EXIN Information Security Management ISO/IEC 27001 ISMP Actual Questions

1. When is revision of an employee’s access rights mandatory?

2. What is a key item that must be kept in mind when designing an enterprise-wide information security program?

3. What is the main reason to use a firewall to separate two parts of your internal network?

4. Which security item is designed to take collections of data from multiple computers?

5. The ambition of the security manager is to certify the organization against ISO/IEC 27001.

What is an activity in the certification program?

6. It is important that an organization is able to prove compliance with information standards and legislation. One of the most important areas is documentation concerning access management. This process contains a number of activities including granting rights, monitoring identity status, logging, tracking access and removing rights. Part of these controls are audit trail records which may be used as evidence for both internal and external audits.

What component of the audit trail is the most important for an external auditor?

7. The security manager of a global company has decided that a risk assessment needs to be completed across the company.

What is the primary objective of the risk assessment?

8. Security monitoring is an important control measure to make sure that the required security level is maintained. In order to realize 24/7 availability of the service, this service is outsourced to a partner in the cloud.

What should be an important control in the contract?

9. What needs to be decided prior to considering the treatment of risks?

10. Who should be asked to check compliance with the information security policy throughout the company?

11. A company's webshop offers prospects and customers the possibility to search the catalog and place orders around the clock. In order to satisfy the needs of both customer and business several requirements have to be met. One of the criteria is data classification.

What is the most important classification aspect of the unit price of an object in a 24h webshop?

12. An experienced security manager is well aware of the risks related to communication over the internet. She also knows that Public Key Infrastructure (PKI) can be used to keep e-mails between employees confidential.

Which is the main risk of PKI?