Free Practice Questions for PECB ISO-IEC-27002-Foundation Exam

The main purpose of Control 5.12, Classification of information, is to ensure that protection needs are identified and understood based on the importance of information. Classification gives information a defined sensitivity or value level, such as public, internal, confidential, or restricted, depending on the organization’s scheme. This classification then drives handling rules, access restrictions, labelling, retention, transfer methods, storage requirements, encryption decisions, and disposal practices. Option B describes the purpose of Control 5.13, Labelling of information, which communicates classification and can support automated information handling. Option C describes the general purpose of access control, especially Control 5.15 and related access rights controls. Classification is foundational because the organization cannot apply proportionate protection unless it understands the value, sensitivity, criticality, legal status, and business impact of the information. ISO/IEC 27002 expects classification to consider confidentiality, integrity, availability, and relevant interested-party requirements. Therefore, option A is the verified answer because it precisely matches the purpose of classifying information. References/Chapters: ISO/IEC 27002:2022, Control 5.12 Classification of information; Control 5.13 Labelling of information; Control 5.15 Access control.

Risk assessment is the overall process of risk identification, risk analysis, and risk evaluation. Option A describes only one component: risk identification. This is where risks are found, recognized, and described. Option B describes risk analysis, where the organization understands the nature of risk and determines the level of risk, often by considering likelihood and consequence. A full assessment also requires risk evaluation, where the analyzed risk is compared against criteria to determine whether it is acceptable or requires treatment. ISO/IEC 27002 relies on this risk-based logic because controls should be selected according to actual security needs. The standard provides guidance on controls, but it does not require every organization to implement every control in the same way. Risk assessment helps determine which controls are necessary, how strongly they should be implemented, and what residual risk remains. This is why option C is the complete and correct answer. ISO/IEC 27002 control implementation is meaningful only when linked to risk, context, business value, and obligations. References/Chapters: ISO/IEC 27002:2022, Clause 4 control selection and attributes; ISO/IEC 27001 risk assessment and treatment; ISO/IEC 27005 risk management terminology.

==========