer: Vulnerability
A vulnerability is a weakness in a system, process, or control that could be exploited by a threat source.
Which of the following best describes 'residual risk'?
Answer: Risk that remains after controls have been implemented
Residual risk is the remaining risk after risk treatment measures have been applied.
Under ISO 27001, who holds ultimate accountability for the ISMS?
Answer: Top management
ISO 27001 clause 5 (Leadership) places accountability for the ISMS on top management of the organization.
What does the 'Plan' phase of the PDCA cycle in an ISMS context involve?
Answer: Establishing security objectives and risk treatment plans
The Plan phase involves establishing ISMS objectives, risk assessment, and selecting appropriate controls and treatment plans.