According to ISO/IEC 27001:2022, is it necessary to ensure that the Information Security Management System can achieve its intended results?

• A.It is only an observation to keep in mind when auditing the management system
• B.It is a requirement to be fulfilled
• C.It is a recommendation, but not a requirement
• D.None of the above

Comment: *

Name: *

Email: *

Verification: *

In the context of clause 6.1 actions to address risks and opportunities, what is defined as residual risk?

• A.Effect of uncertainty on objectives
• B.Informed decision to take a particular risk
• C.Risk remaining after risk treatment
• D.None of the above

Comment: *

Name: *

Email: *

Verification: *

Which statement describes the difference between ISO/IEC 27001:2022 and ISO/IEC 27002:2022?

• A.ISO/IEC 27002:2022 provides guidance on measurement, and ISO/IEC 27001:2022 provides guidance on information security controls
• B.ISO/IEC 27002:2022 provides mandatory requirements for a risk management approach, and ISO/IEC
  27001:2022 contains mandatory requirements for an ISMS
• C.ISO/IEC 27001:2022 contains mandatory requirements, while ISO/IEC 27002:2022 provides guidance on information security controls
• D.ISO/IEC 27002:2022 contains mandatory requirements, while ISO/IEC 27001:2022 provides guidance on information security controls

Comment: *

Name: *

Email: *

Verification: *

Within the ISMS, communicating the importance of effective information security management and of conforming to the ISMS requirements is a responsibility of:

• A.The IT Security Manager
• B.Top management
• C.The IT Manager
• D.The quality management representative

Comment: *

Name: *

Email: *

Verification: *

Management review must include consideration of:

• A.Changes in external and internal issues that are relevant to the ISMS
• B.The status of actions from previous management reviews
• C.Opportunities for continual improvement
• D.All of the above

Comment: *

Name: *

Email: *

Verification: *