ISO 27001 ACTUAL STUDY GUIDE QUESTIONS
AND ANSWERS SURE A+
✔✔1. In statistical terms, _______________ approach is known as the study of a
population by studying representative samples.
A. Synthesis
B. Decomposition
C. Analysis - ✔✔C. Analysis
✔✔1. The practice of producing information based on quantitative empirical data is
known as:
A. Empirics
B. Samples
C. Statistics - ✔✔C. Statistics
✔✔1. Which sampling method is more complex and usually more time consuming to
perform?
A. Interval sampling
B. Systematic sampling
C. Random sampling - ✔✔C. Random sampling
✔✔1. Which option best describes evaluation in auditing?
A. An objective procedure
B. Assessment of nonconformity
C. A subjective procedure - ✔✔C. A subjective procedure
✔✔1. How can an auditor avoid disrupting the auditee's operations?
A. By developing audit test plans using only observation
B. By conducting virtual audits
C. By grouping audit test plans - ✔✔C. By grouping audit test plans
, ✔✔1. To verify conformity to clause 7.5.3 Control of documented information of ISO/IEC
27001, the audit team has validated the electronic structure for classifying and storing
documented information. What type of audit procedure has been used?
A. Technical verification
B. Analysis
C. Documented information review - ✔✔A. Technical verification
✔✔1. Which document can serve as audit evidence to verify conformity to clause 4.3
Determining the scope of the information security management system of ISO/IEC
27001?
A. Statement of Applicability
B. Information security policy
C. Risk assessment report - ✔✔A. Statement of Applicability
✔✔1. Which of the following is considered as audit evidence when verifying conformity
to clause 10.1 Nonconformity and corrective action of ISO/IEC 27001?
A. Risk treatment results
B. Preventive action results
C. Management review results - ✔✔C. Management review results
✔✔1. A combination of audit test plans should be used to verify conformity to the
standard requirements.
A. True
B. False - ✔✔A. True
✔✔DeeCorp, established in 1989, is one of the first companies to offer wireless
technology services in South America. With more than 400 employees, they specialize
in providing innovative engineering services, including network planning, deployment,
integration, and optimization. Complying with ISO/IEC 27001 is very important to
DeeCorp. They hope to finally gain their certification this year.
Eva was appointed to be the audit team leader for DeeCorp's audit. Her job was to
evaluate the current state of DeeCorp's information security management system and
present the audit findings in a comprehensive report. This would allow her to determine
whether she should issue a recommendation for certification to DeeCorp.
Eva has thorough theoretical and practical knowledge of the audit principles and
procedures. She is also experienced in information security. Her team consisted of two
other auditors, Tom and Ben. Eva has alrea - ✔✔C. No, the determined sample size is
significantly low compared to DeeCorp's population, as according to the general
principles, for a population higher than 366, the minimum number of the sample size
should be 25
✔✔1. According to the scenario, Eva wanted an easy-to-use and statistically reliable
sampling method. Which method fits that description?
A. Random sampling
B. Systematic sampling
AND ANSWERS SURE A+
✔✔1. In statistical terms, _______________ approach is known as the study of a
population by studying representative samples.
A. Synthesis
B. Decomposition
C. Analysis - ✔✔C. Analysis
✔✔1. The practice of producing information based on quantitative empirical data is
known as:
A. Empirics
B. Samples
C. Statistics - ✔✔C. Statistics
✔✔1. Which sampling method is more complex and usually more time consuming to
perform?
A. Interval sampling
B. Systematic sampling
C. Random sampling - ✔✔C. Random sampling
✔✔1. Which option best describes evaluation in auditing?
A. An objective procedure
B. Assessment of nonconformity
C. A subjective procedure - ✔✔C. A subjective procedure
✔✔1. How can an auditor avoid disrupting the auditee's operations?
A. By developing audit test plans using only observation
B. By conducting virtual audits
C. By grouping audit test plans - ✔✔C. By grouping audit test plans
, ✔✔1. To verify conformity to clause 7.5.3 Control of documented information of ISO/IEC
27001, the audit team has validated the electronic structure for classifying and storing
documented information. What type of audit procedure has been used?
A. Technical verification
B. Analysis
C. Documented information review - ✔✔A. Technical verification
✔✔1. Which document can serve as audit evidence to verify conformity to clause 4.3
Determining the scope of the information security management system of ISO/IEC
27001?
A. Statement of Applicability
B. Information security policy
C. Risk assessment report - ✔✔A. Statement of Applicability
✔✔1. Which of the following is considered as audit evidence when verifying conformity
to clause 10.1 Nonconformity and corrective action of ISO/IEC 27001?
A. Risk treatment results
B. Preventive action results
C. Management review results - ✔✔C. Management review results
✔✔1. A combination of audit test plans should be used to verify conformity to the
standard requirements.
A. True
B. False - ✔✔A. True
✔✔DeeCorp, established in 1989, is one of the first companies to offer wireless
technology services in South America. With more than 400 employees, they specialize
in providing innovative engineering services, including network planning, deployment,
integration, and optimization. Complying with ISO/IEC 27001 is very important to
DeeCorp. They hope to finally gain their certification this year.
Eva was appointed to be the audit team leader for DeeCorp's audit. Her job was to
evaluate the current state of DeeCorp's information security management system and
present the audit findings in a comprehensive report. This would allow her to determine
whether she should issue a recommendation for certification to DeeCorp.
Eva has thorough theoretical and practical knowledge of the audit principles and
procedures. She is also experienced in information security. Her team consisted of two
other auditors, Tom and Ben. Eva has alrea - ✔✔C. No, the determined sample size is
significantly low compared to DeeCorp's population, as according to the general
principles, for a population higher than 366, the minimum number of the sample size
should be 25
✔✔1. According to the scenario, Eva wanted an easy-to-use and statistically reliable
sampling method. Which method fits that description?
A. Random sampling
B. Systematic sampling
