ISO-IEC-27002-Foundation Exam Dumps - PECB ISO 27002 Questions and Answers

Information security determines both what needs to be protected and how protection should be applied. The first part is understanding information assets, their value, their sensitivity, their owners, their business purpose, and the consequences if they are disclosed, altered, lost, or unavailable. This answers what must be protected and why. The second part is understanding threats, vulnerabilities, risk levels, legal obligations, contractual duties, and control options. This answers what the information must be protected from and how security controls should be designed. ISO/IEC 27002 supports both dimensions. Asset inventory and classification clarify protection needs. Access control, cryptography, backup, logging, network security, secure development, incident management, and physical security define protection methods. Option A is correct but incomplete. Option B is also correct but incomplete. Option C is therefore the verified answer because information security is a complete discipline covering asset understanding, risk understanding, control selection, implementation, monitoring, and improvement. The ISO/IEC 27002 control set is structured to support that full protection lifecycle. References/Chapters: ISO/IEC 27002:2022, Control 5.9 Inventory of information and other associated assets; Control 5.12 Classification of information; Controls 5–8.

Management should define and approve an information security policy to provide direction and support for information security. In ISO/IEC 27002:2022, Control 5.1 requires policies for information security to be defined, approved by management, published, communicated to relevant personnel and interested parties, and reviewed at planned intervals or when significant changes occur. The policy establishes management intent, expectations, responsibilities, and the basis for more detailed topic-specific policies. Option B, a risk management program, is important, but it is not the specific item required by this control to provide overall direction and support. Option C, a list of assets, is also important because asset inventories support control implementation, but it does not replace the policy framework. The policy is the governing statement that aligns information security with business objectives, legal requirements, and risk treatment. It gives authority to procedures, standards, and operational controls. Therefore, the correct answer is option A, understood as the organization’s information security policy. References/Chapters: ISO/IEC 27002:2022, Control 5.1 Policies for information security; Control 5.2 Information security roles and responsibilities; Control 5.9 Inventory of information and other associated assets.

==========