ISO/IEC 27001 Lead Implementer

Ten sample exam questions

One per competency domain, exactly as they appear in the simulator.

1. D1 Fundamental principles and concepts of an ISMS

   The ISMS team of an insurance broker already uses ISO/IEC 27000 as its reference for the terms used in ISO/IEC 27001, as clause 3 of ISO/IEC 27001 directs. The team now needs detailed guidance, going beyond the requirements of clause 6.1.2, on setting risk criteria, identifying risk owners, and analysing and evaluating risks. Which document should it consult?

   1. ISO/IEC 27000, the reference for the terms risk criteria, risk owner and risk evaluation in clause 6.1.2
   2. ISO/IEC 27003, which gives detailed guidance beyond clause 6.1.2 on risk criteria, risk owners and evaluating risks
   3. ISO/IEC 27005, which gives guidance on information security risk management
   4. ISO/IEC 27002, which gives the reference set of controls with guidance on implementing each of them

2. D3 Planning of an ISMS implementation

   In a risk workshop for its payroll process, a retailer's team has listed risk sources, potential events, their causes and their possible consequences. No likelihood or consequence value has been assigned yet, and the risk criteria were approved last month. The facilitator is now planning the team's next session. What should the team do in it?

   1. Assign likelihood and consequence values to each listed risk, so that a level can be set for each of them
   2. Compare each listed risk with the approved criteria, and rank the ones that exceed the acceptance threshold
   3. Select treatment options for the payroll risks whose listed consequences look the most severe to the team
   4. Review the approved criteria against the listed risks, and revise them where consequences look larger than expected

3. D4 Implementation of an ISMS

   At a parcel delivery firm, every request for access to the customer database is logged in the ticket system with the approver, the date and the grounds. Yet a review shows that half of the requesters sent their requests by email to the wrong manager, because the procedure for requesting access was written but never published: it sits in the personal folder of the head of security. Which purpose of documented information did the firm fail to achieve?

   1. Keeping the ISMS stable when people in key roles change, by recording the decisions taken and their outcomes
   2. Defining the direction set by top management, by stating its intentions on access to customer information
   3. Communicating the expected behaviour, by making known to the people concerned the rules they must follow
   4. Controlling documents of external origin, by keeping supplier guidance for the customer database up to date

4. D5 Monitoring and measurement of an ISMS

   The internal audit of a recruitment agency's ISMS has found four nonconformities in the handling of candidate files. The report has already been presented to the head of candidate services. She owns the process, receives its audit results, has accepted all four findings and has the budget and staff to act on them. To save time, she asks the lead internal auditor, who knows the process well, to carry out the fixes before the next audit of the same process. What should the head of candidate services do instead?

   1. Let the lead internal auditor fix them, since she knows the process and her next audit can then confirm the fixes
   2. Send them to the certification body, which decides on the actions and follows them up at the next surveillance audit
   3. Report them to relevant management, which decides on the actions, assigns the resources and sets the deadlines
   4. Assign them to her own process team, which corrects them and analyses their causes

5. D6 Continual improvement of an ISMS

   A payroll services firm runs an 8D analysis after a faulty retention script deleted three weeks of audit log records. The team has been formed, the problem has been described in measurable terms, and the script was disabled on the first day, with no deletions since. Test runs have confirmed that the script was changed without peer review. The daily log volume report showed the drop from the first night, but nobody can yet explain why the deletions went unnoticed for three weeks. The team leader wants to move on. What should the team do next?

   1. Stay in D4: run further tests to confirm that the unreviewed change to the script caused the deletions
   2. Stay in D4: analyse why the daily log volume report did not lead anyone to notice the deletions
   3. Move to D5: choose the permanent corrective action for the script change that the test runs confirmed
   4. Return to D3: check that the interim containment still holds while the remaining causes are analysed

6. D2 ISMS requirements

   Case study 2 - Mirecourt Dental Group (5 questions) Mirecourt Dental Group runs 14 dental clinics in eastern France, with about 320 staff and a central office in Nancy that hosts the shared patient records and imaging system. The managing director, Dr Claire Vasseur, has approved an ISO/IEC 27001 project, and the project manager, Julien Roche, is carrying out the gap analysis with a consultant, Sophie Marchal. Last week Julien held a single group interview with the 14 clinic managers; the regional operations director attended, answered most questions herself, and every manager then agreed with her. Sophie's first findings are as follows. The imaging workstations in the treatment rooms sit on the same flat network as the reception PCs used to browse the internet. Twenty old imaging workstations will be donated to a dental school in June. The new online booking portal stores a card deposit for each appointment, and the payment provider's contract requires stored card data to be unreadable without the keys and the keys to be protected throughout their life cycle. The personnel policy prohibits remote working, and the patient system is described as reachable only from inside the clinics. Julien must present the gap analysis report to Dr Vasseur in six weeks. Question 2 of 5: Which category of security service would most directly address Sophie's finding on the imaging workstations and the reception PCs?

   1. Integrity services, which check the imaging files for corruption and correct it when it is detected
   2. Boundary control services, which isolate the imaging zone from the reception zone at controlled entry points
   3. Audit and monitoring services, which collect and analyse the events logged by the reception PCs and workstations
   4. Access control services, which give every clinic user one identity and shared authentication across the group

7. D7 Preparing for an ISMS certification audit

   Stage 1 of a food producer's certification audit closed last week, and the two areas of concern it raised about the risk treatment plan have been resolved. Stage 2 starts in three weeks. The CEO asks the implementer where the ISMS team should put its effort until then. What should the implementer advise?

   1. Revise the risk treatment plan to record how the two areas of concern were resolved, and have top management approve the new version
   2. Hold the management review again within the three weeks, since stage 2 requires a review held after stage 1
   3. Ask the certification body to move stage 2 back until the ISMS has completed a full year of operation
   4. Make the records of ISMS operation retrievable, including the internal audit and management review results

8. D1 Fundamental principles and concepts of an ISMS

   A health insurer encrypts its medical claim files before copying them to a private cloud. To make restores easier, the decryption key is kept in a text file inside the same cloud folder as the encrypted files. Which security property does the encryption mainly support, and which property does the way the decryption key is kept mainly put at risk?

   1. Encryption supports confidentiality, and the way the decryption key is kept puts availability at risk
   2. Encryption supports integrity, and the way the decryption key is kept puts confidentiality at risk
   3. Encryption supports availability, and the way the decryption key is kept puts integrity at risk
   4. Encryption supports confidentiality, and the way the decryption key is kept puts confidentiality at risk

9. D3 Planning of an ISMS implementation

   Case study 1 - Halvorsen Freight (5 questions) Halvorsen Freight is a logistics operator with 900 staff working from three depots in Bergen, Oslo and Trondheim and a small head office in Oslo. The company holds ISO 9001 and ISO 14001 certificates, each run by its own coordinator with a separate document set and a separate internal audit schedule. In March, the CEO, Ingrid Halvorsen, asked the IT manager, Tomas Berg, to prepare an ISO/IEC 27001 project after two large retail customers made certification a condition for renewing their contracts in eighteen months. Tomas plans to start with a gap analysis that compares current practices with the 93 controls of Annex A only. An external consultant, Rune Solberg, has told the steering committee that every recommendation of ISO/IEC 27002 will have to be applied word for word. Tomas has drafted a list of resources covering people, ICT systems, facilities, information, transportation and budget. He left out the subcontracted hauliers, who move about 40% of the freight and connect to Halvorsen's tracking platform. The CFO, Mette Dahl, has refused to release any budget until she receives a business case for the project. Question 1 of 5: Mette Dahl asks what the business case must contain before she releases any budget. Which content should Tomas give priority to?

   1. The scope of the project, the milestones over the eighteen months, and the roles of the members of the project team
   2. The benefits expected over a set period, the cost of the chosen solution against the alternatives, and its main risks
   3. The results of the gap analysis, the controls to be implemented at each depot, and the timetable for the certification audit
   4. The internal audit programme, the agenda of the first management review, and the quotation obtained from the certification body

10. D4 Implementation of an ISMS

    The risk treatment plan approved by the risk owners of a regional bank lists thirty controls to be deployed over eighteen months by a security team of three people. By month five, the team has deployed the controls for the highest risks that did not depend on a new identity management platform. The supplier now announces that the platform will arrive in month twelve instead of month six. What should the implementer do?

    1. Continue with the lower-risk controls that do not depend on the platform, and show the new date in the monthly status report
    2. Report the delay to the risk owners, who decide what happens to the high risks that now wait six months longer for treatment
    3. Put interim measures in place for the high risks waiting for the platform, and update the plan dates at the next review
    4. Ask the supplier for a partial early release of the platform, and move the dependent controls to month twelve in the plan

Answer these same ten questions in the simulator and see the explanation of every option, including the wrong ones. It opens with no sign-up →

About the official exam: its format, duration and number of questions are set by the certification body and may change, so confirm them in its documentation before you sit it. This material trains the standard, not one body's exam, so it is just as useful if you certify elsewhere.