Question 1

The ambition of the security manager is to certify the organization against ISO/IEC 27001.

What is an activity in the certification program?

AFormulate the security requirements in the outsourcing contracts

BImplement the security baselines in Secure Systems Development Life Cycle (SecSDLC)

CPerform a risk assessment of the secure internet connectivity architecture of the datacenter

DProduce a Statement of Applicability based on risk assessments

Answer : D

Question 2

The information security manager is writing the Information Security Management System (ISMS) documentation. The controls that are to be implemented must be described in one of the phases of the Plan-Do-

Check-Act (PDCA) cycle of the ISMS.

In which phase should these controls be described?

APlan

BDo

CCheck

DAct

Answer : A

Question 3

What needs to be decided prior to considering the treatment of risks?

ACriteria for determining whether or not the risk can be accepted

BHow to apply appropriate controls to reduce the risks

CMitigation plans

DThe development of own guidelines

Answer : A

Question 4

Security monitoring is an important control measure to make sure that the required security level is maintained. In order to realize 24/7 availability of the service, this service is outsourced to a partner in the cloud.

What should be an important control in the contract?

AThe network communication channel is secured by using encryption.

BThe third party is certified against ISO/IEC 27001.

CThe third party is certified for adhering to privacy protection controls.

DYour IT auditor has the right to audit the external party's service management processes.

Answer : D

Question 5

What is the best way to start setting the information security controls?

AImplement the security measures as prescribed by a risk analysis tool

BResort back to the default factory standards

CUse a standard security baseline

Answer : C

Free Practice Questions for Exin ISMP Exam

Question 1

Question 2

Question 3

Question 4

Question 5