[UPDATED] PECB ISO-IEC-27002-Foundation Certification Exam Questions [Q26-Q49]

Rate this post

[UPDATED] PECB ISO-IEC-27002-Foundation Certification Exam Questions

Quickly and Easily Pass PECB Exam with ISO-IEC-27002-Foundation real Dumps

PECB ISO-IEC-27002-Foundation Exam Syllabus Topics:

Topic	Details
Topic 1	Explain the fundamental concepts of information security, cybersecurity, and privacy based on ISO IEC 27002: This domain covers the core principles and definitions that underpin information security, including the concepts of confidentiality, integrity, and availability. It focuses on how ISO IEC 27002 frames cybersecurity and privacy as foundational elements of an organization’s overall security posture.
Topic 2	Discuss the relationship between ISO IEC 27001, ISO IEC 27002, and other standards and regulatory frameworks: This domain examines how ISO IEC 27002 functions as a code of practice that supports the requirements set out in ISO IEC 27001, and how both standards interact with other relevant frameworks. It also addresses how organizations align these standards with applicable laws, regulations, and industry-specific requirements.
Topic 3	Interpret the ISO IEC 27002 organizational, people, physical, and technological controls in the specific context of an organization: This domain covers the four control categories defined in ISO IEC 27002 organizational, people, physical, and technological and how each applies to real-world organizational environments. It requires understanding how to read, interpret, and contextualize these controls based on an organization’s specific needs, risks, and operating conditions.

Q26. Which of the following is an example of an organizational asset in cyberspace?

Medical data

Digital customer identity

Intellectual property

Q27. What is continual improvement?

The process of increasing the effectiveness and efficiency of the organization to fulfill its policy and objectives

A method of examining the nature of something or of determining its essential features and their relations

The action taken to eliminate a detected nonconformity

Q28. What is the primary purpose of control 5.13 Labelling of information?

To facilitate communication of classification and support automated processing

To determine ownership of information assets

To restrict physical access to classified documents

Q29. What does ISO/IEC 27002 recommend regarding audit testing?

Audit tests should be planned and agreed upon between the tester and the appropriate management

Audit tests and other assurance activities should be conducted ad hoc to determine the effectiveness of operational systems and business processes

The organization should temporarily stop its operational systems and business processes during audits and other assurance activities

Q30. Which technological control addresses protection against malware?

8.7 Protection against malware

8.8 Management of technical vulnerabilities

8.9 Configuration management

Q31. What should NOT be taken into account when locating and constructing physical premises?

Local topography

Urban threats

System requirements

Q32. An organization has established and maintains contact with special interest groups with which it shares and obtains information about security threats, vulnerabilities, trends, etc. Based on ISO/IEC 27002, is this a good practice?

No, organizations should avoid sharing or exchanging information about new threats or vulnerabilities

No, organizations should share such information only with the authorities

Yes, it is recommended for organizations to establish and maintain contact with special interest groups regarding security threats, trends, etc.

Q33. Which control addresses the need to define and allocate information security responsibilities?

5.2 Information security roles and responsibilities

5.3 Segregation of duties

5.4 Management responsibilities

Q34. What does information security determine?

What information needs to be protected and why it should be protected

How to protect information and what to protect it from

Both

Q35. According to ISO/IEC 27002, which of the following statements is correct?

Equipment should be sited securely and protected to reduce the risks from environmental and physical threats

Equipment is NOT affected by power failures or other disruptions

Supporting utilities should be tested only at the beginning of the process

Q36. What is the purpose of “segregation of duties” (control 5.3)?

To reduce the risk of fraud, error, or misuse by dividing conflicting duties among different individuals

To ensure all employees have the same access rights

To classify information assets

Q37. In which group of controls does Control 7.9 Security of assets off-premises belong?

Organizational

Physical

Technological

Q38. When can clock synchronization be difficult?

When using only on-premises services

When using multiple cloud services

Both

Q39. Which control specifically addresses secure disposal or re-use of equipment containing storage media?

7.14 Secure disposal or re-use of equipment

7.10 Storage media

7.9 Security of assets off-premises

Q40. What does ISO/IEC 27002 provide?

Guidance for the implementation of information security controls

Requirements for the implementation of information security controls

Guidance for the management of information security risks

Q41. Which control of ISO/IEC 27002 aims to ensure the correct and secure operation of information processing facilities?

Control 7.2 Physical entry

Control 5.37 Documented operating procedures

Control 5.35 Independent review of information security

Q42. How can organizations manage the security of large networks?

By dividing networks into separate network domains and separating them from the public network

By dividing networks into separate network domains and including them into the public network

By avoiding the integration of information services, users, and information systems into large networks

Q43. During which phase of the Plan-Do-Check-Act (PDCA) cycle organizations maintain and improve the information security management system (ISMS)?

Act

Check

Q44. An organization does NOT authenticate the identity of persons that enter the server room, so unauthorized persons can easily gain access to the server. Which control of ISO/IEC 27002 should the organization implement to solve this problem?

Control 8.6 Capacity management

Control 7.2 Physical entry

Control 8.4 Access to source code

Q45. Which situation presented below indicates that the confidentiality of information has been breached?

Employees of all departments of an organization have access to personal data of their colleagues

The Customer Service Department is not able to access customers’ phone numbers due to an equipment failure

One of the employees of the Financial Department of an organization accidentally modified banking information of other staff members

Q46. Which of the following is an example of a “people” control in ISO/IEC 27002?

6.3 Information security awareness, education and training

7.1 Physical security perimeters

8.1 User endpoint devices

Q47. What is risk assessment?

The process of finding, recognizing, and describing risks

The process to comprehend the nature of risk arid to determine the level of risk

The overall process of risk identification, risk analysis, and risk evaluation

Q48. What is the main objective of control 5.1 Policies for information security?

To ensure management direction and support for information security are provided

To classify information according to sensitivity

To manage access rights of employees

Q49. Some employees of an organization find the data processing procedures complicated and have been struggling to follow them effectively. Which of the following threats is the organization facing in this case?

Data input error by employees

Hacking

Information theft