Practice quiz · 8 questions

ISO/IEC 27001:2022 information security

Risk assessment and treatment, the Statement of Applicability and the Annex A control themes.

Practice questions, not official exam questions. Written by ISO Me to help you revise; real exams differ by scheme and provider.

Q1 How many controls are in Annex A of ISO/IEC 27001:2022?

A 114
B 93
C 38
D 133

Answer and explanation

Answer: B. The 2022 edition has 93 controls; the 2013 edition had 114.

Reference: ISO/IEC 27001:2022 Annex A

Q2 Which are the four Annex A control themes?

A Organizational, people, physical, technological
B Plan, do, check, act
C Confidentiality, integrity, availability, privacy
D Policy, process, product, people

Answer and explanation

Answer: A. Annex A groups controls into organizational (A.5), people (A.6), physical (A.7) and technological (A.8).

Reference: ISO/IEC 27001:2022 Annex A

Q3 Which theme contains the most controls?

A People
B Physical
C Organizational
D Technological

Answer and explanation

Answer: C. Organizational 37, technological 34, physical 14, people 8.

Reference: ISO/IEC 27001:2022 Annex A

Q4 The Statement of Applicability is produced as part of:

A Information security risk treatment (6.1.3)
B Management review (9.3)
C Competence (7.2)
D Internal audit (9.2)

Answer and explanation

Answer: A. Risk treatment determines the necessary controls, compares them with Annex A and records them, with justifications, in the Statement of Applicability.

Reference: ISO/IEC 27001 clause 6.1.3

Q5 ISO/IEC 27002 is:

A A certifiable requirements standard
B Guidance on information security controls
C A privacy standard for processors
D The auditing guideline for ISMS

Answer and explanation

Answer: B. ISO/IEC 27002 gives guidance on the controls; organisations certify against ISO/IEC 27001.

Reference: ISO/IEC 27000 family

Q6 Information security is about preserving:

A Confidentiality, integrity and availability
B Cost, quality and delivery
C Accuracy, speed and reliability
D Privacy, ethics and transparency

Answer and explanation

Answer: A. Confidentiality, integrity and availability (CIA) of information.

Reference: ISO/IEC 27001 concepts

Q7 Which clause was added in the 2022 edition?

A 6.3 Planning of changes
B 9.2 Internal audit
C 5.2 Policy
D 4.3 Scope

Answer and explanation

Answer: A. The 2022 edition aligned with the updated structure and added 6.3 Planning of changes.

Reference: ISO/IEC 27001:2022

Q8 How many controls are in the “people” theme?

A 8
B 14
C 34
D 37

Answer and explanation

Answer: A. People controls (A.6) number 8 — screening, terms of employment, awareness and training, disciplinary process and so on.

Reference: ISO/IEC 27001:2022 Annex A