PECB ISO-IEC-27002-Foundation Exam With Confidence Using Practice Dumps

Control 5.7, Threat intelligence, belongs to the organizational control group. ISO/IEC 27002:2022 organizes controls by clauses: Clause 5 contains organizational controls, Clause 6 contains people controls, Clause 7 contains physical controls, and Clause 8 contains technological controls. Threat intelligence is classified as organizational because it supports governance, decision-making, risk awareness, planning, prioritization, and security strategy across the organization. It involves collecting, analyzing, and using information about existing or emerging threats so the organization can reduce risk and improve controls. Threat intelligence can influence vulnerability management, incident response, monitoring, supplier risk management, awareness training, security architecture, and risk treatment plans. Although threat intelligence may use technological tools, its ISO/IEC 27002 placement is organizational because its primary purpose is to guide security decisions and readiness. Option A is incorrect because technological controls are Clause 8. Option B is incorrect because people controls are Clause 6. The verified answer is option C. References/Chapters: ISO/IEC 27002:2022, Clause 5 Organizational controls; Control 5.7 Threat intelligence; Clause 4 Structure of the standard.

==========

System requirements should not be the primary factor listed for locating and constructing physical premises in the ISO/IEC 27002 physical security context. When selecting and constructing premises, organizations should consider physical and environmental threats such as local topography, flood risk, earthquake exposure, weather conditions, crime levels, civil unrest, neighboring facilities, hazardous sites, and urban threats. These considerations help reduce risks to secure areas, information processing facilities, equipment, personnel, and supporting utilities. Local topography is relevant because geography can influence flooding, landslides, access routes, drainage, and natural hazards. Urban threats are relevant because location can affect exposure to crime, protests, terrorism, traffic disruption, adjacent buildings, or public access. System requirements are important in technology design and facility planning, but they are not the type of environmental or location threat consideration targeted by this question. ISO/IEC 27002 physical controls emphasize protecting premises from physical and environmental risks, not choosing location based on application or system functional requirements. Therefore, option C is verified. References/Chapters: ISO/IEC 27002:2022, Control 7.1 Physical security perimeters; Control 7.5 Protecting against physical and environmental threats; Control 7.8 Equipment siting and protection.

==========

Control 6.1 Screening is the ISO/IEC 27002 control that helps organizations ensure employees and contractors are suitable for their roles. Screening is performed before employment or engagement, and it should be proportionate to business requirements, information classification, access levels, legal requirements, and the risks associated with the role. It may include verification of identity, qualifications, employment history, references, criminal record checks where lawful and appropriate, and professional credentials. The goal is not unnecessary intrusion; the goal is to reduce the risk that unsuitable individuals receive access to sensitive information, systems, facilities, or responsibilities. Control 6.4, Disciplinary process, deals with responding to policy violations after employment has begun. Control 6.7, Remote working, addresses security arrangements for work outside organizational premises. Neither directly verifies suitability before assigning a role. ISO/IEC 27002 treats people controls as essential because insider risk, negligence, excessive access, and role mismatch can create significant security exposure. Therefore, option A is the verified answer. References/Chapters: ISO/IEC 27002:2022, Control 6.1 Screening; Control 6.2 Terms and conditions of employment; Control 6.3 Information security awareness, education and training.

==========