Free EXIN Information Security Foundation based on ISO/IEC 27001 Practice Questions

Sample Practice Questions

Try these 10 sample questions from the EXIN Information Security Foundation based on ISO/IEC 27001 practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1What is the organizational purpose of information security controls?

   1. A.To make business objectives subordinate to security goals
   2. B.To support business objectives by protecting important assetsCorrect answer: B
   3. C.To keep security objectives independent of business priorities
   4. D.To set protection levels without reference to business needs

   Explanation: NIST explains that "well-chosen security rules and procedures that are put in place to protect important assets support the overall organizational mission." Security supports the mission; it does not replace it or remove business decisions.

   Reference: NIST SP 800-12 Rev. 1: An Introduction to Information Security — Section 2.1, Information security supports the mission of the organization

2. 2In a security risk assessment, what is a vulnerability?

   1. A.A weakness that a threat source could exploitCorrect answer: A
   2. B.The financial impact after an incident has occurred
   3. C.A safeguard selected to reduce a known risk
   4. D.An event that has already caused a loss

   Explanation: NIST defines a vulnerability as "a weakness in an information system, system security procedures, internal controls, or implementation that could be exploited by a threat source." It is a weakness, not the impact or safeguard.

   Reference: NIST SP 800-30 Rev. 1: Guide for Conducting Risk Assessments — Section 2.3.1, Vulnerabilities and Predisposing Conditions

3. 3A control produces a warning when an attempted intrusion is detected. What type of control is this?

   1. A.Corrective
   2. B.DetectiveCorrect answer: B
   3. C.Insurance
   4. D.Deterrent

   Explanation: NIST describes detective controls as those that "Provide warning of a successful or attempted threat event". The control warns of the attempted intrusion.

   Reference: NIST IR 8286r1: Integrating Cybersecurity and Enterprise Risk Management — Section 3.5.1, Applying Security Controls to Reduce Risk Exposure

4. 4Which information is the HIPAA Security Rule designed to protect for regulated entities?

   1. A.Electronic protected health information held by covered entitiesCorrect answer: A
   2. B.Protected health information solely in paper records
   3. C.Protected health information solely in oral conversations
   4. D.Publicly released health statistics without identifiable individuals

   Explanation: HHS explains that the rule sets safeguards to "secure individuals’ electronic protected health information." Its scope is ePHI held by regulated entities.

   Reference: Summary of the HIPAA Security Rule — Introduction

5. 5An organization's size and information security needs change. How should its ISMS risk management process respond?

   1. A.It can be adapted and scaled as those factors evolveCorrect answer: A
   2. B.It should retain risk criteria that no longer match its activities
   3. C.It should copy another organization's process without tailoring
   4. D.It should adapt to technology while disregarding business needs

   Explanation: ISO describes applying "a risk management process that is adapted to their size and needs, and scale it as necessary as these factors evolve." The process should suit the organization as its circumstances change.

   Reference: ISO/IEC 27001:2022 Information Security Management Systems — Who needs ISO/IEC 27001?

6. 6Which risk management activity produces the strategy for how an organization will assess, respond to, and monitor risk?

   1. A.Assessing risk
   2. B.Responding to risk
   3. C.Monitoring risk
   4. D.Framing riskCorrect answer: D

   Explanation: NIST states that the risk framing component is to "produce a risk management strategy that addresses how organizations intend to assess, respond to, and monitor risk". Assessment, response and monitoring operate within that strategy.

   Reference: NIST SP 800-12 Rev. 1: An Introduction to Information Security — Section 6, Information Security Risk Management, Framing Risk

7. 7A company installs a lock to prevent unauthorized entry through a previously unsecured door. Which control type does this illustrate?

   1. A.Detective
   2. B.Corrective
   3. C.PreventiveCorrect answer: C
   4. D.Insurance

   Explanation: NIST describes preventive controls as those that "Reduce or eliminate specific instances of a vulnerability". The lock reduces the vulnerability of an unsecured entry point before unauthorized entry occurs.

   Reference: NIST IR 8286r1: Integrating Cybersecurity and Enterprise Risk Management — Section 3.5.1, Applying Security Controls to Reduce Risk Exposure

8. 8Under GDPR Article 32, what should the controller and processor consider when selecting security measures for covered personal data processing?

   1. A.The risks and the nature and context of the processingCorrect answer: A
   2. B.The likelihood of harm while disregarding its severity
   3. C.The processing purpose while disregarding its context
   4. D.The cost of measures while disregarding risk to individuals

   Explanation: Article 32 calls for "appropriate technical and organisational measures to ensure a level of security appropriate to the risk" and specifies the factors to consider. The measures are risk appropriate.

   Reference: Regulation (EU) 2016/679, General Data Protection Regulation — Article 32(1), Security of processing

9. 9Which description best captures the ongoing nature of an information security management system?

   1. A.Establish and implement it, then maintain and continually improve itCorrect answer: A
   2. B.Establish and implement it, then keep its initial design unchanged
   3. C.Establish it after assessment, then stop monitoring its operation
   4. D.Implement it once, then postpone changes until a complete redesign

   Explanation: ISO describes "establishing, implementing, maintaining and continually improving an information security management system." The process continues after implementation and assessment.

   Reference: ISO/IEC 27001:2022 Information Security Management Systems — What is ISO/IEC 27001?

10. 10What distinguishes a qualitative risk assessment from a quantitative one?

    1. A.It uses descriptive levels rather than numerical measurementsCorrect answer: A
    2. B.It assesses consequences without considering likelihood
    3. C.It eliminates uncertainty rather than documenting it
    4. D.It considers threats but excludes vulnerabilities

    Explanation: NIST describes qualitative assessments as "assessing risk based on nonnumerical categories or levels" and gives levels such as low and high. Quantitative methods use numbers.

    Reference: NIST SP 800-30 Rev. 1: Guide for Conducting Risk Assessments — Section 2.3.2, Assessment Approaches