Free APMG-International ISO-IEC-27001-Foundation Practice Exam with Questions & Answers | Set: 2

The benefits of implementing an ISMS under ISO/IEC 27001 are well established. Clause 0.1 (General) explains that an ISMS provides asystematic approach to managing sensitive informationand “preserves confidentiality, integrity, and availability of information by applying a risk management process and gives confidence to interested parties that risks are adequately managed.”

Option A is correct as a benefit, since trust and confidence from stakeholders is an outcome of compliance. Option C is also a benefit, since controls are chosen and tailored based on organizational context and risk assessment (Clause 6.1.3). Option D reflects another real benefit—reducing the probability and/or impact of incidents through effective risk management.

However,staff qualifications (option B)are not guaranteed benefits of implementing an ISMS. While training and competence (Clause 7.2) are required, the standard does not require or provide ISO/IEC 27001 Foundation-level certification for staff. That is an external training/certification scheme, not an ISMS outcome.

Therefore, the benefitNOT relevantto implementing ISO/IEC 27001 isB.

Clause 5.2 (Information security policy) requires that the policy:

“includes information security objectives (or provides a framework for setting them)”

“includes a commitment to satisfy applicable requirements related to information security”

“includes a commitment to continual improvement of the ISMS.”

Among the listed options, the exact mandatory requirement is“a commitment to satisfy applicable requirements related to information security”. Option B partially reflects Clause 5.2 (commitment to continual improvement), but the wording given in the standard prioritizes the satisfaction of applicable requirements (e.g., legal, regulatory, contractual). Option C is not a policy requirement. Option D (Statement of Applicability) is a separate mandatory document (Clause 6.1.3) and not part of the policy itself.

Thus, the correct answer isA.

Clause 6.2 (Information security objectives) requires that objectives:

“be consistent with the information security policy”

“be measurable (if practicable)”

“take into account applicable information security requirements”

“be monitored, communicated, and updated as appropriate.”

From this, option A is correct since consistency with policy is an explicit requirement. Option B is incorrect because the standard allows objectives to be measurable “if practicable” (not mandatory for all). Option C is incorrect—objectives are not transferred contractually to third parties, though third-party agreements may include security requirements. Option D is incorrect because the standard requires regular review “as appropriate,” not a fixed annual cycle.

Thus, the verified requirement isA: They shall be consistent with the information security policy.

The requirements for internal audit are explicitly placed inClause 9.2 (Performance Evaluation)of ISO/IEC 27001:2022. The standard requires:

“The organization shall conduct internal audits at planned intervals to provide information on whether the information security management system… conforms to the organization’s own requirements… and to the requirements of this document.” (9.2.1)

“The organization shall plan, establish, implement and maintain an audit programme(s)…” (9.2.2)

This clause clearly falls underPerformance Evaluation (Clause 9), not Planning (Clause 6), Operation (Clause 8), or Improvement (Clause 10). Therefore, the correct answer isC.

ISO/IEC 27001 makes clear that the ISMS is intended to be tailored to the organization. The standard states: “This document also includes requirements for the assessment and treatment of information security risks tailored to the needs of the organization. The requirements set out in this document are generic and are intended to be applicable to all organizations regardless of type, size or nature.” This means implementation is scaled based on each organization’s risk, context, and needs, not a fixed one-size-fits-all set of activities or controls. Clause 6.1.3 further reinforces that control selection is flexible and risk-driven: “Organizations can design controls as required or identify them from any source,” and “Annex A contains a list of possible information security controls… The information security controls listed in Annex A are not exhaustive and additional information security controls can be included if needed.” Together, these extracts verify that the ISMS implementation is influenced by and scaled to the organization’s needs and selected controls, not separated from management processes (A, D) nor mandated to include “all controls” (B).