This Foundation sample checks whether you can recognise core ISMS concepts in a payroll incident without jumping ahead to an implementation or audit role. Reveal each answer to see the reasoning and why the other options fail.
What this exact sample covers
Information-security fundamentals in context
Confidentiality, integrity and availability
Assets, threats and vulnerabilities
Risk and control types
Question 01Domain 1 · recall
Which response best explains confidentiality, integrity and availability in the payroll incident?
AExplain the purpose, relationship and expected outcome of confidentiality, integrity and availability.
BMemorise a label for, but do not connect it to the management-system outcome of confidentiality, integrity and availability.
CAssume the concept can be ignored until a certification body explains it during an external audit.
the answer and reasoning
Correct answerA. Explain the purpose, relationship and expected outcome of confidentiality, integrity and availability.
The stronger response connects confidentiality, integrity and availability to a defined purpose, accountable action and usable evidence. Explain the purpose, relationship and expected outcome of confidentiality, integrity and availability. This avoids mistaking a document, assumption or outsourced activity for an effective and reviewable practice.
Why the other options fail
B. This response deflects an accountability that remains with the organisation or practitioner and would leave the relevant competency unevidenced.
C. This response treats the visible artefact as the outcome and does not establish that the underlying process is suitable, owned and operating.
Which response best connects information assets with accountable asset ownership?
AMemorise a label for, but do not connect it to the management-system outcome of information assets and asset ownership.
BExplain the purpose, relationship and expected outcome of information assets and asset ownership.
CAssume the concept can be ignored until a certification body explains it during an external audit.
the answer and reasoning
Correct answerB. Explain the purpose, relationship and expected outcome of information assets and asset ownership.
The stronger response connects information assets and asset ownership to a defined purpose, accountable action and usable evidence. Explain the purpose, relationship and expected outcome of information assets and asset ownership. This avoids mistaking a document, assumption or outsourced activity for an effective and reviewable practice.
Why the other options fail
A. This response treats the visible artefact as the outcome and does not establish that the underlying process is suitable, owned and operating.
C. This response treats the visible artefact as the outcome and does not establish that the underlying process is suitable, owned and operating.
Which response best distinguishes the threat, vulnerability and consequence in this case?
AMemorise a label for, but do not connect it to the management-system outcome of threats, vulnerabilities and consequences.
BAssume the concept can be ignored until a certification body explains it during an external audit.
CExplain the purpose, relationship and expected outcome of threats, vulnerabilities and consequences.
the answer and reasoning
Correct answerC. Explain the purpose, relationship and expected outcome of threats, vulnerabilities and consequences.
The stronger response connects threats, vulnerabilities and consequences to a defined purpose, accountable action and usable evidence. Explain the purpose, relationship and expected outcome of threats, vulnerabilities and consequences. This avoids mistaking a document, assumption or outsourced activity for an effective and reviewable practice.
Why the other options fail
A. This response treats the visible artefact as the outcome and does not establish that the underlying process is suitable, owned and operating.
B. This response deflects an accountability that remains with the organisation or practitioner and would leave the relevant competency unevidenced.
Which response best explains information-security risk in the context of the payroll service?
AExplain the purpose, relationship and expected outcome of information-security risk.
BMemorise a label for, but do not connect it to the management-system outcome of information-security risk.
CAssume the concept can be ignored until a certification body explains it during an external audit.
the answer and reasoning
Correct answerA. Explain the purpose, relationship and expected outcome of information-security risk.
The stronger response connects information-security risk to a defined purpose, accountable action and usable evidence. Explain the purpose, relationship and expected outcome of information-security risk. This avoids mistaking a document, assumption or outsourced activity for an effective and reviewable practice.
Why the other options fail
B. This response deflects an accountability that remains with the organisation or practitioner and would leave the relevant competency unevidenced.
C. This response treats the visible artefact as the outcome and does not establish that the underlying process is suitable, owned and operating.
Which response best distinguishes preventive, detective and corrective controls for this incident?
AMemorise a label for, but do not connect it to the management-system outcome of preventive, detective and corrective controls.
BExplain the purpose, relationship and expected outcome of preventive, detective and corrective controls.
CAssume the concept can be ignored until a certification body explains it during an external audit.
the answer and reasoning
Correct answerB. Explain the purpose, relationship and expected outcome of preventive, detective and corrective controls.
The stronger response connects preventive, detective and corrective controls to a defined purpose, accountable action and usable evidence. Explain the purpose, relationship and expected outcome of preventive, detective and corrective controls. This avoids mistaking a document, assumption or outsourced activity for an effective and reviewable practice.
Why the other options fail
A. This response treats the visible artefact as the outcome and does not establish that the underlying process is suitable, owned and operating.
C. This response treats the visible artefact as the outcome and does not establish that the underlying process is suitable, owned and operating.
Casual mode shows feedback as you answer. Full access adds the complete weighted bank, exam mode, saved results and domain-level analysis for this exact qualification.
