exin ismp practice test

Information Security Management Professional based on ISO/IEC 27001

Last exam update: Nov 30 ,2025
Page 1 out of 2. Viewing questions 1-15 out of 30

Question 1

Zoning is a security control to separate physical areas with different security levels. Zones with higher
security levels can be secured by more controls. The facility manager of a conference center is
responsible for security.
What combination of business functions should be combined into one security zone?

  • A. Boardroom and general office space
  • B. Computer room and storage facility
  • C. Lobby and public restaurant
  • D. Meeting rooms and Human Resource rooms
Mark Question:
Answer:

C

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 2

Which security item is designed to take collections of data from multiple computers?

  • A. Firewall
  • B. Host-Based Intrusion Detection and Prevention System (Host-Based IDPS)
  • C. Network-Based Intrusion Detection and Prevention System (Network-Based IDPS)
  • D. Virtual Private Network (VPN)
Mark Question:
Answer:

C

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 3

A security manager just finished the final copy of a risk assessment. This assessment contains a list of
identified risks and she has to determine how to treat these risks.
What is the best option for the treatment of risks?

  • A. Begin risk remediation immediately as the organization is currently at risk
  • B. Decide the criteria for determining if the risk can be accepted
  • C. Design appropriate controls to reduce the risk
  • D. Remediate the risk regardless of cost
Mark Question:
Answer:

B

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 4

When should information security controls be considered?

  • A. After the risk assessment
  • B. As part of the scoping meeting
  • C. At the kick-off meeting
  • D. During the risk assessment work
Mark Question:
Answer:

A

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 5

A security architect argues with the internal fire prevention team about the statement in the
information security policy, that doors to confidential areas should be locked at all times. The
emergency
response
team
wants
to access to those areas in case of fire.
What is the best solution to this dilemma?

  • A. The security architect will be informed when there is a fire.
  • B. The doors should stay closed in case of fire to prevent access to confidential areas.
  • C. The doors will automatically open in case of fire.
Mark Question:
Answer:

C

User Votes:
A
50%
B
50%
C
50%
Discussions
vote your answer:
A
B
C
0 / 1000

Question 6

A risk manager is asked to perform a complete risk assessment for a company.
What is the best method to identify most of the threats to the company?

  • A. Have a brainstorm with representatives of all stakeholders
  • B. Interview top management
  • C. Send a checklist for threat identification to all staff involved in information security
Mark Question:
Answer:

A

User Votes:
A
50%
B
50%
C
50%
Discussions
vote your answer:
A
B
C
0 / 1000

Question 7

It is important that an organization is able to prove compliance with information standards and
legislation. One of the most important areas is documentation concerning access management. This
process
contains
a
number of activities including granting rights, monitoring identity status, logging, tracking access and
removing rights. Part of these controls are audit trail records which may be used as evidence for both
internal
and
external audits.
What component of the audit trail is the most important for an external auditor?

  • A. Access criteria and access control mechanisms
  • B. Log review, consolidation and management
  • C. System-specific policies for business systems
Mark Question:
Answer:

A

User Votes:
A
50%
B
50%
C
50%
Discussions
vote your answer:
A
B
C
0 / 1000

Question 8

What is the main reason to use a firewall to separate two parts of your internal network?

  • A. To control traffic intensity between two network segments
  • B. To decrease network loads
  • C. To enable the installation of an Intrusion Detection System
  • D. To separate areas with different confidentiality requirements
Mark Question:
Answer:

D

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 9

A company's webshop offers prospects and customers the possibility to search the catalog and place
orders around the clock. In order to satisfy the needs of both customer and business several
requirements
have
to
be met. One of the criteria is data classification.
What is the most important classification aspect of the unit price of an object in a 24h webshop?

  • A. Confidentiality
  • B. Integrity
  • C. Availability
Mark Question:
Answer:

C

User Votes:
A
50%
B
50%
C
50%
Discussions
vote your answer:
A
B
C
0 / 1000

Question 10

In a company the IT strategy is migrating towards a Service Oriented Architecture (SOA) so that
migrating to the cloud is better feasible in the future. The security architect is asked to make a first
draft
of
the
security
architecture.
Which elements should the security architect draft?

  • A. Management and control of the security services
  • B. The information security policy, the risk assessment and the controls in the security services
  • C. Which security services are provided and in which supporting architectures are they defined
Mark Question:
Answer:

C

User Votes:
A
50%
B
50%
C
50%
Discussions
vote your answer:
A
B
C
0 / 1000

Question 11

The information security architect of a large service provider advocates an open design of the
security architecture, as opposed to a secret design.
What is her main argument for this choice?

  • A. Open designs are easily configured.
  • B. Open designs have more functionality.
  • C. Open designs are tested extensively.
Mark Question:
Answer:

C

User Votes:
A
50%
B
50%
C
50%
Discussions
vote your answer:
A
B
C
0 / 1000

Question 12

When is revision of an employee’s access rights mandatory?

  • A. After any position change
  • B. At hire
  • C. At least each year
  • D. At all moments stated in the information security policy
Mark Question:
Answer:

D

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 13

An employee has worked on the organizational risk assessment. The goal of the assessment is not to
bring residual risks to zero, but to bring the residual risks in line with an organization's risk appetite.
When has the risk assessment program accomplished its primary goal?

  • A. Once the controls are implemented
  • B. Once the transference of the risk is complete
  • C. When decision makers have been informed of uncontrolled risks and proper authority groups decide to leave the risks in place
  • D. When the risk analysis is completed
Mark Question:
Answer:

C

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 14

In a company a personalized smart card is used for both physical and logical access control.
What is the main purpose of the person’s picture on the smart card?

  • A. To authenticate the owner of the card
  • B. To authorize the owner of the card
  • C. To identify the role of the card owner
  • D. To verify the iris of the card owner
Mark Question:
Answer:

A

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 15

What is a key item that must be kept in mind when designing an enterprise-wide information
security program?

  • A. When defining controls follow an approach and framework that is consistent with organizational culture
  • B. Determine controls in the light of specific risks an organization is facing
  • C. Put an enterprise-wide network and Host-Based Intrusion Detection and Prevention System (Host- Based IDPS) into place as soon as possible
  • D. Put an incident management and log file analysis program in place immediately
Mark Question:
Answer:

B

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000
To page 2