Month End Sale 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: save70

ISO 27001 ISO-IEC-27001-Lead-Implementer Book

PECB Certified ISO/IEC 27001 : 2022 Lead Implementer exam Questions and Answers

Question 17

The purpose of control 5.9 inventory of Information and other associated assets of ISO/IEC 27001 is to identify organization's information and other associated assets in order to preserve their information security and assign ownership. Which of the following actions docs NOT fulfill this purpose?

Options:

A.

Conducting regular reviews of identified information and other associated assets

B.

Establishing rules to control physical and logical access to Information and other associated assets

C.

Assigning the responsibility for appropriately classifying and protecting information and other associated assets to the asset owners

Question 18

Invalid Electric, a manufacturer of electrical components, is preparing for its upcoming ISO 27001 certification audit. This is the first time the company has undergone such an audit, and many of itsemployees are not familiar with the process. The management team is concerned that employees may not be adequately prepared for interviews and the scrutiny of documentation during the audit.

To ensure that employees are ready for the audit, the management team is considering several options to help them understand what to expect and how to handle the auditor's questions confidently.

Based on scenario 10. did invalid Electric provide a valid reason for requesting the replacement of the audit learn leader?

Options:

A.

No, because Issuing a recommendation for certification lo a main competitor is not a conflict of interest situation

B.

No, because the auditee can request the replacement of an auditor only if the auditor has worked for the auditee

C.

Yes, because the auditee can request to replace an auditor that has worked for one of its major competitors

Question 19

Scenario 7: InfoSec is a multinational corporation headquartered in Boston, MA, which provides professional electronics, gaming, and entertainment services. After facing numerous information security incidents, InfoSec has decided to establish teams and implement measures to prevent potential incidents in the future

Emma, Bob. and Anna were hired as the new members of InfoSec's information security team, which consists of a security architecture team, an incident response team (IRT) and a forensics team Emma's job is to create information security plans, policies, protocols, and training to prepare InfoSec to respond to incidents effectively Emma and Bob would be full-time employees of InfoSec, whereas Anna was contracted as an external consultant.

Bob, a network expert, will deploy a screened subnet network architecture This architecture will isolate the demilitarized zone (OMZ) to which hosted public services are attached and InfoSec's publicly accessible resources from their private network Thus, InfoSec will be able to block potential attackers from causing unwanted events inside the company's network. Bob is also responsible for ensuring that a thorough evaluation of the nature of an unexpected event is conducted, including the details on how the event happened and what or whom it might affect.

Anna will create records of the data, reviews, analysis, and reports in order to keep evidence for the purpose of disciplinary and legal action, and use them to prevent future incidents. To do the work accordingly, she should be aware of the company's information security incident management policy beforehand

Among others, this policy specifies the type of records to be created, the place where they should be kept, and the format and content that specific record types should have.

Based on scenario 7. InfoSec contracted Anna as an external consultant. Based on her tasks, is this action compliant with ISO/IEC 27001°

Options:

A.

No, the skills of incident response or forensic analysis shall be developed internally

B.

Yes, forensic investigation may be conducted internally or by using external consultants

C.

Yes, organizations must use external consultants for forensic investigation, as required by the standard

Question 20

Scenario 10: ProEBank

ProEBank, an Austrian financial institution, implemented an ISMS and prepared for ISO/IEC 27001 certification. During planning, the company identified aconflict of interestwith one auditor, who had previously worked with their main competitor. ProEBankrefused to undergo the audituntil a new audit team was assigned. The certification body acknowledged the issue and replaced the team.

ProEBank is an Austrian financial institution known for its comprehensive range of banking services. Headquartered in Vienna, it leaverages the city's advanced technological and financial ecosystem To enhance its security posture, ProEBank has implementied an information security management system (ISMS) based on the ISO/IEC 27001. After a year of having the ISMS in place, the company decided to apply for a certification audit to obtain certification against ISO/IEC 27001.

To prepare for the audit, the company first informed its employees for the audit and organized training sessions to prepare them. It also prepared documented information in advance, so that the documents would be ready when external auditors asked to review them Additionally, it determined which of its employees have the knowledge to help the external auditors understand and evaluate the processes.

During the planning phase for the audit, ProEBank reviewed the list of assigned auditors provided by the certification body. Upon reviewing the list, ProEBank identified a potential conflict of interest with one of the auditors, who had previously worked for ProEBank's mein competitor in the banking industry To ensure the integrity of the audit process. ProEBank refused to undergo the audit until a completely new audit team was assigned. In response, the certification body acknowledged the conflict of interest and made the necessary adjustments to ensure the impartiality of the audit team

After the resolution of this issue, the audit team assessed whether the ISMS met both the standard's requirements and the company's objectives. During this process, the audit team focused on reviewing documented information.

Three weeks later, the team conducted an on-site visit to the auditee’s location where they aimed to evaluate whether the ISMS conformed to the requirements of ISO/IEC 27001. was effectively implemented, and enabled the auditee to reach its information security objectives. After the on-site visit the team prepared the audit conclusions and notified the auditee that some minor nonconformities had been detected The audit team leader then issued a recommendation for certification.

After receiving the recommendation from the audit team leader, the certification body established a committee to make the decision for certification. The committee included one member from the audit team and two other experts working for the certification body.

Question:

Is ProEBank's decision to require a new audit team due to a perceived conflict of interest acceptable?

Options:

A.

No – they should have requested only the replacement of the auditor

B.

No – the auditee does not have the right to reject the auditors selected by the certification body

C.

Yes – the auditee is allowed to refuse to undergo the audit until a new audit team is established