Important APMG-International ISO-IEC-27001-Foundation Exam Questions

Answer: B

Explanation:

Clause 6.1.2 (d) states that during risk analysis, the organization shall:

''assess the potential consequences that would result if the risks identified... were to materialize;''

''assess the realistic likelihood of the occurrence of the risks identified;''

''determine the levels of risk.''

This makes it clear that the required output of risk analysis is the determined levels of risk. Risk acceptance criteria (A) are set earlier in 6.1.2(a), treatment control options (C) belong to 6.1.3, and prioritization (D) is part of risk evaluation (6.1.2 e). Therefore, the verified correct output is B: Determined levels of risk.

Answer: B

Explanation:

Clause 4.4 of ISO/IEC 27001:2022 states:

''The organization shall establish, implement, maintain and continually improve an information security management system, including the processes needed and their interactions, in accordance with the requirements of this document.''

This requirement highlights that an ISMS is not static; it must evolve continuously to adapt to new risks, technologies, and business changes. Options A, C, and D are not mentioned in the clause. The continual improvement cycle is central to ISO standards, aligning with the Plan-Do-Check-Act (PDCA) model.

Thus, the missing words are ''continually improve.''

Answer: B

Explanation:

Comprehensive and Detailed Explanation From Exact Extract ISO/IEC 27002:2022 standards:

Annex A.5.12 (Classification of information) states:

''Information should be classified according to the information security needs of the organization based on confidentiality, integrity and availability.''

This aligns directly with option B. Option A (labelling) is a separate control (Annex A.5.13). Option C (security perimeters) is under physical controls (Annex A.7.1). Option D (access control rules) relates to Annex A.5.15 and A.8.2.

Thus, the verified correct statement for the Classification of information control is B.

Answer: A

Explanation:

Comprehensive and Detailed Explanation From Exact Extract ISO/IEC 27000 standards:

According to ISO/IEC 27000:2018, Clause 3.74, a threat is defined as:

''Potential cause of an unwanted incident, which can result in harm to a system or organization.''

This definition directly matches option A.

Option B refers to an ''information security incident'' (ISO/IEC 27000:2018, Clause 3.32).

Option C describes a ''vulnerability'' (ISO/IEC 27000:2018, Clause 3.67).

Option D refers to ''residual risk'' (ISO/IEC 27000:2018, Clause 3.61).

The standard emphasizes that threats exploit vulnerabilities, causing incidents that can harm information confidentiality, integrity, and availability. Correctly identifying threats is critical for risk assessment (Clause 6.1.2). Thus, the correct definition per ISO/IEC 27000 is A.

Answer: A

Explanation:

Clause 7.5 (Documented Information) specifies that organizations must maintain documentation necessary for the effectiveness of the ISMS. Additionally, Clause 9.3 (Management Review) requires ''records of decisions related to continual improvement opportunities'' as an output of management review. This is a core requirement and forms part of the documented information that must be retained and controlled. Third-party materials (B), budgets (C), and cross-reference statements to other ISO standards (D) are not required by ISO/IEC 27001. Only documents that directly demonstrate compliance, decision-making, and continual improvement are mandated. Therefore, the verified minimum required documentation includes records of management review decisions related to continual improvement, confirming Answer: A.