Discuss CertiProf I27001F Exam Topic 2 Question 10

Which statement describes the difference between ISO/IEC 27001:2022 and ISO/IEC 27002:2022?

AISO/IEC 27002:2022 provides guidance on measurement, and ISO/IEC 27001:2022 provides guidance on information security controls

BISO/IEC 27002:2022 provides mandatory requirements for a risk management approach, and ISO/IEC 27001:2022 contains mandatory requirements for an ISMS

CISO/IEC 27001:2022 contains mandatory requirements, while ISO/IEC 27002:2022 provides guidance on information security controls

DISO/IEC 27002:2022 contains mandatory requirements, while ISO/IEC 27001:2022 provides guidance on information security controls

Suggested Answer: C

ISO/IEC 27001:2022 is the certifiable standard that contains requirements for establishing, implementing, maintaining, and continually improving an Information Security Management System. ISO/IEC 27002:2022 is not a certifiable requirements standard. It provides guidance for selecting, implementing, and managing information security controls, including the controls referenced in Annex A of ISO/IEC 27001:2022. Therefore, option C is correct.

=======

Get Premium I27001F Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

17 comments · newest first

Lilli 1 month ago

I like C too. It’s straightforward.

Georgeanna 1 month ago

C is definitely the right choice.

Verlene 2 months ago

No way, A is misleading. C is clearer.

Maurine 2 months ago

I lean towards A. Measurement is key in 27002.

Reid 2 months ago

C makes sense. 27001 is the framework.

Dick 2 months ago

I feel confused about the differences.

Tracie 2 months ago

Agreed! 27002 is more about guidance.

Ruthann 2 months ago

I think C is correct. 27001 has mandatory requirements.

Truman 3 months ago

Just to clarify, 27002 is more about guidance, right?

Lashawn 3 months ago

A is misleading, 27001 is definitely about ISMS.

Ria 3 months ago

Wait, are we sure about that? I thought 27002 had more requirements.

Carlton 3 months ago

Totally agree with C, makes sense!

Jennie 3 months ago

C is correct! 27001 has the mandatory stuff.

Daniela 3 months ago

I’m confused about the specifics, but I remember something about 27002 providing guidance. I just can’t recall if it’s mandatory or not. Maybe A or C?

Carin 4 months ago

I practiced a question similar to this, and I think it was clear that 27001 is the one with the mandatory requirements. So, I’m leaning towards C as well.

Loise 4 months ago

I'm not entirely sure, but I feel like 27002 is more about controls and best practices, not mandatory requirements. Could it be A?

Evangelina 4 months ago

I think I remember that ISO/IEC 27001:2022 has the mandatory requirements for an ISMS, while 27002:2022 is more about guidance. So, maybe C?

CertiProf I27001F Exam - Topic 2 Question 10 Discussion