Learning
Learning
Loading practice session...
ISO 27001 · Exam domain
96 practice questions in this domain. AI-tutored explanations for every answer.
Sign in to practice all 96 questions with progress tracking and AI explanations.
1. According to ISO 27001 Control 6.1, when must background verification checks on personnel be conducted?
Explanation
Control 6.1 explicitly requires screening prior to joining AND on an ongoing basis. While promotion (option C) may trigger re-screening, it is not the only ongoing requirement. Option A misses the ongoing requirement entirely, and option D violates the proportionality principle by mandating uniform annual checks regardless of risk.
2. An organization conducts enhanced criminal background checks, credit checks, and security clearance verification for all employees including administrative staff with no access to sensitive information. As an auditor, what is the appropriate finding regarding Control 6.1?
Explanation
This violates the 'proportional' requirement in Control 6.1. Screening depth must match information classification, business requirements, and risk assessment results. While well-intentioned, uniform maximum screening for low-risk roles wastes resources and likely infringes privacy principles by processing excessive personal data without justification.
3. Which three elements constitute the mandatory verification content ('Big Three') under Control 6.1 screening requirements?
Explanation
Control 6.1 specifically requires verification of identity (are they who they claim to be?), qualifications (can they do the job?), and references (what is their track record?). While criminal records and financial history may be included for high-risk roles, they are not the universal core requirements. Medical history and political affiliations are generally restricted by privacy laws.
4. A developer with access to confidential data is promoted to Database Administrator with access to customer PII and top-secret architectural plans. According to Control 6.1, what must the organization do regarding screening?
Explanation
Control 6.1 requires ongoing screening, which includes trigger-based re-screening upon significant role changes. When an employee's access level changes (especially to higher classification information), the screening level must be re-evaluated and potentially upgraded. This reflects both the 'ongoing' and 'proportional' requirements.
5. When implementing Control 6.1 screening procedures involving criminal record checks, which principle takes precedence if local jurisdiction prohibits such checks for certain roles?
Explanation
While Control 6.1 requires appropriate screening, it must be implemented in compliance with applicable laws and regulations. Legal restrictions on processing certain types of personal data (like criminal records) take precedence over the standard's requirements. The organization must find alternative controls or accept the residual risk within legal boundaries.
Practice all 96+ questions in this domain
Start free practice →