EXIN Information Security Management Professional based on ISO/IEC 27001

EXIN Information Security Management Professional based on ISO/IEC 27001 - ISMP Exam Questions

QUESTION NO: 1
An employee has worked on the organizational risk assessment. The goal of the assessment is not to bring residual risks to zero, but to bring the residual risks in line with an organization's risk appetite.
When has the risk assessment program accomplished its primary goal?

A. When the risk analysis is completed B. When decision makers have been informed of uncontrolled risks and proper authority groups decide to leave the risks in place C. Once the controls are implemented D. Once the transference of the risk is complete

Correct Answer: B

QUESTION NO: 2
What is the best way to start setting the information security controls?

A. Use a standard security baseline B. Implement the security measures as prescribed by a risk analysis tool C. Resort back to the default factory standards

Correct Answer: A

QUESTION NO: 3
What is a key item that must be kept in mind when designing an enterprise-wide information security program?

A. Put an incident management and log file analysis program in place immediately B. Determine controls in the light of specific risks an organization is facing C. When defining controls follow an approach and framework that is consistent with organizational culture D. Put an enterprise-wide network and Host-Based Intrusion Detection and Prevention System (Host-Based IDPS) into place as soon as possible

Correct Answer: B

QUESTION NO: 4
When should information security controls be considered?

A. During the risk assessment work B. As part of the scoping meeting C. After the risk assessment D. At the kick-off meeting

Correct Answer: C