PECB ISO-IEC-27001-Lead-Implementer Exam With Confidence Using Practice Dumps

The correct and verified answer is B. Technological, because the identified risk—unrestricted write access to production source code and development tools—must be managed through technical enforcement mechanisms, not solely by people or organizational measures.

The scenario describes a failure to restrict access to critical production systems, allowing a junior developer to modify source code without authorization. This is a classic access control and privilege management issue that requires technological controls such as role-based access control (RBAC), privileged access management, repository permissions, and segregation of environments.

ISO/IEC 27001:2022 Annex A categorizes controls into organizational, people, physical, and technological groups. The controls relevant to this scenario fall squarely under technological controls, including:

A.8.2 – Privileged access rightsRequires restriction and management of elevated access to prevent unauthorized or excessive privileges.

A.8.3 – Information access restrictionEnsures access to information and systems is limited in accordance with business requirements.

A.8.4 – Access to source codeExplicitly requires that access to source code is restricted, controlled, and monitored.

A.8.32 – Change managementEnsures that changes to production systems are authorized, tested, and approved.

While people controls (such as training or awareness) and organizational controls (such as policies) are supportive, they are insufficient on their own. Without technical enforcement, policies cannot prevent unauthorized access in practice.

ISO/IEC 27001:2022 emphasizes defense-in-depth, where technological controls enforce rules automatically, reducing reliance on human behavior alone.

One of the ways to prepare employees for an ISO/IEC 27001 audit is to conduct practice interviews with them. This can help them to familiarize themselves with the audit process, the types of questions they might be asked, and the evidence they need to provide to demonstrate compliance with the standard. Practice interviews can also help employees to identify any gaps or weaknesses in their knowledge or performance, and to address them before the actual audit. Practice interviews can be conducted by internal auditors, managers, or consultants, and should cover the relevant scope, objectives, and criteria of the audit. (From the PECB ISO/IEC 27001 Lead Implementer Course Manual, page 113)

PECB ISO/IEC 27001 Lead Implementer Course Manual, page 113

PECB ISO/IEC 27001 Lead Implementer Info Kit, page 10

5 Step Plan: How to Prepare for an ISO 27001 Certification Audit