Free PECB ISO/IEC 27002 Foundation Practice Questions

Sample Practice Questions

Try these 10 sample questions from the PECB ISO/IEC 27002 Foundation practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1Which information security property concerns restricting disclosure to authorized parties?

   1. A.ConfidentialityCorrect answer: A
   2. B.Availability
   3. C.Integrity
   4. D.Accountability

   Explanation: NIST defines the concept as "Preserving authorized restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information.". Disclosure restrictions preserve confidentiality; availability concerns access when needed, integrity concerns improper modification, and accountability concerns attribution.

   Reference: NIST Computer Security Resource Center glossary: confidentiality — Definitions, first definition

2. 2Which example illustrates an organizational control in ISO/IEC 27002:2022?

   1. A.Assigning and separating information security responsibilitiesCorrect answer: A
   2. B.Providing employee security awareness sessions
   3. C.Securing physical entrances to information facilities
   4. D.Enforcing restrictions through system software

   Explanation: PECB describes "organizational controls which introduce policies and procedures that tackle issues on an organizational level, such as the segregation of roles and responsibilities". Awareness, physical entry, and system software are associated with other control themes.

   Reference: ISO/IEC 27002:2022 — Information security, cybersecurity, and privacy protection — Organizational Controls

3. 3Which security property is directly affected when an attacker changes a stored invoice without authorization?

   1. A.IntegrityCorrect answer: A
   2. B.Confidentiality
   3. C.Privacy
   4. D.Availability

   Explanation: NIST defines the concept as "Guarding against improper information modification or destruction, and includes ensuring information nonrepudiation and authenticity.". An unauthorized modification directly affects integrity. The scenario does not establish an access outage or unauthorized disclosure.

   Reference: NIST Computer Security Resource Center glossary: integrity — Definitions, first definition

4. 4For the ISO/IEC 27002 people-control theme, which measure addresses employee risks?

   1. A.Providing security awareness and training to employeesCorrect answer: A
   2. B.Managing supplier information security agreements
   3. C.Protecting physical entrances to information facilities
   4. D.Applying software restrictions to system access

   Explanation: PECB identifies "the provision of awareness and training sessions" among people controls. Supplier relationships, physical entrances, and software access restrictions are addressed by other control themes.

   Reference: ISO/IEC 27002:2022 — Information security, cybersecurity, and privacy protection — People Controls

5. 5Which property is the focus when an organization seeks timely, reliable access to information?

   1. A.AvailabilityCorrect answer: A
   2. B.Authenticity
   3. C.Integrity
   4. D.Confidentiality

   Explanation: NIST defines the concept as "Ensuring timely and reliable access to and use of information.". Timely and reliable access is availability; integrity, confidentiality, and authenticity address different properties.

   Reference: NIST Computer Security Resource Center glossary: availability — Definitions, first definition

6. 6Which physical control measure is described by ISO/IEC 27002:2022?

   1. A.Protecting perimeters, entry points, and equipmentCorrect answer: A
   2. B.Providing security awareness training to employees
   3. C.Managing security responsibilities in supplier relationships
   4. D.Restricting system changes through software mechanisms

   Explanation: PECB describes physical controls covering "the security of perimeters, entries, offices, rooms, facilities, equipment, cables, storage media, and utilities". The other activities are associated with people, organizational, or technological controls.

   Reference: ISO/IEC 27002:2022 — Information security, cybersecurity, and privacy protection — Physical Controls

7. 7In security risk analysis, what is a threat?

   1. A.A circumstance or event with potential adverse impactCorrect answer: A
   2. B.A safeguard selected to reduce exposure
   3. C.An existing weakness that can be exploited
   4. D.A decision to accept residual risk

   Explanation: NIST defines the concept as "Any circumstance or event with the potential to adversely impact organizational operations". A threat is a potential source of adverse impact. A weakness is a vulnerability, while a safeguard and a risk decision are different concepts.

   Reference: NIST Computer Security Resource Center glossary: threat — Definitions, first definition

8. 8ISO/IEC 27002:2022 groups controls into four themes. Which example is technological?

   1. A.Using software controls to restrict unauthorized system changesCorrect answer: A
   2. B.Screening individuals during the recruitment process
   3. C.Protecting physical entry points to a facility
   4. D.Setting employee nondisclosure obligations

   Explanation: PECB describes "technological controls which are intended to help organizations protect their information systems against unauthorized access or change, infrastructure overload, and malicious attacks". The other choices concern people or physical controls.

   Reference: ISO/IEC 27002:2022 — Information security, cybersecurity, and privacy protection — Technological Controls

9. 9Which statement defines an information security vulnerability within an organization?

   1. A.A weakness that a threat source could exploitCorrect answer: A
   2. B.A harmful event that has already occurred
   3. C.A control that prevents unauthorized access
   4. D.A measure of the likelihood and impact of harm

   Explanation: NIST defines the concept as "Weakness in an information system, system security procedures, internal controls, or implementation that could be exploited or triggered by a threat source.". A vulnerability is an exploitable weakness, not an incident, safeguard, or measure of risk.

   Reference: NIST Computer Security Resource Center glossary: vulnerability — Definitions, first definition

10. 10In ISO/IEC 27002:2022, what does a control's purpose field explain?

    1. A.Why implementing the control is importantCorrect answer: A
    2. B.How the control can be implemented
    3. C.The short name assigned to the control
    4. D.Values of attributes assigned to the control

    Explanation: PECB says the purpose element "Explains the importance of implementing the control". Guidance describes implementation, the title gives a short name, and the attribute table provides attribute values.

    Reference: ISO/IEC 27002:2022 — Information security, cybersecurity, and privacy protection — Section V, Control Layout