ISO 27001

ISO/IEC 27001 Advanced

Name: eurocompliant.com AI Compliance Copilot
Price: 299 EUR
Author: eurocompliant.com

Complex ISMS scenarios: multi-site scoping, integrating ISO 27001 with other frameworks, and mature risk governance.

10 questions · 80% to pass · free

eurocompliant.com is not an accredited certification body. This is a self-paced educational assessment; the certificate confirms completion only, not a professional, statutory, or accredited qualification.

Your details

Name *

Email *

We'll email your certificate here if you pass. We may occasionally follow up about eurocompliant.com - you can unsubscribe any time.

Question 1 of 10

An organisation wants to scope its ISMS to exclude a business unit that handles the majority of its sensitive customer data. What is the key risk with this approach?

ISO/IEC 27001 requires all business units to be excluded by defaultThe scope exclusion could undermine the credibility and usefulness of the certification if it excludes areas where the most significant information security risks actually resideNo risk — scope can be defined arbitrarily with no consequenceCertification bodies never review scope statements

Question 2 of 10

How should an organisation approach reconciling ISO/IEC 27001 Annex A controls with NIS2's Article 21 risk-management measures?

They are entirely unrelated and cannot be mappedISO/IEC 27001 certification automatically satisfies every NIS2 obligation with no further actionAnnex A's structured control set can be used to help evidence many of the 'appropriate and proportionate' measures NIS2 requires, though gaps specific to NIS2 (e.g. certain reporting timelines) still need separate attentionNIS2 replaces the need for Annex A entirely

Question 3 of 10

Which of the following are hallmarks of a mature risk governance approach under an ISO/IEC 27001 ISMS?

Select all that apply.

Clear linkage between identified risks, treatment decisions, and the Statement of ApplicabilityA documented, repeatable risk assessment methodology applied consistentlyRisk acceptance decisions made and recorded by appropriately authorised risk ownersRisk assessments conducted once at initial certification and never revisited

Question 4 of 10

A multinational organisation is certifying several sites under a single ISMS. What is a key consideration for the risk assessment methodology?

Multi-site certification is not possible under ISO/IEC 27001Only the headquarters site needs a risk assessmentThe methodology should be consistent enough to produce comparable results across sites while still capturing site-specific context and riskEach site can use a completely different, incompatible risk methodology with no consolidation

Question 5 of 10

What is the purpose of 'corrective action' under Clause 10.1 when a nonconformity is identified?

Simply documenting the nonconformity with no further actionReassigning blame to a specific employee with no systemic reviewAutomatically triggering decertificationReacting to the nonconformity, evaluating the need for action to eliminate the root cause(s) so it does not recur, and reviewing the effectiveness of any corrective action taken

Question 6 of 10

An organisation can integrate its ISO/IEC 27001 ISMS with an ISO/IEC 27701 privacy information management extension to address both information security and privacy management within a coordinated management system.

TrueFalse

Question 7 of 10

How does the concept of 'interested parties' under Clause 4.2 influence an organisation's risk assessment scope?

Interested parties are only relevant to marketing, not the ISMSUnderstanding interested parties' relevant requirements (e.g. regulators, customers, partners) helps ensure the risk assessment and ISMS scope address obligations beyond the organisation's own internal preferencesInterested parties are irrelevant to risk assessmentOnly shareholders count as interested parties

Question 8 of 10

A certification body's surveillance audit identifies a major nonconformity related to access control. What is the typical consequence?

Surveillance audits cannot identify major nonconformities, only minor onesThe organisation must address the nonconformity, generally within a defined timeframe, or risk suspension or withdrawal of certificationNo consequence — surveillance audits are purely informationalCertification is immediately and permanently revoked with no opportunity to remediate

Question 9 of 10

Why might an organisation choose to align its ISO/IEC 27001 risk register with a broader enterprise risk management (ERM) framework?

There is no benefit to alignmentERM frameworks are incompatible with ISO/IEC 27001 by designAlignment is a mandatory certification requirement with a prescribed formatTo avoid siloed risk management and ensure information security risk is considered alongside other enterprise risks in overall risk appetite and governance decisions

Question 10 of 10

Which of the following would typically be reviewed as part of ISO/IEC 27001 management review inputs under a mature ISMS?

Select all that apply.

Status of actions from previous management reviewsResults of risk assessment and status of the risk treatment planChanges in external and internal issues relevant to the ISMSThe company's five-year-old marketing plan with no ISMS relevance

0 of 10 answered