ISO/IEC 27001 Foundation

Ten sample exam questions

One per competency domain, exactly as they appear in the simulator.

1. D1 Fundamental principles and concepts of an ISMS

   What is the relationship between ISO/IEC 27001 and ISO/IEC 27002?

   1. ISO/IEC 27002 replaces ISO/IEC 27001 for organizations that, once certified, have reached a sufficient level of maturity
   2. ISO/IEC 27001 contains the certifiable requirements, while ISO/IEC 27002 provides guidance on the implementation of controls
   3. ISO/IEC 27002 contains the auditable requirements, and ISO/IEC 27001 merely gathers the common vocabulary of the family
   4. Both standards contain certifiable requirements, and an organization has to declare conformity with both at once

2. D2 Information security management system (ISMS)

   An organization sets "improve the security of the systems" as its information security objective, with no further detail, and assigns neither an owner nor a deadline. Which requirement of ISO/IEC 27001 is this organization failing to meet?

   1. No requirement is breached here: the wording of information security objectives and their follow-up over time are left to the discretion of each organization, whatever its size
   2. The one in clause 5.2, because the objectives, their indicators, their resources, their owners and their deadlines have to appear, in detail, within the text of the information security policy itself
   3. The requirement of clause 9.1, which makes the establishment of objectives conditional on a prior measurement and evaluation of the information security performance of the previous year
   4. The one in clause 6.2, which requires measurable objectives consistent with the policy, with resources, an owner and a deadline

3. D1 Fundamental principles and concepts of an ISMS

   How does a management system based on ISO/IEC 27001 help an organization to meet its legal obligations?

   1. By replacing the applicable legislation with the requirements of the standard, which are treated as equivalent for the purposes of legal compliance
   2. By transferring responsibility for legal compliance, in its entirety, to the body that issues the certificate, which would then answer to the authorities, the customers and the third parties concerned
   3. By exempting the organization from its sector obligations, in the areas covered by the audit, for as long as the certificate remains valid
   4. By requiring the applicable legal and contractual requirements to be identified and the approach adopted for meeting them to be defined, with follow-up

4. D2 Information security management system (ISMS)

   The management committee of a company records in its context analysis the evolution of the sector, the regulatory changes and the arrival of new competitors, but leaves out its own organizational structure, its resources and its culture. What should be made of that analysis?

   1. It is correct, because clause 4.1 covers the issues that lie beyond the control of the organization, such as the market or the regulatory environment
   2. It is correct, because internal issues are dealt with later on, when the requirements of the interested parties are determined
   3. It is incomplete, because clause 4.1 requires the external issues but also the internal issues to be determined
   4. It is incomplete for an organization that intends to be certified by a third party, whereas an analysis of the external environment suffices in other cases

5. D1 Fundamental principles and concepts of an ISMS

   According to the definition common to management system standards, what is a management system?

   1. A set of interrelated or interacting elements of an organization, used to establish policies and objectives, and processes to achieve those objectives
   2. The set of software applications, including document management applications, with which an organization administers its records and automates its workflows and its approval routes
   3. The organization chart, together with the description of the jobs and the reporting lines of each department
   4. The set of documents approved by top management, in which the work instructions that the personnel have to follow are recorded

6. D2 Information security management system (ISMS)

   While a management system is being set up, the security manager draws up the list of interested parties and includes only the customers. What else has to be taken into account according to ISO/IEC 27001?

   1. Nothing, as long as the customers have formalized their security requirements in the signed contracts and their annexes
   2. The other relevant interested parties, together with their applicable requirements
   3. The suppliers with access to the systems, whether direct or through subcontractors; the risk analysis already covers the other interested parties
   4. The competent authorities and their legal requirements, leaving the other interested parties as a matter of voluntary inclusion

7. D1 Fundamental principles and concepts of an ISMS

   How is the ISO/IEC 27001:2022 standard structured?

   1. In ten clauses of requirements, all of them auditable, followed by three informative annexes containing implementation examples and checklists
   2. In four introductory clauses and six chapters of technical controls, with no requirement relating to the management system
   3. In clauses 1 to 3 of an introductory nature, clauses 4 to 10 containing the requirements of the management system, and an Annex A with the reference controls
   4. In one part of requirements and one part of guidance, both of them mandatory in order to obtain certification and then to keep the certificate at the surveillance audits

8. D2 Information security management system (ISMS)

   During an audit it is found that top management approved the information security policy but has not allocated resources, has not communicated the importance of the system and does not take part in the management review. What conclusion follows?

   1. There is a nonconformity with clause 5.1, because leadership and commitment require a set of actions that go well beyond approving the policy
   2. There is no nonconformity, because approving the policy is the only action that the standard requires of top management
   3. There is a nonconformity with clause 7.5, because the problem is that the policy is not properly documented and distributed
   4. There is no nonconformity, as long as there is an information security manager with authority expressly delegated in writing by top management

9. D1 Fundamental principles and concepts of an ISMS

   Within the ISO/IEC 27000 family of standards, which standard brings together the terms and definitions as well as the overview of the series?

   1. ISO/IEC 27003, which develops the guidance for setting up the management system, together with the terms and definitions specific to that guidance within the family of standards
   2. ISO/IEC 27005, the guidance standard for information security risk management within the family
   3. ISO/IEC 27000, which provides the overview of the family and the vocabulary common to all its standards
   4. ISO/IEC 27004, which deals with monitoring, measurement, analysis and evaluation

10. D2 Information security management system (ISMS)

    An organization has a general information security policy and wants to complete its internal body of policies. Which policy structure matches the practice reflected in ISO/IEC 27001?

    1. A high-level general policy, supported by high-level specific policies and by topic-specific policies that develop concrete subjects
    2. A single general policy covering the internal body of documents: multiplying normative documents harms their understanding, their distribution and their effective control by the personnel
    3. One policy for each Annex A control declared applicable, so that the body of policies mirrors the Statement of Applicability
    4. One policy per department, drafted and approved autonomously by the manager of each area

Answer these same ten questions in the simulator and see the explanation of every option, including the wrong ones. It opens with no sign-up →

About the official exam: its format, duration and number of questions are set by the certification body and may change, so confirm them in its documentation before you sit it. This material trains the standard, not one body's exam, so it is just as useful if you certify elsewhere.