Discuss PECB ISO-IEC-27002-Foundation Exam Topic 1 Question 5

What does ISO/IEC 27002 provide?

AGuidance for the implementation of information security controls

BRequirements for the implementation of information security controls

CGuidance for the management of information security risks

Suggested Answer: A

ISO/IEC 27002:2022 provides guidance for selecting, implementing, and managing information security controls. It is not the certification requirements standard; that role belongs to ISO/IEC 27001. ISO/IEC 27002 supports organizations by explaining the purpose of each control, the implementation guidance, and other related information needed to apply controls appropriately. Its controls are grouped into organizational, people, physical, and technological themes. The standard is intended to be used as a reference when organizations design security measures based on their risks, business needs, legal obligations, contractual requirements, and information security objectives. Therefore, option A is correct because ''guidance'' is the core function of ISO/IEC 27002. Option B is incorrect because ISO/IEC 27002 does not set mandatory requirements for certification. Option C is related to risk management, but it is not the main purpose of ISO/IEC 27002; risk management guidance is more directly associated with ISO/IEC 27005. ISO/IEC 27002 guides control implementation after risk and control needs are determined. Reference/Chapters: ISO/IEC 27002:2022, Clause 1 Scope; Clause 4 Structure of the standard; Controls 5--8.

Get Premium ISO-IEC-27002-Foundation Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

22 comments · newest first

Francoise 2 days ago

Agreed, A makes the most sense.

Malcolm 7 days ago

I think it's A. Guidance for implementing controls.

Malcom 12 days ago

A is definitely the best choice. Clear and practical!

Leonor 17 days ago

I feel B is misleading. It's not about requirements.

Deangelo 23 days ago

True, but A is more specific to controls.

Lemuel 28 days ago

But what about C? Management of risks is crucial too.

Gussie 1 month ago

I agree, A makes sense. It's all about guidance.

Eric 1 month ago

I think it's A. Guidance for implementation.

Reuben 1 month ago

I thought it was more about risk management, but I guess not!

Denise 2 months ago

Yup, definitely A! Helps with implementing controls.

Harris 2 months ago

Wait, are we sure it’s not B? Seems like it could be requirements too.

Bernadine 2 months ago

Totally agree, it's all about guidance!

Deandrea 2 months ago

A) Guidance for the implementation of information security controls.

Karan 2 months ago

Surprised people mix this up, it's pretty clear!

Eden 2 months ago

A) is definitely the right answer!

India 3 months ago

Wait, isn't it more about management of risks?

Hannah 3 months ago

Totally agree, it's all about guidance.

Magda 3 months ago

It provides guidance for implementing security controls!

Mitzie 3 months ago

I believe it focuses on guidance for information security controls, but I might mix it up with another standard that deals with risk management.

Karina 3 months ago

I’m a bit confused; I thought it was more about requirements rather than just guidance. I need to double-check my notes.

Ernest 4 months ago

I remember studying that ISO/IEC 27002 provides guidance, not requirements. It’s similar to that practice question we did last week.

Georgiana 5 months ago

I think ISO/IEC 27002 is about guidance for implementing controls, but I’m not completely sure if it also covers risk management.

PECB ISO-IEC-27002-Foundation Exam - Topic 1 Question 5 Discussion