71 free PECB ISO/IEC 27001 Lead Implementer practice questions from the CertStash pack of 285, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 71 free here, all 285 in the pack, and each step includes the one before it.
Get all 285 questions (US$39) · Download the first 10 as a PDF
Question 1
Based on scenario 1, what is a potential impact of the loss of integrity of information in HealthGenic?
Show answer and explanation
Correct answer: B. Incomplete and incorrect medical reports
Integrity is the property of accuracy and completeness. When the software company modified the patient files, the resulting reports were incomplete and incorrect, so the data no longer reflected reality. Clinicians acting on wrong reports is precisely the impact of an integrity failure.
Why the other options are wrong
- A. Disruption of operations and performance degradation is what happens when a system becomes unavailable, not when data becomes inaccurate.
- C. Service interruptions are an availability impact and a complicated user interface is a usability weakness, so neither describes integrity.
Question 2
Intrinsic vulnerabilities, such as the _____________, are related to the characteristics of the asset. Refer to scenario 1.
Show answer and explanation
Correct answer: C. Complicated user interface
An intrinsic vulnerability is a weakness that belongs to the asset itself, as opposed to an extrinsic one that comes from the environment around it. The asset here is the medical software, and the complicated user interface is a characteristic built into that software, so it is intrinsic.
Why the other options are wrong
- A. A software malfunction is an event that occurs rather than a standing characteristic of the asset.
- B. Service interruptions are a consequence that was suffered, so they are an impact rather than a vulnerability of the asset.
Question 3
Which situation described in scenario 1 represents a threat to HealthGenic?
Show answer and explanation
Correct answer: B. The software company modified information related to HealthGenic’s patients
A threat is a potential cause of an unwanted incident, and it acts on the organization from outside its own control. The software company modifying information belonging to HealthGenic's patients is an external party performing an action that harmed the asset, which is exactly what a threat is.
Why the other options are wrong
- A. Failing to train personnel is an absence of a control, so it is a vulnerability that a threat could exploit.
- C. Choosing to use web-based software is a business decision that creates exposure, so it describes the context and the vulnerability rather than the threat itself.
Question 4
In scenario 1, HealthGenic experienced a number of service interruptions due to the loss of functionality of the software. Which principle of information security has been affected in this case?
Show answer and explanation
Correct answer: A. Availability
Availability is the property of being accessible and usable on demand by an authorized entity. Service interruptions caused by a loss of software functionality mean authorized users could not reach the system when they needed it, so availability was affected.
Why the other options are wrong
- B. Confidentiality concerns disclosure to unauthorized parties, and nothing in this part of the scenario was disclosed.
- C. Integrity concerns accuracy and completeness, and an interruption does not by itself alter any data.
Question 5
Scenario 2: Beauty is a cosmetics company that has recently switched to an e-commerce model, leaving the traditional retail. The top management has decided to build their own custom platform in-house and outsource the payment process to an external provider operating online payments systems that support online money transfers. Due to this transformation of the business model, a number of security controls were implemented based on the identified threats and vulnerabilities associated to critical assets. To protect customers’ information. Beauty’s employees had to sign a confidentiality agreement. In addition, the company reviewed all user access rights so that only authorized personnel can have access to sensitive files and drafted a new segregation of duties chart. However, the transition was difficult for the IT team, who had to deal with a security incident not long after transitioning to the e-commerce model. After investigating the incident, the team concluded that due to the out-of-date anti-malware software, an attacker gained access to their files and exposed customers’ information, including their names and home addresses. The IT team decided to stop using the old anti-malware software and install a new one which would automatically remove malicious code in case of similar incidents. The new software was installed in every workstation within the company. After installing the new software, the team updated it with the latest malware definitions and enabled the automatic update feature to keep it up to date at all times. Additionally, they established an authentication process that requires a user identification and password when accessing sensitive information. In addition, Beauty conducted a number of information security awareness sessions for the IT team and other employees that have access to confidential information in order to raise awareness on the importance of system and network security. Based on the scenario above, answer the following question:After investigating the incident. Beauty decided to install a new anti-malware software. What type of security control has been implemented in this case?
Show answer and explanation
Correct answer: C. Corrective
Controls are classified by when they act relative to an incident. Beauty installed the new anti-malware only after investigating an incident that had already happened, and its stated function is to remove malicious code once it is present. Acting after the event to limit and repair the damage makes it a corrective control.
Why the other options are wrong
- A. A preventive control is put in place to stop an incident before it happens, whereas this was a response to one that already occurred.
- B. A detective control identifies that an incident is occurring, but this software goes further and removes the malicious code.
Question 6
Which statement below suggests that Beauty has implemented a managerial control that helps avoid the occurrence of incidents? Refer to scenario 2.
Show answer and explanation
Correct answer: B. Beauty conducted a number of information security awareness sessions for the IT team and other employees that have access to confidential information
Managerial controls, sometimes called administrative controls, are those exercised through the management of people and processes, and they include training, awareness, management reviews and internal audits. The awareness sessions Beauty ran for its staff are a management action intended to stop incidents occurring, so they are the managerial preventive control described.
Why the other options are wrong
- A. A confidentiality agreement is enforced through contract law, so it is classified as a legal control.
- C. Segregation of duties is a valid preventive measure, but the scenario says the chart was drafted, and the question asks for the statement about avoiding incidents through management of personnel.
Question 7
According to scenario 2, Beauty has reviewed all user access rights. What type of control is this?
Show answer and explanation
Correct answer: A. Detective and administrative
A periodic review of user access rights looks back over the rights that already exist in order to find and identify ones that should not be there, which is the definition of a detective control. It is carried out through management process and personnel rather than through technology, so it is also an administrative control.
Why the other options are wrong
- B. A corrective control repairs damage after an incident, whereas a review searches for problems rather than fixing them.
- C. A legal control derives its force from law or contract, and a technical control is enforced by technology, but a management review of rights is neither.
Question 8
Based on scenario 2. Beauty should have implemented (1) ______________________ to detect (2) ______________________.
Show answer and explanation
Correct answer: C. (1) An intrusion detection system, (2) intrusions on networks
The sentence has to hold together as a control and the thing that control detects. An intrusion detection system exists precisely to monitor a network and identify intrusions on it, so it is the only pairing where the second half is genuinely what the first half detects.
Why the other options are wrong
- A. Access control software restricts who may reach a resource, and it does not detect patches. Patches are applied rather than detected.
- B. Network intrusions are an event rather than a control, so the first blank would contain the thing being detected instead of the mechanism doing the detecting.
Question 9
Based on scenario 2, which information security principle is the IT team aiming to ensure by establishing a user authentication process that requires user identification and password when accessing sensitive information?
Show answer and explanation
Correct answer: B. Confidentiality
Requiring a user identification and a password before sensitive information can be reached ensures that only people who can prove who they are may see that information. Restricting disclosure to authorized users is the definition of confidentiality.
Why the other options are wrong
- A. Integrity concerns keeping data accurate and complete, which authentication does not by itself achieve.
- C. Availability concerns access on demand, and adding an authentication step restricts access rather than assuring it.
Question 10
FinanceX, a well-known financial institution, uses an online banking platform that enables clients to easily and securely access their bank accounts. To log in, clients are required to enter the one-time authorization code sent to their smartphone. What can be concluded from this scenario?
Show answer and explanation
Correct answer: A. FinanceX has implemented a security control that ensures the confidentiality of information
Sending a one-time authorization code to a client's registered smartphone is a recognized secure authentication measure, and its purpose is to make sure only the legitimate account holder can reach the account. Restricting access to the account restricts disclosure of the client's financial information, so the control serves confidentiality.
Why the other options are wrong
- B. An integrity control protects data from unauthorized or accidental alteration, whereas this measure governs who may log in.
- C. Nothing in the scenario indicates the control was implemented incorrectly. It describes a normal and recommended banking practice.
What people say about the full ISO/IEC 27001 Lead Implementer pack 5.0 from 3
ISO-IEC-27001 Lead Implementer exam questions online is great. Thanks, passed.
ISO-IEC-27001 Lead Implementer exam dumps are still valid. Thanks, today I passed my ISO-IEC-27001 Lead Implementer exam smoothly.
ISO-IEC-27001 Lead Implementer exam dumps is still valid. Thanks, today I passed my ISO-IEC-27001 Lead Implementer exam smoothly.
Question 11
Based on scenario 16, how does the HealthGenic's negligence affect the ISMS certificate?
Show answer and explanation
Correct answer: B. HealthGenic might not be able to renew the ISMS certificate, as it has not conducted management reviews at planned intervals
ISO/IEC 27001 requires top management to review the ISMS at planned intervals, and HealthGenic decided not to hold a review at all. A requirement that has simply not been carried out is a nonconformity, and one of this kind puts the renewal of the certificate at risk.
Why the other options are wrong
- A. An absence of detected incidents proves nothing. It may equally mean the company was not monitoring well enough to notice them.
- C. An audit taking longer than planned is a scheduling problem, not a failure against any requirement of the standard.
Question 12
According to scenario 15, the team prevented a potential attack based on knowledge gained from previous incidents. Is this acceptable?
Show answer and explanation
Correct answer: C. Yes, in the absence of an information security incident management policy, lessons learned can be applied
The absence of a documented policy does not prevent a team from acting. Knowledge drawn from earlier incidents is exactly what lessons learned are for, and applying it here let the administrators find and close the exploited vulnerability before an attack succeeded.
Why the other options are wrong
- A. Waiting for a policy to be written before responding would have left the vulnerability open while the threat was active.
- B. Incidents differ in detail but repeat in pattern, which is why experience of earlier ones is valuable.
Question 13
Based on scenario 8, does SunDee comply with ISO/IEC 27001 requirements regarding the monitoring and measurement process?
Show answer and explanation
Correct answer: C. No, because even though the standard does not imply when such a process should be performed, the company must have a monitoring and measurement process in place
ISO/IEC 27001 requires the organization to evaluate the information security performance and the effectiveness of the ISMS, and to determine what will be monitored and measured and when. The standard leaves the timing to the organization, but having such a process at all is mandatory, and SunDee has none.
Why the other options are wrong
- A. Freedom over timing is not freedom to skip the process. The requirement to monitor and measure still stands.
- B. No two year cycle appears anywhere in the standard. The organization sets its own intervals.
Question 14
Scenario 9: OpenTech provides IT and communications services. It helps data communication enterprises and network operators become multi-service providers. During an internal audit, its internal auditor, Tim, has identified nonconformities related to the monitoring procedures. He identified and evaluated several system vulnerabilities. Tim found out that user IDs for systems and services that process sensitive information have been reused and the access control policy has not been followed. After analyzing the root causes of this nonconformity, the ISMS project manager developed a list of possible actions to resolve the nonconformity. Then, the ISMS project manager analyzed the list and selected the activities that would allow the elimination of the root cause and the prevention of a similar situation in the future. These activities were included in an action plan. The action plan, approved by the top management, was written as follows:A new version of the access control policy will be established and new restrictions will be created to ensure that network access is effectively managed and monitored by the Information and Communication Technology (ICT) Department.The approved action plan was implemented and all actions described in the plan were documented. Based on this scenario, answer the following question:OpenTech has decided to establish a new version of its access control policy. What should the company do when such changes occur?
Show answer and explanation
Correct answer: A. Identify the change factors to be monitored
When a control or a policy is changed, the organization needs to know whether the change actually works. That means identifying the factors associated with the change that should be monitored, so its effect on information security performance can be evaluated rather than assumed.
Why the other options are wrong
- B. Information security objectives are set at a higher level and do not have to move every time a policy is revised.
- C. Revising an access control policy does not alter what the ISMS covers, so the scope is untouched.
Question 15
According to scenario 11, to detect (1) _____________________ Antiques should have implemented (2) __________________.
Show answer and explanation
Correct answer: B. (1) Intrusions on networks, (2) an intrusion detection system
The two blanks have to match as a thing detected and the control that detects it. An intrusion detection system exists to monitor network traffic and identify intrusions, so intrusions on networks paired with an intrusion detection system is the only coherent reading.
Why the other options are wrong
- A. Patches are applied rather than detected, and access control software restricts access rather than detecting anything.
- C. Network intrusions are an event, not a control, so they cannot fill the second blank.
Question 16
Based on scenario 6, when should Colin deliver the next training and awareness session?
Show answer and explanation
Correct answer: B. After he conducts a competence needs analysis and records the competence-related issues
Training only works when it is aimed at a gap that has actually been identified. Colin should first analyse what competence each group needs for its role in the ISMS and record the shortfalls he finds, because that analysis is what tells him who needs which session and at what level.
Why the other options are wrong
- A. Satisfying the organization's needs is the outcome he is trying to reach, so it cannot be the precondition for running the session.
- C. Availability and motivation affect scheduling and engagement, but they do not tell him what the session should contain.
Question 17
What is the difference between training and awareness? Refer to scenario 6.
Show answer and explanation
Correct answer: A. Training helps acquire certain skills, whereas awareness develops certain habits and behaviors
Training is instruction aimed at giving people specific skills and knowledge they can apply in their work. Awareness works on attitude, developing the habits and behaviours that make people act securely as a matter of course. The two have different purposes, which is why they are planned separately.
Why the other options are wrong
- B. Training covers both acquiring a skill and applying it. Awareness is not the practical application stage of training.
- C. This reverses the two. Awareness is what transmits a message to inform, while training builds capability.
Question 18
Based on scenario 9, did the ISMS project manager complete the corrective action process appropriately?
Show answer and explanation
Correct answer: C. No, the corrective action process should also include the review of the implementation of the selected actions
Corrective action is not finished when the chosen actions have been carried out. ISO/IEC 27001 requires the organization to review the effectiveness of the corrective action taken, because only that review shows whether the nonconformity has actually been eliminated. The project manager stopped at implementation and documentation.
Why the other options are wrong
- A. This list omits the review of effectiveness, so it describes an incomplete process.
- B. The root cause was addressed. The scenario says the causes were analysed and the actions selected were those that would eliminate the root cause.
Question 19
Which situation described in scenario 12 indicates service unavailability?
Show answer and explanation
Correct answer: A. Lucas was not able to access the website with his credentials
Availability means an authorized user can reach a service when they need it. Lucas held valid credentials and still could not get into the website, so the service was not available to him.
Why the other options are wrong
- B. The attackers retaining access is a confidentiality failure, since it concerns who could reach the data rather than whether Lucas could.
- C. Being asked to change a password is an inconvenience and a control measure, and by itself it does not stop access.
Question 20
According to scenario 12, Solena decided to issue a press release in which its representatives denied the attack. What does this situation present?
Show answer and explanation
Correct answer: B. Lack of transparency toward their users
Transparency requires an organization to be open with interested parties about what has actually happened. Solena knew it had been breached and publicly denied the attack, which is a deliberate withholding of the truth from the customers affected by it.
Why the other options are wrong
- A. Solena did have a means of communicating and used it. The fault was in what it said, not in the absence of a channel.
- C. Availability describes access to information systems, and the press release is a question of honesty rather than of access.
Question 21
Scenario 7: InfoSec is a multinational corporation headquartered in Boston, MA, which provides professional electronics, gaming, and entertainment services. After facing numerous information security incidents, InfoSec has decided to establish teams and implement measures to prevent potential incidents in the future. Emma, Bob, and Anna were hired as the new members of InfoSec’s information security team, which consists of a security architecture team, an incident response team (IRT) and a forensics team. Emma’s job is to create information security plans, policies, protocols, and training to prepare InfoSec to respond to incidents effectively. Emma and Bob would be full-time employees of InfoSec, whereas Anna was contracted as an external consultant. Bob, a network expert, will deploy a screened subnet network architecture. This architecture will isolate the demilitarized zone (DMZ) to which hosted public services are attached and InfoSec’s publicly accessible resources from their private network. Thus, InfoSec will be able to block potential attackers from causing unwanted events inside the company’s network. Bob is also responsible for ensuring that a thorough evaluation of the nature of an unexpected event is conducted, including the details on how the event happened and what or whom it might affect. Anna will create records of the data, reviews, analysis, and reports in order to keep evidence for the purpose of disciplinary and legal action, and use them to prevent future incidents. To do the work accordingly, she should be aware of the company’s information security incident management policy beforehand. Among others, this policy specifies the type of records to be created, the place where they should be kept, and the format and content that specific record types should have. Based on this scenario, answer the following question:Based on his tasks, which team is Bob part of?
Show answer and explanation
Correct answer: C. Incident response team
Bob's second responsibility is to make sure a thorough evaluation of an unexpected event is carried out, covering how it happened and what or whom it affects. Assessing events in this way is the work of the incident response team, which assesses, responds to and learns from incidents.
Why the other options are wrong
- A. Designing the screened subnet is architecture work, but the question asks which team he belongs to based on his tasks taken together, and event assessment places him in incident response.
- B. The forensics team preserves evidence and prepares it for disciplinary or legal use, which is Anna's assignment rather than Bob's.
Question 22
An organization has established a policy that provides the personnel with the information required to effectively deploy encryption solutions in order to protect organizational confidential data. What type of policy is this?
Show answer and explanation
Correct answer: C. Topic-specific policy
A topic-specific policy deals with one subject in enough detail to guide the people who work with it. This policy addresses encryption alone and tells personnel how to deploy encryption solutions, so it is topic-specific rather than a statement of overall direction.
Why the other options are wrong
- A. A high-level general policy states the organization's overall position on information security without descending to a single technology.
- B. High-level and topic-specific describe opposite levels of detail, so the two terms do not combine into a policy type.
Question 23
Based on scenario 6, Lisa found some of the issues being discussed in the training and awareness session too technical, thus not fully understanding the session. What does this indicate?
Show answer and explanation
Correct answer: C. Skyver did not determine differing team needs in accordance to the activities they perform and the intended results
An organization has to work out what competence each group of people needs for the part it plays in the ISMS, and then provide training that meets it. Lisa was given technical content that did not match HR's role, which shows those differing needs were never determined.
Why the other options are wrong
- A. Lisa did seek to close the gap by asking the trainer and her colleagues for help, so the failure was not hers.
- B. Evaluating effectiveness happens after delivery, whereas the fault here occurred earlier, when the content was designed without regard to who would receive it.
Question 24
Scenario 6: Skyver offers worldwide shipping of electronic products, including gaming consoles, flat-screen TVs, computers, and printers. In order to ensure information security, the company has decided to implement an information security management system (ISMS) based on the requirements of ISO/IEC 27001.Colin, the company’s best information security expert, decided to hold a training and awareness session for the personnel of the company regarding the information security challenges and other information security-related controls. The session included topics such as Skyver’s information security approaches and techniques for mitigating phishing and malware. One of the participants in the session is Lisa, who works in the HR Department. Although Colin explains the existing Skyver’s information security policies and procedures in an honest and fair manner, she finds some of the issues being discussed too technical and does not fully understand the session. Therefore, in a lot of cases, she requests additional help from the trainer and her colleagues. Based on the scenario above, answer the following question:How should Colin have handled the situation with Lisa?
Show answer and explanation
Correct answer: C. Deliver training and awareness sessions for employees with the same level of competence needs based on the activities they perform within the company
Competence requirements differ according to what people actually do, so training should be delivered to groups whose needs are alike and pitched at the content relevant to their work. Lisa needed material about HR's part in the ISMS rather than the technical detail aimed at other roles.
Why the other options are wrong
- A. Making a session that is pitched wrongly last longer does not make it any more relevant to the audience.
- B. A promise about future sessions leaves the present session, and Lisa's actual competence gap, unaddressed.
Question 25
The certification body rejected NetworkFuse’s request to change the audit team leader. Is this acceptable? Refer to scenario 10.
Show answer and explanation
Correct answer: B. Yes, because NetworkFuse did not give a valid reason to support their claims
An auditee may object to a proposed auditor, but the objection has to rest on a real threat to impartiality. Having previously audited a competitor is ordinary professional work covered by the auditor's confidentiality obligations, so on its own it does not establish a conflict of interest and the certification body was entitled to refuse.
Why the other options are wrong
- A. An auditee can raise an objection. The standard expects the certification body to consider one that is properly grounded.
- C. Such requests are not automatically granted, otherwise an organization could keep removing auditors until it got one it preferred.
Question 26
An organization has decided to conduct information security awareness and training sessions on a monthly basis for all employees. Only 45% of employees who attended these sessions were able to pass the exam. What does the percentage represent?
Show answer and explanation
Correct answer: C. Performance indicator
A performance indicator expresses how well an activity is achieving what it set out to achieve. The proportion of attendees who passed the exam shows how effective the awareness and training sessions were, so the forty five percent is an indicator of performance.
Why the other options are wrong
- A. A measurement objective states what the organization wants to learn from measuring, such as whether training is effective, rather than the resulting figure.
- B. An attribute is a property being measured, for example whether a given employee passed, and the percentage is derived from many such attributes.
Question 27
Based on scenario 13, Socket Inc. decided to assign users to a separate network when accessing cloud storage files. What does this ensure?
Show answer and explanation
Correct answer: A. Better security when using cloud storage files
Putting users who reach the cloud storage on a separate network keeps that traffic away from the rest of the environment, so a compromise elsewhere is less likely to reach the customer data and vice versa. The result is better security when those files are used.
Why the other options are wrong
- B. No control eliminates risk. Segregation reduces it, and a residual risk always remains.
- C. Backups are created by the separate control of keeping copies on network drives, which has nothing to do with network segregation.
Question 28
Based on scenario 4, what type of assets were identified during risk assessment?
Show answer and explanation
Correct answer: A. Supporting assets
Assets are divided into primary assets, which are the business processes and the information itself, and supporting assets, which are the things that primary assets depend on. Hardware, software and networks are all supporting assets, because they carry and process the information rather than being the information.
Why the other options are wrong
- B. Primary assets are the essential business processes and the information handled by the organization, neither of which was listed.
- C. Business assets is another name for primary assets, so it describes the same category that was not identified here.
Question 29
Which situation presented in scenario 16 is not in compliance with ISO/IEC 27001 requirements?
Show answer and explanation
Correct answer: A. Emma has an operational role in the HealthGenic's management system
Auditors must not audit their own work. Emma is HealthGenic's information security officer, so she holds an operational role in the very management system she was told to audit, and she cannot examine it impartially.
Why the other options are wrong
- B. The timing of a recertification audit is governed by the certification cycle agreed with the certification body, not by a requirement of ISO/IEC 27001.
- C. Broad access to offices and documentation is what an auditor needs. Restricting it would be the problem, not granting it.
Question 30
Based on scenario 17, did InVid Electric provide a valid reason for requesting the replacement of the audit team leader?
Show answer and explanation
Correct answer: A. No, because issuing a recommendation for certification to a main competitor is not a conflict of interest situation
An objection to an auditor has to rest on a real threat to impartiality. Auditing another company in the same sector is ordinary professional work, and the auditor is bound by confidentiality over everything learned there, so having recommended a competitor for certification does not create a conflict of interest.
Why the other options are wrong
- B. Previous work for the auditee is one ground for objection, but it is not the only one, so this states the rule too narrowly.
- C. If auditing a competitor disqualified an auditor, no specialist with sector experience could ever be appointed.
Question 31
Scenario 3: Socket Inc. is a telecommunications company offering mainly wireless products and services. It uses MongoDB, a document model database that offers high availability, scalability, and flexibility. Last month, Socket Inc. reported an information security incident. A group of hackers compromised its MongoDB database, because the database administrators did not change its default settings, leaving it without a password and publicly accessible. Fortunately, Socket Inc. performed regular information backups in their MongoDB database, so no information was lost during the incident. In addition, a syslog server allowed Socket Inc. to centralize all logs in one server. The company found out that no persistent backdoor was placed and that the attack was not initiated from an employee inside the company by reviewing the event logs that record user faults and exceptions. To prevent similar incidents in the future, Socket Inc. decided to use an access control system that grants access to authorized personnel only. The company also implemented a control in order to define and implement rules for the effective use of cryptography, including cryptographic key management, to protect the database from unauthorized access. The implementation was based on all relevant agreements, legislation, and regulations, and the information classification scheme. To improve security and reduce the administrative efforts, network segregation using VPNs was proposed. Lastly, Socket Inc. implemented a new system to maintain, collect, and analyze information related to information security threats, and integrate information security into project management. Based on the scenario above, answer the following question:Which security control does NOT prevent information security incidents from recurring?
Show answer and explanation
Correct answer: C. Information backup
The question asks which control does not stop incidents recurring. Information backup does not stop anything from happening. It exists so the organization can restore data once an incident has already caused loss, which makes it a corrective control rather than a preventive one.
Why the other options are wrong
- A. Segregation of networks is a preventive control that keeps an attacker who reaches one segment from moving into others.
- B. Managing privileged access rights is a preventive control that stops unauthorized users from obtaining powerful accounts in the first place.
Question 32
“The ISMS covers all departments within Company XYZ that have access to customers’ data. The purpose of the ISMS is to ensure the confidentiality, integrity, and availability of customers’ data, and ensure compliance with the applicable regulatory requirements regarding information security.” What does this statement describe?
Show answer and explanation
Correct answer: B. The organizational boundaries of the ISMS scope
Organizational boundaries state which parts of the organization the ISMS covers. The statement names all departments that have access to customers' data, which identifies units within the company, so it is defining the organizational boundary.
Why the other options are wrong
- A. An information systems boundary would name the specific systems, applications and infrastructure included, and none are named.
- C. A physical boundary would name sites, buildings or areas, and the statement mentions no location at all.
Question 33
According to scenario 17, InVid Electric did not conduct a self-evaluation prior to the audit. Is this compliant to ISO/IEC 27001?
Show answer and explanation
Correct answer: A. Yes, the standard does not require to conduct a self-evaluation before the audit, however it is a good practice to follow
No clause of ISO/IEC 27001 requires a self-evaluation before a certification audit, so InVid Electric has breached nothing. It remains a sensible thing to do, because it exposes gaps while there is still time to close them.
Why the other options are wrong
- B. The standard does not restrict how an organization prepares, so it does not confine it to internal audit and management review reports.
- C. Reviewing clauses 4 to 10 beforehand is good practice, but the standard does not make it mandatory.
Question 34
Employees of the Finance Department did not fully understand the awareness sessions. What should TradeB do to avoid similar situations in the future? Refer to scenario 14.
Show answer and explanation
Correct answer: B. Adjust awareness sessions to the target audience based on the activities they perform within the company
Competence needs differ according to what people do, so awareness content has to be pitched at the group receiving it. The Finance Department needed material framed around its own work rather than the technical detail it was given, and adjusting sessions to the target audience is what prevents a repeat.
Why the other options are wrong
- A. A longer session delivered at the wrong level is still at the wrong level.
- C. Self-study leaves employees to bridge on their own the gap the trainer failed to bridge, which does not fix the design of the programme.
Question 35
If an organization wants to monitor operations in real time and notify users about deviations, which type of dashboard should be used?
Show answer and explanation
Correct answer: C. Operational dashboard
An operational dashboard presents what is happening right now and raises an alert when a value moves outside its expected range. Monitoring operations in real time and notifying users of deviations is exactly what it is built for.
Why the other options are wrong
- A. A strategic dashboard tracks long term objectives for senior management and is reviewed periodically rather than continuously.
- B. A tactical dashboard supports analysis of progress over the medium term, so it does not deliver real time alerting.
Question 36
What is the most important asset to Socket Inc. associated with the use of cloud storage? Refer to scenario 13.
Show answer and explanation
Correct answer: C. Customers' personal data
The asset that matters most is the one whose loss would harm the organization and the people it holds information about. Customers' personal data is the information being protected, and every control in the list exists to keep it safe, which makes it the primary asset.
Why the other options are wrong
- A. Network drives are infrastructure that holds copies of information, so they are supporting assets.
- B. Employees are people who use the asset. They are not themselves the information being protected.
Question 37
Which of the actions presented in scenario 4 is NOT compliant with the requirements of ISO/IEC 27001?
Show answer and explanation
Correct answer: B. The Statement of Applicability was drafted before conducting the risk assessment
The Statement of Applicability records which controls are necessary, why each is included or excluded, and whether it is implemented. That determination comes out of the risk treatment process, so it can only be produced after the risk assessment. TradeB drafted the Statement of Applicability first, which reverses the required order.
Why the other options are wrong
- A. Selecting only the controls applicable to the organization is correct practice, and the standard expressly allows controls to be excluded with justification.
- C. ISO/IEC 27001 does not say who must perform the work, so engaging external experts is permitted provided the organization retains responsibility.
Question 38
Based on scenario 3. what would help Socket Inc. address similar information security incidents in the future?
Show answer and explanation
Correct answer: C. Using the access control system to ensure that only authorized personnel is granted access
The incident occurred because the database was left with default settings and no password, so it was publicly reachable. An access control system that grants access only to authorized personnel closes exactly that gap and stops the same kind of unauthorized access happening again.
Why the other options are wrong
- A. Continuing to use the default settings is the very weakness that caused the incident.
- B. Cryptographic keys protect the confidentiality of the stored data, but they do not control who is able to reach the database.
Question 39
Based on scenario 8, did the nonconformity report include all the necessary aspects?
Show answer and explanation
Correct answer: C. No, the report must also specify the audit criteria
A nonconformity has to be stated against something. A complete report identifies the audit criteria that were not met, describes the nonconformity with the evidence supporting it, and classifies it as major or minor. Tessa recorded the description, the findings and her recommendations, but without naming the criteria breached the finding is not properly substantiated.
Why the other options are wrong
- A. The report was not complete, because the requirement that was not met is never identified.
- B. Determining the root cause belongs to the organization during corrective action under ISO/IEC 27001, not to the auditor writing up the finding.
Question 40
Diana works as a customer service representative for a large e-commerce company. One day, she accidently modified the order details of a customer without their permission. Due to this error, the customer received an incorrect product. Which information security principle was breached in this case?
Show answer and explanation
Correct answer: C. Integrity
Integrity is the property of accuracy and completeness, and it covers preventing a person who is authorized to modify data from making an error. Diana changed the order details by mistake, so the stored order no longer matched what the customer actually requested and the wrong product shipped.
Why the other options are wrong
- A. Availability was never affected, because the order record remained accessible throughout.
- B. Confidentiality concerns disclosure to unauthorized parties, and no information was exposed by the change.
Question 41
Based on scenario 11, after investigating the incident, Antiques decided to install a new anti-malware software. What type of security control has been implemented in this case?
Show answer and explanation
Correct answer: A. Corrective
The new anti-malware was chosen after an incident had already occurred and been investigated, and its function is to remove malicious code once it is present. Acting after the event to limit and repair the harm is what makes a control corrective.
Why the other options are wrong
- B. A preventive control is put in place ahead of any incident to stop one occurring.
- C. A detective control reports that something is happening, whereas this software also removes the malicious code.
Question 42
Which situation described in scenario 15 indicates that Texas H&H Inc. implemented a detective control?
Show answer and explanation
Correct answer: B. Texas H&H Inc. tested its system for malicious activity and checked cloud-based email settings
A detective control looks for signs that something is wrong. Testing the systems for malicious activity and checking whether the cloud based email settings had been altered are both searches for evidence of compromise, which is detection.
Why the other options are wrong
- A. Integrating the incident management policy is a governance measure that guides future response rather than detecting anything.
- C. Forensic analysis takes place after the event to establish what happened, which makes it part of the response rather than a detective control.
Question 43
Texas H&H Inc. decided to assign an internal expert for their forensic analysis. Is this acceptable? Refer to scenario 15.
Show answer and explanation
Correct answer: A. Yes, forensic analysis can be done by either an internal or external expert
ISO/IEC 27001 does not say who must perform forensic analysis. The organization stays responsible for the outcome, so it may use its own competent staff or engage an external specialist, whichever gives it the capability it needs.
Why the other options are wrong
- B. The standard contains no requirement to hire externally, so this misstates it.
- C. Texas H and H must investigate what happened in its own environment. Waiting on the provider's conclusions would leave its own systems unexamined.
Question 44
According to scenario 18, TroNicon SPEC aimed to eliminate the causes of adverse events by focusing on:
Show answer and explanation
Correct answer: B. Preventing information security incidents rather than correcting them
Before the ISMS, TroNicon SPEC relied on informal practices and dealt with problems as they arose. Adopting the ISMS shifted the emphasis to stopping incidents before they occur, which is what eliminating the causes of adverse events means.
Why the other options are wrong
- A. Detection identifies incidents that are already under way, which is not the same as removing their causes.
- C. Correcting rather than preventing describes the position the company held before implementing the ISMS.
Question 45
Which tool is used to identify, analyze, and manage interested parties?
Show answer and explanation
Correct answer: B. The power/interest matrix
The power and interest matrix plots each interested party according to how much influence it has and how much it cares about the outcome. Those two axes are what let an organization identify its interested parties, analyse their significance and decide how to manage and engage each group.
Why the other options are wrong
- A. The probability and impact matrix is a risk analysis tool used to rank risks, not people.
- C. The likelihood and severity matrix is another way of expressing risk levels and has nothing to do with interested parties.
Question 46
Based on scenario 9, OpenTech has taken all the actions needed, except ___________.
Show answer and explanation
Correct answer: B. Preventive actions
OpenTech reacted to a nonconformity that had already been found, analysed its causes and put in place actions to stop it happening again. All of that is corrective action. Preventive action deals with a potential nonconformity that has not yet occurred, and nothing OpenTech did was aimed at a problem it had not already experienced.
Why the other options are wrong
- A. Corrective actions were taken, since the whole action plan responded to the identified nonconformity.
- C. Corrections were made permanent through the new policy version and the new restrictions.
Question 47
What supports the continual improvement of an ISMS?
Show answer and explanation
Correct answer: A. The update of documented information
The ISMS is described and driven by its documented information, so improvement becomes real only when the policies, procedures and records are revised to reflect what has been learned. Keeping documented information current is what carries an improvement into everyday practice.
Why the other options are wrong
- B. Action plans deal with particular findings and close once those actions are done, so they do not sustain improvement across the system.
- C. External audit reports are produced by the certification body and record its findings. The organization does not update them.
Question 48
Based on scenario 12, which principle of information security was NOT compromised by the attack?
Show answer and explanation
Correct answer: B. Integrity
Confidentiality fell when customer names, addresses and passwords were exposed, and availability fell when Lucas could not reach the website with valid credentials. Nothing in the scenario shows any customer data being altered or corrupted, so integrity is the principle that was not compromised.
Why the other options are wrong
- A. Confidentiality was compromised, because thousands of customer records were exposed to the attackers.
- C. Availability was compromised, because Lucas was repeatedly unable to access the website using his own credentials.
Question 49
Socket Inc. has implemented a control for the effective use of cryptography and cryptographic key management. Is this compliant with ISO/IEC 27001? Refer to scenario 3.
Show answer and explanation
Correct answer: B. Yes, the control for the effective use of the cryptography can include cryptographic key management
Annex A of ISO/IEC 27001 contains a single control covering the use of cryptography, and its stated scope is rules for the effective use of cryptography including cryptographic key management. Socket Inc. therefore implemented one control covering both matters exactly as the standard describes it.
Why the other options are wrong
- A. The control is not limited to key management. It covers the use of cryptography as a whole, with key management as one part.
- C. The standard does not provide a separate control for cryptographic key management. Key management is contained within the use of cryptography control.
Question 50
An organization has implemented a control that enables the company to manage storage media through their life cycle of use, acquisition, transportation and disposal. Which control category does this control belong to?
Show answer and explanation
Correct answer: B. Physical
Annex A groups its controls into organizational, people, physical and technological themes. Managing storage media across acquisition, use, transportation and disposal is the storage media control, which sits in the physical theme because it governs the handling and movement of tangible media.
Why the other options are wrong
- A. Organizational controls cover policies, roles, supplier relationships and similar governance matters rather than the handling of physical media.
- C. Technological controls are those enforced by technology, such as cryptography, logging and malware protection.
Question 51
The application used by an organization has a complicated user interface. What does the complicated user interface represent in this case?
Show answer and explanation
Correct answer: A. An intrinsic vulnerability, since it is a characteristic of the asset
A vulnerability is a weakness that can be exploited, and an intrinsic one belongs to the asset itself. A complicated user interface is a property of the application as built, so it is intrinsic rather than something imposed from outside.
Why the other options are wrong
- B. An extrinsic vulnerability arises from the environment surrounding the asset, whereas this weakness is part of the application.
- C. A threat is a potential cause of an incident and comes from outside the asset. A confusing interface is a weakness that a threat could exploit.
Question 52
The ISMS of Company XYZ covers all departments that have access to customers’ data. Its ISMS aims to ensure the confidentiality, integrity, and availability of its customers’ data, and ensure compliance with the applicable regulatory requirements regarding information security. Which ISMS boundary is described?
Show answer and explanation
Correct answer: B. The organizational boundaries of the ISMS scope
The statement identifies the parts of the organization covered, namely all departments that have access to customers' data. Naming units within the company in this way defines the organizational boundary of the scope.
Why the other options are wrong
- A. A logical boundary would identify networks, systems or data flows, none of which is named.
- C. A physical boundary would identify sites, buildings or areas, and no location is mentioned at all.
Question 53
Scenario 10: NetworkFuse develops, manufactures, and sells network hardware. The company has had an operational information security management system (ISMS) based on ISO/IEC 27001 requirements and a quality management system (QMS) based on ISO 9001 for approximately two years. Recently, it has applied for a combined certification audit in order to obtain certification against ISO/IEC 27001 and ISO 9001.After selecting the certification body, NetworkFuse prepared the employees for the audit. The company decided to not conduct a self-evaluation before the audit since, according to the top management, it was not necessary. In addition, it ensured the availability of documented information, including internal audit reports and management reviews, technologies in place, and the general operations of the ISMS and the QMS. However, the company requested from the certification body that the documentation could not be carried off-site. However, the audit was not performed within the scheduled days because NetworkFuse rejected the audit team leader assigned and requested their replacement. The company asserted that the same audit team leader issued a recommendation for certification to its mam competitor, which, for the company’s top management, was a potential conflict of interest. The request was not accepted by the certification body. Based on the scenario above, answer the following question:Does NetworkFuse fulfill the prerequisites for a certification audit?
Show answer and explanation
Correct answer: B. Yes, because internal audits and management reviews have been performed
Before a certification audit the organization must be able to show that its management system is genuinely operating, and the evidence for that is a completed internal audit programme and management reviews performed at planned intervals. NetworkFuse has both, so the prerequisites are met.
Why the other options are wrong
- A. Engaging a certification body is an administrative step in arranging the audit rather than evidence that the management system works.
- C. There is no rule that the ISMS must have run for a full year. What matters is that the required activities have been carried out.
Question 54
Which of the following is NOT part of the steps required by ISO/IEC 27001 that an organization must take when a nonconformity is detected?
Show answer and explanation
Correct answer: C. Communicate the details of the nonconformity to every employee of the organization and suspend the employee that caused the nonconformity
The question asks which step is not required. ISO/IEC 27001 requires the organization to react to the nonconformity, evaluate whether action is needed to eliminate its causes, implement that action and review its effectiveness. Broadcasting the details to every employee and suspending whoever was involved appears nowhere in the standard and would be a disciplinary matter rather than a management system one.
Why the other options are wrong
- A. Reacting to the nonconformity, controlling and correcting it and dealing with its consequences is the first required step.
- B. Evaluating the need for action to eliminate the causes so the problem does not recur or occur elsewhere is also expressly required.
Question 55
According to scenario 14, Alex used terminology and concepts that were not understood by participants. Which principle of effective communication strategy did Alex NOT follow?
Show answer and explanation
Correct answer: A. Appropriateness
Appropriateness requires the message to suit the people receiving it, including the language and level of detail used. Alex used terminology his audience did not know, so the content did not fit the audience in front of him.
Why the other options are wrong
- B. Transparency concerns openness about what is being done, and Alex was open. His material was simply pitched wrongly.
- C. Credibility concerns whether the speaker is believed, and nothing suggests the participants doubted him.
Question 56
Based on scenario 5, after migrating to cloud, Operaze’s IT team changed the ISMS scope and implemented all the required modifications. Is this acceptable?
Show answer and explanation
Correct answer: A. Yes, because the ISMS scope should be changed when there are changes to the external environment
The scope of the ISMS is determined by considering the internal and external issues facing the organization and the interfaces and dependencies with other parties. Moving physical servers onto a third party's infrastructure changes all of those, so the scope has to be revisited and updated to reflect the new arrangement.
Why the other options are wrong
- B. A scope once defined is not fixed forever. The standard expects it to be kept current as the organization changes.
- C. Management involvement matters, but the question asks whether changing the scope after this migration is acceptable, and the migration is precisely the kind of change that requires it.
Question 57
How does SunDee’s negligence affect the ISMS certificate? Refer to scenario 8.
Show answer and explanation
Correct answer: B. SunDee might not be able to renew the ISMS certificate, because it has not conducted management reviews at planned intervals
ISO/IEC 27001 requires top management to review the ISMS at planned intervals, and it is a requirement rather than an option. SunDee has gone two years without doing so, which is a failure against the standard and puts the renewal of its certificate at risk.
Why the other options are wrong
- A. A single late internal audit does not repair two years of missing management reviews, so it does not secure the certificate.
- C. An audit overrunning its schedule is an inconvenience, not a breach of any requirement of the standard.
Question 58
Why did InfoSec establish an IRT? Refer to scenario 7.
Show answer and explanation
Correct answer: C. To assess, respond to, and learn from information security incidents
An incident response team exists to assess information security incidents, respond to them so that damage is contained, and draw lessons from them so the organization improves. That full cycle of assess, respond and learn is why InfoSec set the team up.
Why the other options are wrong
- A. Compliance may be a consequence, but a team is established to achieve a purpose rather than to satisfy a clause.
- B. Collecting, preserving and analysing evidence is the forensics function, which is a separate team in this scenario.
Question 59
Scenario 8: SunDee is an American biopharmaceutical company, headquartered in California, the US. It specializes in developing novel human therapeutics, with a focus on cardiovascular diseases, oncology, bone health, and inflammation. The company has had an information security management system (ISMS) based on ISO/IEC 27001 in place for the past two years. However, it has not monitored or measured the performance and effectiveness of its ISMS and conducted management reviews regularly. Just before the recertification audit, the company decided to conduct an internal audit. It also asked most of their staff to compile the written individual reports of the past two years for their departments. This left the Production Department with less than the optimum workforce, which decreased the company’s stock. Tessa was SunDee’s internal auditor. With multiple reports written by 50 different employees, the internal audit process took much longer than planned, was very inconsistent, and had no qualitative measures whatsoever. Tessa concluded that SunDee must evaluate the performance of the ISMS adequately. She defined SunDee’s negligence of ISMS performance evaluation as a major nonconformity, so she wrote a nonconformity report including the description of the nonconformity, the audit findings, and recommendations. Additionally, Tessa created a new plan which would enable SunDee to resolve these issues and presented it to the top management. Based on the scenario above, answer the following question:What caused SunDee’s workforce disruption?
Show answer and explanation
Correct answer: C. The voluminous written reports
The question asks what disrupted the workforce. SunDee asked most of its staff to compile written individual reports covering two years, and the effort that took left the Production Department below the workforce it needed. The volume of report writing is what pulled people away from their jobs.
Why the other options are wrong
- A. The neglect of performance evaluation is why the reports were suddenly needed, so it is the background cause rather than the thing that took staff away from production.
- B. Inconsistency between reports made the audit harder for Tessa, but it did not reduce the number of people available to work.
Question 60
Scenario 17: InVid Electric is an American company that specializes in manufacturing, developing, and selling network hardware. The company has had an operational information security management system (ISMS) based on ISO/IEC 27001 requirements and a quality management system (QMS) based on ISO 9001 for approximately two years. Recently, it has applied for a combined certification audit in order to obtain certification against ISO/IEC 27001 and ISO 9001.After selecting the certification body, InVid Electric prepared the employees for the audit. The company decided to not conduct a self-evaluation before the audit since, according to the top management, it was not necessary. In addition, it ensured the availability of documented information, including internal audit reports and management reviews, technologies in place, and the general operations of the ISMS and the QMS. However, the company requested from the certification body that the documentation could not be carried off-site. Nonetheless, the audit was not performed within the scheduled time frame because InVid Electric rejected the assigned audit team leader and requested their replacement. According to the top management reasoning, the audit team leader represented a potential conflict of interest as the same audit team leader issued a recommendation for certification to InVid Electric’s main competitor. Based on the scenario, answer the following question:How can InVid Electric's ensure that its employees are prepared for the audit?
Show answer and explanation
Correct answer: A. By conducting practice interviews with the employees
Employees are interviewed during a certification audit and most will never have experienced one. Practice interviews let them rehearse describing what they actually do, which is how they arrive prepared rather than anxious.
Why the other options are wrong
- B. Watching the technologies in use teaches nothing about answering an auditor's questions.
- C. Coaching staff from past audit reports encourages rehearsed answers rather than truthful ones, which undermines the audit.
Question 61
Based on scenario 15, what else should Texas H&H Inc. do when responding to the incident?
Show answer and explanation
Correct answer: B. Record and document the incident which serves as input for future corrective actions
An incident has to be recorded and documented so that what happened, what was done and what it revealed is preserved. That record is the input for corrective action and for the lessons that stop the same weakness being exploited again.
Why the other options are wrong
- A. Abandoning cloud services altogether is a disproportionate reaction that discards the business benefit rather than managing the risk.
- C. A policy that guides employees on responding to incidents is useless if only top management sees it.
Question 62
Based on scenario 5, which committee should Operaze create to ensure the smooth running of the ISMS?
Show answer and explanation
Correct answer: A. Information security committee
An information security committee brings together representatives from the relevant parts of the organization so that information security is coordinated, decisions are taken consistently and the ISMS keeps running properly once it is in place. That ongoing coordination is exactly what Operaze's top management wanted to secure.
Why the other options are wrong
- B. A management committee deals with the general running of the business rather than with the ISMS specifically.
- C. An operational committee handles day to day operational matters and does not carry responsibility for the management system as a whole.
Question 63
Does HealthGenic comply with the requirements of ISO/IEC 27001 regarding the monitoring and measurement process? Refer to scenario 16.
Show answer and explanation
Correct answer: C. No, because even though the standard does not imply when such a process should be performed, the company must have a monitoring and measurement process in place
ISO/IEC 27001 requires the organization to determine what needs to be monitored and measured, and to evaluate information security performance and the effectiveness of the ISMS. The standard leaves the timing to the organization, but it does not make the process optional, and HealthGenic's IT team neglected it entirely.
Why the other options are wrong
- A. Freedom to choose when to monitor is not freedom to skip monitoring altogether, so the absence of the process is still a failure.
- B. No two year interval appears anywhere in the standard. The organization sets its own planned intervals.
Question 64
Why should the security testing processes be defined and implemented in the development life cycle?
Show answer and explanation
Correct answer: B. To validate if information security requirements are met when applications are deployed to the production environment
Security testing during the development life cycle exists so that the information security requirements set for an application are checked before it goes live. Testing at each stage confirms those requirements are actually met when the application is deployed to production.
Why the other options are wrong
- A. Keeping production safe from development and test activity is the purpose of separating those environments, which is a different control.
- C. Identifying assets and defining protection responsibilities is the purpose of the asset inventory control.
Question 65
Following a reported event, an information security event ticket has been completed and its priority has been assigned. Then, the event has been evaluated to determine if it is an information security incident. Which phase of the incident management has been completed?
Show answer and explanation
Correct answer: A. Initial assessment and decision
After an event has been detected and reported, the assessment and decision phase applies the organization's criteria to it, assigns a priority and decides whether the event is in fact an information security incident. Completing the ticket, prioritizing it and reaching that decision is that phase from start to finish.
Why the other options are wrong
- B. Detection and reporting ends once the event has been noticed and passed on, before any judgement is made about what it is.
- C. Evaluation and confirmation is not one of the phases of incident management. The decision on whether an event is an incident belongs to the assessment and decision phase.
Question 66
Based on scenario 18, is the action plan for treating the nonconformity related to control 8.13 Information backup valid?
Show answer and explanation
Correct answer: B. No, it does not describe the explicit changes of the existing backup procedure
The plan says only that the backup procedure will be updated. It never states what will change, so nobody can tell whether the improper formatting of the backup medium that caused the failure will actually be addressed, and there is nothing concrete to verify afterwards.
Why the other options are wrong
- A. An updated procedure could eliminate the nonconformity. The defect is that the plan does not say how, not that the approach is incapable of working.
- C. The plan cannot be judged sufficient when the changes it promises are left entirely unspecified.
Question 67
Who should be involved, among others, in the draft, review, and validation of information security procedures?
Show answer and explanation
Correct answer: C. The employees in charge of ISMS operation
Procedures describe how work is actually carried out, so the people who perform that work are the ones who can say whether a procedure is accurate and workable. Guidance on preparing for the implementation of controls is explicit that the employees in charge of the operations concerned should take part in drafting, reviewing and validating the content of these procedures.
Why the other options are wrong
- A. An external expert can advise, but an outsider does not know the day to day operation well enough to validate a procedure on their own.
- B. The information security committee brings together representatives from across the organization to coordinate and oversee information security. It sets direction and approves policy rather than drafting operating procedures.
Question 68
What risk treatment option has Company A implemented if it has required from its employees the change of email passwords at least once every 60 days?
Show answer and explanation
Correct answer: A. Risk modification
Risk modification, also called risk reduction, means applying a control that lowers the likelihood or the impact of a risk. Forcing a password change every sixty days shortens the window in which a stolen or guessed password stays useful, so it reduces the likelihood of unauthorized access while the risk itself remains.
Why the other options are wrong
- B. Avoidance means ceasing the activity that gives rise to the risk, and the company continues to use email.
- C. Retention means keeping the risk without applying a control, whereas a control has plainly been applied here.
Question 69
Scenario 15: Texas H&H Inc. is a multinational corporation headquartered in Boston, MA, which provides professional electronics, gaming, and entertainment services. The company decided to utilize cloud storage services which best suited its needs, due to the large amount of data that the company processes daily. Recently, Texas H&H Inc. learned that the cloud storage provider that it uses has been publicly compromised. Being aware of the high risk of data exposure, the security administrators of Texas H&H Inc. decided to undertake actions that could prevent a potential attack. In the absence of an information security incident management policy, their response was based on their knowledge gained from previous incidents. They tested their systems for any malicious activity or violation and checked if the cloud-based email settings were changed. By quickly responding to the exploited vulnerability that was found, the team was able to prevent the attack. Once they made sure that the attackers do not have access in their system, the security administrators decided to proceed with the forensic analysis. They concluded that their access security system was not designed for threat detection, including the detection of malicious files which could be the cause of possible future attacksBased on these findings, Texas H&H Inc. decided to modify its access security system to avoid future incidents and integrate an incident management policy in their information security policy that could serve as guidance for employees on how to respond to similar incidents. Based on the scenario above, answer the following question:Texas H&H Inc. decided to integrate the incident management policy to the existent information security policy. How do you define this situation?
Show answer and explanation
Correct answer: A. Acceptable, the incident management policy may be integrated into the overall information security policy of the organization
An organization decides how to arrange its policies. An incident management policy may stand alone as a topic-specific policy or be incorporated into the overall information security policy, and either arrangement satisfies the standard as long as the content is there.
Why the other options are wrong
- B. Environmental, health and safety matters are governed by other management systems and have no bearing on how this policy is structured.
- C. Nothing requires a separate document. Clarity and effectiveness depend on the content and how it is communicated, not on the number of documents.
Question 70
Which approach should organizations use to implement an ISMS based on ISO/IEC 27001?
Show answer and explanation
Correct answer: A. An approach that is suitable for organization’s scope
ISO/IEC 27001 states requirements but does not prescribe how to meet them, so the organization chooses an approach that fits its own scope, size, structure and risks. An approach suited to the defined scope is what makes the resulting ISMS workable.
Why the other options are wrong
- B. The standard imposes no time limit on implementation, so twelve months is not a criterion.
- C. The standard does not provide an implementation approach at all. It sets out requirements to be satisfied.
Question 71
An organization uses Platform as a Services (PaaS) to host its cloud-based services. As such, the cloud provider manages most of the services to the organization. However, the organization still manages_____________.
Show answer and explanation
Correct answer: C. Application and data
Under Platform as a Service the provider runs the servers, storage, networking, virtualization and operating system, and it offers the customer a platform to build on. What remains with the customer is what it puts on that platform, which is its applications and its data.
Why the other options are wrong
- A. The operating system and virtualization layer are managed by the provider in a Platform as a Service arrangement.
- B. Servers and storage are physical infrastructure, which the provider owns and operates.
That was 71 of 285.
The full PECB ISO/IEC 27001 Lead Implementer pack has all 285 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.
Not ready yet? Get the first 142 free as one PDF by email. Get the Half Pack →