EXIN Information Security Management Professional based on ISO/IEC 27001 (ISMP.EN) Sample Exam - Edition 202506

Sep 30, 2026

Upload by asba

Sample exam for the EXIN Information Security Management Professional based on ISO/IEC 27001 (ISMP.EN). The rules and regulations for EXIN examinations apply, with this exam comprising 30 multiple-choice questions, each with several possible answers where only one is correct unless stated otherwise. Maximum score is 30, requiring at least 20 points to pass. The exam duration is 90 minutes, followed by an answer key and an evaluation section.

LanguageEnglish

CategoryExam

FormatPDF

Pages28

Reading Time1 h 11 min

AccessFree to download

Introduction

Sample exam

Answer key

Evaluation

Sample Exam Edition 202506 Copyright © EXIN Holding B.V. 2025. All rights reserved. EXIN® is a registered trademark. No part of this publication may be reproduced, stored, utilized or transmitted in any form or by any means, electronic, mechanical, or otherwise, without the prior written permission from EXIN. Content Introduction 4 Sample exam 5 Answer key 13 Evaluation 27 Introduction This is the EXIN Information Security Management Professional based on ISO/IEC 27001 (ISMP.EN) sample exam. The Rules and Regulations for EXIN’s examinations apply to this exam. This exam consists of 30 multiple-choice questions. Each multiple-choice question has a number of possible answers, of which only one is correct, unless otherwise stated. The maximum number of points that can be obtained for this exam is 30. Each correct answer is worth 1 point. You need 20 points or more to pass the exam. The time allowed for this exam is 90 minutes. Good luck! Sample exam 1 / 30 Which is a key element of security strategy development? A) Description of how the services are being supported B) Policy that does not conflict with the law of the organization's country C) Relevant control objectives D) Return on Investment (ROI) 2 / 30 An organization has several suppliers which contribute to the delivery and support of end-to-end services. Which capability should the organization invest in primarily to minimize the information security issues originating from its suppliers? A) Audits B) Governance C) Risk management D) Training 3 / 30 The security manager is responsible for defining the security controls for a company. The company is selecting a supplier to host the web-facing ordering system. What is the most important aspect the security manager should look for? A) A standard for due care B) A standard for due diligence C) Benchmarking D) Best security practices 4 / 30 Security controls are defined based on the security classification of a data element. Who is responsible for the security classification of a data element? A) The board of directors, that runs the company B) The data custodian, who manages the use of the data C) The process owner, who governs the process D) The system owner, who safeguards the information system 5 / 30 A risk manager is asked to perform a complete risk assessment for a company. What is the best method to identify most of the threats to the company? A) Have a brainstorm with representatives of all stakeholders B) Interview top management C) Send a checklist for threat identification to all staff involved in information security 6 / 30 Information security management is currently being implemented in a company that sells books. The project leader for the information security project understands that the risk identification process requires her to list organizational assets arranged in order of importance and she is working with the financial manager to develop this list. The weight of importance is based on the following criteria: impact on revenue (30%), impact on profitability (40%) and impact on public image (30%) . The financial manager has come up with four important information assets: -Supplier orders (outbound) -Customer order via SSL (inbound) -Supplier fulfillment advice (inbound) -Customer service request via e-mail (inbound) What asset ranks the highest based on the impact criteria? A) Supplier orders (outbound) B) Customer order via SSL (inbound) C) Supplier fulfillment advice (inbound) D) Customer service request via e-mail (inbound) 7 / 30 An operations manager wants some advice about opening a second data center as a hot standby location. What would the information security officer (ISO) advise the operations manager to do? A) Ensure that network and power supply are made redundant and from different providers B) Ensure that physical access is only granted to specific operators

FAQs

How many multiple-choice questions are included in this sample exam?

The sample exam consists of 30 multiple-choice questions.

What score is needed to pass?

You need 20 points or more to pass.

What is the allowed time for the exam?

The time allowed for this exam is 90 minutes.

Sep 30, 2026

Upload by asba