APMG-International ISO/IEC 27001 (2022) Foundation - ISO-IEC-27001-Foundation Exam Questions [2026]

QUESTION NO: 1
What is a vulnerability?

A. A security incident B. An information asset C. A weakness that can be exploited by a threat D. A type of malware

Correct Answer: C

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 2
What is the purpose of corrective action in ISO/IEC 27001?

A. To increase the number of controls B. To perform an external audit C. To punish employees D. To eliminate the cause of a nonconformity and prevent recurrence

Correct Answer: D

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 3
What is a requirement for a corrective action made in response to a nonconformity?

A. They always eliminate the cause of the nonconformity B. They are proportionate to the likelihood of the nonconformity recurring C. They do NOT change the organization's information security policies D. They are appropriate to the effects of the nonconformity

Correct Answer: D

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 4
Which statement about the conduct of audits is true?

A. During Stage 1 of a certification audit, evidence is collected by observing activities B. Third party audits are conducted by a customer of the organization C. The certificate issued after a successful re-certification audit in typical schemes lasts for one year D. One of the focus areas for a surveillance audit is the output from internal audits and management reviews

Correct Answer: D

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 5
Which document lists the security controls that are applicable to the organization?

A. Risk Register B. Statement of Applicability (SoA) C. Information Security Policy D. Business Continuity Plan

Correct Answer: B

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 6
Which activity is an operational planning and control requirement?

A. Scheduling of second party audits B. Review the consequences of unintended changes C. Document information security objectives D. Perform information security risk assessments at planned intervals

Correct Answer: B

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 7
What is required to be reported by the Information security event reporting control?

A. Observed or suspected events B. Information disclosure C. Asset disposal D. Unauthorized access

Correct Answer: A

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 8
Who is required to ensure that staff are supported so that they can contribute to the information security management system?

A. ISO/IEC 27001 practitioners within the organization B. Top management of the organization C. Management responsible for each area of operation D. Auditors who audit each area of operation

Correct Answer: B

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).