ISO-IEC-27002-Foundation Exam Dumps : ISO/IEC 27002 Foundation Exam

Clock synchronization can be difficult when using multiple cloud services. ISO/IEC 27002 Control 8.17 emphasizes that clocks of information processing systems should be synchronized to approved time sources. Accurate time is essential for logging, monitoring, incident investigation, transaction integrity, forensic analysis, authentication, certificate validation, and event correlation. In a simple on-premises environment, an organization may centrally manage time sources using internal NTP servers or domain services. In multi-cloud environments, systems may span different providers, regions, platforms, managed services, containers, serverless functions, and third-party logging systems. Each environment may have different time settings, time source controls, administrative access limits, time zone handling, timestamp formats, and logging precision. This makes consistent synchronization and correlation more challenging. Option A is not the best answer because “only on-premises services” are typically easier to synchronize under a single administrative model. Option C is too broad because the question asks when synchronization can be difficult, and the ISO/IEC 27002 exam logic points to multiple cloud services. References/Chapters: ISO/IEC 27002:2022, Control 8.17 Clock synchronization; Control 8.15 Logging; Control 5.23 Information security for use of cloud services.

==========

Control 6.1 Screening is the ISO/IEC 27002 control that helps organizations ensure employees and contractors are suitable for their roles. Screening is performed before employment or engagement, and it should be proportionate to business requirements, information classification, access levels, legal requirements, and the risks associated with the role. It may include verification of identity, qualifications, employment history, references, criminal record checks where lawful and appropriate, and professional credentials. The goal is not unnecessary intrusion; the goal is to reduce the risk that unsuitable individuals receive access to sensitive information, systems, facilities, or responsibilities. Control 6.4, Disciplinary process, deals with responding to policy violations after employment has begun. Control 6.7, Remote working, addresses security arrangements for work outside organizational premises. Neither directly verifies suitability before assigning a role. ISO/IEC 27002 treats people controls as essential because insider risk, negligence, excessive access, and role mismatch can create significant security exposure. Therefore, option A is the verified answer. References/Chapters: ISO/IEC 27002:2022, Control 6.1 Screening; Control 6.2 Terms and conditions of employment; Control 6.3 Information security awareness, education and training.

==========

ISO/IEC 27002:2022 provides guidance for selecting, implementing, and managing information security controls. It is not the certification requirements standard; that role belongs to ISO/IEC 27001. ISO/IEC 27002 supports organizations by explaining the purpose of each control, the implementation guidance, and other related information needed to apply controls appropriately. Its controls are grouped into organizational, people, physical, and technological themes. The standard is intended to be used as a reference when organizations design security measures based on their risks, business needs, legal obligations, contractual requirements, and information security objectives. Therefore, option A is correct because “guidance” is the core function of ISO/IEC 27002. Option B is incorrect because ISO/IEC 27002 does not set mandatory requirements for certification. Option C is related to risk management, but it is not the main purpose of ISO/IEC 27002; risk management guidance is more directly associated with ISO/IEC 27005. ISO/IEC 27002 guides control implementation after risk and control needs are determined. References/Chapters: ISO/IEC 27002:2022, Clause 1 Scope; Clause 4 Structure of the standard; Controls 5–8.

==========