Free EXIN Information Security Essentials based on ISO/IEC 27001 Practice Questions

Sample Practice Questions

Try these 10 sample questions from the EXIN Information Security Essentials based on ISO/IEC 27001 practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1What is the purpose of an information security management system based on ISO/IEC 27001?

   1. A.To manage risks to information through an organized management systemCorrect answer: A
   2. B.To manage information security through technical safeguards alone
   3. C.To protect information by addressing confidentiality alone
   4. D.To replace security risk management with certification alone

   Explanation: ISO states that an ISMS is "a system to manage risks related to the security of data owned or handled by the company". It therefore addresses information security risks systematically; it does not eliminate all risk or restrict the scope to confidentiality.

   Reference: ISO/IEC 27001:2022 - Information security management systems — What is ISO/IEC 27001?

2. 2Which two factors does NIST typically associate with information security risk?

   1. A.Impact and likelihood of an eventCorrect answer: A
   2. B.Impact and cost of the security policy
   3. C.Likelihood and number of authorized users
   4. D.Likelihood and cost of the information system

   Explanation: NIST describes risk as typically a function of "the adverse impacts that would arise if the circumstance or event occurs" and "the likelihood of occurrence." Both the possible harm and chance of the event matter.

   Reference: NIST SP 800-12 Revision 1: An Introduction to Information Security — Section 6, Information Security Risk Management, p. 34

3. 3In the FIPS 199 approach, what guides the security categorization of an information type?

   1. A.Potential impact from a loss of each security objectiveCorrect answer: A
   2. B.Replacement cost without assessing potential mission impact
   3. C.Impact on confidentiality without considering other objectives
   4. D.Past losses without considering the potential impact of a future loss

   Explanation: FIPS 199 states that determining a security category requires "determining the potential impact for each security objective associated with the particular information type." The category relates to the consequences of loss.

   Reference: FIPS 199: Standards for Security Categorization of Federal Information and Information Systems — Security Categorization Applied to Information Types, p. 3

4. 4Under 45 CFR 164.306(a), whose electronic protected health information is covered by the general security requirements?

   1. A.Electronic protected health information created, received, maintained, or transmitted by a covered entity or business associateCorrect answer: A
   2. B.Electronic health information handled by any organization regardless of its role
   3. C.All records in any format held by a covered entity, including paper records
   4. D.Electronic protected health information handled by covered entities but not business associates

   Explanation: The rule applies to covered entities and business associates and says: "Ensure the confidentiality, integrity, and availability of all electronic protected health information the covered entity or business associate creates, receives, maintains, or transmits." The provision identifies the regulated information and actors.

   Reference: 45 CFR 164.306: Security Standards, General Rules — 45 CFR 164.306(a)(1)

5. 5Which statement correctly describes the general scope of an information system?

   1. A.It consists exclusively of hardware used to store secret files
   2. B.It consists of organized resources used to handle informationCorrect answer: B
   3. C.It consists exclusively of software used to transmit information
   4. D.It consists of unrelated records without an organized information-handling purpose

   Explanation: NIST describes an information system as "a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information." The concept describes organized resources and their information-related functions.

   Reference: NIST SP 800-12 Revision 1: An Introduction to Information Security — Section 1.4, Important Terminology, p. 2

6. 6Which situation is an example of a non-adversarial threat source?

   1. A.A criminal deliberately steals employee credentials
   2. B.A storm damages the building housing a serverCorrect answer: B
   3. C.A former employee deliberately deletes records
   4. D.An attacker installs malicious software on a workstation

   Explanation: NIST explains that "Non-adversarial threat sources refer to natural disasters or erroneous actions taken by individuals" in everyday work. A storm is a natural event rather than an intentional attack.

   Reference: NIST SP 800-12 Revision 1: An Introduction to Information Security — Section 4, Threats, p. 20

7. 7What can a human-readable information security label communicate to a recipient?

   1. A.Special handling or distribution instructionsCorrect answer: A
   2. B.Proof that the recipient is authorized to access the item
   3. C.Proof that the item has already been encrypted
   4. D.Permission to distribute the item regardless of policy

   Explanation: NIST describes displaying security attributes in human-readable form to identify "special dissemination, handling, or distribution instructions". The label communicates the applicable handling requirements.

   Reference: NIST SP 800-53 Revision 5: Security and Privacy Controls for Information Systems and Organizations — AC-16(5), Attribute Displays on Objects to Be Output

8. 8A financial institution subject to the FTC Safeguards Rule maintains a record on behalf of itself. Which record can be customer information under the rule?

   1. A.A paper or electronic record containing nonpublic personal information about a financial institution's customerCorrect answer: A
   2. B.Only an electronic record, regardless of whether its contents are public
   3. C.Only a publicly available record about a financial institution's customer
   4. D.A record containing no personal information about a financial institution's customer

   Explanation: The rule defines customer information as "any record containing nonpublic personal information about a customer of a financial institution, whether in paper, electronic, or other form, that is handled or maintained by or on behalf of you or your affiliates." The definition covers more than electronic records.

   Reference: 16 CFR 314.2: Definitions — 16 CFR 314.2(d)

9. 9When evaluating a system for its intended use, what does validation confirm?

   1. A.To determine whether specified design requirements were fulfilled
   2. B.To judge operational suitability solely from a user's preference
   3. C.To confirm that requirements for the intended use are fulfilledCorrect answer: C
   4. D.To assume intended-use needs are met whenever construction is complete

   Explanation: NIST defines validation as "Confirmation, through the provision of objective evidence, that the requirements for a specific intended use or application have been fulfilled." The check focuses on the intended use, rather than only whether specified requirements were built correctly.

   Reference: NIST SP 800-160 Volume 1 Revision 1: Engineering Trustworthy Secure Systems — Appendix B, Glossary, validation, p. 62

10. 10How does a threat event relate to a vulnerable system?

    1. A.It is a situation that could cause undesirable consequencesCorrect answer: A
    2. B.It is a weakness that could be exploited by a threat source
    3. C.It is the amount of risk an organization is willing to accept
    4. D.It is the risk remaining after a response is applied

    Explanation: NIST defines a threat event as "an incident or situation that could potentially cause undesirable consequences or impacts." A threat source can lead to such an event when a system is vulnerable.

    Reference: NIST SP 800-12 Revision 1: An Introduction to Information Security — Section 4, Threats, p. 20