APMG-International ISO-IEC-27001-Foundation Exam Dumps

Clause 8.1 (Operational planning and control) requires organizations to:

''Ensure that changes are controlled. The organization shall review the consequences of unintended changes, taking action to mitigate any adverse effects, as necessary.''

This requirement ensures that operational processes are planned, controlled, and adjusted where unexpected changes occur. Risk assessments (B) are covered in Clause 6.1.2 (Planning), not operations. Scheduling second-party audits (C) is not an ISMS requirement but part of supplier/customer arrangements. Documenting objectives (D) belongs to Clause 6.2 (Planning).

Thus, the required operational planning and control activity is A: Review the consequences of unintended changes.

Clause 6.2 (Information security objectives) requires that objectives:

''be consistent with the information security policy''

''be measurable (if practicable)''

''take into account applicable information security requirements''

''be monitored, communicated, and updated as appropriate.''

From this, option A is correct since consistency with policy is an explicit requirement. Option B is incorrect because the standard allows objectives to be measurable ''if practicable'' (not mandatory for all). Option C is incorrect---objectives are not transferred contractually to third parties, though third-party agreements may include security requirements. Option D is incorrect because the standard requires regular review ''as appropriate,'' not a fixed annual cycle.

Thus, the verified requirement is A: They shall be consistent with the information security policy.

ISO/IEC 27001 requires internal audits and sets out how they must be conducted: ''The organization shall conduct internal audits at planned intervals...'' (9.2.1) and ''plan, establish, implement and maintain an audit programme(s)... [and] select auditors and conduct audits that ensure objectivity and the impartiality of the audit process'' (9.2.2). These extracts confirm that practitioners (internal to the organization) can conduct internal audits provided objectivity and impartiality are ensured (e.g., they do not audit their own work). Surveillance audits (option A) and audits of Accredited Training Organizations or Certification Bodies (options C, D) are third-party activities outside the remit of an internal practitioner under ISO/IEC 27001; the standard's audit requirement is focused on the organization's own internal audit programme. Therefore, conducting an internal audit (B) is the correct practitioner activity per Clause 9.2.

The benefits of implementing an ISMS under ISO/IEC 27001 are well established. Clause 0.1 (General) explains that an ISMS provides a systematic approach to managing sensitive information and ''preserves confidentiality, integrity, and availability of information by applying a risk management process and gives confidence to interested parties that risks are adequately managed.''

Option A is correct as a benefit, since trust and confidence from stakeholders is an outcome of compliance. Option C is also a benefit, since controls are chosen and tailored based on organizational context and risk assessment (Clause 6.1.3). Option D reflects another real benefit---reducing the probability and/or impact of incidents through effective risk management.

However, staff qualifications (option B) are not guaranteed benefits of implementing an ISMS. While training and competence (Clause 7.2) are required, the standard does not require or provide ISO/IEC 27001 Foundation-level certification for staff. That is an external training/certification scheme, not an ISMS outcome.

Therefore, the benefit NOT relevant to implementing ISO/IEC 27001 is B.

Clause 5.2 (Information security policy) requires that the policy:

''includes information security objectives (or provides a framework for setting them)''

''includes a commitment to satisfy applicable requirements related to information security''

''includes a commitment to continual improvement of the ISMS.''

Among the listed options, the exact mandatory requirement is ''a commitment to satisfy applicable requirements related to information security''. Option B partially reflects Clause 5.2 (commitment to continual improvement), but the wording given in the standard prioritizes the satisfaction of applicable requirements (e.g., legal, regulatory, contractual). Option C is not a policy requirement. Option D (Statement of Applicability) is a separate mandatory document (Clause 6.1.3) and not part of the policy itself.

Thus, the correct answer is A.