PECB ISO-IEC-27002-Foundation ISO/IEC 27002 Foundation Exam Exam Practice Test

Management should require all personnel to apply information security according to the organization’s established information security policy, topic-specific policies, and procedures. ISO/IEC 27002 makes management responsibilities clear: leadership must ensure personnel understand and fulfill their security duties. Personnel are expected to follow approved policies and procedures, protect information assets, report security events, and comply with assigned responsibilities. Option B is incorrect because establishing and approving policies is a management responsibility, not a duty assigned to all personnel. Option C is incorrect because reading ISO/IEC 27002 guidelines is not a substitute for following the organization’s own approved policies and procedures. ISO/IEC 27002 provides guidance to organizations, but employees need practical internal rules that apply to their roles, systems, data, and processes. Management commitment is demonstrated by assigning responsibilities, communicating expectations, providing awareness and training, and enforcing compliance. The core principle is that information security must be operationalized through everyday behavior, not left as abstract documentation. Therefore, option A is the verified answer. References/Chapters: ISO/IEC 27002:2022, Control 5.4 Management responsibilities; Control 5.1 Policies for information security; Control 6.3 Information security awareness, education and training.

==========

Continual improvement is the process of increasing an organization’s effectiveness and efficiency so that it better fulfills its policies and objectives. In information security, improvement is not limited to fixing one defect. It is the ongoing refinement of controls, processes, responsibilities, technologies, awareness, monitoring, and response capabilities. Option B describes analysis, which may support improvement but is not the definition. Option C describes correction or corrective action for a nonconformity, which can be one mechanism of improvement but does not cover the complete concept. ISO/IEC 27002 supports continual improvement through controls such as learning from information security incidents, independent review, compliance monitoring, threat intelligence, vulnerability management, change management, and documented operating procedures. A mature organization uses evidence from incidents, audits, metrics, user behavior, supplier performance, new threats, and business changes to adjust its controls. The key idea is progressive enhancement of suitability, adequacy, and effectiveness. Therefore, option A aligns with the management system and ISO/IEC 27002 control logic. References/Chapters: ISO/IEC 27002:2022, Control 5.27 Learning from information security incidents; Control 5.35 Independent review of information security; Control 8.8 Management of technical vulnerabilities.

==========

Control 5.35, Independent review of information security, is the control intended to ensure that the organization’s approach to managing information security remains suitable, adequate, and effective. Independent reviews provide objective evaluation of whether policies, processes, controls, responsibilities, and implementation remain aligned with business needs, risks, legal requirements, and the organization’s security objectives. The review may consider governance, control design, control operation, risk treatment, compliance, incident trends, technology changes, supplier dependencies, and audit results. Control 5.4, Management responsibilities, is important because management must ensure personnel apply security according to policies and procedures, but it is not the control specifically focused on independent review. Control 5.24 concerns planning and preparation for incident management, which supports response capability but does not broadly assess the continuing suitability of the whole security approach. The phrase “suitable, adequate and effective” is a strong indicator of review and assurance. ISO/IEC 27002 uses independent review to challenge assumptions, detect weaknesses, and support continual improvement. Therefore, option B is the verified answer. References/Chapters: ISO/IEC 27002:2022, Control 5.35 Independent review of information security; Control 5.36 Compliance with policies, rules and standards for information security; Control 5.4 Management responsibilities.

ISO/IEC 27002:2022 provides guidance for selecting, implementing, and managing information security controls. It is not the certification requirements standard; that role belongs to ISO/IEC 27001. ISO/IEC 27002 supports organizations by explaining the purpose of each control, the implementation guidance, and other related information needed to apply controls appropriately. Its controls are grouped into organizational, people, physical, and technological themes. The standard is intended to be used as a reference when organizations design security measures based on their risks, business needs, legal obligations, contractual requirements, and information security objectives. Therefore, option A is correct because “guidance” is the core function of ISO/IEC 27002. Option B is incorrect because ISO/IEC 27002 does not set mandatory requirements for certification. Option C is related to risk management, but it is not the main purpose of ISO/IEC 27002; risk management guidance is more directly associated with ISO/IEC 27005. ISO/IEC 27002 guides control implementation after risk and control needs are determined. References/Chapters: ISO/IEC 27002:2022, Clause 1 Scope; Clause 4 Structure of the standard; Controls 5–8.

==========

Information security should be integrated into project management so that security risks related to projects and deliverables are effectively addressed. Projects often introduce new systems, processes, suppliers, data flows, technologies, applications, facilities, or business changes. If security is considered only after implementation, weaknesses may already be embedded in design, architecture, contracts, code, configurations, or operating procedures. ISO/IEC 27002 Control 5.8 expects information security to be integrated into project management activities so risks are identified and treated throughout the project lifecycle. This includes security requirements, risk assessments, roles and responsibilities, acceptance criteria, testing, supplier requirements, privacy considerations, change control, and secure transition to operation. Option A is too general and focuses on applying ISO/IEC 27001 principles rather than the precise purpose of the control. Option B is too narrow because audits can support assurance but are not the primary reason for integration. The main purpose is risk management within projects and deliverables. Therefore, option C is verified. References/Chapters: ISO/IEC 27002:2022, Control 5.8 Information security in project management; Control 8.26 Application security requirements; Control 8.29 Security testing in development and acceptance.

==========

The purpose of Control 8.20, Network security, is to protect information in networks and supporting information processing facilities from compromise through the network. This includes protecting data in transit, network devices, network services, communication paths, routing, management interfaces, and connected systems. Network compromise can lead to unauthorized access, interception, malware propagation, denial of service, lateral movement, data exfiltration, or manipulation of traffic. Option B relates more closely to Control 8.21, Security of network services, which addresses security mechanisms, service levels, and management requirements for network services. Option C relates to Control 8.22, Segregation of networks, which specifically concerns splitting networks into security boundaries or domains. Control 8.20 is broader: it establishes the general objective of securing networks against compromise. ISO/IEC 27002 expects organizations to manage and control networks according to risk, including architecture, monitoring, authentication, encryption where needed, device hardening, and protection of network management functions. The correct answer is therefore option A. References/Chapters: ISO/IEC 27002:2022, Control 8.20 Network security; Control 8.21 Security of network services; Control 8.22 Segregation of networks.

==========

A fire alarm is a detective and technical control. It is detective because it identifies or signals that a fire-related event may be occurring. The alarm does not normally stop the fire from starting, and it does not restore damaged assets after the event. Its purpose is to detect indicators such as smoke, heat, or fire and trigger response actions such as evacuation, suppression, emergency communication, or incident handling. It is technical because it operates through engineered or electronic mechanisms rather than through management approval, legal clauses, or purely administrative processes. ISO/IEC 27002:2022 classifies controls using attributes, including control type. Control types include preventive, detective, and corrective. Fire alarms align with the physical security control area because fire is a physical and environmental threat to information processing facilities, equipment, storage media, and supporting infrastructure. The value of the control is timely detection, reducing the chance that a physical event escalates unnoticed into major damage or service disruption. References/Chapters: ISO/IEC 27002:2022, Clause 4 control attributes; Control 7.4 Physical security monitoring; Control 7.5 Protecting against physical and environmental threats.

==========

Accidental changes compromise integrity. Integrity is the property that information remains accurate, complete, and protected against unauthorized or improper modification. Even when a change is accidental rather than malicious, the effect is the same from an integrity perspective: the information may no longer be trustworthy. ISO/IEC 27002 supports integrity through many controls, including access control, change management, configuration management, backup, logging, secure coding, malware protection, segregation of duties, and separation of development, test, and production environments. Availability would be affected if information or systems were not accessible or usable when required. Confidentiality would be affected if information were disclosed or made available to unauthorized parties. The question specifically mentions accidental changes, not unavailability or disclosure, so integrity is the correct principle. This distinction is central to information security because different principles require different controls. For example, preventing accidental changes may require access restrictions, validation, change approval, version control, monitoring, and recovery procedures. References/Chapters: ISO/IEC 27002:2022, Clause 4 control attributes; Control 8.32 Change management; Control 8.9 Configuration management; Control 8.13 Information backup.

==========

Control 6.1 Screening is the ISO/IEC 27002 control that helps organizations ensure employees and contractors are suitable for their roles. Screening is performed before employment or engagement, and it should be proportionate to business requirements, information classification, access levels, legal requirements, and the risks associated with the role. It may include verification of identity, qualifications, employment history, references, criminal record checks where lawful and appropriate, and professional credentials. The goal is not unnecessary intrusion; the goal is to reduce the risk that unsuitable individuals receive access to sensitive information, systems, facilities, or responsibilities. Control 6.4, Disciplinary process, deals with responding to policy violations after employment has begun. Control 6.7, Remote working, addresses security arrangements for work outside organizational premises. Neither directly verifies suitability before assigning a role. ISO/IEC 27002 treats people controls as essential because insider risk, negligence, excessive access, and role mismatch can create significant security exposure. Therefore, option A is the verified answer. References/Chapters: ISO/IEC 27002:2022, Control 6.1 Screening; Control 6.2 Terms and conditions of employment; Control 6.3 Information security awareness, education and training.

==========

The situation describes a people-related operational threat: data input error by employees. The root cause is not a malicious external attack or theft; it is that employees cannot reliably follow complicated processing procedures. ISO/IEC 27002 recognizes that people, competence, awareness, and documented procedures are essential to information security. When procedures are unclear, excessive, or difficult to follow, employees may enter incorrect data, omit fields, select wrong categories, mishandle classifications, misroute information, or unintentionally corrupt records. This primarily threatens integrity because the information may no longer be accurate or complete. Hacking would involve unauthorized technical intrusion, and information theft would involve intentional unauthorized taking or disclosure of information. Neither is stated in the scenario. ISO/IEC 27002 addresses this type of risk through information security awareness, education and training, documented operating procedures, clear responsibilities, and appropriate segregation of duties. Effective controls should make correct behavior practical and repeatable, not merely documented. Therefore, the verified answer is option A. References/Chapters: ISO/IEC 27002:2022, Control 6.3 Information security awareness, education and training; Control 5.37 Documented operating procedures; Control 5.3 Segregation of duties.

==========

A vulnerability with no currently identified corresponding threat should still be recognized and monitored. A vulnerability is a weakness that could be exploited, but risk usually depends on the relationship between assets, threats, vulnerabilities, likelihood, and consequences. When no active or relevant threat is identified, immediate treatment may not be proportionate. However, ignoring the vulnerability would be inconsistent with ISO/IEC 27002’s risk-aware approach. Threat conditions change. A weakness that appears low priority today may become exploitable after a new attack technique, system exposure, business change, supplier change, or threat actor capability emerges. Recognizing the vulnerability ensures it is recorded and available for future assessment. Monitoring it ensures the organization detects changes in exploitability, exposure, or threat relevance. ISO/IEC 27002 supports this through threat intelligence and management of technical vulnerabilities, both of which require organizations to remain alert to changes in the threat and vulnerability landscape. Therefore, the correct answer is both recognizing and monitoring the vulnerability. References/Chapters: ISO/IEC 27002:2022, Control 5.7 Threat intelligence; Control 8.8 Management of technical vulnerabilities; Control 5.36 Compliance with policies, rules and standards for information security.

==========

Control 5.37, Documented operating procedures, aims to ensure the correct and secure operation of information processing facilities. Operating procedures translate security and operational requirements into repeatable instructions for administrators, operators, support teams, and users. They can cover system startup and shutdown, backup, restoration, logging, error handling, media handling, job scheduling, maintenance, incident escalation, access administration, and secure processing steps. Without documented procedures, operations become inconsistent and dependent on individual memory or informal practice, increasing the likelihood of mistakes, outages, unauthorized changes, or insecure handling. Control 7.2, Physical entry, protects secure physical areas by controlling access to facilities, but it does not define operational procedures. Control 5.35, Independent review of information security, assesses whether the information security approach remains suitable, adequate, and effective, but it does not provide the day-to-day operating instructions. ISO/IEC 27002 places documented procedures in the organizational control group because reliable operation requires governance, clarity, and repeatability. Therefore, option B is the verified answer. References/Chapters: ISO/IEC 27002:2022, Control 5.37 Documented operating procedures; Control 7.2 Physical entry; Control 5.35 Independent review of information security.

==========