Free PECB ISO/IEC 27001 Foundation Practice Questions

Sample Practice Questions

Try these 10 sample questions from the PECB ISO/IEC 27001 Foundation practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1How does ISO/IEC 27000:2018 define the coverage of its ISMS vocabulary?

   1. A.It covers commonly used terms while allowing ISMS standards to define additional terms.Correct answer: A
   2. B.It exhaustively covers every term and prevents ISMS standards from adding definitions.
   3. C.It covers technical control terms while excluding management-system terms.
   4. D.It covers organization-specific terms while excluding terminology shared by ISMS standards.

   Explanation: ISO states that the definitions “do not cover all terms and definitions applied within the ISMS family of standards; and - do not limit the ISMS family of standards in defining new terms for use.” The vocabulary is shared and nonexhaustive: A preserves those features. B makes it exhaustive, C excludes management-system terms, and D excludes the common terminology the abstract expressly covers.

   Reference: ISO/IEC 27000:2018 — ISO abstract — Abstract, terms-and-definitions limitations

2. 2A proposed security objective says only 'make information safer,' although a measurable target is practicable. Which revision best addresses the weakness?

   1. A.Move the statement into a supplier contract without changing it.
   2. B.Remove the objective because only policies may be measured.
   3. C.Express a defined security outcome with a measurable target.Correct answer: C
   4. D.Replace it with a list of every purchased security product.

   Explanation: PECB states: “Consistent with information security policy  Measurable (if practicable)” A measurable target makes progress assessable. Moving vague wording or listing purchases does not define the security outcome.

   Reference: PECB ISMS implementation webinar — Slide 25, Information Security Objectives and Planning to achieve them

3. 3An organization is distinguishing ISMS requirements from supporting control guidance. Which pairing reflects the roles of ISO/IEC 27001 and ISO/IEC 27002?

   1. A.ISO/IEC 27001 gives control implementation advice; ISO/IEC 27002 specifies ISMS requirements.
   2. B.ISO/IEC 27001 specifies ISMS requirements; ISO/IEC 27002 gives control best practices.Correct answer: B
   3. C.ISO/IEC 27001 specifies product testing requirements; ISO/IEC 27002 specifies ISMS requirements.
   4. D.ISO/IEC 27001 specifies auditor accreditation requirements; ISO/IEC 27002 gives risk assessment results.

   Explanation: ISO explains: “While ISO/IEC 27001 specifies the requirements for establishing an ISMS, ISO/IEC 27002 provides the detailed best practices and controls that can be applied within the ISMS.” The requirements/guidance distinction supports B. A reverses those roles; C substitutes product testing for an organizational management system; D substitutes auditor accreditation and assessment results for the two standards’ actual purposes.

   Reference: ISO/IEC 27002:2022 — ISO — FAQ, How does ISO/IEC 27002 relate to ISO/IEC 27001?

4. 4A department proposes a security objective that conflicts with the organization's information security policy. Which action is appropriate?

   1. A.Adopt it because departmental objectives override policy.
   2. B.Align the objective with the information security policy.Correct answer: B
   3. C.Keep the conflict if the objective has a numerical target.
   4. D.Treat the objective as valid once it is documented.

   Explanation: PECB states: “Consistent with information security policy” Policy consistency is required independently of measurability and documentation; a departmental origin does not override policy.

   Reference: PECB ISMS implementation webinar — Slide 25, Information Security Objectives and Planning to achieve them

5. 5A supplier says that following ISO/IEC 27002 recommendations alone gives it ISO/IEC 27002 certification. How should an ISMS manager assess that statement?

   1. A.It is correct if the supplier documents its selected controls.
   2. B.It is correct if the supplier also measures control effectiveness.
   3. C.It is incorrect because ISO/IEC 27002 is guidance that cannot itself be certified to.Correct answer: C
   4. D.It is incorrect because ISO/IEC 27002 is an accreditation standard for certification bodies.

   Explanation: ISO explicitly states: “No, ISO/IEC 27002 provides best practice recommendations and cannot be certified to.” C identifies the certification boundary. Documenting controls or measuring them does not convert guidance into a certifiable requirements standard. D supplies a different and incorrect institutional role rather than the actual reason.

   Reference: ISO/IEC 27002:2022 — ISO — FAQ, Does ISO/IEC 27002 lead to certification?

6. 6Which input should a team consider when establishing its information security objectives?

   1. A.Training attendance numbers without considering security requirements or risk results.
   2. B.Historical equipment purchases without considering security requirements or risk results.
   3. C.A certification provider's software preferences without considering organizational risks.
   4. D.Applicable security requirements and risk assessment and treatment results.Correct answer: D

   Explanation: PECB states: “Consider information security requirements and results from risk assessment and risk treatment” Objectives should respond to requirements and risk results. A single activity count, purchase history, or vendor preference cannot replace those inputs.

   Reference: PECB ISMS implementation webinar — Slide 25, Information Security Objectives and Planning to achieve them

7. 7A team is checking the stated purpose of the 2017 edition of ISO/IEC 27003 before using it as background material. Which purpose is explicitly stated by ISO?

   1. A.Explanation and guidance on ISO/IEC 27001:2013.Correct answer: A
   2. B.Requirements for certification bodies conducting ISMS audits.
   3. C.Measurement methods for evaluating ISMS performance.
   4. D.Guidance for managing information security incidents.

   Explanation: ISO’s abstract states: “ISO/IEC 27003:2017 provides explanation and guidance on ISO/IEC 27001:2013.” A preserves both purpose and the referenced edition. Certification-body requirements, measurement guidance and incident-management guidance are different subjects; none is the purpose stated for this document. This does not claim that its 2013 references replace the target exam’s 2022 requirements.

   Reference: ISO/IEC 27003:2017 — ISO abstract — Abstract

8. 8An objective is achieved and the organization's risks and priorities then change. What should happen to the objectives?

   1. A.Update them when necessary to remain relevant.Correct answer: A
   2. B.Retain them unchanged because they were once approved.
   3. C.Replace them automatically with the certification audit schedule.
   4. D.Stop communicating them after the first successful measurement.

   Explanation: PECB states: “Update when necessary” Objectives are maintained as conditions change. Approval or an earlier success does not make them permanent, and an audit schedule is not a replacement security objective.

   Reference: PECB ISMS implementation webinar — Slide 25, Information Security Objectives and Planning to achieve them

9. 9An ISMS team seeks a family-standard reference focused on evaluating whether its processes and controls are effective. Which reference has that published focus?

   1. A.ISO/IEC 27000, for overview and vocabulary.
   2. B.ISO/IEC 27003, for explanation and implementation guidance.
   3. C.ISO/IEC 27005, for managing information security risks.
   4. D.ISO/IEC 27004, for monitoring and measurement of ISMS effectiveness.Correct answer: D

   Explanation: ISO/IEC 27004’s abstract includes “the monitoring and measurement of the effectiveness of an information security management system (ISMS) including its processes and controls;” D matches the requested measurement purpose. Overview/vocabulary, implementation explanation and risk management support other tasks, but do not identify the measurement reference requested here.

   Reference: ISO/IEC 27004:2016 — ISO abstract — Abstract, item b

10. 10Which pair correctly distinguishes an internal issue from an external issue when understanding organizational context?

    1. A.Internal: industry regulation; external: staff culture.
    2. B.Internal: competitor behavior; external: decision-making processes.
    3. C.Internal: staff culture; external: the legal and regulatory environment.Correct answer: C
    4. D.Internal: political conditions; external: organizational structure.

    Explanation: The source states: “Perceptions and Values of Staff Culture Information Systems Decision Making Processes” The external-context slide also lists “Legal and Regulatory”. Staff culture is internal; laws and regulations arise externally. The other pairs reverse internal organizational features and external environmental factors.

    Reference: PECB ISMS implementation webinar — Slides 9–10, Understanding the Organization and its Context