Exit demo ISO-27001-LA ISO/IEC 27001:2022 Lead Auditor PDF format · free preview

PECB ISO-27001-LA - Questions & Answers

Free preview · every answer includes a full explanation

Product page: https://prepkeys.com/iso-27001-la.html

Question 1
Single choice

In acceptable use of Information Assets, which is the best practice?

A.

Access to information and communication systems are provided for business purpose only

B.

Interfering with or denying service to any user other than the employee's host

C.

Playing any computer games during office hours

D.

Accessing phone or network transmissions, including wireless or wifi transmissions

Question 2
Single choice

Scenario 6: Sinvestment is an insurance company that offers home, commercial, and life insurance. The company was founded in North Carolina, but have recently expanded in other locations, including Europe and Africa.

Sinvestment is committed to complying with laws and regulations applicable to their industry and preventing any information security incident. They have implemented an ISMS based on ISO/IEC 27001 and have applied for ISO/IEC 27001 certification.

Two auditors were assigned by the certification body to conduct the audit. After signing a confidentiality agreement with Sinvestment. they started the audit activities. First, they reviewed the documentation required by the standard, including the declaration of the ISMS scope, information security policies, and internal audits reports. The review process was not easy because, although Sinvestment stated that they had a documentation procedure in place, not all documents had the same format.

Then, the audit team conducted several interviews with Sinvestment's top management to understand their role in the ISMS implementation. All activities of the stage 1 audit were performed remotely, except the review of documented information, which took place on-site, as requested by Sinvestment.

During this stage, the auditors found out that there was no documentation related to information security training and awareness program. When asked, Sinvestment's representatives stated that the company has provided information security training sessions to all employees. Stage 1 audit gave the audit team a general understanding of Sinvestment's operations and ISMS.

The stage 2 audit was conducted three weeks after stage 1 audit. The audit team observed that the marketing department (which was not included in the audit scope) had no procedures in place to control employees' access rights. Since controlling employees' access rights is one of the ISO/IEC 27001 requirements and was included in the information security policy of the company, the issue was included in the audit report. In addition, during stage 2 audit, the audit team observed that Sinvestment did not record

logs of user activities. The procedures of the company stated that "Logs recording user activities should be retained and regularly reviewed," yet the company did not present any evidence of the implementation of such procedure.

During all audit activities, the auditors used observation, interviews, documented information review, analysis, and technical verification to collect information and evidence. All the audit findings during stages 1 and 2 were analyzed and the audit team decided to issue a positive recommendation for certification.

According to ISO/IEC 27001 requirements, does the company need to provide evidence of implementation of the procedure regarding logs recording user activities? Refer to scenario 6.

A.

Yes, event logs recording user activities must be kept and regularly reviewed

B.

No, because the implementation of this procedure is not a requirement of the standard

C.

No, the company only recommended implementing this procedure

Question 3
Multiple choice

Which two of the following phrases are 'objectives' in relation to a first-party audit?

A.

Apply international standards

B.

Prepare the audit report for the certification body

C.

Confirm the scope of the management system is accurate

D.

Complete the audit on time

E.

Apply Regulatory requirements

F.

Update the management policy

Question 4
Multiple choice

You are performing an ISMS audit at a residential nursing home called ABC that provides healthcare services. You find all nursing home residents wear an electronic wristband for monitoring their location, heartbeat, and blood pressure always. You learned that the electronic wristband automatically uploads all data to the artificial intelligence (AI) cloud server for healthcare monitoring and analysis by healthcare staff.

To verify the scope of ISMS, you interview the management system representative (MSR) who explains that the ISMS scope covers an outsourced data center.

Select three options for the audit evidence you need to find to verify the scope of the ISMS.

A.

The auditee has identified the resident's needs and expectations on the facility and environmental safety

B.

The auditee has ISO 9001 certification

C.

The auditee has identified the governmental authorities' needs and expectations on healthcare services and patient data handling

D.

The auditee has identified the resident's needs and expectations on how they should protect the
resident's personal data

E.

The auditee has identified the resident's needs and expectations on the comfort facility, medical professional's competence, and clean environment

F.

The auditee has identified the resident's needs and expectations on healthcare medical treatment services

G.

The IT service agreement with the data center where the artificial intelligence (AI) cloud server is located

H.

The auditee is considering the purchase of a healthcare monitoring app from an external software company

Question 5
Single choice

Which option below about the ISMS scope is correct?

A.

ISMS scope should be available as documented information

B.

ISMS scope should ensure continual improvement

C.

ISMS scope should be compatible with the strategic orientation of the organization

Question 6
Multiple choice

You are an experienced audit team leader guiding an auditor in training,

Your team is currently conducting a third-party surveillance audit of an organisation that stores data on behalf of external clients. The auditor in training has been tasked with reviewing the TECHNOLOGICAL controls listed in the Statement of Applicability (SoA) and implemented at the site.

Select four controls from the following that would you expect the auditor in training to review.

A.

The development and maintenance of an information asset inventory

B.

Rules for transferring information within the organisation and to other organisations

C.

Confidentiality and nondisclosure agreements

D.

How protection against malware is implemented

E.

Access to and from the loading bay

F.

The conducting of verification checks on personnel

G.

Remote working arrangements

H.

How information security has been addressed within supplier agreements

I.

How the organisation evaluates its exposure to technical vulnerabilities

J.

The organisation's business continuity arrangements

K.

The organisation's arrangements for information deletion

L.

Information security awareness, education and training

M.

How access to source code and development tools are managed

N.

The operation of the site CCTV and door control systems

O.

The organisation's arrangements for maintaining equipment

P.

How power and data cables enter the building

Question 7
Multiple choice

You are carrying out your first third-party ISMS surveillance audit as an audit team leader. You are presently in the auditee's data centre with another member of your audit team and the organisation's guide.

You request access to a locked room protected by a combination lock and iris scanner. The room contains several rows of uninterruptable power supplies along with several data cabinets containing client-supplied equipment, predominantly servers, and switches.

You note that there is a gas-based fire extinguishing system in place. A label indicates that the system requires testing every 6 months however the most recent test recorded on the label was carried out by the manufacturer 12 months ago.

Based on the scenario above which two of the following actions would you now take?

A.

Determine if requirements for recording fire extinguisher checks have been revised within the last year.
If so, suggest these are referenced on the existing labels as an opportunity for improvement

B.

Make a note to ask the site maintenance manager for evidence that a fire extinguishing system test was carried out 6 months ago

C.

Providing water-based extinguishers are accessible in the room, take no further action as these provide an alternative means to put out a fire

D.

Raise a nonconformity against control A.5.7 'threat intelligence' as the organisation has not identified the need to take action against the threat of fire

E.

Raise a nonconformity against control A.7.11 'supporting utilities' as information processing facilities are not adequately protected against possible disruption

F.

Require the guide to initiate the organisation's information security incident process

Question 8
Multiple choice

You are conducting an ISMS audit in the despatch department of an international logistics organisation that provides shipping services to large organisations including local hospitals and government offices. Parcels typically contain pharmaceutical products, biological samples, and documents such as passports and driving licences. You note that the company records show a very large number of returned items with causes including mis-addressed labels and, in 15% of company cases, two or more labels for different addresses for the one package. You are interviewing the Shipping Manager (SM).

You: Are items checked before being dispatched?

SH: Any obviously damaged items are removed by the duty staff before being dispatched, but the small profit margin makes it uneconomic to implement a formal checking process.

You: What action is taken when items are returned?
SM: Most of these contracts are relatively low value, therefore it has been decided that it is easier and more convenient to simply reprint the label and re-send individual parcels than it is to implement an investigation.

You raise a nonconformity.
Referencing the scenario, which six of the following Appendix A controls would you expect the auditee to have implemented when you conduct the follow-up audit?

A.

5.11 Return of assets

B.

8.12 Data leakage protection

C.

5.3 Segregation of duties

D.

6.3 Information security awareness, education, and training

E.

7.10 Storage media

F.

8.3 Information access restriction

G.

5.6 Contact with special interest groups

H.

6.4 Disciplinary process

I.

7.4 Physical security monitoring

J.

5.13 Labelling of information

K.

5.32 Intellectual property rights

Question 9
Single choice

Scenario 9: UpNet, a networking company, has been certified against ISO/IEC 27001. It provides network security, virtualization, cloud computing, network hardware, network management software, and networking technologies.

The company's recognition has increased drastically since gaining ISO/IEC 27001 certification. The

certification confirmed the maturity of UpNefs operations and its compliance with a widely recognized and accepted standard. But not everything ended after the certification. UpNet continually reviewed and enhanced its security controls and the overall effectiveness and efficiency of the ISMS by conducting internal audits. The top management was not willing to employ a full-time team of internal auditors, so they decided to outsource the internal audit function. This form of internal audits ensured independence, objectivity, and that they had an advisory role about the continual improvement of the ISMS.

Not long after the initial certification audit, the company created a new department specialized in data and storage products. They offered routers and switches optimized for data centers and software-based networking devices, such as network virtualization and network security appliances. This caused changes to the operations of the other departments already covered in the ISMS certification scope.

Therefore. UpNet initiated a risk assessment process and an internal audit. Following the internal audit result, the company confirmed the effectiveness and efficiency of the existing and new processes and controls.

The top management decided to include the new department in the certification scope since it complies with ISO/IEC 27001 requirements. UpNet announced that it is ISO/IEC 27001 certified and the certification scope encompasses the whole company.
One year after the initial certification audit, the certification body conducted another audit of UpNefs ISMS.
This audit aimed to determine the UpNefs ISMS fulfillment of specified ISO/IEC 27001 requirements and ensure that the ISMS is being continually improved. The audit team confirmed that the certified ISMS continues to fulfill the requirements of the standard. Nonetheless, the new department caused a significant impact on governing the management system. Moreover, the certification body was not informed about any changes. Thus, the UpNefs certification was suspended.

Based on the scenario above, answer the following question:

UpNet announced that the ISMS certification scope encompasses the whole company once ensuring that the new department also complies with the ISO/IEC 27001 requirements.

How would you classify this situation illustrated in scenario 9?

A.

Unacceptable, the internal auditor should have approved the extension audit, not the top management

B.

Unacceptable, UpNet should have requested and granted an extension audit prior to making the announcement

C.

Acceptable, the internal audit confirmed the effectiveness and efficiency of the existing and new processes and controls

Question 10
Single choice

What is the difference between a restricted and confidential document?

A.

Restricted - to be shared among an authorized group Confidential - to be shared among named individuals

B.

Restricted - to be shared among named individuals Confidential - to be shared among an authorized group

C.

Restricted - to be shared among named individuals Confidential - to be shared across the organization only

D.

Restricted - to be shared among named individuals Confidential - to be shared with friends and family

Showing 10 of 394 questions · Unlock the full set