ISO-IEC-27002-Foundation Practice Questions

A.  

No, organizations should avoid sharing or exchanging information about new threats or vulnerabilities

B.  

No, organizations should share such information only with the authorities

C.  

Yes, it is recommended for organizations to establish and maintain contact with special interest groups regarding security threats, trends, etc.

A.  

Require all personnel to apply information security in accordance with the established information security policy, topic-specific policies and procedures of the organization

B.  

Require all personnel to establish and approve information security policies, topic-specific policies and procedures of the organization

C.  

Require all personnel to read the guidelines of ISO/IEC 27002

A.  

Control 8.11 Data masking

B.  

Control 8.23 Web filtering

C.  

Control 5.18 Access rights

A.  

Control 8.29 Security testing in development and acceptance

B.  

Control 8.26 Application security requirements

C.  

Control 8.28 Secure coding

A.  

The roles and responsibilities for the key management

B.  

Security checkpoints in projects

C.  

Restricting and filtering systems connection to the network

A.  

Availability

B.  

Integrity

C.  

Confidentiality

A.  

Corrective and managerial

B.  

Detective and technical

C.  

Preventive and legal

A.  

What information needs to be protected and why it should be protected

B.  

How to protect information and what to protect it from

C.  

Both A and B

A.  

Property that information is not made available or disclosed to unauthorized individuals, entities, or processes

B.  

Property of accuracy and completeness

C.  

Property of being accessible and usable upon demand by an authorized entity

A.  

Employees of all departments of an organization have access to personal data of their colleagues

B.  

The Customer Service Department is not able to access customers’ phone numbers due to an equipment failure

C.  

One of the employees of the Financial Department of an organization accidentally modified banking information of other staff members