This sample follows a payroll disclosure from basic security properties into defensible scope, the Statement of Applicability and authority for residual-risk acceptance. Reveal each answer to see the reasoning and why the other options fail.
What this exact sample covers
ISMS scope, treatment and accountability
Confidentiality, threats and vulnerabilities
ISMS scope and the SoA
Risk-treatment accountability
Question 01Domain 1 · application
A payroll file is disclosed to an unauthorised contractor but remains accurate and available. Which information-security property failed?
AConfidentiality
BIntegrity
CAvailability
the answer and reasoning
Correct answerA. Confidentiality
Confidentiality protects information from unauthorised disclosure or access. The file can remain complete and available while still suffering a confidentiality breach.
Why the other options fail
B. The information was not changed, so its integrity was not the property that failed.
C. The file remained accessible to authorised users, so availability was preserved.
A threat actor exists, but the exposed service has no weakness the actor can exploit. What is the best conclusion for this scenario?
AThe service has maximum inherent risk because a threat actor exists
BThe threat alone does not create the described risk without a relevant vulnerability
CThe organisation can ignore the threat permanently
the answer and reasoning
Correct answerB. The threat alone does not create the described risk without a relevant vulnerability
Information-security risk arises where threats can exploit vulnerabilities and cause consequences. A threat without a relevant weakness does not establish the described risk path.
Why the other options fail
A. A threat does not automatically make likelihood or consequence maximal.
C. The environment can change, so threats and vulnerabilities still require monitoring.
An organisation decides an Annex A control is not necessary for its scoped ISMS. Where must that decision and its justification be recorded?
AOnly in the internal audit report
BOnly in the information security policy
CIn the Statement of Applicability
the answer and reasoning
Correct answerC. In the Statement of Applicability
The Statement of Applicability records necessary controls, their implementation status and justification for included and excluded Annex A controls. It makes selection decisions traceable.
Why the other options fail
A. An audit report tests conformity; it is not the primary record of control applicability.
B. The policy sets direction and is not a control-by-control applicability register.
A company defines its ISMS scope as “the IT department” although customer data is processed by sales and a cloud provider. What should the implementer do first?
AReassess boundaries, interfaces and dependencies before approving the scope
BAccept the scope because departments may always be certified separately
CAdd every Annex A control and leave the scope unchanged
the answer and reasoning
Correct answerA. Reassess boundaries, interfaces and dependencies before approving the scope
Scope must reflect context, interested-party requirements, interfaces and dependencies. The implementer should first establish the real information flows and accountable boundaries.
Why the other options fail
B. A narrow scope is not valid when it omits relevant dependencies without analysis.
C. More controls do not repair a scope that misrepresents where information is processed.
A risk-treatment plan names actions and dates but no person is authorised to accept residual risk. Which role is missing?
AThe certification auditor
BAn authorised risk owner
CThe document controller
the answer and reasoning
Correct answerB. An authorised risk owner
Residual risk acceptance is a management decision assigned to an accountable risk owner. Treatment actions alone are incomplete without authorised review and acceptance of what remains.
Why the other options fail
A. A certification auditor evaluates conformity and must not own the client’s risk decisions.
C. Document control does not confer authority to accept business risk.
Casual mode shows feedback as you answer. Full access adds the complete weighted bank, exam mode, saved results and domain-level analysis for this exact qualification.
