62 free PECB ISO/IEC 27001 Lead Auditor practice questions from the CertStash pack of 249, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 62 free here, all 249 in the pack, and each step includes the one before it.
Get all 249 questions (US$39) · Download the first 10 as a PDF
Question 1
Three auditors were assigned to conduct a certification audit in Company X. Before the audit commenced, the certification body provided the auditors' names and background information to Company X. Company X requested the replacement of one of the auditors because they are a former employee. Is this acceptable?
Show answer and explanation
Correct answer: A. Yes, a situation of conflict of interest is a valid reason to request the replacement of the auditor
A former employee of the auditee constitutes a potential conflict of interest that compromises auditor independence and objectivity. This is a valid reason for the auditee to request replacement of the auditor. ISO/IEC 17021 standards recognize that auditors must be free from conflicts of interest, and a former employment relationship creates a credible independence concern that justifies replacement.
Why the other options are wrong
- B. The premise is incorrect; a former employee relationship is itself a real conflict of interest without requiring additional justification.
- C. Auditees do have the right to request auditor replacement when valid reasons such as conflicts of interest are presented.
Question 2
What is the main reason for sending an engagement letter before the initial contact with the auditee?
Show answer and explanation
Correct answer: A. To confirm the authority to conduct the audit
The engagement letter is sent before the initial contact to confirm the auditor's authority and mandate to conduct the audit. It establishes the formal authorization from the certification body and defines the auditor's credentials and right to perform the audit. While the letter may include some scheduling details, its primary purpose is to establish and confirm the auditor's legal and professional authority.
Why the other options are wrong
- B. While scheduling may be mentioned, providing audit details and scheduling are secondary outcomes; the main purpose is confirming authority.
- C. Audit objectives are typically established during the initial contact and audit planning, not through the engagement letter.
Question 3
In a joint audit involving multiple audit teams, how many audit team leaders are typically designated per audit?
Show answer and explanation
Correct answer: A. One audit team leader per audit, regardless of the number of audit teams involved
In joint audits involving multiple audit teams, there is one designated audit team leader responsible for coordinating all teams, ensuring consistency, and reporting to the certification body. This single point of coordination maintains audit coherence and accountability, regardless of how many individual teams are involved in auditing different locations or functions.
Why the other options are wrong
- B. Allowing each team to appoint its own leader would create coordination problems and conflicting reporting structures.
- C. Joint audits require designated leadership to coordinate activities across multiple teams and ensure audit effectiveness.
Question 4
Why should materiality be considered during the initial contact?
Show answer and explanation
Correct answer: A. To determine the audit duration
Materiality considered during the initial contact helps determine the audit duration and resource allocation. By identifying which processes, systems, and risks are most significant to the organization's information security, the auditor can allocate appropriate time and depth of audit activities. Processes of greater materiality require more extensive examination, directly influencing how long the audit will take.
Why the other options are wrong
- B. Audit team roles are defined during audit planning based on expertise and qualifications, not primarily on materiality considerations.
- C. Audit objectives are typically set during audit planning based on the certification criteria and scope, though materiality may inform their prioritization.
Question 5
During which stage of the audit do auditors identify key processes to be audited and prioritized on the basis of materiality?
Show answer and explanation
Correct answer: B. Stage 1 audit
Stage 1 audit is when auditors review the organization's documentation, policies, and processes to identify which key processes exist and should be audited. These processes are then prioritized based on materiality, assessing which are most significant to information security objectives. Stage 2 audit focuses on the on-site evaluation of those prioritized processes and their implementation.
Why the other options are wrong
- A. Initial contact establishes basic audit parameters but does not involve deep process identification and materiality prioritization.
- C. Stage 2 audit is the on-site audit phase where identified and prioritized processes are evaluated; prioritization occurs in Stage 1.
Question 6
When multiple offices of a certification body are involved, what must be ensured?
Show answer and explanation
Correct answer: B. A legally enforceable agreement that covers all sites within the certification scope
When multiple offices of a certification body are involved, a single legally enforceable agreement that covers all sites and locations within the certification scope must be established. This ensures consistent terms, unified responsibility, and clear contractual relationships regardless of which office serves as the primary contact or conducts specific audit activities.
Why the other options are wrong
- A. Separate agreements per office would create fragmentation, inconsistency in terms, and unclear responsibility; a unified agreement is required.
- C. Only the main office having an agreement would leave other offices without contractual standing and create coordination and accountability issues.
Question 7
What is the objective of penetration testing in the risk assessment process?
Show answer and explanation
Correct answer: B. To identify potential failures in the ICT protection schemes
Penetration testing is a practical security assessment technique designed to identify potential failures, weaknesses, and gaps in information and communication technology (ICT) protection schemes by simulating real-world attacks. It goes beyond theoretical analysis to discover actual vulnerabilities that could be exploited by threat actors, making it a critical component of risk assessment.
Why the other options are wrong
- A. Code reviews are a different security practice focused on analyzing source code for defects, not simulating real-world attacks.
- C. Physical hardware inspection is an asset management activity, not a penetration testing objective.
Question 8
Which controls are related to the Annex A controls of ISO/IEC 27001 and are often selected from other guides and standards or defined by the organization to meet its specific needs?
Show answer and explanation
Correct answer: A. General controls
General controls in ISO/IEC 27001 refer to controls that are not specifically mandated by Annex A but are selected from other authoritative guides and standards or defined by the organization itself to address its particular context, risk profile, and business requirements. These complement the normative Annex A controls to create a tailored control set.
Why the other options are wrong
- B. Strategic controls is not a standard categorization within ISO/IEC 27001 terminology.
- C. Specific controls typically refer to controls directly mapped to particular threats or vulnerabilities, not the broader organizational selections outside Annex A.
Question 9
Which of the following statements regarding threats and vulnerabilities in information security is NOT correct?
Show answer and explanation
Correct answer: C. All vulnerabilities require immediate implementation of controls regardless of corresponding threats
Not all vulnerabilities require immediate control implementation regardless of corresponding threats. Risk management principles dictate that controls should be prioritized based on the likelihood that a vulnerability will be exploited and the potential impact if exploitation occurs. A vulnerability with no credible threat or very low risk may not warrant immediate remediation. Controls must be justified by actual risk, not simply by the existence of a vulnerability.
Why the other options are wrong
- A. This statement is correct; vulnerabilities can indeed be intrinsic (inherent to the asset) or extrinsic (arising from external factors).
- B. This statement is correct; threats require a vulnerability to materialize into actual harm to confidentiality, integrity, or availability.
Question 10
Which situation presented below represents a threat?
Show answer and explanation
Correct answer: C. Cyber attackers infiltrated the network by exploiting a zero-day vulnerability in the organization's firewall software
A threat is an external agent or circumstance with the potential to cause harm. Cyber attackers infiltrating a network by exploiting a zero-day vulnerability represents an actual threat, an external malicious actor actively attempting to compromise the organization's security. Option A describes a misuse of authorized access (an internal incident), and Option B describes a missing control or vulnerability, not an active threat.
Why the other options are wrong
- A. This describes an insider threat or misuse of legitimate credentials, but it is internal abuse rather than an external threat.
- B. The absence of MFA is a control gap or vulnerability, not a threat itself; a threat would be an actor attempting to exploit this gap.
What people say about the full ISO/IEC 27001 Lead Auditor pack 5.0 from 2
Fantastic online study questions for preparing ISO-IEC-27001 Lead Auditor exam. I gave my ISO-IEC-27001 Lead Auditor exam with the questions and passed. So will you.
Valid ISO-IEC-27001 Lead Auditor exam questions for passing ISO-IEC-27001 Lead Auditor exam. Great!!!
Question 11
After an information security incident, an organization created a comprehensive backup procedure involving regular, automated backups of all critical data to off-site storage locations. By doing so, which principle of information security is the organization applying in this case?
Show answer and explanation
Correct answer: C. Availability
Creating comprehensive automated backups to off-site storage locations directly supports the Availability principle. Availability ensures data and systems remain accessible and operational. Regular backups provide recovery capability, enabling the organization to restore data and resume operations after incidents such as data loss, corruption, or disasters. This protects against availability loss. Option A (Integrity) concerns data accuracy and authenticity, which backups do support but that is not the primary principle being applied. Option B (Confidentiality) concerns protecting data from unauthorized access; while secure backups should maintain confidentiality, the scenario emphasizes recovery capability, which is an availability function.
Why the other options are wrong
- A. While backups can protect integrity by enabling recovery of authentic data, the primary function described is recovery capability for operational continuity.
- B. While backups should be confidential, the scenario emphasizes restoration and operational recovery, which is an availability concern.
Question 12
Which two of the following statements are true? (Choose two.)
Show answer and explanation
Correct answer: A, E. The audit plan describes the arrangements for a set of one or more audits planned for a specific time frame and directed towards a specific purpose; The audit programme describes the arrangements for a set of one or more audits planned for a specific time frame and directed towards a specific purpose.
An audit programme describes the arrangements for a set of one or more audits planned for a specific time frame and directed towards a specific purpose, making option E correct. An audit plan describes the activities and arrangements for a single audit, making option A correct. Option B incorrectly defines the audit plan as describing arrangements for multiple audits. Option C is wrong because responsibility for managing the audit programme rests with the organization's management, not the audit team leader. Option D is incorrect because audit plans can be modified during execution if circumstances warrant. Option F incorrectly attributes the definition of an audit programme to an audit plan.
Why the other options are wrong
- B. This describes the audit programme, not the audit plan; the audit plan is specific to a single audit.
- C. Responsibility for managing the audit programme rests with the organization, not the audit team leader.
- D. Audit plans can be adjusted during the audit if needed.
- F. This definition applies to an audit programme, not an audit plan.
Question 13
A marketing agency has developed its risk assessment approach as part of the ISMS implementation. Is this acceptable?
Show answer and explanation
Correct answer: A. Yes, any risk assessment methodology that complies with the ISO/IEC 27001 requirements can be used
ISO/IEC 27001 does not mandate a specific risk assessment methodology. The standard requires that organizations establish and implement a risk assessment process that meets the standard's requirements for identifying, analyzing, and evaluating risks. Organizations have the flexibility to choose or develop their own risk assessment approach provided it complies with ISO/IEC 27001 requirements regarding risk identification, analysis, and evaluation. The methodology must be documented and consistently applied, but it need not be a recognized international framework if it meets the standard's criteria.
Why the other options are wrong
- B. While alignment with recognized methodologies can be beneficial, ISO/IEC 27001 does not require this; compliance with the standard's risk assessment requirements is the determining factor.
- C. ISO/IEC 27001 does not prescribe a specific risk assessment methodology; organizations retain the flexibility to develop approaches tailored to their context and needs.
Question 14
Which one of the following conclusions in the audit report is not required by the certification body when deciding to grant certification?
Show answer and explanation
Correct answer: B. The organization fully complies with all legal and other requirements applicable to the Information Security Management System.
Before granting certification, the certification body requires conclusions confirming that major nonconformities have been corrected (A), corrective action plans for minor nonconformities are acceptable (C), and the certification scope has been fulfilled (D). Option B is not required because full compliance with all legal and other requirements is a continuous responsibility, not a prerequisite for initial certification. Organizations must demonstrate compliance with applicable legal requirements, but absolute perfection across all legal obligations is not a certification grant condition. Certification confirms system effectiveness and control implementation, not perfect legal compliance across all possible domains.
Why the other options are wrong
- A. Major nonconformity corrections must be verified and accepted before certification.
- C. Acceptance of corrective action plans for minor nonconformities is required.
- D. Certification scope fulfillment is an essential requirement for granting certification.
Question 15
Which two of the following actions are the individual(s) managing the audit programme responsible for? (Choose two.)
Show answer and explanation
Correct answer: B, E. Defining the objectives, scope and criteria for an individual audit; Determining the resources necessary for the audit programme
The individuals managing the audit programme are responsible for defining the objectives, scope, and criteria for the overall audit programme (option B), and for determining the resources necessary to execute the audit programme (option E). These are strategic-level responsibilities of audit programme management that ensure the programme is properly structured and adequately resourced.
Why the other options are wrong
- A. Communicating with the auditee during individual audits is the responsibility of the auditor conducting that audit, not the programme manager.
- C. Defining the plan of an individual audit is the responsibility of the audit team lead for that specific audit, not the programme manager.
- D. Determining legal requirements applicable to audits would fall to the organization or auditee, not the audit programme manager.
- F. Keeping the accreditation body informed is an organizational responsibility, not necessarily the audit programme manager's role in all contexts.
Question 16
You are an experienced audit team leader guiding an auditor in training. Your team is currently conducting a third-party surveillance audit of an organization that stores data on behalf of external clients. The auditor in training has been tasked with reviewing the PHYSICAL controls listed in the Statement of Applicability (SoA) and implemented at the site. Select four controls from the following that would you expect the auditor in training to review. (Choose four.)
Show answer and explanation
Correct answer: A, B, F, G. Access to and from the loading bay; How power and data cables enter the building; The operation of the site CCTV and door control systems; The organization's arrangements for maintaining equipment
Physical security controls are specific mechanisms protecting facilities and assets against unauthorized access and environmental threats. Option A is correct because loading bay access represents critical physical perimeter control. Option B is correct because cable entry points are physical security vulnerabilities requiring protection against tampering and unauthorized access. Option F is correct because CCTV and door control systems are primary physical access management technologies. Option G is correct because equipment maintenance procedures ensure operational integrity and security-relevant functionality of physical infrastructure. These controls directly address physical security as defined in ISO/IEC 27001.
Why the other options are wrong
- C. Information security awareness and training are people-focused controls addressing human factors, not physical security.
- D. Personnel verification checks relate to human resources and personnel management, not physical security infrastructure.
- E. Information asset inventory development is an asset management process, not a physical security control.
- H. Business continuity arrangements address organizational resilience and recovery, not physical security infrastructure controls.
Question 17
You are an experienced ISMS audit team leader conducting a third-party surveillance visit. You notice that although the auditee is claiming conformity with ISO/IEC 27001:2022 they are still referring to Improvement as clause 10.2 (as it was in the 2013 edition) when this is now clause 10.1 in the 2022 edition. You have confirmed they are meeting all of the 2022 requirements set out in the standard. Select one option of the action you should take.
Show answer and explanation
Correct answer: D. Raise it as an opportunity for improvement
Since the organization is meeting all ISO/IEC 27001:2022 requirements, their reference to the older clause numbering system represents outdated documentation terminology rather than a nonconformity. The organization demonstrates conformity through actual control implementation and operation, not through correct clause citations. Option D is appropriate because noting this discrepancy as an opportunity for improvement allows the organization to update their terminology to align with the current standard edition, enhancing documentation clarity without raising a formal nonconformity. This constructive approach supports continuous improvement while recognizing that actual compliance is achieved.
Why the other options are wrong
- A. Bringing up a minor terminology issue at closing creates unnecessary emphasis on a non-substantive matter.
- B. Reporting this in the audit report as a finding elevates terminology to audit documentation status inappropriately.
- C. Clause 7.5.3 addresses documented information control processes; outdated clause references in discussion are not control failures.
Question 18
An organization is evaluating the materiality of different processes within its ISMS. It is assessing the direct expenses involved with personnel, third party services, and general fees. Which factor of materiality is the company primarily considering?
Show answer and explanation
Correct answer: B. Cost of the process
When evaluating materiality of processes within an ISMS, the organization is assessing direct expenses related to personnel, third-party services, and general fees, these are operational costs directly associated with running the process itself. This represents the 'cost of the process' factor of materiality. While cost of operations might seem similar, it typically refers to broader organizational costs rather than process-specific expenses. The potential cost of errors would involve different types of expenses (remediation, liability, reputation damage) rather than the direct operational expenses mentioned.
Why the other options are wrong
- A. Cost of operations is too broad and general, whereas the scenario specifically identifies expenses directly tied to individual processes.
- C. Potential cost of errors involves indirect consequences and remediation expenses, not the direct operational expenses being evaluated.
Question 19
You are performing an ISMS audit at a residential nursing home that provides healthcare services. The next step in your audit plan is to verify the information security of the business continuity management process. During the audit, you learned that the organization activated one of the business continuity plans (BCPs) to make sure the nursing service continued during the recent pandemic. You ask the Service Manager to explain how the organization manages information security during the business continuity management process. The Service Manager presents the nursing service continuity plan for a pandemic and summarizes the process as follows: Stop the admission of any NEW residents. 70% of administration staff and 30% of medical staff will work from home. Regular staff self-testing, including submitting a negative test report 1 day BEFORE they come to the office. Install ABC's healthcare mobile app, tracking their footprint and presenting a GREEN Health Status QR-Code for checking on the spot. You ask the Service Manager how to prevent non-relevant family members or interested parties from accessing residents' personal data when staff work from home. The Service Manager cannot answer and suggests the IT Security Manager should help with that. You would like to further investigate other areas to collect more audit evidence. Select three options that will be in your audit trail. (Choose three.)
Show answer and explanation
Correct answer: A, D, F. Collect more evidence by interviewing more staff to ensure they have the necessary awareness to work from home. (Relevant to clause 7.3); Collect more evidence on how and when the Business Continuity Plan has been tested. (Relevant to control A.5.29); Collect more evidence on how the organization manages information security on mobile devices and during teleworking (Relevant to control A.6.7)
Valid audit trails must directly address gaps identified in the pandemic continuity plan. Option A collects evidence on staff awareness for remote work (Clause 7.3, competence requirements). Option D investigates Business Continuity Plan testing (Control A.5.29, testing and updating BCPs). Option F addresses mobile device and teleworking security controls (Control A.6.7), directly relevant to the unaddressed question about preventing unauthorized family access to resident data during work-from-home scenarios.
Why the other options are wrong
- B. Incident response outsourcing (A.5.19) is not relevant to the identified information security gap in remote work scenarios.
- C. Staff feelings about working arrangements (Clause 4.2) are outside ISMS scope and not information security evidence.
- E. Covid testing procedures (A.7.2) address occupational health, not information security controls.
- G. Resident discharge risk assessment relates to operational continuity, not information security management.
- H. General resource provision (Clause 7.1) doesn't specifically address information security controls for remote work.
Question 20
Which of the following statements regarding documented information in an organization's ISMS is incorrect?
Show answer and explanation
Correct answer: B. The collection of documented information should be a target in itself
The collection of documented information should not be a target in itself. According to ISO/IEC 27001 principles, documented information should support the operation of the ISMS and provide evidence of conformity, but excessive documentation for its own sake creates administrative burden without adding value. Option A correctly states the purpose of documented information, and option C correctly recognizes that documented information should be appropriately detailed to be effective. Option B represents a misunderstanding that treating documentation volume as a goal leads to ineffective ISMS implementation.
Why the other options are wrong
- A. This statement correctly identifies that documented information guides ISMS operation and provides evidence of effectiveness, which is the proper purpose.
- C. This statement correctly indicates that documented information should be sufficiently detailed to ensure thoroughness and effectiveness; over-complexity should be avoided, but this is not the same as the collection itself being a target.
Question 21
Select two of the following options that are the responsibility of a legal technical expert on the audit team during a certification audit. (Choose two.)
Show answer and explanation
Correct answer: A, E. Advising on legal checkpoints for the audit team; Meeting the organization's legal representative
A legal technical expert on an audit team provides specialized guidance and verification support within professional bounds. Option A is correct because advising on legal checkpoints ensures the audit team identifies and addresses legally significant areas within the ISMS scope. Option E is correct because meeting the organization's legal representative is a standard audit activity enabling the expert to gather information and clarify legal compliance matters directly. These responsibilities focus on information gathering and professional guidance while maintaining audit objectivity.
Why the other options are wrong
- B. Criticizing legal compliance issues is judgmental language inappropriate for auditors, who should report findings objectively.
- C. Debating legal points with the auditee undermines audit neutrality and creates adversarial dynamics.
- D. Evaluating the auditee's legal knowledge is not an audit function; evaluating system compliance is.
- F. Verifying the organization's legal status (incorporation, registration) is administrative, not a technical expert responsibility during an ISMS audit.
Question 22
Which two of the following options do not participate in a second-party audit to ISO/IEC 27001? (Choose two.)
Show answer and explanation
Correct answer: B, D. An auditor employed by a certification body; An auditor from an accreditation body
A second-party audit is conducted by or on behalf of an external party, typically a customer or supplier. An auditor employed by a certification body (option B) performs third-party audits, not second-party audits, making B correct. An auditor from an accreditation body (option D) is not a participant in second-party audits; accreditation bodies oversee certification bodies, making D correct. Option A is wrong because external consultancy auditors can conduct second-party audits. Option C is wrong because CQI and IRCA trained auditors can perform second-party audits. Option E is wrong because customer internal auditors can conduct second-party audits of their suppliers. Option F is wrong because auditor certification bodies produce auditors who can perform second-party audits.
Why the other options are wrong
- A. External consultancy auditors routinely conduct second-party audits on behalf of clients.
- C. CQI and IRCA scheme-trained auditors are qualified to perform second-party audits.
- E. Internal auditors from customers are a primary participant in second-party audits of suppliers.
- F. Certified auditors from auditor certification bodies can perform second-party audits.
Question 23
According to ISO/IEC 17021-1, what is the purpose of surveillance audits?
Show answer and explanation
Correct answer: C. To maintain confidence in the certified management system between audits
According to ISO/IEC 17021-1, surveillance audits are conducted between recertification audits to maintain confidence in the certified management system. They verify continued compliance and effectiveness of the ISMS, ensuring that the organization continues to meet certification requirements without the full scope of an initial or recertification audit.
Why the other options are wrong
- A. Assessing compliance and granting initial certification is the purpose of the initial certification audit, not surveillance audits.
- B. Evaluating financial performance is not within the scope of ISO/IEC 27001 surveillance audits.
Question 24
You are an experienced ISMS audit team leader guiding an auditor in training. You are testing her understanding of follow-up audits by asking her a series of questions to which the answer is either 'true' or 'false'. Which two of the following questions should the answer be 'true'? (Choose two.)
Show answer and explanation
Correct answer: C, F. A follow-up audit may be carried out where nonconformities are major; The outcomes of a follow-up audit should be reported to the individual managing the audit programme and the audit client
Option C is correct: follow-up audits may be conducted where major nonconformities have been identified to verify that corrective actions have been effective. Option F is correct: the outcomes of follow-up audits must be reported to both the individual managing the audit programme and the audit client, ensuring transparency and accountability. Option A is incorrect because follow-up audits are not required for all nonconformities, typically only for major ones. Option B is too restrictive; follow-up audits may be required for other circumstances beyond major nonconformities. Option D is incorrect as follow-up audits cannot downgrade the original nonconformity grading; they assess whether corrective actions were effective. Option E is incomplete; outcomes must be reported to the audit programme manager and client, not just the original team leader.
Why the other options are wrong
- A. Follow-up audits are not required for all nonconformities, only typically for major ones.
- B. Follow-up audits may be required in other situations beyond only major nonconformities.
- D. The original nonconformity grading cannot be changed by follow-up audit; effectiveness of corrections is what is assessed.
- E. Outcomes must be reported to both the audit programme manager and the audit client, not only to the original auditor.
Question 25
Which two options are benefits of third-party accredited certification of information security management systems to ISO/IEC 27001:2022 for organizations and interested parties? (Choose two.)
Show answer and explanation
Correct answer: C, D. Third-party accredited certification demonstrates that the organization's management system is maintained and effective; Third-party accredited certification demonstrates the organization's management system adopted a systematic approach to information security
Third-party accredited certification demonstrates that the organization's management system is maintained and effective through independent verification, and it demonstrates that the organization has adopted a systematic approach to information security as required by ISO/IEC 27001:2022. These benefits provide assurance to interested parties about the quality and systematic nature of the organization's information security controls.
Why the other options are wrong
- A. Third-party certification does not guarantee compliance with all legal and legislation requirements, only with ISO/IEC 27001 requirements.
- B. ISO/IEC 27001 certifies management systems, not ICT products; product certification requires different schemes.
- E. Certification does not ensure increased customer acquisition; market success depends on many factors beyond certification.
- F. Certification provides assurance about information security practices but does not guarantee protection from all external interference.
Question 26
Prior to initiating the audit activities, the auditors considered the auditee's context, critical processes, and expectations. Which auditing principle has been applied?
Show answer and explanation
Correct answer: A. Due professional care
The auditing principle of due professional care requires auditors to exercise reasonable care and competence in planning and conducting audits, which includes considering the auditee's context, critical processes, and stakeholder expectations before beginning audit activities. This principle ensures that auditors approach the engagement with appropriate diligence and understanding of the organization being audited. The scenario states that auditors considered these factors prior to initiating activities, which exemplifies due professional care.
Why the other options are wrong
- B. Professional skepticism relates to critically evaluating evidence validity and questioning information reliability, not to pre-audit planning considerations.
- C. Integrity refers to conducting audits honestly and fairly, maintaining independence, and acting in good faith, not specifically to considering context and expectations during planning.
Question 27
You are an experienced ISMS audit team leader who is currently conducting a third party initial certification audit of a new client, using ISO/IEC 27001:2022 as your criteria. It is the afternoon of the second day of a 2-day audit, and you are just about to start writing your audit report. So far no nonconformities have been identified and you and your team have been impressed with both the site and the organization's ISMS. At this point, a member of your team approaches you and tells you that she has been unable to complete her assessment of leadership and commitment as she has spent too long reviewing the planning of changes. Which one of the following actions will you take in response to this information?
Show answer and explanation
Correct answer: H. Review the audit plan and client availabilities to determine whether there is any opportunity for another member of your team to pick up this task before the closing meeting.
As audit team leader, the appropriate response to incomplete assessment is to actively manage the audit timeline and resources. Reviewing the audit plan and client availabilities to determine if another team member can complete the assessment before the closing meeting demonstrates professional audit management. This approach maintains audit integrity without making premature recommendations, terminating the audit, or compromising professional standards. The audit plan should have allocated sufficient time for all scope areas, and resource reallocation is the standard management solution.
Why the other options are wrong
- A. Returning later would indicate poor audit planning and is not standard practice for initial certification audits.
- B. Offering to work outside audit time in exchange for personal benefits is unethical and violates auditor independence.
- C. Unable to recommend certification is premature when a team member simply needs to reallocate time within the remaining audit period.
- D. Terminating the entire audit is disproportionate when the scope gap may be addressed through resource reallocation.
- E. Seeking permission to recommend certification without completing required assessment areas violates audit standards.
- F. Unnecessary escalation when the audit team leader has authority to manage audit resources and timeline.
- G. Recording positive recommendation without completing all required assessments violates ISO/IEC 27001 audit requirements and compromises certification integrity.
Question 28
Which of the following types of audit requires that the auditee and audit team agree on remote access protocols prior to conducting the audit?
Show answer and explanation
Correct answer: A. Virtual
Virtual audits, which are conducted remotely using electronic means, require that the auditee and audit team agree on remote access protocols prior to conducting the audit. This is essential to establish secure communication channels, define technology platforms, arrange necessary system access, and ensure both parties have appropriate equipment and connectivity. Internal and external audits can be conducted on-site without prior remote access protocol agreements.
Why the other options are wrong
- B. Internal audits typically occur on-site and do not require remote access protocol agreements in advance.
- C. External audits, while they may be conducted on-site or virtually, do not inherently require remote access protocol agreements unless specifically planned as virtual audits.
Question 29
You are performing an ISO 27001 ISMS surveillance audit at a residential nursing home, ABC Healthcare Services. ABC uses a healthcare mobile app designed and maintained by a supplier, WeCare, to monitor residents' well-being. During the audit, you learn that 90% of the residents' family members regularly receive medical device advertisements from WeCare, by email and SMS once a week. The service agreement between ABC and WeCare prohibits the supplier from using residents' personal data. ABC has received many complaints from residents and their family members. The Service Manager says that the complaints were investigated as an information security incident which found that they were justified. Corrective actions have been planned and implemented according to the nonconformity and corrective action management procedure. You write a nonconformity "ABC failed to comply with information security control A.5.34 (Privacy and protection of PII) relating to the personal data of residents' and their family members. A supplier, WeCare, used residents' personal information to send advertisements to family members." Select three options of the corrections and corrective actions listed that you would expect ABC to make in response to the nonconformity. (Choose three.)
Show answer and explanation
Correct answer: B, E, F. ABC cancels the service agreement with WeCare; ABC introduces background checks on information security performance for all suppliers; ABC periodically monitors compliance with all applicable legislation and contractual requirements involving third parties.
Option B is correct: canceling the service agreement with WeCare removes the source of the nonconformity and demonstrates commitment to preventing recurrence. Option E is correct: implementing background checks on information security performance for all suppliers addresses the root cause by ensuring suppliers meet security standards before engagement. Option F is correct: establishing periodic monitoring of compliance with legislation and contractual requirements for all third parties creates ongoing controls to prevent similar violations. Option A is unnecessary; the audit did not identify a cyber-crime vulnerability. Option C may already be true; the SoA issue is separate from the supplier's unauthorized use. Option D is disproportionate if the app itself functions securely when properly controlled. Option G is a legal matter outside ISMS corrective action scope. Option H alone is insufficient to prevent supplier misuse of data.
Why the other options are wrong
- A. The nonconformity stems from supplier contract violation, not an app vulnerability requiring cyber-crime testing.
- C. The SoA inclusion does not prevent supplier violations; this addresses documentation rather than the control failure.
- D. Discontinuing the app is disproportionate when the issue is supplier misuse, not app functionality.
- G. Legal action is a business decision, not a corrective action that prevents recurrence of the ISMS nonconformity.
- H. Staff training alone does not address a third-party supplier's independent violation of contractual obligations.
Question 30
During an opening meeting of a Stage 2 audit, the Managing Director of the client organization invites the audit team to view a new organization video lasting 45 minutes. Which two of the following responses should the audit team leader make? (Choose two.)
Show answer and explanation
Correct answer: B, D. Advise the Managing Director that the audit team has to keep to the planned schedule; State that the audit team leader will stay behind after the opening meeting to view the video on behalf of the team
During an audit opening meeting, the audit team must maintain control of the audit schedule and timeline to ensure all planned activities are completed. Option B is correct because the audit team leader should politely but firmly advise that the planned audit schedule must be adhered to, preventing scope creep and unplanned delays. Option D is correct because the audit team leader can offer a professional compromise by indicating they will review the video independently after the formal meeting, demonstrating respect for the client's initiative while protecting audit time. This approach balances courtesy with audit integrity and maintains professional boundaries.
Why the other options are wrong
- A. Agreeing to the 45-minute viewing would compromise the audit schedule and planned activities.
- C. Inviting the Managing Director to the hotel is inappropriate and crosses professional boundaries.
- E. Viewing only five minutes provides insufficient context and is dismissive of the client's effort.
- F. Even during breaks, viewing a 45-minute video is impractical and interferes with scheduled audit activities.
Question 31
You are performing an ISMS audit at a residential nursing home that provides healthcare services and are reviewing the Software Code Management (SCM) system. You found a total of 10 user accounts on the SCM. You confirm that one of the users, Scott, resigned 9-months ago. The SCM System Administrator confirmed Scott's last check out of the source code was found 1 month ago. He was using one of the authorized desktops from the local network in a secure area. You check with the user deregistration procedure which states "Managers have to make sure of deregistration of the user account and authorization immediately from the relevant ICT system and/or equipment after resignation approval." There was no deregistration record for user Scott. The IT Security Manager explains that Scott still comes back to the office every month after he resigned to provide support on source code maintenance. That's why his account on SCM still exists. You would like to investigate other areas further to collect more audit evidence. Select three options that would not be valid audit trails. (Choose three.)
Show answer and explanation
Correct answer: B, C, G. Collect more evidence on how the transition of Scott from full-time to part-time employment was managed (Relevant to control A.6.5); Collect more evidence from Scott's background verification checks performed by the human resource department under the new employment relationship. (Relevant to control A.6.1); Collect more evidence on how the organization pays for Scott's source code maintenance support service. (Relevant to control A.6.2)
Invalid audit trails are those that don't address the core information security issue: an unauthorized former employee retaining system access. Option B examines employment transition procedures, but Scott's situation involves re-engagement as an external provider, not transition between employment types. Option C requires background verification only for new employment relationships, but Scott's re-engagement as an external contractor doesn't constitute a new employment hire. Option G addresses payment/procurement procedures, which are administrative but unrelated to the identified access control and user deregistration non-conformities.
Why the other options are wrong
- A. Access control reviews (A.5.35) are directly relevant to identifying and correcting the lapsed deregistration.
- D. Conflict of interest evaluation (A.5.3) is relevant when former employees re-engage with system access.
- E. Desktop and network access controls (A.5.15) are central to the non-conformity of unauthorized continued access.
- F. Secure area access (A.8.4) is relevant because Scott accessed secure areas without updated authorization records.
- H. Source code security storage (A.8.4) directly addresses how checked-out code was protected, relevant to the violation.
Question 32
Auditor competence is a combination of knowledge and skills. Which two of the following activities are predominately related to "knowledge"? (Choose two.)
Show answer and explanation
Correct answer: D, F. Determining what evidence to gather; Understanding how to identify findings
Knowledge is understanding what should be done and why, while skills are the ability to execute actions. Determining what evidence to gather (option D) is a knowledge activity, it requires understanding what the standard requires and what information is relevant to assess compliance. Understanding how to identify findings (option F) is also a knowledge activity, it requires knowing what constitutes a conformity, nonconformity, or improvement opportunity.
Why the other options are wrong
- A. Communicating with the auditee is primarily a skill, the ability to interact effectively.
- B. Designing a checklist requires both knowledge and skills, but it is more heavily dependent on practical skills.
- C. Determining how to seek evidence is a skill activity, the tactical ability to extract information through questions and observation.
- E. Following an audit trail that deviates from the prepared checklist is a skill activity requiring practical judgment and execution ability.
Question 33
What is the purpose of using a combination of audit test plans?
Show answer and explanation
Correct answer: A. To verify compliance with standards and criteria through multiple methods
The purpose of using a combination of audit test plans is to verify compliance with standards and criteria through multiple methods. Different test plans employ various audit techniques, such as observation, interviews, sampling, and data testing, that together provide comprehensive evidence of conformity. Using multiple methods strengthens audit conclusions by triangulating evidence from different sources and reducing the risk of missing nonconformities that might be undetected by a single approach.
Why the other options are wrong
- B. Equal audit coverage across all areas is not the primary purpose; audit resources are allocated based on risk assessment and materiality, not uniform distribution.
- C. Reducing audit frequency is not a purpose of test plans; the frequency of audits is determined by management system requirements and risk, independent of test plan methodology.
Question 34
As an auditor, you have noticed that ABC Inc. has established a procedure to manage the removable storage media. The procedure is based on the classification scheme adopted by ABC Inc. Thus, if the information stored is classified as "confidential," the procedure applies. On the other hand, information classified as "public" does not have confidentiality requirements; thus, only a procedure for ensuring its integrity and availability applies. What type of audit finding is this?
Show answer and explanation
Correct answer: C. Conformity
This is a conformity finding. ABC Inc. has established a classification-based procedure that appropriately applies different protection measures based on information sensitivity: confidential data receives comprehensive protection including confidentiality controls, while public data receives only integrity and availability protections. This demonstrates appropriate and proportionate risk management aligned with the organization's classification scheme. The procedure is logically sound and conforms to information security management principles.
Why the other options are wrong
- A. A nonconformity would exist if required controls were missing or improperly implemented; here the procedure correctly differentiates protection based on classification.
- B. An anomaly refers to an unusual or unexpected observation; this is a normal, well-reasoned procedural approach that demonstrates conformity.
Question 35
Which of the following can be considered as a minor nonconformity?
Show answer and explanation
Correct answer: C. The organization has communicated its information security policy, including a framework for objectives and action principles. The policy considers business characteristics, and legal, regulatory, and contractual requirements, but lacks reference to continual ISMS improvement
A minor nonconformity represents a deviation from ISO/IEC 27001 requirements that has low risk impact and does not significantly compromise the ISMS. Option C describes a documentation gap where the information security policy lacks explicit reference to continual improvement, a procedural or documentation issue that does not prevent the ISMS from functioning or create immediate security vulnerabilities. Options A and B both describe significant control gaps that directly enable security breaches: inadequate phishing training creates active malware risk, and missing multi-factor authentication leaves accounts vulnerable to unauthorized access. These represent major nonconformities due to their direct impact on core security objectives.
Why the other options are wrong
- A. Lack of phishing training allowing malware infiltration and data breaches is a major control gap with direct security impact, not a minor issue.
- B. Absence of multi-factor authentication leaving accounts vulnerable to unauthorized access represents a major control weakness, not a minor nonconformity.
Question 36
A cybersecurity company implemented an access control software that allows only authorized personnel to access sensitive files. Which type of control has the company implemented in this case?
Show answer and explanation
Correct answer: A. Preventive control
A preventive control is designed to stop an undesirable event from occurring in the first place. Access control software that restricts unauthorized personnel from accessing sensitive files prevents unauthorized access before it can happen, making it a preventive control that blocks threats proactively.
Why the other options are wrong
- B. Detective controls identify and alert when an undesirable event has already occurred, such as logging and monitoring systems.
- C. Corrective controls remediate or restore systems after an undesirable event has taken place.
Question 37
You are performing an ISMS audit at a residential nursing home called ABC that provides healthcare services. You find all nursing home residents wear an electronic wristband for monitoring their location, heartbeat, and blood pressure always. You learned that the electronic wristband automatically uploads all data to the artificial intelligence (AI) cloud server for healthcare monitoring and analysis by healthcare staff. To verify the scope of ISMS, you interview the management system representative (MSR) who explains that the ISMS scope covers an outsourced data center. Select four options for the clauses and/or controls of ISO/IEC 27001:2022 that are directly relevant to the verification of the scope of the ISMS. (Choose four.)
Show answer and explanation
Correct answer: A, B, C, E. Clause 4.1 Understanding the organization and its context; Clause 4.2 Understanding the needs and expectations of interested parties; Clause 4.3 Determining the scope of the information security management system; Control 5.3 Legal, statutory, regulatory and contractual requirements
Verifying ISMS scope requires examining how the organization understands itself and its context (Clause 4.1), identifies interested parties' needs and expectations (Clause 4.2), determines what falls within the ISMS scope boundaries (Clause 4.3), and ensures relevant legal, statutory, regulatory and contractual requirements are understood (Control 5.3). These four elements are fundamental to establishing proper ISMS scope. In this scenario, the outsourced data center handling personal health data requires these foundational elements to confirm scope adequacy.
Why the other options are wrong
- D. Policy (Clause 5.2) documents information security direction but doesn't verify scope definition.
- F. Organizational roles and responsibilities (Control 5.3) address accountability but not scope verification.
- G. Awareness, education, and training (Control 7.3) support implementation but don't verify scope.
- H. Secure areas (Control 7.6) are a specific control implementation, not scope verification.
Question 38
In the context of a third-party certification audit, confidentiality is an issue in an audit programme. Select two options which correctly state the function of confidentiality in an audit. (Choose two.)
Show answer and explanation
Correct answer: D, E. Auditors should obtain the auditee's permission before using a camera or recording equipment; Confidentiality is one of the principles of audit conduct
Auditors should obtain the auditee's permission before using cameras or recording equipment (option D) because such tools capture sensitive information and confidentiality agreements must be respected. Confidentiality is one of the principles of audit conduct (option E) established by audit standards such as ISO 19011, ensuring auditors maintain professional ethics and protect sensitive organizational information disclosed during the audit.
Why the other options are wrong
- A. The presence of a guide does not eliminate the risk to sensitive information; confidentiality obligations exist regardless of accompaniment.
- B. Audit information cannot be used for the auditor's personal competence improvement without explicit permission due to confidentiality obligations.
- C. While regulatory requirements may exist, the principle of confidentiality is primarily an ethical and professional standard, not purely a regulatory enforcement issue.
- F. Observers can be part of the audit team but must still respect confidentiality obligations; access depends on auditee agreement and audit programme rules.
Question 39
Which one of the following options best describes the main purpose of a Stage 2 third-party audit?
Show answer and explanation
Correct answer: D. To identify nonconformances against a standard
A Stage 2 third-party certification audit is the detailed on-site audit that occurs after Stage 1 (initial review). Its primary purpose is to identify nonconformances, areas where the organization fails to meet the requirements of the standard being audited. During Stage 2, auditors examine processes, documentation, and evidence in depth to verify compliance against the standard's criteria.
Why the other options are wrong
- A. Checking for legal compliance is broader than the specific focus of a Stage 2 audit, which targets standard requirements.
- B. Determining readiness for certification is the purpose of Stage 1, not Stage 2.
- C. Getting to know the organization is primarily the purpose of Stage 1; Stage 2 assumes this knowledge and focuses on detailed assessment.
Question 40
You are performing an Information Security Management System (ISMS) audit at a European-based residential nursing home called ABC that provides healthcare services. The next step in your audit plan is to verify the effectiveness of the continual improvement process. During the audit, you learned most of the residents' family members (90%) receive WeCare medical device promotion advertisements through email and SMS once a week via ABC's healthcare mobile app. All of them do not agree on the use of the collected personal data for marketing or any other purposes than nursing and medical care on the signed service agreement with ABC. They have very strong reason to believe that ABC is leaking residents' and family members' personal information to a non-relevant third party and they have filed complaints. The Service Manager says that, after investigation, all these complaints have been treated as nonconformities. The corrective actions have been planned and implemented according to the nonconformity and corrective management procedure (Document reference ID: ISMS_L2_10.1, version 1). You write a nonconformity which you will follow up on later. Select the best sentence for the non-conformity:
Show answer and explanation
Correct answer: F. "When reviewing the effectiveness of action taken in response to a nonconformity, an auditor seeks evidence of change that will prevent recurrence of the issue."
Option F correctly describes the auditor's role in nonconformity evaluation: the auditor reviews the action taken in response to the nonconformity and seeks evidence that demonstrates change and prevents recurrence of the issue. This language emphasizes evaluating the effectiveness of corrective actions to ensure they address root causes and prevent future occurrences. Option A uses incorrect language ('allow recurrence' suggests auditors approve continued problems). Option B conflates follow-up audits with initial nonconformity evaluation. Option C uses 'reduces probability' which is weaker than necessary; corrective action must prevent recurrence. Option D relies on assurance rather than objective evidence. Option E uses vague language ('comfort') rather than demanding evidence of change.
Why the other options are wrong
- A. This language incorrectly suggests auditors seek evidence permitting recurrence, which is contrary to audit purposes.
- B. This conflates follow-up audit evaluation with initial nonconformity assessment; the initial audit documents the issue, follow-up verifies correction.
- C. Using 'reduces probability' is insufficient; corrective action must prevent recurrence, not merely reduce likelihood.
- D. Relying on auditee assurance is insufficient; auditors require objective evidence, not promises.
- E. Seeking 'comfort' is too vague and subjective; auditors must gather concrete evidence of effective change.
Question 41
Scenario: Clinic, founded in the 1990s, is a medical device company that specializes in treatments for heart-related conditions and complex surgical interventions. Based in Europe, it serves both patients and healthcare professionals. Clinic collects patient data to tailor treatments, monitor outcomes, and improve device functionality. To enhance data security and build trust, Clinic is implementing an information security management system (ISMS) based on ISO/IEC 27001. This initiative demonstrates Clinic's commitment to securely managing sensitive patient information and its proprietary technologies. Clinic established the scope of its ISMS by solely considering internal issues, interfaces and dependencies between activities conducted internally and those outsourced to other organizations, and the expectations of interested parties. This scope was carefully documented and made accessible. In defining its ISMS, Clinic chose to focus specifically on key processes within critical departments such as Research and Development, Patient Data Management, and Customer Support. Despite initial challenges. Clinic remained committed to its ISMS implementation, tailoring security controls to its unique needs. The project team excluded certain Annex A controls from ISO/IEC 27001, incorporating additional sector-specific controls to enhance security. The project team meticulously evaluated the applicability of these controls against internal and external factors, culminating in developing a comprehensive Statement of Applicability (SoA) detailing the rationale behind control selection and implementation. As preparations for certification progressed, Brian, appointed as the team leader for the project team, adopted a self-directed risk assessment methodology to identify and evaluate the company, strategic issues, and security practices. This proactive approach ensured that Clinic's risk assessment aligned with its objectives and missions. Based on scenario, Clinic initially defined its information security objectives and then conducted a risk assessment. Is this acceptable?
Show answer and explanation
Correct answer: C. No, information security objectives must be established, taking into account risk assessment results, as per ISO/IEC 27001 requirements
ISO/IEC 27001 requires that information security objectives be established after and in consideration of the risk assessment results. The risk assessment process identifies risks and their potential impact, and objectives must be aligned with these findings to ensure they address the actual risk landscape. Establishing objectives before assessing risks may result in objectives that do not appropriately address the organization's true security needs and threat environment.
Why the other options are wrong
- A. Objectives cannot simply be adjusted after risk assessment; they must be informed by and grounded in the risk assessment from the outset.
- B. Risk assessment does not need to wait for objectives to be fully implemented; rather, objectives must be informed by risk assessment results.
Question 42
What is the purpose of audit test plans in the audit process?
Show answer and explanation
Correct answer: B. To conduct audit procedures such as observation and interviews
The purpose of audit test plans in the audit process is to conduct audit procedures such as observation and interviews. Test plans outline which specific audit techniques and procedures will be applied to gather evidence about conformity to standards and criteria. They provide the framework and methodology for performing the detailed fieldwork that generates audit evidence, including interviews with personnel, observations of processes, sampling activities, and document reviews.
Why the other options are wrong
- A. Developing detailed audit reports is an outcome of audit procedures, not the purpose of test plans themselves; test plans guide the evidence-gathering phase.
- C. Selecting all elements for validation would compromise audit efficiency; test plans use sampling and risk-based selection to focus on material areas.
Question 43
You are a certification body auditor, conducting a surveillance audit to ISO/IEC 27001:2022 of a data center operated by a client who provides hosting services for ICT facilities. You and your guide are currently in one of the private suites that the client rents out to customers. Access to each suite is controlled using a combination lock. CCTV is also installed in every suite. Within each suite are three data cabinets in which the client can locate mission-critical servers and other items of networking equipment such as switches and routers. You notice that whilst two of the cabinets in your suite are locked, the third is unlocked. You ask the guide why. They reply "This is because the client is currently swapping out a hard drive unit. Their technician is currently on a lunch break". What three actions should you undertake next? (Choose three.)
Show answer and explanation
Correct answer: E, F, H. Raise an opportunity for improvement suggesting cabinet doors are locked whenever clients leave their suites, even if they intend to return within a short time; Review the CCTV records to ensure that only the client has accessed the cabinet since it was last confirmed as locked; With the permission of the guide, speak to the customer to confirm that they are in the process of swapping out a drive.
When discovering an unlocked cabinet during authorized maintenance, the auditor should raise an opportunity for improvement (Option E) regarding locking procedures when staff leave, review CCTV records to verify access history (Option F), and speak with the customer to confirm authorized maintenance activity (Option H). These proportionate responses gather evidence and provide constructive feedback without assuming non-conformity when authorized work explains the situation.
Why the other options are wrong
- A. An unlocked cabinet requires investigation; inaction is inappropriate audit practice.
- B. Identity management (5.16) is not the appropriate control; this relates to physical access controls.
- C. Physical entry (7.2) is already controlled by combination locks and CCTV; the issue is temporary supervision during authorized work.
- D. Continuous monitoring is not practical during authorized activities; the suite demonstrates adequate physical security measures.
- G. Reprimanding the technician exceeds auditor authority and scope; the auditor role is to assess conformity, not discipline.
Question 44
You are an experience ISMS audit team leader carrying out a third-party certification audit of an organization specializing in the secure disposal of confidential documents and removable media. Both documents and media are shredded in military grade devices which make it impossible to reconstruct the original. The audit has gone well and you are just about to start to write the audit report, 30 minutes before the closing meeting. At this point one of the organization's employees knocks on your door and asks if they can speak to you. They tell you that when things get busy her manager tells her to use a lower grade industrial shredder instead as the organization has more of these and they operate faster. You were not informed about the existence or use of these machines by the auditee. Select three options for how you should respond to this information. (Choose three.)
Show answer and explanation
Correct answer: A, C, G. Advise the individual managing the audit programme of any recommendation by you to conduct a further audit prior to certification; Consider the need for a subsequent audit within 4 weeks based on the additional information that has come to light; Verify with the auditee that lower grade machines are used in certain circumstances
Upon discovering undisclosed use of lower-grade shredders, the auditor must take immediate corrective action. Option A requires informing the audit programme manager about recommending a follow-up audit before certification. Option C mandates scheduling a subsequent audit within 4 weeks to assess the non-conformity. Option G requires verifying with the auditee the circumstances of lower-grade machine use, as this represents a significant deviation from disclosed practices that affects audit findings and certification validity.
Why the other options are wrong
- B. Reviewing client contracts is the organization's responsibility, not the auditor's role during audit closure.
- D. Auditing based on sampling doesn't excuse failure to identify material process variations affecting certification decisions.
- E. Extending current audit duration doesn't address the systemic issue; a separate follow-up audit is required.
- F. While operational planning is relevant, the primary non-conformity relates to transparency and control implementation, not specifically 8.1.
Question 45
Scenario: Clinic, founded in the 1990s, is a medical device company that specializes in treatments for heart-related conditions and complex surgical interventions. Based in Europe, it serves both patients and healthcare professionals. Clinic collects patient data to tailor treatments, monitor outcomes, and improve device functionality. To enhance data security and build trust, Clinic is implementing an information security management system (ISMS) based on ISO/IEC 27001. This initiative demonstrates Clinic's commitment to securely managing sensitive patient information and its proprietary technologies. Clinic established the scope of its ISMS by solely considering internal issues, interfaces and dependencies between activities conducted internally and those outsourced to other organizations, and the expectations of interested parties. This scope was carefully documented and made accessible. In defining its ISMS, Clinic chose to focus specifically on key processes within critical departments such as Research and Development, Patient Data Management, and Customer Support. Despite initial challenges. Clinic remained committed to its ISMS implementation, tailoring security controls to its unique needs. The project team excluded certain Annex A controls from ISO/IEC 27001, incorporating additional sector-specific controls to enhance security. The project team meticulously evaluated the applicability of these controls against internal and external factors, culminating in developing a comprehensive Statement of Applicability (SoA) detailing the rationale behind control selection and implementation. As preparations for certification progressed, Brian, appointed as the team leader for the project team, adopted a self-directed risk assessment methodology to identify and evaluate the company, strategic issues, and security practices. This proactive approach ensured that Clinic's risk assessment aligned with its objectives and missions. Based on the scenario above, answer the following question: Does the Clinic's SoA document meet the ISO/IEC 27001 requirements for the SoA?
Show answer and explanation
Correct answer: C. No. because it does not contain the justification for the exclusion of controls from Annex A of ISO/IEC 27001
ISO/IEC 27001 requires that the Statement of Applicability include not only the controls that are included in the ISMS but also the justification for why controls from Annex A have been excluded. The scenario states that Clinic excluded certain Annex A controls but the SoA only details the rationale for inclusion and implementation, not the exclusions. A complete SoA must address why each Annex A control was either included or excluded from the organization's ISMS.
Why the other options are wrong
- A. While the SoA should include applicable Annex A controls, it must also include exclusion justifications, which are missing in this case.
- B. Including additional sector-specific controls beyond Annex A is acceptable in ISO/IEC 27001, as organizations may add controls to address specific risks.
Question 46
You are an experienced ISMS audit team leader guiding an auditor in training. She asks you about the grading of nonconformities in audit reports. You decide to test her knowledge by asking her which four of the following statements are true. (Choose four.)
Show answer and explanation
Correct answer: A, B, D, E. Major nonconformities may be subject to on-site follow up; Nonconformities may be graded to indicate their significance; Several minor nonconformities can be grouped into a major nonconformity; The action taken to address major nonconformities is typically more substantial than the action taken to address minor nonconformities
Option A is correct: major nonconformities warrant more substantial follow-up including on-site verification. Option B is correct: nonconformities are graded to indicate their significance and impact. Option D is correct: multiple minor nonconformities affecting the same control objective can be consolidated into a major nonconformity assessment. Option E is correct: the severity of the nonconformity determines the extent and nature of corrective action required, with major issues requiring more substantial responses. Option C incorrectly limits grading to only two terms when organizations may use additional categories. Option F is incorrect because grading criteria are typically established by the auditing organization or agreed with the audit client, not solely by the auditee. Option G is incorrect as grading details are explained at closing meeting, not opening. Option H is incorrect as minor nonconformities should not be reclassified upward.
Why the other options are wrong
- C. Nonconformities can be graded using various schemes beyond just major/minor categories.
- F. The audit client and auditing organization determine grading criteria, not solely the auditee.
- G. Detailed grading criteria are explained during findings discussion and closing meeting, not at the opening.
- H. Minor nonconformities should not be regraded as opportunities for improvement; these are distinct categories.
Question 47
Which two of the following phrases would apply to "plan" in relation to the Plan-Do-Check-Act cycle for a business process? (Choose two.)
Show answer and explanation
Correct answer: A, D. Organizing changes; Setting objectives
In the Plan-Do-Check-Act cycle, the Plan phase involves organizing changes and setting objectives for the business process. Organizing changes encompasses defining what modifications or improvements will be made, while setting objectives establishes the goals and targets the process aims to achieve. These two elements form the foundation for the subsequent Do, Check, and Act phases.
Why the other options are wrong
- B. Providing ICT assets is a Do phase activity, not part of planning.
- C. Retaining documentation is typically part of the Do or Check phase, supporting execution and verification rather than planning.
- E. Training staff is generally a Do phase activity for implementing planned changes, not part of the planning phase itself.
Question 48
During discussions with the individual(s) managing the audit programme of a certification body, the Management System Representative of the client organization asks for a specific auditor for the certification audit. Select two of the following options for how the individual(s) managing the audit programme should respond. (Choose two.)
Show answer and explanation
Correct answer: C, D. Advise the Management System Representative that the audit team selection is a decision that the audit programme manager needs to make based on the resources available; State that his request will be considered but may not be taken up
The audit programme manager holds responsibility for auditor selection based on competence, impartiality, and available resources. Option C is correct because it appropriately clarifies that auditor selection is a management decision made according to resource availability and audit programme requirements, not client preferences. Option D is correct because it indicates flexibility within professional boundaries, the request can be noted and considered, but acceptance is not guaranteed and depends on operational feasibility. This maintains the certification body's independence while showing responsiveness to client concerns.
Why the other options are wrong
- A. Cost considerations should not be the primary reason for denying requests; professional criteria should be paramount.
- B. Automatically accepting the request would compromise auditor independence and programme management authority.
- E. Escalating to management is inappropriate; the audit programme manager already has this authority.
- F. Suggesting the client change certification bodies is unprofessional and dismissive of a reasonable inquiry.
Question 49
When an organization needs to determine the resources required for the internal audit programme, which one of the following issues does not impact on the achievement of its intended results?
Show answer and explanation
Correct answer: B. Access by the audit program manager to the competence records of the Information Security Management System manager.
When determining resources for an internal audit programme, the critical factors directly impacting audit results include auditor competence, technical expertise, documented information access, and logistical considerations like time zones. Option B is the exception: access by the audit programme manager to the competence records of the Information Security Management System manager does not directly impact audit results. While the ISMS manager's records are separate from auditor qualification records, the audit programme manager needs access to auditor competence records, not the ISMS manager's personal records. This distinction makes B the item that does not impact intended results.
Why the other options are wrong
- A. Auditor and expert availability directly affects audit quality and coverage.
- C. Access to documented information is essential for conducting effective audits.
- D. Time zone differences impact scheduling, coordination, and audit efficiency.
Question 50
The purpose of a management system is to?
Show answer and explanation
Correct answer: C. Manage the performance of an organization.
The primary purpose of a management system is to manage the performance of an organization. A management system provides a structured framework through which organizational performance is directed, controlled, and continuously improved across defined processes. This includes setting objectives, implementing controls, monitoring results, and making adjustments as needed.
Why the other options are wrong
- A. Dictating performance is too authoritarian and does not reflect the collaborative, process-based nature of a management system.
- B. While improvement is a benefit and outcome of a management system, management itself, not improvement alone, is the primary purpose.
- D. Monitoring is one aspect of management, but the broader purpose encompasses planning, implementing, and controlling as well.
Question 51
Select the option which best describes how Information Security Management System audits should be conducted:
Show answer and explanation
Correct answer: D. Audit methods should be used to assess objective evidence in order to generate audit findings. Then, the audit conclusion should be created and presented to the auditee at the closing meeting.
Option D correctly describes the proper audit sequence: audit methods are employed to assess objective evidence, which generates audit findings; these findings are then synthesized into audit conclusions, which are presented to the auditee at the closing meeting. Objective evidence (facts, documentation, observations) is the required basis for auditor assessments. Audit findings are the specific observations, while conclusions are overall assessments of conformance. Option A incorrectly references circumstantial evidence and wrong audiences. Option B conflates criteria and methods, and presents to wrong audience. Option C uses recommendations instead of conclusions and wrong timing. Option E reverses the logical sequence. Option F incorrectly references objectives and timing.
Why the other options are wrong
- A. Circumstantial evidence is insufficient for auditing; objective evidence is required, and results are presented to audit team leader, not after report creation.
- B. Audit criteria are standards, not methods; presentations occur at closing meeting with auditee, not at team meetings.
- C. Audit methods generate findings and conclusions, not recommendations; these are presented at closing meeting, not recommendations to auditee.
- E. The sequence is reversed; objectives guide the audit, not generate conclusions from evidence.
- F. Objectives provide direction but do not generate conclusions; recommendations go to management review after ISMS implementation, not in initial reporting.
Question 52
Which option below is correct about the audit plan?
Show answer and explanation
Correct answer: B. The audit plan should be flexible to allow for modifications
The audit plan should be flexible to allow for modifications. While audit plans provide structure and direction, they must remain adaptable to accommodate unexpected findings, changing organizational circumstances, or new information discovered during the audit. Auditors must be able to adjust procedures and scope as needed to ensure audit objectives are met and risks are properly addressed. This flexibility is essential to effective audit management.
Why the other options are wrong
- A. While audit plans do involve audit procedures, this statement is incomplete and does not capture the key characteristic of audit plans; flexibility is the defining feature.
- C. The audit plan is prepared by the audit team and audit management, not by the auditee's top management; the auditee is consulted but does not prepare the plan.
Question 53
Which of the options below does an internal audit program NOT allow?
Show answer and explanation
Correct answer: C. The prevention of nonconformities
While internal audit programs enable verification of corrective action effectiveness and can reduce manual audit tasks through systematic approaches and planning, they do not prevent nonconformities. Internal audits detect, identify, and assess nonconformities; they help manage and address them once discovered, but prevention of nonconformities is achieved through control design and implementation, not through the audit program itself.
Why the other options are wrong
- A. Internal audit programs explicitly verify the effectiveness of corrective actions taken in response to identified nonconformities.
- B. Internal audit programs can reduce manual audit tasks through better planning, scheduling, and use of audit techniques and tools.
Question 54
Which of the following best defines managerial controls?
Show answer and explanation
Correct answer: A. Controls related to the management of personnel, including training of employees, management reviews, and internal audits
Managerial controls relate to the management of personnel and organizational processes, including employee training, management reviews, and internal audits. These controls address human factors and organizational governance. Option B describes administrative controls, which concern organizational structure, segregation of duties, and approval processes, structural rather than managerial in nature. Option C describes technical controls, which involve technology and security tools like firewalls and IDSs. Managerial controls are distinct from both administrative and technical controls, focusing specifically on personnel management and oversight functions.
Why the other options are wrong
- B. These are administrative controls related to organizational structure and procedures, not managerial controls focused on personnel management.
- C. These are technical controls employing technology and systems, not managerial controls involving personnel management and reviews.
Question 55
Which one of the following outcomes of an audit does not require the auditee to respond?
Show answer and explanation
Correct answer: A. A conformity
A conformity is a positive finding indicating that the auditee meets the audited requirements. Since conformities represent compliance and not deficiencies or areas for action, they do not require a response or corrective action from the auditee. Nonconformities, opportunities for improvement, and diverging opinions all require auditee engagement or response.
Why the other options are wrong
- B. A diverging opinion concerning audit evidence requires discussion and clarification between the auditor and auditee.
- C. A nonconformity requires the auditee to develop and implement corrective actions.
- D. An opportunity for improvement, while not mandatory, typically receives consideration and response from the auditee.
Question 56
According to ISO/IEC 27001, an Information Security Management System seeks to protect which two of the following? (Choose two.)
Show answer and explanation
Correct answer: C, F. The confidentiality of information; The integrity of information
ISO/IEC 27001 establishes an Information Security Management System to protect the confidentiality, integrity, and availability of information, commonly known as the CIA triad. Confidentiality (option C) ensures information is not disclosed to unauthorized parties, while integrity (option F) ensures information is accurate, complete, and unaltered. These are core security objectives that an ISMS addresses through its controls and processes.
Why the other options are wrong
- A. Accessibility is not a primary ISMS protection goal; availability differs from accessibility in the security context.
- B. Authenticity, while related to security, is not one of the three main CIA triad components that ISO/IEC 27001 emphasizes.
- D. Consistency is not a primary information security protection goal in ISO/IEC 27001.
- E. Integration of information is not a security protection goal; integrity is what matters, not integration.
Question 57
Who is primarily responsible for the preparation and content of the audit report?
Show answer and explanation
Correct answer: A. Audit team leader
The audit team leader holds primary responsibility for the preparation and content of the audit report. This includes ensuring that the report accurately reflects all findings, conclusions, and recommendations from the entire audit team. The team leader must verify that the report is objective, complete, and properly documents all evidence supporting the audit conclusions.
Why the other options are wrong
- B. While individual team members contribute findings and information, the overall responsibility for the report's preparation and content rests with the team leader.
- C. The certification body reviews and approves the audit report but does not prepare it; that responsibility belongs to the audit team leader.
Question 58
Scenario: Clinic, founded in the 1990s, is a medical device company that specializes in treatments for heart-related conditions and complex surgical interventions. Based in Europe, it serves both patients and healthcare professionals. Clinic collects patient data to tailor treatments, monitor outcomes, and improve device functionality. To enhance data security and build trust, Clinic is implementing an information security management system (ISMS) based on ISO/IEC 27001. This initiative demonstrates Clinic's commitment to securely managing sensitive patient information and its proprietary technologies. Clinic established the scope of its ISMS by solely considering internal issues, interfaces and dependencies between activities conducted internally and those outsourced to other organizations, and the expectations of interested parties. This scope was carefully documented and made accessible. In defining its ISMS, Clinic chose to focus specifically on key processes within critical departments such as Research and Development, Patient Data Management, and Customer Support. Despite initial challenges. Clinic remained committed to its ISMS implementation, tailoring security controls to its unique needs. The project team excluded certain Annex A controls from ISO/IEC 27001, incorporating additional sector-specific controls to enhance security. The project team meticulously evaluated the applicability of these controls against internal and external factors, culminating in developing a comprehensive Statement of Applicability (SoA) detailing the rationale behind control selection and implementation. As preparations for certification progressed, Brian, appointed as the team leader for the project team, adopted a self-directed risk assessment methodology to identify and evaluate the company, strategic issues, and security practices. This proactive approach ensured that Clinic's risk assessment aligned with its objectives and missions. Based on scenario, which methodology did Brian choose to conduct risk assessment?
Show answer and explanation
Correct answer: A. OCTAVE
The scenario describes Brian adopting a 'self-directed risk assessment methodology' that 'ensured that Clinic's risk assessment aligned with its objectives and missions.' OCTAVE (Operationally Critical Threat, Asset, and Vulnerability Evaluation) is a self-directed, asset-driven risk assessment methodology that emphasizes organizational context, strategic business objectives, and self-assessment. This methodology allows organizations to tailor the assessment to their specific needs and missions, which aligns with the description of Brian's approach in the scenario.
Why the other options are wrong
- B. MEHARI is a more prescriptive, comprehensive risk management methodology that is less focused on self-directed assessment aligned with organizational objectives.
- C. EBIOS is a structured methodology developed by French authorities that is less commonly described as self-directed and does not emphasize alignment with organizational missions to the same extent as OCTAVE.
Question 59
The auditor used sampling to ensure that event logs recording information security events are maintained and regularly reviewed. Sampling was based on the audit objectives, whereas the sample selection process was based on the probability theory. What type of sampling was used?
Show answer and explanation
Correct answer: A. Statistical sampling
Statistical sampling was used because the sample selection was based on probability theory. Statistical sampling is a quantitative approach that uses mathematical principles and probability to select samples from a population in a way that allows results to be projected to the entire population with measurable confidence. This method differs from judgment-based sampling, which relies on the auditor's professional judgment without mathematical probability foundations.
Why the other options are wrong
- B. Judgment-based sampling relies on the auditor's expertise and professional judgment rather than probability theory to select samples.
- C. Multi-site sampling refers to sampling across multiple locations or sites; the scenario does not indicate sampling across multiple sites.
Question 60
Which one of the following options describes the main purpose of a Stage 1 audit?
Show answer and explanation
Correct answer: C. To determine readiness for Stage 2
Under ISO/IEC 17021-1, the Stage 1 audit reviews the documented management system, scope and site conditions to evaluate whether the organization is ready for the Stage 2 audit. Its main output is a decision on readiness and any areas of concern to resolve before Stage 2.
Why the other options are wrong
- A. Legal compliance is considered as part of the management system review but is not the main purpose of Stage 1.
- B. The Stage 2 audit plan is informed by Stage 1, but compiling it is not the purpose of the Stage 1 audit.
- D. Understanding the organization happens during Stage 1, but it serves the real aim of judging readiness for Stage 2.
Question 61
What is the main difference between qualitative and quantitative evidence?
Show answer and explanation
Correct answer: B. Qualitative evidence focuses on evaluating if a process or control complies with the audit criteria, while quantitative evidence aims to determine if a process in operation is functional and effective
Qualitative evidence evaluates whether processes or controls comply with established audit criteria through examination of attributes and conformance. Quantitative evidence determines whether processes in operation are functional and effective through numerical measurement and analysis. Qualitative evidence addresses the 'what' and 'whether' (compliance), while quantitative evidence addresses the 'how much' and 'how effective' (operational performance and measurable outcomes).
Why the other options are wrong
- A. This reverses the definitions and incorrectly characterizes qualitative evidence as sample-based analysis, when qualitative evidence focuses on compliance evaluation rather than statistical estimation.
- C. This incorrectly presents qualitative evidence as population-based estimation and conflates quantitative evidence with standard compliance rather than operational effectiveness.
Question 62
Scenario: Clinic, founded in the 1990s, is a medical device company that specializes in treatments for heart-related conditions and complex surgical interventions. Based in Europe, it serves both patients and healthcare professionals. Clinic collects patient data to tailor treatments, monitor outcomes, and improve device functionality. To enhance data security and build trust, Clinic is implementing an information security management system (ISMS) based on ISO/IEC 27001. This initiative demonstrates Clinic's commitment to securely managing sensitive patient information and its proprietary technologies. Clinic established the scope of its ISMS by solely considering internal issues, interfaces and dependencies between activities conducted internally and those outsourced to other organizations, and the expectations of interested parties. This scope was carefully documented and made accessible. In defining its ISMS, Clinic chose to focus specifically on key processes within critical departments such as Research and Development, Patient Data Management, and Customer Support. Despite initial challenges. Clinic remained committed to its ISMS implementation, tailoring security controls to its unique needs. The project team excluded certain Annex A controls from ISO/IEC 27001, incorporating additional sector-specific controls to enhance security. The project team meticulously evaluated the applicability of these controls against internal and external factors, culminating in developing a comprehensive Statement of Applicability (SoA) detailing the rationale behind control selection and implementation. As preparations for certification progressed, Brian, appointed as the team leader for the project team, adopted a self-directed risk assessment methodology to identify and evaluate the company, strategic issues, and security practices. This proactive approach ensured that Clinic's risk assessment aligned with its objectives and missions. Based on scenario, the Clinic decided that the ISMS would cover only key processes and departments. Is this acceptable?
Show answer and explanation
Correct answer: A. Yes, but the decision to exclude other processes and departments must be justified
ISO/IEC 27001 permits organizations to define the scope of their ISMS based on their specific needs, organizational boundaries, and context. However, any exclusion of processes, departments, or activities must be documented and justified. The decision to focus on key processes within critical departments is acceptable provided the rationale for excluding other areas is clearly articulated and documented in the Statement of Applicability. This approach allows flexibility while maintaining accountability for scope decisions.
Why the other options are wrong
- B. Organizations can request certification even with a limited scope, provided the scope is clearly defined and justified; there is no blanket prohibition against certification for scoped ISMS implementations.
- C. ISO/IEC 27001 does not mandate inclusion of all organizational processes and departments; risk-based scoping is a core principle of the standard.
That was 62 of 249.
The full PECB ISO/IEC 27001 Lead Auditor pack has all 249 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.
Not ready yet? Get the first 119 free as one PDF by email. Get the Half Pack →