Exam ISO-IEC-27002-Foundation Topic 1 Question 22 Discussion
Actual exam question for PECB's ISO-IEC-27002-Foundation exam
Question #: 22
Topic #: 1
Question #: 22
Topic #: 1
An organization has established and maintains contact with special interest groups with which it shares and obtains information about security threats, vulnerabilities, trends, etc. Based on ISO/IEC 27002, is this a good practice?
Suggested Answer: C Vote an answer
Establishing and maintaining contact with special interest groups is a good practice under ISO/IEC 27002.
Organizations benefit from timely information about security threats, vulnerabilities, attack trends, advisories, defensive practices, and sector-specific risks. Special interest groups can include industry associations, information sharing and analysis centers, professional forums, security communities, vendor groups, government-supported networks, and trusted peer organizations. This supports threat intelligence, incident readiness, vulnerability management, and continual improvement. Option A is incorrect because avoiding information exchange would isolate the organization and weaken its ability to anticipate emerging threats.
Option B is too restrictive because authorities may be important contacts, but they are not the only legitimate or useful source of security information. ISO/IEC 27002 encourages appropriate contact with relevant groups while still requiring responsible handling of shared information, confidentiality, trust boundaries, and legal obligations. The security value lies in turning external knowledge into better internal controls, awareness, monitoring, and response. Therefore, option C is the verified answer. References/Chapters: ISO/IEC 27002:
2022, Control 5.6 Contact with special interest groups; Control 5.7 Threat intelligence; Control 8.8 Management of technical vulnerabilities.
Organizations benefit from timely information about security threats, vulnerabilities, attack trends, advisories, defensive practices, and sector-specific risks. Special interest groups can include industry associations, information sharing and analysis centers, professional forums, security communities, vendor groups, government-supported networks, and trusted peer organizations. This supports threat intelligence, incident readiness, vulnerability management, and continual improvement. Option A is incorrect because avoiding information exchange would isolate the organization and weaken its ability to anticipate emerging threats.
Option B is too restrictive because authorities may be important contacts, but they are not the only legitimate or useful source of security information. ISO/IEC 27002 encourages appropriate contact with relevant groups while still requiring responsible handling of shared information, confidentiality, trust boundaries, and legal obligations. The security value lies in turning external knowledge into better internal controls, awareness, monitoring, and response. Therefore, option C is the verified answer. References/Chapters: ISO/IEC 27002:
2022, Control 5.6 Contact with special interest groups; Control 5.7 Threat intelligence; Control 8.8 Management of technical vulnerabilities.
by Virginia at Jul 31, 2026, 06:14 PM
0
0
0
10
Comments
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
Report Comment
Commenting
You can sign-up / login (it's free).