PECB ISO-IEC-27002-Foundation Exam With Confidence Using Practice Dumps

The “Act” phase is the phase in which an organization maintains and improves the information security management system. In the PDCA logic, “Plan” establishes objectives, policies, processes, risk treatment plans, and controls. “Do” implements and operates the planned processes and controls. “Check” monitors, measures, audits, and reviews performance. “Act” uses the results of checking to correct weaknesses, improve effectiveness, and adapt the ISMS to changing conditions. ISO/IEC 27002 is not itself the PDCA requirements standard, but its controls support the management system lifecycle used by ISO/IEC 27001. Examples include independent review of information security, compliance review, learning from incidents, management of vulnerabilities, and change management. These controls generate findings and lessons that feed improvement actions. “Do” is not the best answer because it focuses on implementation. “Check” is not the best answer because it evaluates performance but does not itself complete improvement. The phase that maintains and improves the ISMS is “Act.” References/Chapters: ISO/IEC 27002:2022, Control 5.35 Independent review of information security; Control 5.27 Learning from information security incidents; ISO/IEC 27001 PDCA-based management system model.

==========

Control 6.1 Screening is the ISO/IEC 27002 control that helps organizations ensure employees and contractors are suitable for their roles. Screening is performed before employment or engagement, and it should be proportionate to business requirements, information classification, access levels, legal requirements, and the risks associated with the role. It may include verification of identity, qualifications, employment history, references, criminal record checks where lawful and appropriate, and professional credentials. The goal is not unnecessary intrusion; the goal is to reduce the risk that unsuitable individuals receive access to sensitive information, systems, facilities, or responsibilities. Control 6.4, Disciplinary process, deals with responding to policy violations after employment has begun. Control 6.7, Remote working, addresses security arrangements for work outside organizational premises. Neither directly verifies suitability before assigning a role. ISO/IEC 27002 treats people controls as essential because insider risk, negligence, excessive access, and role mismatch can create significant security exposure. Therefore, option A is the verified answer. References/Chapters: ISO/IEC 27002:2022, Control 6.1 Screening; Control 6.2 Terms and conditions of employment; Control 6.3 Information security awareness, education and training.

==========

Confidentiality means that information is protected from unauthorized disclosure or availability. The correct statement is option A because it expresses the essential confidentiality concept: information must not be made available or disclosed to unauthorized individuals, entities, or processes. ISO/IEC 27002 supports confidentiality through controls such as information classification, labelling, access control, identity management, authentication, cryptography, data masking, information transfer rules, and data leakage prevention. The purpose is to ensure that only approved users, systems, or processes can view or receive information according to business need and authorization. Option B describes integrity, because accuracy and completeness relate to whether information remains correct and unaltered. Option C describes availability, because accessibility and usability on demand relate to authorized access when needed. In ISO/IEC 27002, many controls are mapped to confidentiality, integrity, and availability through control attributes. A confidentiality breach can occur through excessive internal access, accidental disclosure, lost media, weak access permissions, exposed credentials, or insecure transfer. References/Chapters: ISO/IEC 27002:2022, Clause 4 control attributes; Control 5.12 Classification of information; Control 5.15 Access control; Control 8.24 Use of cryptography.

==========