Free GAQM ISO-CLA-22 Exam Questions

Question 1

In establishing an ISMS, which principle most directly addresses the ongoing monitoring and adjustment of security controls based on performance and changing threat landscape?

A : Continual Improvement

B : Risk-Based Thinking

C : Management Responsibility

D : Process Approach

Answer: A

Question 2

Regarding the effectiveness of corrective actions after an ISO 27001 audit, what's the auditor's MOST important responsibility?

A : Ensuring all corrective actions are implemented precisely as recommended by the auditor.

B : Verifying that corrective actions address the root cause of the nonconformity and prevent recurrence.

C : Approving the budget for implementing all corrective actions.

D : Training the auditee's employees on the correct way to implement corrective actions.

Answer: B

Question 3

Considering resource allocation, which activity MOST significantly impacts the effectiveness of the audit program when managing multiple ISO/IEC 27001 audits across different departments with varying risk profiles?

A : Providing generic checklists applicable to all departments to ensure consistency.

B : Allocating auditor time and expertise proportionally to the risk profile and complexity of each department's ISMS.

C : Scheduling all departmental audits consecutively to minimize travel expenses for the audit team.

D : Using only internal auditors to reduce external audit costs and maintain confidentiality.

Answer: B

Question 4

Imagine a significant data breach occurs after an ISO 27001 certification audit. The auditor's report stated no major nonconformities regarding access controls. Which action is MOST appropriate for the certified organization immediately?

A : Ignore the breach as the organization is already certified and a subsequent audit will address it.

B : Immediately notify the certification body (CB) of the breach and initiate a thorough investigation to determine if there were any systemic failures not identified during the audit.

C : Issue a press release stating the organization is ISO 27001 certified, therefore, the breach was likely an external attack and not an internal control failure.

D : Wait for the next surveillance audit to inform the CB about the breach and any corrective actions taken.

Answer: B

Question 5

Considering resource allocation, which activity MOST significantly impacts the effectiveness of the audit program when managing multiple ISO/IEC 27001 audits across different departments with varying risk profiles?

A : Providing generic checklists applicable to all departments to ensure consistency.

B : Allocating auditor time and expertise proportionally to the risk profile and complexity of each department's ISMS.

C : Scheduling all departmental audits consecutively to minimize travel expenses for the audit team.

D : Using only internal auditors to reduce external audit costs and maintain confidentiality.

Answer: B