時間が経つとともに、Tech4Examはより多くの受験生から大好評を博します。弊社のISO-IEC-27002-Foundation資料は99％の成功率を持っていますから、弊社のPECBのISO-IEC-27002-Foundation練習問題を利用したら、最もよい結果を得ることができます。弊社のISO-IEC-27002-Foundation練習問題さえ使用すれば試験の成功までもっと近くなります。
| トピック | 出題範囲 |
|---|---|
| トピック 1 |
|
| トピック 2 |
|
| トピック 3 |
|
>> PECB ISO-IEC-27002-Foundation専門トレーリング <<
我々はISO-IEC-27002-Foundation問題集の英語版と日本語版を開発しています。英語版と日本語版の内容が同じですが、言葉だけ違います。ISO-IEC-27002-Foundation問題集に英語試験と日本語試験を準備する受験者たちは気楽に試験に合格することができます。それに、我々のPECBのISO-IEC-27002-Foundation日本語版問題集を購入するなら、英語版をおまけにさし上げます。
質問 # 72
An organization uses an access control software that allows only authorized employees to access sensitive files. What type of control is this?
正解：B
解説：
Access control software that allows only authorized employees to access sensitive files is a preventive control.
Its purpose is to stop unauthorized access before it occurs by enforcing approved access rules. In ISO/IEC
27002, access control is implemented through policies, identity management, authentication, authorization, access rights review, privileged access control, and restrictions on information access. This type of software can prevent unauthorized disclosure, unauthorized modification, misuse of sensitive data, and violation of privacy or contractual obligations. It is not primarily detective because it does not merely discover an event after it has happened. It is not corrective because it does not restore damaged information or reverse the impact of an incident. Its security value is in blocking access attempts that do not meet authorization criteria.
The principle behind the control is least privilege: users should receive only the access necessary for their role and responsibilities. For sensitive files, this is especially important because confidentiality, integrity, and accountability depend on correct authorization. References/Chapters: ISO/IEC 27002:2022, Control 5.15 Access control; Control 5.16 Identity management; Control 5.18 Access rights; Control 8.3 Information access restriction.
質問 # 73
What does information security determine?
正解：A
解説：
Information security determines both what needs to be protected and how protection should be applied. The first part is understanding information assets, their value, their sensitivity, their owners, their business purpose, and the consequences if they are disclosed, altered, lost, or unavailable. This answers what must be protected and why. The second part is understanding threats, vulnerabilities, risk levels, legal obligations, contractual duties, and control options. This answers what the information must be protected from and how security controls should be designed. ISO/IEC 27002 supports both dimensions. Asset inventory and classification clarify protection needs. Access control, cryptography, backup, logging, network security, secure development, incident management, and physical security define protection methods. Option A is correct but incomplete. Option B is also correct but incomplete. Option C is therefore the verified answer because information security is a complete discipline covering asset understanding, risk understanding, control selection, implementation, monitoring, and improvement. The ISO/IEC 27002 control set is structured to support that full protection lifecycle. References/Chapters: ISO/IEC 27002:2022, Control 5.9 Inventory of information and other associated assets; Control 5.12 Classification of information; Controls 5-8.
質問 # 74
According to Control 5.27 Learning from information security incidents, how can organizations use the information gained from the evaluation of information security incidents?
正解：B
解説：
Information gained from evaluating information security incidents should be used to improve both user awareness and training and the incident management plan. Control 5.27 focuses on learning from incidents so that organizations reduce the likelihood or impact of recurrence. Incident evaluation can reveal root causes, control failures, user mistakes, unclear procedures, delayed escalation, insufficient logging, poor communication, supplier weaknesses, or technical vulnerabilities. If users contributed to the incident through phishing response, mishandling of information, weak passwords, or reporting delays, awareness and training should be improved. If the incident response process showed weaknesses in roles, escalation, evidence collection, communication, containment, recovery, or decision-making, the incident management plan should be updated. ISO/IEC 27002 treats incidents as a feedback mechanism for continual improvement, not merely isolated events to close. Option B is correct because both listed uses are valid and mutually reinforcing.
Strong incident learning improves controls, procedures, monitoring, user behavior, and readiness for future events. References/Chapters: ISO/IEC 27002:2022, Control 5.27 Learning from information security incidents; Control 5.24 Information security incident management planning and preparation; Control 6.3 Information security awareness, education and training.
質問 # 75
What is the purpose of Control 8.20 Network security of ISO/IEC 27002?
正解：C
解説：
The purpose of Control 8.20, Network security, is to protect information in networks and supporting information processing facilities from compromise through the network. This includes protecting data in transit, network devices, network services, communication paths, routing, management interfaces, and connected systems. Network compromise can lead to unauthorized access, interception, malware propagation, denial of service, lateral movement, data exfiltration, or manipulation of traffic. Option B relates more closely to Control 8.21, Security of network services, which addresses security mechanisms, service levels, and management requirements for network services. Option C relates to Control 8.22, Segregation of networks, which specifically concerns splitting networks into security boundaries or domains. Control 8.20 is broader: it establishes the general objective of securing networks against compromise. ISO/IEC 27002 expects organizations to manage and control networks according to risk, including architecture, monitoring, authentication, encryption where needed, device hardening, and protection of network management functions.
The correct answer is therefore option A. References/Chapters: ISO/IEC 27002:2022, Control 8.20 Network security; Control 8.21 Security of network services; Control 8.22 Segregation of networks.
質問 # 76
What does ISO/IEC 27002 recommend regarding audit testing?
正解：C
解説：
ISO/IEC 27002 recommends that audit testing should be planned and agreed upon between the tester and appropriate management. The purpose is to obtain assurance without creating unnecessary disruption, exposure, or operational risk. Audit tests can involve access attempts, vulnerability checks, sampling, transaction tracing, configuration review, log review, or control validation. If such activities are unmanaged, they may overload systems, expose sensitive information, interrupt services, conflict with change windows, or create false incident signals. Option B is incorrect because ad hoc assurance testing can be risky and inconsistent unless properly authorized and controlled. Option C is incorrect because audits should not normally require stopping operational systems and business processes; rather, they should be designed to minimize disruption while preserving evidence quality. ISO/IEC 27002 treats audit and assurance activities as important but controlled. Planning should define scope, timing, method, responsibilities, data handling, access requirements, and communication. The verified answer is option A because it balances assurance with operational security and business continuity. References/Chapters: ISO/IEC 27002:2022, Control 8.34 Protection of information systems during audit testing; Control 5.35 Independent review of information security.
質問 # 77
......
知識は、将来価値のある報酬を提供できる無形資産と定義されているため、neverめないでください。また、ISO-IEC-27002-Foundation試験の準備は、試験に効果的に対処するのに十分な知識を提供できます。試験の受験者のニーズを満たすために、当社の専門家は完璧な配置とメッセージの科学的編集で当社のISO-IEC-27002-Foundation練習資料を作成したため、完璧な資料を見つけるために他の多数の資料を勉強する必要はありません。 ISO-IEC-27002-Foundation試験クイズは、最高のヘルプを提供します。そして、ISO-IEC-27002-Foundationトレーニング資料は決してあなたを失望させません。
ISO-IEC-27002-Foundation PDF問題サンプル: https://www.tech4exam.com/ISO-IEC-27002-Foundation-pass-shiken.html