Free Preparation Discussions
MENU
APMG-International ISO-IEC-27001-Foundation Exam Questions
- Topic 1: Compliance: Regulatory compliance refers to an organization’s commitment to understanding and adhering to applicable laws, policies, and regulations to operate within established legal and ethical standards.
- Topic 2: Continuous Improvement Process (CI, CIP): A continuous or continual improvement process (CIP or CI) involves ongoing, systematic efforts to enhance products, services, or operational processes to achieve higher efficiency and effectiveness over time.
- Topic 3: Self Confidence: Self-confidence is the belief in one’s abilities, competence, and value, reflecting a sense of assurance and inner strength.
- Topic 4: Cybersecurity: Cybersecurity, also known as IT security or computer security, involves safeguarding computer systems, networks, and data from unauthorized access, theft, damage, or disruption to ensure the integrity and availability of digital information.
- Topic 5: Security Breaches: Security breaches occur when unauthorized access or violations of security protocols are detected or imminent, potentially compromising data or system integrity.
- Topic 6: Data Security: Data security refers to protecting digital information—such as that stored in databases or networks—from destruction, unauthorized access, or malicious attacks, ensuring confidentiality and integrity.
- Topic 7: Framework Design: Framework design is the process of developing a reusable structural foundation that supports and guides the creation and organization of software systems.
- Topic 8: Information Management (IM): Information management (IM) encompasses the entire lifecycle of information within an organization—from its collection and storage to its distribution, use, and eventual archiving or disposal.
- Topic 9: Risk Management: Risk management is the systematic process of identifying, evaluating, and implementing strategies to reduce or control the impact of potential uncertainties on organizational goals.
Free APMG-International ISO-IEC-27001-Foundation Exam Actual Questions
Note: Premium Questions for ISO-IEC-27001-Foundation were last updated On Feb. 25, 2026 (see below)
Identify the missing words in the following sentence.
The organization shall establish, implement, maintain and [ ? ] an information security management system, including the processes needed and their interactions, in accordance with the requirements of this document.
Clause 4.4 of ISO/IEC 27001:2022 states:
''The organization shall establish, implement, maintain and continually improve an information security management system, including the processes needed and their interactions, in accordance with the requirements of this document.''
This requirement highlights that an ISMS is not static; it must evolve continuously to adapt to new risks, technologies, and business changes. Options A, C, and D are not mentioned in the clause. The continual improvement cycle is central to ISO standards, aligning with the Plan-Do-Check-Act (PDCA) model.
Thus, the missing words are ''continually improve.''
To whom are the information security policies required to be communicated, according to the control in Annex A of ISO/IEC 27001?
Comprehensive and Detailed Explanation From Exact Extract ISO/IEC 27002:2022 standards:
Annex A.5.1 (Policies for information security) clearly specifies:
''Information security policy and topic-specific policies should be defined, approved by management, published, communicated to and acknowledged by relevant personnel and relevant interested parties...''
This means the communication obligation is not limited to top management (A) or only ISMS staff (B), nor does it stop at employees only (C). Instead, ISO/IEC 27001/27002 mandate a broader scope: all relevant personnel and relevant interested parties must be informed. This ensures both internal stakeholders (employees, contractors, temporary staff) and external interested parties (suppliers, partners, regulators, customers, etc.) receive the right policy communications where applicable. Therefore, the correct and verified answer is D.
Which trend in information security performance is required to be considered during a management review of the ISMS?
Clause 9.3.2 (Management Review Inputs) states that management reviews shall include:
''c) information on the information security performance, including trends in: (1) nonconformities and corrective actions; (2) monitoring and measurement results; (3) audit results; and (4) fulfilment of information security objectives.''
This makes achievement of information security objectives (option A) a required trend to be considered. While external/internal requirements (C) and continual improvement opportunities (D) are also part of management review inputs, they are not specifically listed under ''trends in performance.'' Option B is outside the direct requirement.
Thus, the verified answer is A.
Which item is required to be included in an information security policy?
Clause 5.2 (Information security policy) requires that the policy:
''includes information security objectives (or provides a framework for setting them)''
''includes a commitment to satisfy applicable requirements related to information security''
''includes a commitment to continual improvement of the ISMS.''
Among the listed options, the exact mandatory requirement is ''a commitment to satisfy applicable requirements related to information security''. Option B partially reflects Clause 5.2 (commitment to continual improvement), but the wording given in the standard prioritizes the satisfaction of applicable requirements (e.g., legal, regulatory, contractual). Option C is not a policy requirement. Option D (Statement of Applicability) is a separate mandatory document (Clause 6.1.3) and not part of the policy itself.
Thus, the correct answer is A.
What is the definition of a threat according to ISO/IEC 27000?
Comprehensive and Detailed Explanation From Exact Extract ISO/IEC 27000 standards:
According to ISO/IEC 27000:2018, Clause 3.74, a threat is defined as:
''Potential cause of an unwanted incident, which can result in harm to a system or organization.''
This definition directly matches option A.
Option B refers to an ''information security incident'' (ISO/IEC 27000:2018, Clause 3.32).
Option C describes a ''vulnerability'' (ISO/IEC 27000:2018, Clause 3.67).
Option D refers to ''residual risk'' (ISO/IEC 27000:2018, Clause 3.61).
The standard emphasizes that threats exploit vulnerabilities, causing incidents that can harm information confidentiality, integrity, and availability. Correctly identifying threats is critical for risk assessment (Clause 6.1.2). Thus, the correct definition per ISO/IEC 27000 is A.
- Select Question Types you want
- Set your Desired Pass Percentage
- Allocate Time (Hours : Minutes)
- Create Multiple Practice tests with Limited Questions
- Customer Support
Eladia
4 days agoSheron
11 days agoLeonardo
19 days agoOdette
26 days agoMona
1 month agoHoney
1 month agoKeneth
2 months agoDick
2 months agoChrista
2 months agoRossana
2 months agoDelisa
3 months agoThad
3 months agoLucy
3 months agoGeoffrey
3 months agoCarmen
4 months agoMargart
4 months agoFausto
4 months agoTaryn
4 months agoAliza
5 months agoHaydee
5 months agoErnestine
5 months ago