Questions for the ISMP were updated on : Nov 21 ,2025
What is the best way to start setting the information security controls?
C
Security monitoring is an important control measure to make sure that the required security level is
maintained. In order to realize 24/7 availability of the service, this service is outsourced to a partner
in the cloud.
What should be an important control in the contract?
D
What needs to be decided prior to considering the treatment of risks?
A
The information security manager is writing the Information Security Management System (ISMS)
documentation. The controls that are to be implemented must be described in one of the phases of
the
Plan-Do-
Check-Act (PDCA) cycle of the ISMS.
In which phase should these controls be described?
A
The ambition of the security manager is to certify the organization against ISO/IEC 27001.
What is an activity in the certification program?
D
The Board of Directors of an organization is accountable for obtaining adequate assurance.
Who should be responsible for coordinating the information security awareness campaigns?
C
A protocol to investigate fraud by employees is being designed.
Which measure can be part of this protocol?
B
What is a risk treatment strategy?
B
An experienced security manager is well aware of the risks related to communication over the
internet. She also knows that Public Key Infrastructure (PKI) can be used to keep e-mails between
employees confidential.
Which is the main risk of PKI?
A
A security manager for a large company has the task to achieve physical protection for corporate
data stores.
Through which control can physical protection be achieved?
D
An information security officer is asked to write a retention policy for a financial system. She is aware
of the fact that some data must be kept for a long time and other data must be deleted.
Where should she look for guidelines first?
C
The handling of security incidents is done by the incident management process under guidelines of
information security management. These guidelines call for several types of mitigation plans.
Which mitigation plan covers short-term recovery after a security incident has occurred?
C
Who should be asked to check compliance with the information security policy throughout the
company?
B
The security manager of a global company has decided that a risk assessment needs to be completed
across the company.
What is the primary objective of the risk assessment?
B
Recovery Time Objective (RTO) and Recovery Point Objective (RPO) are key terms in business
continuity management (BCM). Reducing loss of data is one of the focus areas of a BCM policy.
What requirement is in the data recovery policy to realize minimal data loss?
B