Free Preparation Discussions
MENU
APMG-International ISO-IEC-27001-Foundation Exam Questions
- Topic 1: Compliance: Regulatory compliance refers to an organization’s commitment to understanding and adhering to applicable laws, policies, and regulations to operate within established legal and ethical standards.
- Topic 2: Continuous Improvement Process (CI, CIP): A continuous or continual improvement process (CIP or CI) involves ongoing, systematic efforts to enhance products, services, or operational processes to achieve higher efficiency and effectiveness over time.
- Topic 3: Self Confidence: Self-confidence is the belief in one’s abilities, competence, and value, reflecting a sense of assurance and inner strength.
- Topic 4: Cybersecurity: Cybersecurity, also known as IT security or computer security, involves safeguarding computer systems, networks, and data from unauthorized access, theft, damage, or disruption to ensure the integrity and availability of digital information.
- Topic 5: Security Breaches: Security breaches occur when unauthorized access or violations of security protocols are detected or imminent, potentially compromising data or system integrity.
- Topic 6: Data Security: Data security refers to protecting digital information—such as that stored in databases or networks—from destruction, unauthorized access, or malicious attacks, ensuring confidentiality and integrity.
- Topic 7: Framework Design: Framework design is the process of developing a reusable structural foundation that supports and guides the creation and organization of software systems.
- Topic 8: Information Management (IM): Information management (IM) encompasses the entire lifecycle of information within an organization—from its collection and storage to its distribution, use, and eventual archiving or disposal.
- Topic 9: Risk Management: Risk management is the systematic process of identifying, evaluating, and implementing strategies to reduce or control the impact of potential uncertainties on organizational goals.
Free APMG-International ISO-IEC-27001-Foundation Exam Actual Questions
Note: Premium Questions for ISO-IEC-27001-Foundation were last updated On Jun. 07, 2026 (see below)
What is required to be reported by the Information security event reporting control?
Comprehensive and Detailed Explanation From Exact Extract ISO/IEC 27002:2022 standards:
Annex A, control 6.8 (Information security event reporting) specifies:
''Information security events should be reported through appropriate management channels as quickly as possible. The organization should require all employees and contractors to note and report any observed or suspected information security events.''
This wording confirms that the required reporting covers ''observed or suspected events.'' Specific event types like information disclosure (A) or unauthorized access (B) are examples but not the broad requirement. Asset disposal (C) is addressed separately under equipment lifecycle controls (Annex A.7.14).
Therefore, the verified correct answer is D: Observed or suspected events.
Which statement describes a requirement of an internal audit programme?
Clause 9.2.2 of ISO/IEC 27001:2022 specifies requirements for the internal audit programme. It requires organizations to:
''Plan, establish, implement and maintain an audit programme(s) including the frequency, methods, responsibilities, planning requirements and reporting, which shall take into consideration the importance of the processes concerned, changes affecting the organization, and the results of previous audits.''
This makes option C correct, since importance of the processes is a required factor. Option A is incorrect because audits do not need third-party auditors; objectivity can be maintained internally if independence is respected. Option B is wrong because previous audit results must be considered, not disregarded. Option D is also incorrect --- the standard does not specify a 3-year cycle; frequency depends on risks and needs.
Thus, the correct verified answer is C.
What is the name of the control clause used to control information security breaches within Annex A of ISO/IEC 27001?
Comprehensive and Detailed Explanation From Exact Extract ISO/IEC 27002:2022 standards:
Annex A in ISO/IEC 27001 refers directly to ISO/IEC 27002 for control guidance. In ISO/IEC 27002:2022, Clause 6.8 is titled:
''Information security event reporting -- Information security events should be reported through appropriate management channels as quickly as possible.''
This control ensures breaches, incidents, or suspected issues are reported for action. The other options (B, C, D) are not the exact titles in Annex A. The official title is Information security event reporting, confirming Answer: A.
Which statement describes a requirement of an internal audit programme?
Clause 9.2.2 of ISO/IEC 27001:2022 specifies requirements for the internal audit programme. It requires organizations to:
''Plan, establish, implement and maintain an audit programme(s) including the frequency, methods, responsibilities, planning requirements and reporting, which shall take into consideration the importance of the processes concerned, changes affecting the organization, and the results of previous audits.''
This makes option C correct, since importance of the processes is a required factor. Option A is incorrect because audits do not need third-party auditors; objectivity can be maintained internally if independence is respected. Option B is wrong because previous audit results must be considered, not disregarded. Option D is also incorrect --- the standard does not specify a 3-year cycle; frequency depends on risks and needs.
Thus, the correct verified answer is C.
What is required to be reported by the Information security event reporting control?
Comprehensive and Detailed Explanation From Exact Extract ISO/IEC 27002:2022 standards:
Annex A, control 6.8 (Information security event reporting) specifies:
''Information security events should be reported through appropriate management channels as quickly as possible. The organization should require all employees and contractors to note and report any observed or suspected information security events.''
This wording confirms that the required reporting covers ''observed or suspected events.'' Specific event types like information disclosure (A) or unauthorized access (B) are examples but not the broad requirement. Asset disposal (C) is addressed separately under equipment lifecycle controls (Annex A.7.14).
Therefore, the verified correct answer is D: Observed or suspected events.
- Select Question Types you want
- Set your Desired Pass Percentage
- Allocate Time (Hours : Minutes)
- Create Multiple Practice tests with Limited Questions
- Customer Support
Patricia Miller
2 days agoMonica Clark
8 days agoDaniel Sanchez
1 month agoJennifer Peterson
1 month agoDonna Hall
1 month agoMonica Hall
1 month agoLaura Smith
28 days agoStephanie Ramirez
24 days agoRuthann
2 months agoBrunilda
2 months agoDorothy
3 months agoGilma
3 months agoCyndy
3 months agoEladia
3 months agoSheron
4 months agoLeonardo
4 months agoOdette
4 months agoMona
4 months agoHoney
5 months agoKeneth
5 months agoDick
5 months agoChrista
5 months agoRossana
6 months agoDelisa
6 months agoThad
6 months agoLucy
6 months agoGeoffrey
7 months agoCarmen
7 months agoMargart
7 months agoFausto
7 months agoTaryn
8 months agoAliza
8 months agoHaydee
8 months agoErnestine
8 months ago