ISO 27001

ISO/IEC 27001 Practitioner

Name: eurocompliant.com AI Compliance Copilot
Price: 299 EUR
Author: eurocompliant.com

Implementing an ISMS in practice: risk treatment, the Statement of Applicability, and continual improvement.

12 questions · 75% to pass · free

eurocompliant.com is not an accredited certification body. This is a self-paced educational assessment; the certificate confirms completion only, not a professional, statutory, or accredited qualification.

Your details

Name *

Email *

We'll email your certificate here if you pass. We may occasionally follow up about eurocompliant.com - you can unsubscribe any time.

Question 1 of 12

Under Clause 6.1.3, after identifying risks, what must an organisation do to treat them?

Outsource all risk decisions to a single Annex A controlAutomatically accept every risk regardless of severitySelect a risk treatment option (e.g. modify, retain, avoid, share) and determine the controls necessary to implement the chosen optionNothing further is required once risks are identified

Question 2 of 12

Which of the following are recognised risk treatment options commonly referenced alongside ISO/IEC 27001 (via ISO 31000-aligned practice)?

Select all that apply.

Risk avoidanceRisk modification (applying controls)Ignoring the risk register entirelyRisk sharing (e.g. via insurance or a third party)

Question 3 of 12

What is the relationship between the Statement of Applicability and Annex A?

The SoA documents which Annex A controls are included/excluded and why, tailored to the organisation's specific risk treatment decisionsAnnex A controls are all mandatory with no exclusions ever permittedThe SoA replaces Annex A entirelyThe SoA has no relationship to Annex A

Question 4 of 12

Under Clause 9.1, what must an organisation determine regarding monitoring and measurement of the ISMS?

Measurement is entirely optional and unrelated to certificationWhat needs to be monitored/measured, the methods, when, and by whom, to ensure valid resultsOnly financial metrics matterNothing needs to be measured

Question 5 of 12

What is the purpose of a management review, as implied by the PDCA (Plan-Do-Check-Act) cycle underlying ISO/IEC 27001?

For top management to review the ISMS's continuing suitability, adequacy and effectiveness at planned intervalsIt has no defined purposeTo set the company's advertising budgetTo replace internal audits entirely

Question 6 of 12

Under Clause 7.2, what must an organisation do regarding competence of persons doing work affecting information security performance?

Nothing — competence is irrelevant to the ISMSDetermine necessary competence, ensure persons are competent (e.g. via training/experience), and retain evidenceCompetence only matters for external auditorsOnly the CEO needs to be competent

Question 7 of 12

Which Annex A control area would 'access control' most naturally fall under?

None — access control is not addressed by Annex AA.8 Technological controlsA.7 Physical controls exclusivelyA.5 Organizational controls exclusively, never technological

Question 8 of 12

What does 'continual improvement' under Clause 10.2 require of an organisation?

No action — the clause is aspirational onlyImprovement only after a nonconformity is found, and never otherwiseContinually improving the suitability, adequacy and effectiveness of the ISMSA one-time improvement effort at initial certification only

Question 9 of 12

An organisation can achieve ISO/IEC 27001 certification while excluding some Annex A controls, provided the exclusion is justified in the Statement of Applicability and does not affect the organisation's ability to meet its risk treatment decisions.

TrueFalse

Question 10 of 12

What is the significance of Clause 4 ('context of the organisation') to the rest of the ISMS?

It is only relevant to organisations with international operationsIt only concerns the organisation's physical office locationIt establishes understanding of internal/external issues and interested parties' needs, which shapes the scope and risk assessment that followIt has no bearing on later clauses

Question 11 of 12

How does an internal audit programme under Clause 9.2 typically relate to the certification (external) audit?

Internal audits are conducted by or on behalf of the organisation itself and feed into readiness for the independent external certification auditThey are the same audit performed by the same partyInternal audits replace the need for a certification body entirelyInternal audits are only required after certification is achieved, never before

Question 12 of 12

Nonconformities identified during an ISO/IEC 27001 internal audit must always result in the organisation losing its certification.

TrueFalse

0 of 12 answered