APMG-International ISO-IEC-27001-Foundation Exam Dumps

Clause 6.1.1 (Planning) states:

''The organization shall plan:

d) actions to address these risks and opportunities; and

e) how to:

integrate and implement the actions into its ISMS processes; and

evaluate the effectiveness of these actions.''

This confirms the missing words are ''evaluate the effectiveness of''. Communication (A), applying resources (B), and improving effectiveness (C) are important concepts elsewhere but not the direct requirement stated in this clause.

Clause 9.3.2 (Management Review Inputs) states that management reviews shall include:

''c) information on the information security performance, including trends in: (1) nonconformities and corrective actions; (2) monitoring and measurement results; (3) audit results; and (4) fulfilment of information security objectives.''

This makes achievement of information security objectives (option A) a required trend to be considered. While external/internal requirements (C) and continual improvement opportunities (D) are also part of management review inputs, they are not specifically listed under ''trends in performance.'' Option B is outside the direct requirement.

Thus, the verified answer is A.

Clause 5.1 (Leadership and Commitment) requires top management to demonstrate leadership by:

''ensuring the information security policy and the information security objectives are established and are compatible with the strategic direction of the organization;''

''ensuring the integration of the ISMS requirements into the organization's processes;''

''ensuring that the resources needed for the ISMS are available;''

Among the options, the one explicitly mandated is ensuring that information security objectives are established. Risk assessments (C) and implementing audit actions (D) are responsibilities of management but not the direct leadership evidence required in Clause 5.1. Communicating interested party feedback (A) is relevant but not specifically cited as leadership evidence. Thus, the verified answer is B.

Comprehensive and Detailed Explanation From Exact Extract ISO/IEC 27000 standards:

According to ISO/IEC 27000:2018, Clause 3.74, a threat is defined as:

''Potential cause of an unwanted incident, which can result in harm to a system or organization.''

This definition directly matches option A.

Option B refers to an ''information security incident'' (ISO/IEC 27000:2018, Clause 3.32).

Option C describes a ''vulnerability'' (ISO/IEC 27000:2018, Clause 3.67).

Option D refers to ''residual risk'' (ISO/IEC 27000:2018, Clause 3.61).

The standard emphasizes that threats exploit vulnerabilities, causing incidents that can harm information confidentiality, integrity, and availability. Correctly identifying threats is critical for risk assessment (Clause 6.1.2). Thus, the correct definition per ISO/IEC 27000 is A.

Clause 8.1 (Operational planning and control) requires organizations to:

''Ensure that changes are controlled. The organization shall review the consequences of unintended changes, taking action to mitigate any adverse effects, as necessary.''

This requirement ensures that operational processes are planned, controlled, and adjusted where unexpected changes occur. Risk assessments (B) are covered in Clause 6.1.2 (Planning), not operations. Scheduling second-party audits (C) is not an ISMS requirement but part of supplier/customer arrangements. Documenting objectives (D) belongs to Clause 6.2 (Planning).

Thus, the required operational planning and control activity is A: Review the consequences of unintended changes.