I27001F CertiProf Certified ISO/IEC 27001:2022 Foundation Free Practice Exam Questions (2026 Updated)

The three fundamental properties of information security are confidentiality, integrity, and availability, often referred to as the CIA triad. Confidentiality means information is accessible only to authorized persons or entities. Integrity means safeguarding the accuracy and completeness of information. Availability means information and associated assets are accessible and usable when required. These principles are foundational within ISO/IEC 27001 and ISO/IEC 27002. Therefore, option B is correct.

=======

Annex A of ISO/IEC 27001:2022 contains the reference set of information security controls used to support risk treatment decisions. In the 2022 edition, these controls are organized into four themes: organizational, people, physical, and technological controls. Annex A is not a set of ISMS implementation steps and it is not a risk management guideline. Its role is to provide a structured set of control objectives and controls that may be selected as part of risk treatment. Therefore, option B is the correct answer.

=======

Clause 4.3 of ISO/IEC 27001:2022 requires the organization to determine the boundaries and applicability of the ISMS. When determining the scope, the organization must consider the external and internal issues referred to in clause 4.1, the requirements referred to in clause 4.2, and interfaces and dependencies between activities performed by the organization and those performed by other organizations. Therefore, option D is the correct answer.

=======

ISO/IEC 27001:2022 requires top management to demonstrate leadership and commitment by ensuring that the information security policy and information security objectives are established and are compatible with the strategic direction of the organization. Top management must also integrate ISMS requirements into the organization’s processes, ensure resources are available, support relevant roles, and promote continual improvement. The standard does not allow leadership accountability to be replaced by a consultant or a volunteer. Therefore, option A is correct.

=======

In ISO/IEC 27001:2022, the Statement of Applicability is a required documented output of the information security risk treatment process. It must contain the necessary controls, including whether they are implemented, and the justification for their inclusion. It must also include justification for excluding controls from Annex A when they are not applicable. Therefore, all three elements listed in options A, B, and C are part of a proper Statement of Applicability, making option D the correct answer.

=======

A specific leadership responsibility in ISO/IEC 27001:2022 is for top management to communicate the importance of effective information security management and of conforming to the ISMS requirements. This communication role is part of demonstrating leadership and commitment, helping create organizational awareness and support for the ISMS. Therefore, option B is correct.

=======

ISO/IEC 27001:2022 requires the organization to establish and maintain information security risk criteria, identify information security risks, and identify risk owners as part of the risk assessment process. These activities are core elements of clause 6 on planning and risk assessment. Since all of the listed options are required parts of the process, the correct answer is D.

ISO/IEC 27001:2022 requires the organization to plan, establish, implement, and maintain an audit programme that takes into consideration the importance of the processes concerned and the results of previous audits. This ensures that audit effort is focused appropriately and that past issues are followed up effectively. The standard does not prescribe a minimum of two audits in the first year, nor does it make certification body availability or supplier count the defining factors. Therefore, option C is correct.

=======

ISO/IEC 27001:2022 requires the organization to determine what needs to be monitored and measured, including information security processes and controls, the methods for monitoring, measurement, analysis, and evaluation, when these activities will be performed, and when the results will be analyzed and evaluated. The standard does not mandate a specific tool, consultant, or designated individual for compliance. Therefore, option C is the correct answer.

=======

ISO/IEC 27001:2022 requires documented information to be controlled so that it is available and suitable for use where and when needed, and adequately protected. The standard does not require purchasing software, hiring consultants, or assigning external validation as mandatory conditions for compliance. Those may be organizational choices, but they are not requirements of the standard. Therefore, option A is the correct answer.

=======

The standard requires top management to review the ISMS at planned intervals. This review is intended to confirm the continuing suitability, adequacy, and effectiveness of the ISMS. While auditors, process owners, and certification bodies may provide inputs or findings, the management review itself is a responsibility of top management. Therefore, option D is the correct answer.

=======