NO.12 An organization uses an access control software that allows only authorized employees to access sensitive files. What type of control is this?

NO.13 During which phase of the Plan-Do-Check-Act cycle do organizations maintain and improve the information security management system?

NO.14 In which group of controls does Control 7.9 Security of assets off-premises belong?

NO.15 What is continual improvement?

NO.16 What should the organization’s management define and approve to ensure appropriate direction and support for information security?

NO.17 When can clock synchronization be difficult?

NO.18 Which situation presented below indicates that the confidentiality of information has been breached?

NO.19 According to Control 5.1 Policies for information security, regarding which of the following, among others, should an information security policy contain statements?

NO.20 Which control of ISO/IEC 27002 aims to ensure the correct and secure operation of information processing facilities?

NO.21 What should be considered, among others, when establishing a remote working policy?

NO.22 An organization has established and maintains contact with special interest groups with which it shares and obtains information about security threats, vulnerabilities, trends, etc. Based on ISO/IEC 27002, is this a good practice?

NO.23 According to Control 5.27 Learning from information security incidents, how can organizations use the information gained from the evaluation of information security incidents?

NO.24 What should the organization do with regard to the information security roles and responsibilities of an employee who is leaving or changing the job role?

NO.25 Which of the following controls aims to ensure the integrity of operational systems and prevent exploitation of technical vulnerabilities?

NO.26 What should an organization do if it detects a vulnerability that does not have a corresponding threat?

NO.27 Which of the following controls should the organization implement to ensure that its approach to managing information security continues to be suitable, adequate and effective?

NO.28 According to ISO/IEC 27002, which of the following statements is correct?