ISO-IEC-27001-Lead-Auditor Exam Dumps, ISO-IEC-27001-Lead-Auditor Practice Test Questions [Q71-Q89]

QUESTION 71
Select the words that best complete the sentence to describe an audit finding.

QUESTION 72
After a devastating office fire, all staff are moved to other branches of the company. At what moment in the incident management process is this measure effectuated?

Between incident and damage

Between detection and classification

Between recovery and normal operations

Between classification and escalation

QUESTION 73
You are performing an ISMS audit at a residential nursing home called ABC that provides healthcare services. You find all nursing home residents wear an electronic wristband for monitoring their location, heartbeat, and blood pressure always. You learned that he electronic wristband automatically uploads all data to the artificial intelligence (AI) cloud server for healthcare monitoring and analysis by healthcare staff.
To verify the scope of ISMS, you interview the management system representative (MSR) who explains that the ISMS scope covers an outsourced data center.
Select four options for the clauses and/or controls of ISO/IEC 27001:2022 that are directly relevant to the verification of the scope of the ISMS.

Control 5.3 Organizational roles, responsibilites and authorities

Clause 4.2 Understanding the needs and expectations of interested parties

Control 5.3 Legal, statutory, regulatory and contractual requirements

Control 6.3 Information security awareness, education, and training

Clause 5.2 Policy

Clause 4.1 Understanding the organization and its context

Control 7.6 Working in secure areas

Clause 4.3 Determining the scope of the information security management system

* B. This clause requires the organisation to determine the interested parties that are relevant to the ISMS, and the requirements of these interested parties12. This clause is relevant to the verification of the scope of the ISMS because it helps the organisation to identify the stakeholders that have an influence or an interest in the information security of the organisation, such as customers, suppliers, regulators, employees, etc. The organisation should also consider the needs and expectations of these interested parties when defining the scope of the ISMS, and ensure that they are met and communicated.
* E. This clause requires the organisation to establish an information security policy that provides the framework for setting the information security objectives and guiding the information security activities13. This clause is relevant to the verification of the scope of the ISMS because it helps the organisation to define the direction and principles of the ISMS, and to align them with the strategic goals and context of the organisation. The information security policy should also be consistent with the scope of the ISMS, and should be communicated and understood within the organisation and by relevant interested parties.
* F. This clause requires the organisation to determine the internal and external issues that are relevant to the purpose and the context of the organisation, and that affect its ability to achieve the intended outcomes of the ISMS14. This clause is relevant to the verification of the scope of the ISMS because it helps the organisation to understand the factors and conditions that influence the information security of the organisation, such as the legal, technological, social, economic, environmental, etc. The organisation should also monitor and review these issues, and consider them when defining the scope of the ISMS.
* H. This clause requires the organisation to determine the boundaries and applicability of the ISMS to establish its scope15. This clause is relevant to the verification of the scope of the ISMS because it helps the organisation to describe the information and processes that are included in the ISMS, and to document the scope in a clear and concise manner. The organisation should also consider the issues, requirements, and interfaces identified in clauses 4.1, 4.2, and 4.3 when determining the scope of the ISMS, and ensure that the scope is appropriate to the nature and scale of the organisation.
References:
1: PECB Candidate Handbook – ISO 27001 Lead Auditor, page 17 2: ISO/IEC 27001:2022 – Information technology – Security techniques – Information security management systems – Requirements, clause
4.2 3: ISO/IEC 27001:2022 – Information technology – Security techniques – Information security management systems – Requirements, clause 5.2 4: ISO/IEC 27001:2022 – Information technology – Security techniques – Information security management systems – Requirements, clause 4.1 5: ISO/IEC
27001:2022 – Information technology – Security techniques – Information security management systems – Requirements, clause 4.3

QUESTION 74
You work in the office of a large company. You receive a call from a person claiming to be from the Helpdesk. He asks you for your password.
What kind of threat is this?

Natural threat

Organizational threat

Social Engineering

Arason

QUESTION 75
You are an experienced ISMS auditor, currently providing support to an ISMS auditor in training who is carrying out her first initial certification audit. She asks you what she should be verifying when auditing an organisation’s Information Security objectives. You ask her what she has included in her audit checklist and she provides the following replies.
Which three of these responses would you cause you concern in relation to conformity with ISO/IEC 27001:
2022?

I am going to check how each Information Security objective has been communicated to those who need to be aware of it in order for the objective to be achieved

I am going to check that top management have determined the Information Security objectives for the current year. If not, I will check that this task has been programmed to be completed

I am going to check that the Information Security objectives are written down on paper so that everyone is clear on what needs to be achieved, how it will be achieved, and by when it will be achieved

I am going to check that there is a process in place to periodically revisit Information Security objectives, with a view to amending or cancelling them if circumstances necessitate this

I am going to check that a completion date has been set for each objective and that there are no objectives with missing ‘achieve by’ dates

I am going to check that the necessary budget, manpower and materials to achieve each objective has been determined

I am going to check that all the Information Security objectives are measurable. If they are not measurable the organisation will not be able to track progress against them

According to ISO/IEC 27001:2022, which specifies the requirements for establishing, implementing, maintaining and continually improving an information security management system (ISMS), clause 6.2 requires an organization to establish information security objectives at relevant functions and levels1. The objectives should be consistent with the information security policy; measurable (if practicable) or capable of being evaluated; monitored; communicated; updated as appropriate1. Therefore, when auditing an organization’s information security objectives, an ISMS auditor should verify these aspects in accordance with the audit criteria.
Three responses from the ISMS auditor in training that would cause concern in relation to conformity with ISO/IEC 27001:2022 are:
* I am going to check that top management have determined the Information Security objectives for the current year. If not, I will check that this task has been programmed to be completed: This response would cause concern because it implies that the auditor in training is not aware of the requirement to establish information security objectives at relevant functions and levels, not just at the top management level. It also implies that the auditor in training is willing to accept a delay or postponement in determining the information security objectives, which may affect the ISMS performance and effectiveness.
* I am going to check that the Information Security objectives are written down on paper so that everyone is clear on what needs to be achieved, how it will be achieved, and by when it will be achieved: This response would cause concern because it implies that the auditor in training is not aware of the requirement to establish information security objectives that are measurable (if practicable) or capable of being evaluated, not just written down on paper. It also implies that the auditor in training is not aware of the flexibility and suitability of different media or formats for documenting and communicating information security objectives, such as electronic or digital records, posters, newsletters, etc.
* I am going to check that a completion date has been set for each objective and that there are no objectives with missing ‘achieve by’ dates: This response would cause concern because it implies that the auditor in training is not aware of the requirement to establish information security objectives that are monitored, not just completed by a certain date. It also implies that the auditor in training is not aware of the possibility and necessity of updating information security objectives as appropriate, such as when changes occur in the internal or external context of the organization, or when new risks or opportunities arise.
The other responses from the ISMS auditor in training are acceptable and do not cause concern in relation to conformity with ISO/IEC 27001:2022. For example, checking how each Information Security objective has been communicated to those who need to be aware of it in order for the objective to be achieved is relevant to verifying the communication aspect of clause 6.2; checking that there is a process in place to periodically revisit Information Security objectives, with a view to amending or cancelling them if circumstances necessitate this is relevant to verifying the updating aspect of clause 6.2; checking that the necessary budget, manpower and materials to achieve each objective has been determined is relevant to verifying the planning aspect of clause 6.2; checking that all the Information Security objectives are measurable. If they are not measurable the organisation will not be able to track progress against them is relevant to verifying the measurability aspect of clause 6.2. References: ISO/IEC 27001:2022 – Information technology – Security techniques – Information security management systems – Requirements

QUESTION 76
Who are allowed to access highly confidential files?

Employees with a business need-to-know

Contractors with a business need-to-know

Employees with signed NDA have a business need-to-know

Non-employees designated with approved access and have signed NDA

QUESTION 77
Select the words that best complete the sentence:
To complete the sentence with the best word(s), click on the blank section you want to complete so that it is highlighted in red, and then click on the applicable text from the options below. Alternatively, you may drag and drop the option to the appropriate blank section.

QUESTION 78
What type of measure involves the stopping of possible consequences of security incidents?

Corrective

Detective

Repressive

Preventive

QUESTION 79
CMM stands for?

Capability Maturity Matrix

Capacity Maturity Matrix

Capability Maturity Model

Capable Mature Model

QUESTION 80
How are data and information related?

Data is a collection of structured and unstructured information

Information consists of facts and statistics collected together for reference or analysis

When meaning and value are assigned to data, it becomes information

QUESTION 81
A well-executed risk analysis provides a great deal of useful information. A risk analysis has four main objectives.
What is not one of the four main objectives of a risk analysis?

Identifying assets and their value

Implementing counter measures

Establishing a balance between the costs of an incident and the costs of a security measure

Determining relevant vulnerabilities and threats

QUESTION 82
You are an experienced ISMS audit team leader guiding an auditor in training. Your team has just completed a third-party surveillance audit of a mobile telecom provider. The auditor in training asks you how you intend to prepare for the Closing meeting. Which four of the following are appropriate responses?

I will advise the auditee that the purpose of the closing meeting is for the audit team to communicate our findings. It is not an opportunity for the auditee to challenge the findings

I will instruct my audit team to wait outside the auditee’s offices so we can leave as quickly as possible after the closing meeting. This saves our time and the client’s time too

It is not necessary to prepare for the closing meeting. Once you have carried out as many audits as I have you already know what needs to be discussed

I will schedule a closing meeting with the auditee’s representatives at which the audit conclusions will be presented

I will contact head office to ensure our invoice has been paid, If not, I will cancel the closing meeting and temporarily withhold the audit report

I will discuss any follow-up required with my audit team

I will review and, as appropriate, approve my teams audit conclusions

I will review the audit evidence and the audit findings with the rest of the team

According to ISO 19011:2018, which provides guidelines for auditing management systems, clause 6.6 requires the audit team leader to conduct a closing meeting with the auditee’s representatives at the end of the audit to present the audit conclusions and any findings1. The closing meeting should also provide an opportunity for the auditee to ask questions, clarify issues, acknowledge the findings, and comment on the audit process1. Therefore, when preparing for the closing meeting, an ISMS auditor should consider the following actions:
I will advise the auditee that the purpose of the closing meeting is for the audit team to communicate our findings. It is not an opportunity for the auditee to challenge these: This action is appropriate because it reflects the fact that the auditor has followed a systematic and consistent approach to collecting and evaluating audit evidence and reaching audit conclusions. The auditor should advise the auditee that the purpose of the closing meeting is for the audit team to communicate their findings, which are based on objective evidence and professional judgement. The auditor should also explain that it is not an opportunity for the auditee to challenge these findings, as they have already been discussed and confirmed during the audit. However, the auditor should also invite the auditee to ask questions, clarify issues, acknowledge the findings, and comment on the audit process1.
I will schedule a closing meeting with the auditee’s representatives at which the audit conclusions will be presented: This action is appropriate because it reflects the fact that the auditor has followed a planned and agreed audit programme and schedule. The auditor should schedule a closing meeting with the auditee’s representatives at which the audit conclusions will be presented, in accordance with clause
6.6 of ISO 19011:20181. The auditor should also ensure that the closing meeting is attended by those responsible for managing or implementing the ISMS, as well as any other relevant parties1.
I will discuss any follow-up required with my audit team: This action is appropriate because it reflects the fact that the auditor has followed a risk-based approach to determining and reporting any follow-up actions required by the auditee or the certification body. The auditor should discuss any follow-up required with their audit team, such as verifying corrective actions for nonconformities or conducting a subsequent audit1. The auditor should also document any follow-up actions in the audit report1.
I will review and, as appropriate, approve my teams audit conclusions: This action is appropriate because it reflects the fact that the auditor has followed a rigorous and professional process to reaching and reporting audit conclusions. The auditor should review and, as appropriate, approve their teams audit conclusions, which are based on objective evidence and professional judgement. The auditor should also ensure that their teams audit conclusions are consistent with the audit objectives and scope, and reflect the overall performance and conformity of the ISMS1.

QUESTION 83
You are performing an ISMS audit at a residential nursing home that provides healthcare services. The next step in your audit plan is to verify the information security incident management process. The IT Security Manager presents the information security incident management procedure (Document reference ID: ISMS_L2_16, version 4) and explains that the process is based on ISO/IEC 27035-1:2016.
You review the document and notice a statement “any information security weakness, event, and incident should be reported to the Point of Contact (PoC) within 1 hour after identification”. When interviewing staff, you found that there were differences in the understanding of the meaning of “weakness, event, and incident”.
The IT Security Manager explained that an online “information security handling” training seminar was conducted 6 months ago. All of the interviewed persons participated in and passed the reporting exercise and course assessment.
You are preparing the audit findings. Select two options that are correct.

There is a nonconformity (NC). The information security incident training has failed. This is not conforming with clause 7.2 and control A.6.3.

There is a nonconformity (NC). The terminology of the the incident management reporting process is unclear as evidenced by staff misunderstanding of the meaning of “weakness, event and incident”. This is not conforming with clause 9.1 and control A.5.24.

There is an opportunity for improvement (OFI). The information security incident training effectiveness can be improved. This is relevant to clause 7.2 and control A.6.3.

There is an opportunity for improvement (OFI). The information security weaknesses, events, and incidents are reported. This is relevant to clause 9.1 and control A.5.24.

There is no nonconformance. The information security handling training has been effective. This conforms with clause 7.2 and control A.6.3.

There is no nonconformance. The information security weaknesses, events, and incidents are reported.
This conforms with clause 9.1 and control A.5.24.

According to ISO/IEC 27001:2022 clause 7.2, the organization must ensure that the persons doing work under its control are aware of the information security policy, their contribution to the effectiveness of the ISMS, the implications of not conforming to the ISMS requirements, and the benefits of improved information security performance. The organization must also provide information security awareness education and training to its personnel and relevant interested parties. According to control A.6.3, the organization must ensure that all employees and contractors are made aware of the information security incident management procedures and their expected roles and responsibilities. Therefore, an opportunity for improvement (OFI) can be identified if the information security incident training effectiveness can be improved, as evidenced by the differences in the understanding of the meaning of “weakness, event, and incident” among the staff.
According to ISO/IEC 27001:2022 clause 9.1, the organization must monitor, measure, analyze and evaluate the information security performance and the effectiveness of the ISMS. The organization must also retain appropriate documented information as evidence of the monitoring and measurement results. According to control A.5.24, the organization must establish and maintain an information security incident management process that includes the following activities:
*reporting information security events and weaknesses;
*assessing and deciding on information security events;
*responding to information security incidents;
*learning from information security incidents;
*collecting evidence and disclosing information.
Therefore, a nonconformity (NC) can be identified if the terminology of the incident management reporting process is unclear, as evidenced by the staff misunderstanding of the meaning of “weakness, event, and incident”. This could lead to inconsistent or inaccurate reporting, assessment, response, learning, and disclosure of information security incidents, which could affect the information security performance and the effectiveness of the ISMS.
References:
*ISO/IEC 27001:2022, clauses 7.2, 9.1, and Annex A controls A.5.24 and A.6.3
*[PECB Candidate Handbook ISO/IEC 27001 Lead Auditor], pages 15-16, 18-19, 22-23
*ISO/IEC 27035-1:2016, clauses 4, 5, 6, 7, and 8
*ISO 27001 – Annex A.16: Information Security Incident Management
*ISO 27001:2022 Annex A Control 5.24 – What’s New?

QUESTION 84
You are an experienced audit team leader guiding an auditor in training.
Your team is currently conducting a third-party surveillance audit of an organisation that stores data on behalf of external clients. The auditor in training has been tasked with reviewing the PEOPLE controls listed in the Statement of Applicability (SoA) and mplemented at the site.
Select four controls from the following that would you expect the auditor in training to review.

Confidentiality and nondisclosure agreements

How protection against malware is implemented

Information security awareness, education and training

Remote working arrangements

The conducting of verification checks on personnel

The operation of the site CCTV and door control systems

The organisation’s arrangements for information deletion

The organisation’s business continuity arrangements

Explanation
The PEOPLE controls are related to the human aspects of information security, such as roles and responsibilities, awareness and training, screening and contracts, and remote working. The auditor in training should review the following controls:
* Confidentiality and nondisclosure agreements (A): These are contractual obligations that bind the employees and contractors of the organisation to protect the confidentiality of the information they handle, especially the data of external clients. The auditor should check if these agreements are signed, updated, and enforced by the organisation. This control is related to clause A.7.2.1 of ISO/IEC
27001:2022.
* Information security awareness, education and training : These are activities that aim to enhance the knowledge, skills, and behaviour of the employees and contractors regarding information security. The auditor should check if these activities are planned, implemented, evaluated, and improved by the organisation. This control is related to clause A.7.2.2 of ISO/IEC 27001:2022.
* Remote working arrangements (D): These are policies and procedures that govern the information security aspects of working from locations other than the organisation’s premises, such as home or public places. The auditor should check if these arrangements are defined, approved, and monitored by the organisation. This control is related to clause A.6.2.1 of ISO/IEC 27001:2022.
* The conducting of verification checks on personnel (E): These are background checks that verify the identity, qualifications, and suitability of the employees and contractors who have access to sensitive
* information or systems. The auditor should check if these checks are conducted, documented, and reviewed by the organisation. This control is related to clause A.7.1.1 of ISO/IEC 27001:2022.
References:
* ISO/IEC 27001:2022, Information technology – Security techniques – Information security management systems – Requirements
* PECB Candidate Handbook ISO/IEC 27001 Lead Auditor, 1
* ISO 27001:2022 Lead Auditor – IECB, 2
* ISO 27001:2022 certified ISMS lead auditor – Jisc, 3
* ISO/IEC 27001:2022 Lead Auditor Transition Training Course, 4
* ISO 27001 – Information Security Lead Auditor Course – PwC Training Academy, 5

QUESTION 85
Which one of the following conclusions in the audit report is not required by the certification body when deciding to grant certification?

The corrections taken by the organisation related to major nonconformities have been accepted.

The organisation fully complies with all legal and other requirements applicable to the Information Security Management System.

The plans to address corrective actions related to minor nonconformities have been accepted

The scope of certification has been fulfilled

QUESTION 86
You are an ISMS audit team leader tasked with conducting a follow-up audit at a client’s data centre.
Following two days on-site you conclude that of the original 12 minor and 1 major nonconformities that prompted the follow-up audit, only 1 minor nonconformity still remains outstanding.
Select four options for the actions you could take.

Agree with the auditee/audit client how the remaining nonconformity will be cleared, by when, and how its clearance will be verified

Recommend that the outstanding minor nonconformity is dealt with at the next surveillance audit

Close the follow-up audit as the organisation has demonstrated it is committed to clearing the nonconformities raised

Recommend suspension of the organisation’s certification as they have failed to implement the agreed corrections and corrective actions within the agreed timescale

Advise the auditee that you will arrange for the next audit to be an online audit to deal with the outstanding nonconformity

Note the progress made but hold the audit open until all corrective action has been cleared

Advise the individual managing the audit programme of any decision taken regarding the outstanding nonconformity

Conduct an unannounced follow-up audit on-site to review the one outstanding minor nonconformity once it has been cleared

The four options for the actions you could take are A, C, F, and G. These options are consistent with the guidance and requirements of ISO 19011:2018, Clause 6.712. You could agree with the auditee/audit client how the remaining nonconformity will be cleared, by when, and how its clearance will be verified (A), and document the agreement in the audit report1. You could close the follow-up audit as the organisation has demonstrated it is committed to clearing the nonconformities raised , and report the outcome to the audit client and other relevant parties1. You could note the progress made but hold the audit open until all corrective action has been cleared (F), and determine the need for another follow-up audit or other actions1. You could also advise the individual managing the audit programme of any decision taken regarding the outstanding nonconformity (G), as they are responsible for the overall management and coordination of the audit programme3. The other options are either not appropriate or not necessary for the situation. You should not recommend that the outstanding minor nonconformity is dealt with at the next surveillance audit (B), as this may compromise the audit objectives and the audit programme1. You should not recommend suspension of the organisation’s certification as they have failed to implement the agreed corrections and corrective actions within the agreed timescale (D), as this is not within your role or authority as an ISMS auditor4. You should not advise the auditee that you will arrange for the next audit to be an online audit to deal with the outstanding nonconformity (E), as this may not be feasible or effective depending on the nature and complexity of the nonconformity1. You should not conduct an unannounced follow-up audit on-site to review the one outstanding minor nonconformity once it has been cleared (H), as this may not be in accordance with the audit agreement or the audit programme1. References: 1: ISO 19011:2018, Guidelines for auditing management systems, Clause 6.7 \n2: PECB Certified ISO/IEC 27001 Lead Auditor Exam Preparation Guide, Domain 6:
Closing an ISO/IEC 27001 audit \n3: ISO 19011:2018, Guidelines for auditing management systems, Clause
5.3 \n4: ISO/IEC 27006:2022, Information technology – Security techniques – Requirements for bodies providing audit and certification of information security management systems, Clause 9.6

QUESTION 87
Which two of the following phrases are ‘objectives’ in relation to a first-party audit?

Apply international standards

Prepare the audit report for the certification body

Confirm the scope of the management system is accurate

Complete the audit on time

Apply Regulatory requirements

Update the management policy

QUESTION 88
During a follow-up audit, you notice that a nonconformity identified for completion before the follow-up audit is still outstanding.
Which four of the following actions should you take?

Report the failure to address the corrective action for the outstanding nonconformity to the organisation’s top management

Immediately raise an nonconformity as the date for completion has been exceeded

If the delay is justified agree on a revised date for clearing the nonconformity with the auditee/audit client

Contact the individuals) managing the audit programme to seek their advice as to how to proceed

Decide whether the delay in addressing the nonconformity is justified

Cancel the follow-up audit and return when an assurance has been received that the nonconformity has been cleared

Note the nonconformity is still outstanding and follow audit trails to determine why

If the delay is unjustified advise the auditee /audit client and agree on remedial action

QUESTION 89
You are an audit team leader conducting a third-party surveillance audit of a telecom services provider. You have assigned responsibility for auditing the organisation’s information security objectives to a junior member of your audit team. Before they begin their assessment, you ask them the following question to check their understanding of the requirements of ISO/IEC 27001:2022.
Which four of the following criteria must Information security objectives fulfil?

They must be communicated appropriately

They must be available as documented information

They must always be measured

They must always be monitored

They must be reviewed annually

They must be clear and unambiguous

They must be consistent with the IS Policy

They must be achievable

Explanation
According to ISO/IEC 27001:2022, clause 6.2, information security objectives are the specific results that an organisation intends to achieve with its information security management system (ISMS). The standard specifies that information security objectives must fulfil the following criteria:
* They must be communicated appropriately (A): The organisation must ensure that the relevant internal and external parties are informed about the information security objectives and their roles and responsibilities in achieving them. This can help to create awareness, commitment, and accountability for information security. This criterion is related to clause 6.2.2 of ISO/IEC 27001:2022.
* They must be available as documented information (B): The organisation must maintain and retain documented information on the information security objectives, including their scope, level, indicators, and time frame. This can help to provide evidence, traceability, and consistency for information security. This criterion is related to clause 6.2.1 of ISO/IEC 27001:2022.
* They must be consistent with the IS Policy (G): The organisation must ensure that the information security objectives are aligned with the information security policy, which is the top-level statement of the organisation’s intentions and direction for information security. This can help to support the strategic objectives and the context of the organisation. This criterion is related to clause 5.2 of ISO/IEC
27001:2022.
* They must be achievable (H): The organisation must ensure that the information security objectives are realistic and attainable, considering the available resources, capabilities, and constraints. This can help to avoid setting unrealistic or unfeasible expectations and to monitor and measure the progress and performance of information security. This criterion is related to clause 6.2.1 of ISO/IEC 27001:2022.
References:
* ISO/IEC 27001:2022, Information technology – Security techniques – Information security management systems – Requirements1
* PECB Candidate Handbook ISO/IEC 27001 Lead Auditor2
* ISO 27001:2022 Lead Auditor – PECB3
* ISO 27001:2022 certified ISMS lead auditor – Jisc4
* ISO/IEC 27001:2022 Lead Auditor Transition Training Course5
* ISO 27001 – Information Security Lead Auditor Course – PwC Training Academy6

Exam Dumps VCE

ISO-IEC-27001-Lead-Auditor Exam Dumps, ISO-IEC-27001-Lead-Auditor Practice Test Questions [Q71-Q89]

Leave a Reply Cancel reply