Achieve The Utmost Performance In ISO-IEC-27001-Lead-Auditor Exam Pass Guaranteed
Achive your Success with Latest PECB ISO-IEC-27001-Lead-Auditor Exam
PECB ISO-IEC-27001-Lead-Auditor exam is designed for individuals who wish to become certified as an ISO/IEC 27001 lead auditor. ISO/IEC 27001 is an international standard that provides a framework for information security management systems (ISMS). The standard outlines the requirements for establishing, implementing, maintaining, and continually improving an ISMS. Being certified as an ISO/IEC 27001 lead auditor demonstrates that an individual is proficient in auditing and assessing an organization's compliance with the standard.
PECB ISO-IEC-27001-Lead-Auditor certification exam is a highly respected and internationally recognized exam that tests the knowledge and skills of professionals in the field of information security. Passing ISO-IEC-27001-Lead-Auditor exam demonstrates a high level of proficiency in auditing and managing information security management systems against the ISO/IEC 27001 standard. PECB Certified ISO/IEC 27001 Lead Auditor exam certification can help professionals advance their careers and increase their earning potential in the information security industry.
PECB ISO-IEC-27001-Lead-Auditor (PECB Certified ISO/IEC 27001 Lead Auditor) Exam is an internationally recognized certification that attests to the competence of individuals in performing audits of information security management systems (ISMS) based on the ISO/IEC 27001 standard. PECB Certified ISO/IEC 27001 Lead Auditor exam certification is issued by the Professional Evaluation and Certification Board (PECB), a global provider of training, examination, and certification services in various fields, including information security.
NEW QUESTION # 242
Question
Factors such as costs related to nonconformities or penalties in case of failure to comply with legal and contractual obligations are evaluated during the definition of which of the following?
- A. Audit risks
- B. Materiality
- C. Reasonable assurance
Answer: B
Explanation:
The correct answer is Materiality, because materiality involves evaluating the significance and potential impact of issues identified during an audit, including financial, legal, contractual, and reputational consequences. In auditing, materiality helps determine which matters are important enough to influence audit conclusions or stakeholder decisions.
When defining materiality, auditors consider factors such as the cost of nonconformities, potential regulatory penalties, contractual breaches, and the broader business impact of noncompliance. For an ISO/IEC 27001 audit, this may include assessing whether failures in information security controls could lead to fines under data protection laws, loss of customer trust, or breach of service-level agreements. These considerations help auditors decide where to focus audit effort and how to prioritize findings.
Option B is incorrect because audit risk relates to the risk that auditors may reach incorrect conclusions due to inherent, control, or detection risks. While costs and penalties may influence risk assessment, they are not evaluated specifically when defining audit risk. Option C is incorrect because reasonable assurance refers to the level of confidence an audit can provide, not the evaluation of financial or legal impacts.
ISO 19011 supports the use of materiality concepts to ensure audits focus on issues that matter most to the organization and interested parties. Therefore, evaluating costs and penalties is directly linked to defining materiality.
NEW QUESTION # 243
Audit methods can be either with or without interaction with individuals representing the auditee. Which two of the following methods are with interaction?
- A. Checking legal compliance with local authorities
- B. Observing work performed via live video streaming
- C. Sampling (e.g. products)
- D. Analysing documents provided in advance of the audit
- E. Reviewing checklists with auditee
- F. Conducting interviews
Answer: E,F
Explanation:
According to the PECB Candidate Handbook for ISO/IEC 27001 Lead Auditor, audit methods can be classified into two categories: with or without interaction with individuals representing the auditee (page 12).
Audit methods with interaction include reviewing checklists with auditee and conducting interviews, as they involve direct communication and feedback from the auditee. Audit methods without interaction include sampling (e.g. products), observing work performed via live video streaming, checking legal compliance with local authorities, and analysing documents provided in advance of the audit, as they do not require any dialogue or exchange with the auditee. References: PECB Candidate Handbook for ISO/IEC 27001 Lead Auditor, page 12.
NEW QUESTION # 244
You are an experienced ISMS audit team leader guiding an auditor in training. You are testing her understanding of follow-up audits by asking her a series of questions to which the answer is either "true* or
'false'. Which four of the following questions should the answer be true"'
- A. A follow-up audit is required in all instances where nonconformities have been identified
- B. A follow-up audit may be carried out where nonconformities are major
- C. A follow-up audit is required only in instances where a major nonconformity has been identified
- D. The outcome of a follow-up audit could be a recommendabon to suspend the client's certification
- E. The outcomes of a follow-up audit should be reported to the individual managing the audit programme and the audit client
- F. A follow-up audit may be carried out where nonconformities are minor
- G. The outcomes of a follow-up audit should be reported to top management and the audit team leader who carried out the audit where the nonconformities were initially identified
- H. The outcome of a follow-up audit could lower a major nonconformity to minor status
Answer: B,E,F,G
Explanation:
* A follow-up audit may be carried out where nonconformities are major. This is true because a major nonconformity is a situation that raises significant doubt about the ability of the organization's management system to achieve its intended results, and therefore requires immediate corrective action. A follow-up audit is necessary to verify the effectiveness of the corrective action and the conformity of the management system12.
* A follow-up audit may be carried out where nonconformities are minor. This is true because a minor nonconformity is a situation that does not affect the capability of the management system to achieve its intended results, but represents a deviation from the specified requirements. A follow-up audit may be conducted to check the implementation of the corrective action and the improvement of the management system12.
* The outcomes of a follow-up audit should be reported to top management and the audit team leader who carried out the audit where the nonconformities were initially identified. This is true because the top management is responsible for ensuring the effectiveness and continual improvement of the management system, and the audit team leader is accountable for the audit process and the audit conclusions. The follow-up audit report should provide them with objective evidence of the status of the nonconformities and the corrective actions taken by the auditee13.
* The outcomes of a follow-up audit should be reported to the individual managing the audit programme and the audit client. This is true because the individual managing the audit programme is responsible for planning, implementing, monitoring and reviewing the audit activities, and the audit client is the organization or person requesting an audit. The follow-up audit report should inform them of the results of the follow-up audit and any changes in the certification status of the auditee13.
References :=
* ISO 19011:2022 Guidelines for auditing management systems
* ISO/IEC 27001:2022 Information technology - Security techniques - Information security management systems - Requirements
* ISO/IEC 17021-1:2022 Conformity assessment - Requirements for bodies providing audit and certification of management systems - Part 1: Requirements
NEW QUESTION # 245
Scenario 5: Data Grid Inc. is a well-known company that delivers security services across the entire information technology infrastructure. It provides cybersecurity software, including endpoint security, firewalls, and antivirus software. For two decades, Data Grid Inc. has helped various companies secure their networks through advanced products and services. Having achieved reputation in the information and network security field, Data Grid Inc. decided to obtain the ISO/IEC 27001 certification to better secure its internal and customer assets and gain competitive advantage.
Data Grid Inc. appointed the audit team, who agreed on the terms of the audit mandate. In addition, Data Grid Inc. defined the audit scope, specified the audit criteria, and proposed to close the audit within five days. The audit team rejected Data Grid Inc.'s proposal to conduct the audit within five days, since the company has a large number of employees and complex processes. Data Grid Inc. insisted that they have planned to complete the audit within five days, so both parties agreed upon conducting the audit within the defined duration. The audit team followed a risk-based auditing approach.
To gain an overview of the main business processes and controls, the audit team accessed process descriptions and organizational charts. They were unable to perform a deeper analysis of the IT risks and controls because their access to the IT infrastructure and applications was restricted. However, the audit team stated that the risk that a significant defect could occur to Data Grid Inc.'s ISMS was low since most of the company's processes were automated. They therefore evaluated that the ISMS, as a whole, conforms to the standard requirements by asking the representatives of Data Grid Inc. the following questions:
* How are responsibilities for IT and IT controls defined and assigned?
* How does Data Grid Inc. assess whether the controls have achieved the desired results?
* What controls does Data Grid Inc. have in place to protect the operating environment and data from malicious software?
* Are firewall-related controls implemented?
Data Grid Inc.'s representatives provided sufficient and appropriate evidence to address all these questions.
The audit team leader drafted the audit conclusions and reported them to Data Grid Inc.'s top management. Though Data Grid Inc. was recommended for certification by the auditors, misunderstandings were raised between Data Grid Inc. and the certification body in regards to audit objectives. Data Grid Inc. stated that even though the audit objectives included the identification of areas for potential improvement, the audit team did not provide such information.
Based on this scenario, answer the following question:
Based on scenario 5, the audit team disagreed with the proposed audit duration by Data Grid Inc. for the ISMS audit. How do you describe such a situation?
- A. Acceptable, auditors have the right to object, even refuse the audit mandate, if they deem that the audit duration is not sufficient
- B. Unacceptable, the audit duration is defined by the auditee and cannot be changed by the auditors
- C. Unacceptable, once the audit mandate is accepted, the audit duration cannot be changed
Answer: A
Explanation:
Auditors have the authority to object or even refuse an audit mandate if they believe that the audit duration proposed by the auditee is not sufficient to thoroughly assess the ISMS. It is crucial for the audit to be comprehensive enough to cover all necessary aspects of the system, ensuring its effectiveness and compliance.
NEW QUESTION # 246
Scenario 6: Cyber ACrypt is a cybersecurity company that provides endpoint protection by offering anti-malware and device security, asset life cycle management, and device encryption. To validate its ISMS against ISO/IEC 27001 and demonstrate its commitment to cybersecurity excellence, the company underwent a meticulous audit process led by John, the appointed audit team leader.
Upon accepting the audit mandate, John promptly organized a meeting to outline the audit plan and team roles This phase was crucial for aligning the team with the audit's objectives and scope However, the initial presentation to Cyber ACrypt's staff revealed a significant gap in understanding the audit's scope and objectives, indicating potential readiness challenges within the company As the stage 1 audit commenced, the team prepared for on-site activities. They reviewed Cyber ACrypt's documented information, including the information security policy and operational procedures ensuring each piece conformed to and was standardized in format with author identification, production date, version number, and approval date Additionally, the audit team ensured that each document contained the information required by the respective clause of the standard This phase revealed that a detailed audit of the documentation describing task execution was unnecessary, streamlining the process and focusing the team's efforts on critical areas During the phase of conducting on-site activities, the team evaluated management responsibility for the Cyber Acrypt's policies This thorough examination aimed to ascertain continual improvement and adherence to ISMS requirements Subsequently, in the document, the stage 1 audit outputs phase, the audit team meticulously documented their findings, underscoring their conclusions regarding the fulfillment of the stage 1 objectives. This documentation was vital for the audit team and Cyber ACrypt to understand the preliminary audit outcomes and areas requiring attention.
The audit team also decided to conduct interviews with key interested parties. This decision was motivated by the objective of collecting robust audit evidence to validate the management system's compliance with ISO/IEC 27001 requirements. Engaging with interested parties across various levels of Cyber ACrypt provided the audit team with invaluable perspectives and an understanding of the ISMS's implementation and effectiveness.
The stage 1 audit report unveiled critical areas of concern. The Statement of Applicability (SoA) and the ISMS policy were found to be lacking in several respects, including insufficient risk assessment, inadequate access controls, and lack of regular policy reviews. This prompted Cyber ACrypt to take immediate action to address these shortcomings. Their prompt response and modifications to the strategic documents reflected a strong commitment to achieving compliance.
The technical expertise introduced to bridge the audit team's cybersecurity knowledge gap played a pivotal role in identifying shortcomings in the risk assessment methodology and reviewing network architecture. This included evaluating firewalls, intrusion detection and prevention systems, and other network security measures, as well as assessing how Cyber ACrypt detects, responds to, and recovers from external and internal threats. Under John's supervision, the technical expert communicated the audit findings to the representatives of Cyber ACrypt. However, the audit team observed that the expert s objectivity might have been compromised due to receiving consultancy fees from the auditee. Considering the behavior of the technical expert during the audit, the audit team leader decided to discuss this concern with the certification body.
Based on the scenario above, answer the following question:
Which activity was NOT conducted correctly by the audit team during the Stage 1 audit?
- A. Conducting on-site activities by evaluating management responsibility for Cyber ACrypt's policies
- B. Preparing for on-site activities by including the information security policy and operational procedures for review
- C. Documenting the Stage 1 audit outputs by failing to include the relevant evidence or supporting documentation
Answer: C
Explanation:
Comprehensive and Detailed In-Depth
C . Correct Answer:
The audit team documented findings, but the scenario does not confirm whether sufficient supporting evidence was included.
ISO 19011:2018 requires audit findings to be properly documented and justified with evidence.
Failing to document evidence reduces audit credibility.
A . Incorrect:
Preparing for the audit by reviewing policies and procedures is correct practice.
B . Incorrect:
Evaluating management responsibility for ISMS compliance is a required step in Stage 1.
Relevant Standard Reference:
ISO/IEC 27001:2022 Clause 9.2 (Internal Audit)
NEW QUESTION # 247
You are conducting a third-party surveillance audit when another member of the audit team approaches you seeking clarification. They have been asked to assess the organisation's application of control 5.7 - Threat Intelligence. They are aware that this is one of the new controls introduced in the 2022 edition of ISO/IEC
27001, and they want to make sure they audit the control correctly.
They have prepared a checklist to assist them with their audit and want you to confirm that their planned activities are aligned with the control's requirements.
Which three of the following options represent valid audit trails?
- A. I will check that the organisation has a fully documented threat intelligence process
- B. I will speak to top management to make sure all staff are aware of the importance of reporting threats
- C. I will review how information relating to information security threats is collected and evaluated to produce threat intelligence
- D. I will ensure that appropriate measures have been introduced to inform top management as to the effectiveness of current threat intelligence arrangements
- E. I will check that threat intelligence is actively used to protect the confidentiality, integrity and availability of the organisation's information assets
- F. I will ensure that the task of producing threat intelligence is assigned to the organisation's internal audit team
- G. I will ensure that the organisation's risk assessment process begins with effective threat intelligence
- H. I will determine whether internal and external sources of information are used in the production of threat intelligence
Answer: A,E,H
Explanation:
The options that represent valid audit trails for assessing the organisation's application of control 5.7 - Threat Intelligence, according to ISO/IEC 27001:2022, are:
Option A: I will determine whether internal and external sources of information are used in the production of threat intelligence. This is relevant because effective threat intelligence typically requires gathering information from multiple sources to be comprehensive.
Option D: I will check that the organisation has a fully documented threat intelligence process. Proper documentation is a core requirement in ISO standards to ensure processes are defined, implemented, and maintained consistently.
Option E: I will check that threat intelligence is actively used to protect the confidentiality, integrity, and availability of the organisation's information assets. This verifies that the output of threat intelligence is being used effectively within the organisation's information security practices.
NEW QUESTION # 248
Which two of the following statements are true?
- A. The benefits of implementing an ISMS primarily result from a reduction in information security risks
- B. The benefit of certifying an ISMS is to obtain contracts from governmental institutions
- C. The purpose of an ISMS is to apply a risk management process for preserving information security
- D. The purpose of an ISMS is to demonstrate compliance with regulatory requirements
Answer: A,C
Explanation:
The benefits of implementing an ISMS are not limited to a reduction in information security risks, but also include improved business performance, customer satisfaction, legal compliance, and stakeholder confidence.
The benefit of certifying an ISMS is not only to obtain contracts from governmental institutions, but also to demonstrate the organisation's commitment to information security to other potential customers, partners, and regulators. The purpose of an ISMS is to apply a risk management process for preserving information security, which means identifying, analysing, evaluating, treating, monitoring, and reviewing the information security risks that the organisation faces. The purpose of an ISMS is not to demonstrate compliance with regulatory requirements, but rather to ensure that the organisation meets its own information security objectives and obligations.
References:
* ISO/IEC 27001:2022 Lead Auditor (Information Security Management Systems) objectives and content from Quality.org and PECB
* ISO/IEC 27001:2013 Information technology - Security techniques - Information security management systems - Requirements [Section 0.1] and [Section 1]
NEW QUESTION # 249
What type of compliancy standard, regulation or legislation provides a code of practice for information security?
- A. IT Service Management
- B. Computer criminality act
- C. ISO/IEC 27002
- D. Personal data protection act
Answer: C
NEW QUESTION # 250
Which two of the following statements are true?
- A. Responsibility for managing the audit programme rests with the audit team leader.
- B. Once agreed, the audit plan is fixed and cannot be changed during the conducting of the audi.
- C. The audit programme describes the arrangements for a set of one or more audits planned for a specific time frame and directed towards a specific purpose.
- D. The audit plan describes the arrangements for a set of one or more audits planned for a specific time frame and directed towards a specific purpose.
- E. The audit programme describes the activities and arrangements for an audit.
- F. The audit plan describes the activities and arrangements for an audit.
Answer: D,F
Explanation:
The two true statements are B and E. According to ISO 19011:2022, the audit plan describes the arrangements for a set of one or more audits planned for a specific time frame and directed towards a specific purpose1, while the audit programme describes the activities and arrangements for an audit2. The other options are either false or irrelevant. The responsibility for managing the audit programme rests with the audit programme manager, not the audit team leader (A)3. The audit plan can be changed during the conducting of the audit if necessary, with the agreement of the audit client and the auditee4. The audit programme and the audit plan are not the same thing, so D and F are incorrect. References: 1: ISO 19011:2022, Guidelines for auditing management systems, Clause 3.8 \n2: ISO 19011:2022, Guidelines for auditing management systems, Clause 3.9 \n3: ISO 19011:2022, Guidelines for auditing management systems, Clause 5.3.1 \n4: ISO 19011:2022, Guidelines for auditing management systems, Clause 6.4.2
NEW QUESTION # 251
Which department maintain's contacts with law enforcement authorities, regulatory bodies, information service providers and telecommunications service providers depending on the service required.
- A. COO
- B. CSM
- C. CISO
- D. MRO
Answer: C
Explanation:
The department that maintains contacts with law enforcement authorities, regulatory bodies, information service providers and telecommunications service providers depending on the service required is CISO. CISO stands for Chief Information Security Officer. A CISO is a senior-level executive who is responsible for overseeing the information security strategy and governance of an organization. A CISO also leads the information security function and coordinates with other departments and stakeholders to ensure compliance with laws, regulations and standards related to information security. A CISO may also act as a liaison between the organization and external parties, such as law enforcement authorities or service providers, in case of incidents or investigations involving information security issues. ISO/IEC 27001:2022 requires the organization to assign top management roles and responsibilities for ensuring that information security objectives are established and achieved (see clause 5.3). Reference: CQI & IRCA Certified ISO/IEC 27001:2022 Lead Auditor Training Course, ISO/IEC 27001:2022 Information technology - Security techniques - Information security management systems - Requirements, What is CISO?
NEW QUESTION # 252
You have a hard copy of a customer design document that you want to dispose off. What would you do
- A. Throw it in any dustbin
- B. Give it to the office boy to reuse it for other purposes
- C. Shred it using a shredder
- D. Be environment friendly and reuse it for writing
Answer: C
NEW QUESTION # 253 
Answer:
Explanation:
Explanation:
An audit finding is the result of the evaluation of the collected audit evidence against audit criteria.
NEW QUESTION # 254
An organisation is looking for management system initial certification. Please identify the sequence of the activities to be undertaken by the organisation.
To complete the sequence click on the blank section you want to complete so that it is highlighted in red, and then click on the applicable text from the options below. Alternatively, you may drag and drop the options to the appropriate blank section.
Answer:
Explanation:
Explanation:
The correct sequence of activities is:
Establish the management system
Plan the audit programme
Conduct internal audits
Hold a Management Review
Engage a Certification Body for stage 1 and stage 2 audits
Complete any corrective actions
Comprehensive but Short Explanation: = According to the PECB Candidate Handbook - ISO/IEC 27001 Lead Auditor, the steps for achieving certification are as follows1:
Establish the management system: This involves defining the scope, objectives, policies, procedures, and controls of the ISMS, as well as ensuring the availability of resources and top management commitment.
Plan the audit programme: This involves defining the audit objectives, criteria, scope, frequency, methods, and responsibilities for conducting internal audits of the ISMS.
Conduct internal audits: This involves verifying the conformity and effectiveness of the ISMS, as well as identifying any nonconformities or opportunities for improvement.
Hold a Management Review: This involves reviewing the performance and suitability of the ISMS, as well as deciding on any changes or actions needed to improve it.
Engage a Certification Body for stage 1 and stage 2 audits: This involves selecting a reputable and accredited certification body to conduct an external audit of the ISMS, consisting of two stages: a documentation review and an on-site assessment.
Complete any corrective actions: This involves addressing any nonconformities or findings identified by the certification body, and providing evidence of their implementation and effectiveness.
References: = 1: PECB Candidate Handbook - ISO/IEC 27001 Lead Auditor, pages 25-26.
NEW QUESTION # 255
What type of legislation requires a proper controlled purchase process?
- A. Computer criminality act
- B. Government information act
- C. Intellectual property rights act
- D. Personal data protection act
Answer: C
Explanation:
Explanation
An intellectual property rights act is a type of legislation that requires a proper controlled purchase process.
Intellectual property rights are legal rights that protect creations of the mind, such as inventions, literary and artistic works, designs, symbols, names and images. Intellectual property rights can include patents, trademarks, copyrights, trade secrets, etc. A proper controlled purchase process is a process that ensures that the organization obtains valid licenses or permissions from the owners or authorized parties of the intellectual property rights before using or acquiring any intellectual property assets. This process helps to avoid infringing on the intellectual property rights of others, which may result in legal actions, fines, damages or reputational harm. ISO/IEC 27001:2022 requires the organization to comply with relevant legal and contractual obligations related to intellectual property rights (see clause A.18.1.4). References: [CQI & IRCA Certified ISO/IEC 27001:2022 Lead Auditor Training Course], ISO/IEC 27001:2022 Information technology
- Security techniques - Information security management systems - Requirements, What is Intellectual Property?
NEW QUESTION # 256
How are data and information related?
- A. Information consists of facts and statistics collected together for reference or analysis
- B. Data is a collection of structured and unstructured information
- C. When meaning and value are assigned to data, it becomes information
Answer: C
NEW QUESTION # 257
You are performing an ISMS audit at a residential nursing home railed ABC that provides healthcare services. The next step in your audit plan is to verify the effectiveness of the continual improvement process. During the audit, you learned most of the residents' family members (90%) receive WeCare medical device promotional advertisements through email and SMS once a week via ABC's healthcare mobile app. All of them do not agree on the use of the collected personal data (or marketing or any other purposes than nursing and medical care on the signed service agreement with ABC. They have very strong reason to believe that ABC is leaking residents' and family members' personal information to a non-relevant third party and they have filed complaints.
The Service Manager says that all these complaints have been treated as nonconformities, and the corrective actions have been planned and implemented according to the Nonconformity and Corrective management procedure. The corrective action involved stopping working with WeCare the medical device manufacturer immediately and asking them to delete all personal data received as well as sending an apology email to all residents and their family members.
You are preparing the audit findings. Select one option of the correct finding.
- A. Nonconformity: ABC does not follow the signed healthcare service agreement with residents' family members
- B. No nonconformity: I would like to collect more evidence on how the organisation defines the management system scope and see if they covered WeCare medical device manufacture
- C. Nonconformity: The management review does not take the feedback from residents' family members into consideration
- D. No nonconformity: The Service Manager implemented the corrective actions and the Customer Service Representative evaluates the effectiveness of implemented corrective actions
Answer: A
Explanation:
According to ISO 27001:2022 clause 8.1.4, the organisation shall ensure that externally provided processes, products or services that are relevant to the information security management system are controlled. This includes implementing appropriate contractual requirements related to information security with external providers, such as customers who send ICT equipment for reclamation12 In this case, ABC is a residential nursing home that provides healthcare services to its residents and collects their personal data and their family members' personal data. ABC has a signed service agreement with the residents' family members that states that the collected personal data will not be used for marketing or any other purposes than nursing and medical care. However, ABC has violated this contractual requirement by sharing the personal data with WeCare, a medical device manufacturer, who has used the data to send promotional advertisements to the residents' family members via email and SMS. This has caused dissatisfaction and complaints from the residents' family members, who have a strong reason to believe that ABC is leaking their personal information to a non-relevant third party.
Therefore, the audit finding is a nonconformity with clause 8.1.4 of ISO 27001:2022, as ABC has failed to control the externally provided processes, products or services that are relevant to the information security management system, and has breached the contractual requirements related to information security with its customers. The fact that ABC has taken corrective actions to stop working with WeCare and to apologise to the customers does not eliminate the nonconformity, but only mitigates its consequences. The nonconformity still needs to be recorded, evaluated, and reviewed for effectiveness and improvement.
Reference:
1: ISO/IEC 27001:2022 Lead Auditor (Information Security Management Systems) Course by CQI and IRCA Certified Training 1 2: ISO/IEC 27001 Lead Auditor Training Course by PECB 2
NEW QUESTION # 258
You are performing an ISMS audit at a European-based residential
nursing home called ABC that provides healthcare services. You find all nursing home residents wear an electronic wristband for monitoring their location, heartbeat, and blood pressure always. You learned that the electronic wristband automatically uploads all data to the artificial intelligence (AI) cloud server for healthcare monitoring and analysis by healthcare staff.
The next step in your audit plan is to verify that the information security policy and objectives have been established by top management.
During the audit, you found the following audit evidence.
Match the audit evidence to the corresponding requirement in ISO/IEC 27001:2022.
Answer:
Explanation:
NEW QUESTION # 259
The computer room is protected by a pass reader. Only the System Management department has a pass.
What type of security measure is this?
- A. a logical security measure
- B. a repressive security measure
- C. a physical security measure
- D. a corrective security measure
Answer: C
NEW QUESTION # 260
You are performing an ISMS audit at a residential nursing home that provides healthcare services. The next step in your audit plan is to verify the information security of the business continuity management process. During the audit, you learned that the organisation activated one of the business continuity plans (BCPs) to make sure the nursing service continued during the recent pandemic. You ask the Service Manager to explain how the organization manages information security during the business continuity management process.
The Service Manager presented the nursing service continuity plan for a pandemic and summarised the process as follows:
Stop the admission of any NEW residents.
70% of administration staff and 30% of medical staff will work from home.
Regular staff self-testing, including submitting a negative test report 1 day BEFORE they come to the office.
Install ABC's healthcare mobile app, tracking their footprint and presenting a GREEN Health Status QR-Code for checking on the spot.
You ask the Service Manager how to prevent non-relevant family members or interested parties from accessing residents' personal data when staff work from home. The Service Manager cannot answer and suggests the IT Security Manager should help with that.
You would like to further investigate other areas to collect more audit evidence. Select three options that will not be in your audit trail.
- A. Collect more evidence on how the organisation manages information security on mobile devices and during teleworking (Relevant to control A.6.7)
- B. Collect more evidence on how the organisation makes sure all staff periodically conduct a positive Covid test (Relevant to control A.7.2)
- C. Collect more evidence on how the organisation performs a business risk assessment to evaluate how fast the existing residents can be discharged from the nursing home. (Relevant to clause 6)
- D. Collect more evidence that staff only use IT equipment protected from malware when working from home (relevant to control A.8.7)
- E. Collect more evidence on how information security protocols are maintained during disruption (relevant to control A.5.29)
- F. Collect more evidence on how and when the Business Continuity Plan has been tested. (Relevant to control A.5.29)
- G. Collect more evidence by interviewing additional staff to ensure they are aware of the need to sometimes work from home (Relevant to clause 7.3)
- H. Collect more evidence on what resources the organisation provides to support the staff working from home. (Relevant to clause 7.1)
Answer: B,C,H
Explanation:
According to ISO/IEC 27001:2022 clause 6.1, the organization must establish, implement and maintain an information security risk management process that includes the following activities:
establishing and maintaining information security risk criteria;
ensuring that repeated information security risk assessments produce consistent, valid and comparable results; identifying the information security risks; analyzing the information security risks; evaluating the information security risks; treating the information security risks; accepting the information security risks and the residual information security risks; communicating and consulting with stakeholders throughout the process; monitoring and reviewing the information security risks and the risk treatment plan.
According to control A.5.29, the organization must establish, document, implement and maintain processes, procedures and controls to ensure the required level of continuity for information security during a disruptive situation. The organization must also:
determine its requirements for information security and the continuity of information security management in adverse situations, e.g. during a crisis or disaster; establish, document, implement and maintain processes, procedures and controls to ensure the required level of continuity for information security during an adverse situation; verify the availability of information processing facilities.
Therefore, the following options will not be in your audit trail, as they are not relevant to the information security risk management process or the information security continuity process:
E . Collect more evidence on how the organisation makes sure all staff periodically conduct a positive Covid test (Relevant to control A.7.2). This is not relevant to the information security aspects of business continuity management, as it is related to the health and safety of the staff, not the protection of information assets. Control A.7.2 is about screening of personnel prior to employment, not during employment.
G . Collect more evidence on how the organisation performs a business risk assessment to evaluate how fast the existing residents can be discharged from the nursing home. (Relevant to clause 6). This is not relevant to the information security aspects of business continuity management, as it is related to the operational and financial aspects of the business, not the identification and treatment of information security risks. Clause 6 is about the information security risk management process, not the business risk management process.
H . Collect more evidence on what resources the organisation provides to support the staff working from home. (Relevant to clause 7.1). This is not relevant to the information security aspects of business continuity management, as it is related to the general provision of resources for the ISMS, not the specific processes, procedures and controls to ensure the continuity of information security during a disruptive situation. Clause 7.1 is about determining and providing the resources needed for the establishment, implementation, maintenance and continual improvement of the ISMS, not the resources needed for the staff working from home.
Reference:
ISO/IEC 27001:2022, clauses 6.1, 7.1, and Annex A control A.5.29
[PECB Candidate Handbook ISO/IEC 27001 Lead Auditor], pages 14-15, 17, 22-23 ISO 27001:2022 Annex A Control 5.29 - What's New?
ISO 22301 Business Continuity Management System
NEW QUESTION # 261
......
Revolutionary Guide To Exam PECB Dumps: https://dumpstorrent.dumpsking.com/ISO-IEC-27001-Lead-Auditor-testking-dumps.html
