ISO-IEC-27001-Lead-Auditor Leak Questions

PECB Certified ISO/IEC 27001 2022 Lead Auditor exam Questions and Answers

Question 77

How are internal audits and external audits related?

Options:

Internal audits ensure that the organization regularly monitors the external audit reports and action plans

Internal audits ensure the implementation of the corrective actions before the organization is recommended for certification by the external auditor

Internal audits and external audits are included in the certification cycle, which ensures the monitoring of the management system on a regular basis

Question 78

You are performing an ISMS audit at a residential nursing home that provides healthcare services. The next step in your audit

plan is to verify the information security of the business continuity management process. During the audit, you learned that

the organisation activated one of the business continuity plans (BCPs) to make sure the nursing service continued during the

recent pandemic. You ask the Service Manager to explain how the organization manages information security during the

business continuity management process.

The Service Manager presented the nursing service continuity plan for a pandemic and summarised the process as follows:

Stop the admission of any NEW residents.

70% of administration staff and 30% of medical staff will work from home.

Regular staff self-testing, including submitting a negative test report 1 day BEFORE they come to the office.

Install ABC's healthcare mobile app, tracking their footprint and presenting a GREEN Health Status QR-Code for checking on the spot.

You ask the Service Manager how to prevent non-relevant family members or interested parties from accessing residents' personal data when staff work from home. The Service Manager cannot answer and suggests the IT Security Manager should help with that.

You would like to further investigate other areas to collect more audit evidence. Select three options that will not be in your audit trail.

Options:

Collect more evidence on how information security protocols are maintained during disruption (relevant to control A.5.29)

Collect more evidence that staff only use IT equipment protected from malware when working from home (relevant to control A.8.7)

Collect more evidence by interviewing additional staff to ensure they are aware of the need to sometimes work from home (Relevant to clause 7.3)

Collect more evidence on how and when the Business Continuity Plan has been tested. (Relevant to control A.5.29)

Collect more evidence on how the organisation makes sure all staff periodically conduct a positive Covid test (Relevant to control A.7.2)

Collect more evidence on how the organisation manages information security on mobile devices and during teleworking (Relevant to control A.6.7)

Collect more evidence on how the organisation performs a business risk assessment to evaluate how fast the existing residents can be discharged from the nursing home. (Relevant to clause 6)

Answer:

E, G, H

Explanation:

According to ISO/IEC 27001:2022 clause 6.1, the organization must establish, implement and maintain an information security risk management process that includes the following activities:

establishing and maintaining information security risk criteria;
ensuring that repeated information security risk assessments produce consistent, valid and comparable results;
identifying the information security risks;
analyzing the information security risks;
evaluating the information security risks;
treating the information security risks;
accepting the information security risks and the residual information security risks;
communicating and consulting with stakeholders throughout the process;
monitoring and reviewing the information security risks and the risk treatment plan.

According to control A.5.29, the organization must establish, document, implement and maintain processes, procedures and controls to ensure the required level of continuity for information security during a disruptive situation. The organization must also:

determine its requirements for information security and the continuity of information security management in adverse situations, e.g. during a crisis or disaster;
establish, document, implement and maintain processes, procedures and controls to ensure the required level of continuity for information security during an adverse situation;
verify the availability of information processing facilities.

Therefore, the following options will not be in your audit trail, as they are not relevant to the information security risk management process or the information security continuity process:

E. Collect more evidence on how the organisation makes sure all staff periodically conduct a positive Covid test (Relevant to control A.7.2). This is not relevant to the information security aspects of business continuity management, as it is related to the health and safety of the staff, not the protection of information assets. Control A.7.2 is about screening of personnel prior to employment, not during employment.
G. Collect more evidence on how the organisation performs a business risk assessment to evaluate how fast the existing residents can be discharged from the nursing home. (Relevant to clause 6). This is not relevant to the information security aspects of business continuity management, as it is related to the operational and financial aspects of the business, not the identification and treatment of information security risks. Clause 6 is about the information security risk management process, not the business risk management process.
H. Collect more evidence on what resources the organisation provides to support the staff working from home. (Relevant to clause 7.1). This is not relevant to the information security aspects of business continuity management, as it is related to the general provision of resources for the ISMS, not the specific processes, procedures and controls to ensure the continuity of information security during a disruptive situation. Clause 7.1 is about determining and providing the resources needed for the establishment, implementation, maintenance and continual improvement of the ISMS, not the resources needed for the staff working from home.

References:

ISO/IEC 27001:2022, clauses 6.1, 7.1, and Annex A control A.5.29
[PECB Candidate Handbook ISO/IEC 27001 Lead Auditor], pages 14-15, 17, 22-23
ISO 27001:2022 Annex A Control 5.29 - What’s New?
ISO 22301 Business Continuity Management System

Question 79

Which one of the following options describes the main purpose of a Stage 1 audit?

Options:

To determine readiness for Stage 2

To check for legal compliance by the organisation

To get to know the organisation

To compile the audit plan

Question 80

Scenario 5: Data Grid Inc. is a well-known company that delivers security services across the entire information technology infrastructure. It provides cybersecurity software, including endpoint security, firewalls, and antivirus software. For two decades, Data Grid Inc. has helped various companies secure their networks through advanced products and services. Having achieved reputation in the information and network security field, Data Grid Inc. decided to obtain the ISO/IEC 27001 certification to better secure its internal and customer assets and gain competitive advantage.

Data Grid Inc. appointed the audit team, who agreed on the terms of the audit mandate. In addition, Data Grid Inc. defined the audit scope, specified the audit criteria, and proposed to close the audit within five days. The audit team rejected Data Grid Inc.'s proposal to conduct the audit within five days, since the company has a large number of employees and complex processes. Data Grid Inc. insisted that they have planned to complete the audit within five days, so both parties agreed upon conducting the audit within the defined duration. The audit team followed a risk-based auditing approach.

To gain an overview of the main business processes and controls, the audit team accessed process descriptions and organizational charts. They were unable to perform a deeper analysis of the IT risks and controls because their access to the IT infrastructure and applications was restricted. However, the audit team stated that the risk that a significant defect could occur to Data Grid Inc.'s ISMS was low since most of the company's processes were automated. They therefore evaluated that the ISMS, as a whole, conforms to the standard requirements by asking the representatives of Data Grid Inc. the following questions:

•How are responsibilities for IT and IT controls defined and assigned?

•How does Data Grid Inc. assess whether the controls have achieved the desired results?

•What controls does Data Grid Inc. have in place to protect the operating environment and data from malicious software?

•Are firewall-related controls implemented?

Data Grid Inc.'s representatives provided sufficient and appropriate evidence to address all these questions.

The audit team leader drafted the audit conclusions and reported them to Data Grid Inc.'s top management. Though Data Grid Inc. was recommended for certification by the auditors, misunderstandings were raised between Data Grid Inc. and the certification body in regards to audit objectives. Data Grid Inc. stated that even though the audit objectives included the identification of areas for potential improvement, the audit team did not provide such information.

Based on this scenario, answer the following question:

Based on scenario 5, the audit team disagreed with the proposed audit duration by Data Grid Inc. for the ISMS audit. How do you describe such a situation?

Options:

Acceptable, auditors have the right to object, even refuse the audit mandate, if they deem that the audit duration is not sufficient

Unacceptable, the audit duration is defined by the auditee and cannot be changed by the auditors

Unacceptable, once the audit mandate is accepted, the audit duration cannot be changed

New Year Special 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: save70

ISO-IEC-27001-Lead-Auditor Leak Questions

PECB Certified ISO/IEC 27001 2022 Lead Auditor exam Questions and Answers

Options:

Answer:

Explanation:

Options:

Answer:

Explanation:

Options:

Answer:

Explanation:

Options:

Answer:

Explanation:

CompTIA

Fortinet

Microsoft

Salesforce