Pass Your Exam Easily! ISO-IEC-27001-Lead-Auditor Real Question Answers Updated on Dec 16, 2023
Actual Questions Answers Pass With Real ISO-IEC-27001-Lead-Auditor Exam Dumps
NEW QUESTION # 66
You are the lead auditor of the courier company SpeeDelivery. You have carried out a risk analysis and now want to determine your risk strategy. You decide to take measures for the large risks but not for the small risks.
What is this risk strategy called?
- A. Risk neutral
- B. Risk skipping
- C. Risk avoidance
- D. Risk bearing
Answer: D
Explanation:
The risk strategy that involves taking measures for the large risks but not for the small risks is called risk bearing. Risk bearing is a strategy that accepts the existence of risks and their potential consequences without implementing any specific controls to reduce them. Risk bearing is usually applied to risks that have low likelihood and low impact, or when the cost of controls outweighs the benefits. Risk bearing implies that the organization has enough resources and resilience to cope with the risks if they materialize. ISO/IEC 27001:2022 defines risk acceptance as "decision to accept risk" (see clause 3.4). Reference: [CQI & IRCA Certified ISO/IEC 27001:2022 Lead Auditor Training Course], ISO/IEC 27001:2022 Information technology - Security techniques - Information security management systems - Requirements, [What is Risk Bearing?]
NEW QUESTION # 67
How is the purpose of information security policy best described?
- A. An information security policy documents the analysis of risks and the search for countermeasures.
- B. An information security policy provides direction and support to the management regarding information security.
- C. An information security policy provides insight into threats and the possible consequences.
- D. An information security policy makes the security plan concrete by providing it with the necessary details.
Answer: B
Explanation:
The purpose of information security policy is best described as providing direction and support to the management regarding information security. An information security policy is a high-level document that defines the organization's vision, objectives, principles and responsibilities for information security. It also sets the scope and context of the information security management system and aligns it with the organization's strategy and culture. An information security policy does not document the analysis of risks or the search for countermeasures, nor does it make the security plan concrete or provide insight into threats and consequences. These are tasks for other documents or processes within the information security management system. ISO/IEC 27001:2022 defines information security policy as "policy that provides direction and support for information security in accordance with business requirements and relevant laws and regulations" (see clause 3.29). Reference: [CQI & IRCA Certified ISO/IEC 27001:2022 Lead Auditor Training Course], ISO/IEC 27001:2022 Information technology - Security techniques - Information security management systems - Requirements, What is Information Security Policy?
NEW QUESTION # 68
What type of system ensures a coherent Information Security organisation?
- A. Information Technology Service Management System (ITSM)
- B. Federal Information Security Management Act (FISMA)
- C. Information Security Management System (ISMS)
- D. Information Exchange Data System (IEDS)
Answer: C
Explanation:
An Information Security Management System (ISMS) is a systematic approach to managing the security of information assets within an organization. It includes the policies, processes, and controls that address the risks and opportunities related to information security. An ISMS is based on the Plan-Do-Check-Act (PDCA) cycle, which consists of four phases: establishment, implementation, operation, and maintenance. Therefore, an ISMS is set up in the following order: establishment, implementation, operation, maintenance. Reference: ISO/IEC 27000:2022, clause 3.24; ISO/IEC 27001:2022, clause 4.
NEW QUESTION # 69
After completing Stage 1 and in preparation for a Stage 2 initial certification audit, the auditee informs the audit team leader that they wish to extend the audit scope to include two additional sites that have recently been acquired by the organisation.
Considering this information, what action would you expect the audit team leader to take?
- A. Arrange to complete a remote Stage 1 audit of the two sites using a video conferencing platform
- B. Increase the length of the Stage 2 audit to include the extra sites
- C. Inform the auditee that the request can be accepted but a full Stage 1 audit must be repeated
- D. Obtain information about the additional sites to inform the certification body
Answer: D
Explanation:
According to ISO/IEC 17021-1, which specifies the requirements for bodies providing audit and certification of management systems, a certification body should establish criteria for determining audit time and audit team composition based on factors such as the scope of certification, size and complexity of the organization, risks associated with its activities, etc2. Therefore, if an auditee requests to extend the audit scope to include two additional sites after completing Stage 1 of an initial certification audit, the audit team leader should obtain information about the additional sites to inform the certification body, so that they can review and approve the change in scope and adjust the audit time and audit team accordingly2. The other options are not appropriate actions for the audit team leader to take in this situation. For example, increasing the length of the Stage 2 audit to include the extra sites without informing the certification body may violate their procedures and policies; arranging to complete a remote Stage 1 audit of the two sites using a video conferencing platform may not be feasible or effective depending on the nature and location of the sites; and informing the auditee that the request can be accepted but a full Stage 1 audit must be repeated may not be necessary or reasonable if there are no significant changes in the auditee's ISMS since Stage 12. Reference: ISO/IEC 17021-1:2015 - Conformity assessment - Requirements for bodies providing audit and certification of management systems - Part 1: Requirements
NEW QUESTION # 70
Access Control System, CCTV and security guards are form of:
- A. Compliance
- B. Access Control
- C. Environment Security
- D. Physical Security
Answer: D
NEW QUESTION # 71
Which six of the following actions are the individual(s) managing the audit programme responsible for?
- A. Defining the objectives, scope and criteria for an individual audit
- B. Establishing the extent of the audit programme
- C. Selecting the audit team
- D. Retaining documented information of the audit results
- E. Determining the resources necessary for the audit programme
- F. Communicating with the auditee during the audit
- G. Defining the plan of an individual audit
- H. Establishing the audit programme
Answer: A,B,C,D,G,H
Explanation:
According to ISO 19011:2018, which provides guidelines for auditing management systems, an audit programme is a set of one or more audits planned for a specific time frame and directed towards a specific purpose1. The individual(s) managing the audit programme are responsible for establishing, implementing and maintaining the audit programme in accordance with the organization's policies and objectives1. This includes defining the extent of the audit programme based on strategic direction, risks and opportunities; establishing the audit programme by defining its objectives, scope and criteria; determining the resources necessary for the audit programme; selecting competent auditors and assigning them to appropriate audits; defining the objectives, scope and criteria for each individual audit; defining the plan of each individual audit; retaining documented information of the audit results; reviewing and improving the performance of the audit programme1. Therefore, these six actions are part of the responsibilities of the individual(s) managing the audit programme. The other option, communicating with the auditee during the audit, is not a responsibility of the individual(s) managing the audit programme, but rather a responsibility of the audit team leader1. Reference: ISO 19011:2018 - Guidelines for auditing management systems
NEW QUESTION # 72
What would be the reference for you to know who should have access to data/document?
- A. Information Rights Management (IRM)
- B. Access Control List (ACL)
- C. Masterlist of Project Records (MLPR)
- D. Data Classification Label
Answer: B
Explanation:
The reference for you to know who should have access to data/document is the Access Control List (ACL), which is a list of users or groups who are authorized to access a specific data/document and their respective access rights (such as read, write, modify, delete, etc.). The ACL is a tool for implementing the access control policy of the organization, which is defined in accordance with ISO/IEC 27001:2022 clause 9.4.1. The ACL should be maintained and updated regularly to ensure that only authorized users can access the data/document. Reference: [CQI & IRCA Certified ISO/IEC 27001:2022 Lead Auditor Training Course], [ISO/IEC 27001:2022 Information technology - Security techniques - Information security management systems - Requirements]
NEW QUESTION # 73
After a fire has occurred, what repressive measure can be taken?
- A. Repairing all systems after the fire
- B. Extinguishing the fire after the fire alarm sounds
- C. Buying in a proper fire insurance policy
Answer: B
NEW QUESTION # 74
You are conducting an ISMS audit in the despatch department of an international logistics organisation that provides shipping services to large organisations including local hospitals and government offices. Parcels typically contain pharmaceutical products, biological samples, and documents such as passports and driving licences. You note that the company records show a very large number of returned items with causes including misaddressed labels and, in 15% of cases, two or more labels for different addresses for the one package. You are interviewing the Shipping Manager (SM).
You: Are items checked before being dispatched?
SM: Any obviously damaged items are removed by the duty staff before being dispatched, but the small profit margin makes it uneconomic to implement a formal checking process.
You: What action is taken when items are returned?
SM: Most of these contracts are relatively low value, therefore it has been decided that it is easier and more convenient to simply reprint the label and re-send individual parcels than it is to implement an investigation.
You raise a nonconformity against ISO 27001:2022 based on the lack of control of the labelling process.
At the closing meeting, the Shipping Manager issues an apology to you that his comments may have been misunderstood. He says that he did not realise that there is a background IT process that automatically checks that the right label goes onto the right parcel otherwise the parcel is ejected at labelling. He asks that you withdraw your nonconformity.
Select three options of the correct responses that you as the audit team leader would make to the request of the Shipping Manager.
- A. Inform him of your understanding and withdraw the nonconformity
- B. Thank the Shipping Manager for his honesty but advise that withdrawing the nonconformity is not the right way to proceed
- C. Ask the audit team members to state what they think should happen
- D. Indicate that the nonconformity is evidence of a deeper system failure that needs to be rectified
- E. Inform the Shipping Manager that the nonconformity is minor and should be quickly corrected
- F. Advise the Shipping Manager that the nonconformity must stand since the evidence obtained for it was dear
- G. Advise the Shipping Manager that his request will be included in the audit report
- H. Advise management that the new information provided will be discussed when the auditors have more time
Answer: B,G,H
Explanation:
A) Advise the Shipping Manager that his request will be included in the audit report. This is true because the audit report should document all the relevant information and evidence related to the audit, including any requests or objections raised by the auditee. The audit report should also provide the rationale for the audit conclusions and recommendations12.
B) Advise management that the new information provided will be discussed when the auditors have more time. This is true because the auditors should not make hasty decisions based on incomplete or unverified information. The auditors should review and evaluate the new information in a systematic and objective manner, and determine whether it affects the audit findings, nonconformities, or conclusions12.
F) Thank the Shipping Manager for his honesty but advise that withdrawing the nonconformity is not the right way to proceed. This is true because the auditors should acknowledge and appreciate the cooperation and transparency of the auditee, but also maintain their professional integrity and independence. The auditors should not withdraw a nonconformity unless they are satisfied that it was raised in error or that it has been effectively corrected and verified12.
Reference:
ISO 19011:2022 Guidelines for auditing management systems
ISO/IEC 17021-1:2022 Conformity assessment - Requirements for bodies providing audit and certification of management systems - Part 1: Requirements
NEW QUESTION # 75
Which of the following does an Asset Register contain? (Choose two)
- A. Process ID
- B. Asset Type
- C. Asset Modifier
- D. Asset Owner
Answer: B,D
Explanation:
An asset register is a document that contains information about the assets associated with information and information processing facilities within the scope of the information security management system. An asset register should include, among other things, the asset type and the asset owner. The asset type is a category or classification of the asset, such as hardware, software, data, document, service, etc. The asset owner is a person or entity that has been assigned the responsibility for managing and protecting the asset throughout its lifecycle. The asset type and the asset owner are important information for identifying and controlling the assets, as well as for performing risk assessments and applying security controls. ISO/IEC 27001:2022 requires the organization to maintain an inventory of assets within the scope of the information security management system (see clause A.8.1.1). Reference: CQI & IRCA Certified ISO/IEC 27001:2022 Lead Auditor Training Course, ISO/IEC 27001:2022 Information technology - Security techniques - Information security management systems - Requirements, What is an Asset Register?
NEW QUESTION # 76
A hacker gains access to a webserver and can view a file on the server containing credit card numbers.
Which of the Confidentiality, Integrity, Availability (CIA) principles of the credit card file are violated?
- A. Compliance
- B. Confidentiality
- C. Integrity
- D. Availability
Answer: B
Explanation:
Confidentiality is one of the Confidentiality, Integrity, Availability (CIA) principles of information security that states that only authorized parties should have access to information assets. Confidentiality protects the secrecy and privacy of information from unauthorized disclosure or exposure. A hacker gaining access to a web server and viewing a file containing credit card numbers violates the confidentiality principle, as he or she is not an authorized party and has access to sensitive information that belongs to others. Therefore, the correct answer is B. Reference: ISO/IEC 27000:2022, clause 3.8; Defining Security Principles - Pearson IT Certification.
NEW QUESTION # 77
You are performing an ISMS initial certification audit at a residential nursing home that provides healthcare services. The next step in your audit plan is to conduct the closing meeting. During the final audit team meeting, as an audit team leader, you agree to report 2 minor nonconformities and 1 opportunity for improvement as below:
Select one option of the recommendation to the audit programme manager you are going to advise to the auditee at the closing meeting.
- A. Recommend that an unannounced audit is carried out at a future date
- B. Recommend that a partial audit is required within 3 months
- C. Recommend certification after your approval of the proposed corrective action plan Recommend that the findings can be closed out at a surveillance audit in 1 year
- D. Recommend certification immediately
- E. Recommend that a full scope re-audit is required within 6 months
Answer: C
Explanation:
According to ISO/IEC 17021-1:2015, which specifies the requirements for bodies providing audit and certification of management systems, clause 9.4.9 requires the certification body to make a certification decision based on the information obtained during the audit and any other relevant information1. The certification body should also consider the effectiveness of the corrective actions taken by the auditee to address any nonconformities identified during the audit1. Therefore, when making a recommendation to the audit programme manager, an ISMS auditor should consider the nature and severity of the nonconformities and the proposed corrective actions.
Based on the scenario above, the auditor should recommend certification after their approval of the proposed corrective action plan and recommend that the findings can be closed out at a surveillance audit in 1 year. The auditor should provide the following justification for their recommendation:
Justification: This recommendation is appropriate because it reflects the fact that the auditee has only two minor nonconformities and one opportunity for improvement, which do not indicate a significant or systemic failure of their ISMS. A minor nonconformity is defined as a failure to achieve one or more requirements of ISO/IEC 27001:2022 or a situation which raises significant doubt about the ability of an ISMS process to achieve its intended output, but does not affect its overall effectiveness or conformity2. An opportunity for improvement is defined as a suggestion for improvement beyond what is required by ISO/IEC 27001:20222. Therefore, these findings do not prevent or preclude certification, as long as they are addressed by appropriate corrective actions within a reasonable time frame. The auditor should approve the proposed corrective action plan before recommending certification, to ensure that it is realistic, achievable, and effective. The auditor should also recommend that the findings can be closed out at a surveillance audit in 1 year, to verify that the corrective actions have been implemented and are working as intended.
The other options are not valid recommendations for the audit programme manager, as they are either too lenient or too strict for the given scenario. For example:
Recommend certification immediately: This option is not valid because it implies that the auditor ignores or accepts the nonconformities, which is contrary to the audit principles and objectives of ISO 19011:20182, which provides guidelines for auditing management systems. It also contradicts the requirement of ISO/IEC 17021-1:20151, which requires the certification body to consider the effectiveness of the corrective actions taken by the auditee before making a certification decision.
Recommend that a full scope re-audit is required within 6 months: This option is not valid because it implies that the auditor overreacts or exaggerates the nonconformities, which is contrary to the audit principles and objectives of ISO 19011:20182. It also contradicts the requirement of ISO/IEC 17021-1:20151, which requires the certification body to determine whether a re-audit is necessary based on the nature and extent of nonconformities and other relevant factors. A full scope re-audit is usually reserved for major nonconformities or multiple minor nonconformities that indicate a serious or widespread failure of an ISMS.
Recommend that an unannounced audit is carried out at a future date: This option is not valid because it implies that the auditor distrusts or doubts the auditee's commitment or capability to implement corrective actions, which is contrary to the audit principles and objectives of ISO 19011:20182. It also contradicts the requirement of ISO/IEC 17021-1:20151, which requires the certification body to conduct unannounced audits only under certain conditions, such as when there are indications of serious problems with an ISMS or when required by sector-specific schemes.
Recommend that a partial audit is required within 3 months: This option is not valid because it implies that the auditor imposes or prescribes a specific time frame or scope for verifying corrective actions, which is contrary to the audit principles and objectives of ISO 19011:20182. It also contradicts the requirement of ISO/IEC 17021-1:20151, which requires the certification body to determine whether a partial audit is necessary based on the nature and extent of nonconformities and other relevant factors. A partial audit may be appropriate for minor nonconformities, but the time frame and scope should be agreed upon with the auditee and based on the proposed corrective action plan.
NEW QUESTION # 78
An employee caught with offense of abusing the internet, such as P2P file sharing or video/audio streaming, will not receive a warning for committing such act but will directly receive an IR.
- A. False
- B. True
Answer: B
NEW QUESTION # 79
A well-executed risk analysis provides a great deal of useful information. A risk analysis has four main objectives.
What is not one of the four main objectives of a risk analysis?
- A. Determining relevant vulnerabilities and threats
- B. Implementing counter measures
- C. Establishing a balance between the costs of an incident and the costs of a security measure
- D. Identifying assets and their value
Answer: B
NEW QUESTION # 80
What type of legislation requires a proper controlled purchase process?
- A. Government information act
- B. Personal data protection act
- C. Intellectual property rights act
- D. Computer criminality act
Answer: C
Explanation:
An intellectual property rights act is a type of legislation that requires a proper controlled purchase process. Intellectual property rights are legal rights that protect creations of the mind, such as inventions, literary and artistic works, designs, symbols, names and images. Intellectual property rights can include patents, trademarks, copyrights, trade secrets, etc. A proper controlled purchase process is a process that ensures that the organization obtains valid licenses or permissions from the owners or authorized parties of the intellectual property rights before using or acquiring any intellectual property assets. This process helps to avoid infringing on the intellectual property rights of others, which may result in legal actions, fines, damages or reputational harm. ISO/IEC 27001:2022 requires the organization to comply with relevant legal and contractual obligations related to intellectual property rights (see clause A.18.1.4). Reference: [CQI & IRCA Certified ISO/IEC 27001:2022 Lead Auditor Training Course], ISO/IEC 27001:2022 Information technology - Security techniques - Information security management systems - Requirements, What is Intellectual Property?
NEW QUESTION # 81
You are an experienced ISMS auditor, currently providing support to an ISMS auditor in training who is carrying out her first initial certification audit. She asks you what she should be verifying when auditing an organisation's Information Security objectives. You ask her what she has included in her audit checklist and she provides the following replies.
Which three of these responses would you cause you concern in relation to conformity with ISO/IEC 27001:2022?
- A. I am going to check that the necessary budget, manpower and materials to achieve each objective has been determined
- B. I am going to check that all the Information Security objectives are measurable. If they are not measurable the organisation will not be able to track progress against them
- C. I am going to check how each Information Security objective has been communicated to those who need to be aware of it in order for the objective to be achieved
- D. I am going to check that the Information Security objectives are written down on paper so that everyone is clear on what needs to be achieved, how it will be achieved, and by when it will be achieved
- E. I am going to check that there is a process in place to periodically revisit Information Security objectives, with a view to amending or cancelling them if circumstances necessitate this
- F. I am going to check that a completion date has been set for each objective and that there are no objectives with missing 'achieve by' dates
- G. I am going to check that top management have determined the Information Security objectives for the current year. If not, I will check that this task has been programmed to be completed
Answer: D,F,G
Explanation:
According to ISO/IEC 27001:2022, which specifies the requirements for establishing, implementing, maintaining and continually improving an information security management system (ISMS), clause 6.2 requires an organization to establish information security objectives at relevant functions and levels1. The objectives should be consistent with the information security policy; measurable (if practicable) or capable of being evaluated; monitored; communicated; updated as appropriate1. Therefore, when auditing an organization's information security objectives, an ISMS auditor should verify these aspects in accordance with the audit criteria.
Three responses from the ISMS auditor in training that would cause concern in relation to conformity with ISO/IEC 27001:2022 are:
I am going to check that top management have determined the Information Security objectives for the current year. If not, I will check that this task has been programmed to be completed: This response would cause concern because it implies that the auditor in training is not aware of the requirement to establish information security objectives at relevant functions and levels, not just at the top management level. It also implies that the auditor in training is willing to accept a delay or postponement in determining the information security objectives, which may affect the ISMS performance and effectiveness.
I am going to check that the Information Security objectives are written down on paper so that everyone is clear on what needs to be achieved, how it will be achieved, and by when it will be achieved: This response would cause concern because it implies that the auditor in training is not aware of the requirement to establish information security objectives that are measurable (if practicable) or capable of being evaluated, not just written down on paper. It also implies that the auditor in training is not aware of the flexibility and suitability of different media or formats for documenting and communicating information security objectives, such as electronic or digital records, posters, newsletters, etc.
I am going to check that a completion date has been set for each objective and that there are no objectives with missing 'achieve by' dates: This response would cause concern because it implies that the auditor in training is not aware of the requirement to establish information security objectives that are monitored, not just completed by a certain date. It also implies that the auditor in training is not aware of the possibility and necessity of updating information security objectives as appropriate, such as when changes occur in the internal or external context of the organization, or when new risks or opportunities arise.
The other responses from the ISMS auditor in training are acceptable and do not cause concern in relation to conformity with ISO/IEC 27001:2022. For example, checking how each Information Security objective has been communicated to those who need to be aware of it in order for the objective to be achieved is relevant to verifying the communication aspect of clause 6.2; checking that there is a process in place to periodically revisit Information Security objectives, with a view to amending or cancelling them if circumstances necessitate this is relevant to verifying the updating aspect of clause 6.2; checking that the necessary budget, manpower and materials to achieve each objective has been determined is relevant to verifying the planning aspect of clause 6.2; checking that all the Information Security objectives are measurable. If they are not measurable the organisation will not be able to track progress against them is relevant to verifying the measurability aspect of clause 6.2. Reference: ISO/IEC 27001:2022 - Information technology - Security techniques - Information security management systems - Requirements
NEW QUESTION # 82
What is a definition of compliance?
- A. A rule or directive made and maintained by an authority.
- B. Laws, considered collectively or the process of making or enacting laws
- C. The state or fact of according with or meeting rules or standards
- D. An official or authoritative instruction
Answer: C
Explanation:
Compliance is the state or fact of according with or meeting rules or standards1. In the context of information security, compliance means adhering to the applicable laws, regulations, policies, and contractual obligations that affect the organization's information assets2. Compliance is one of the objectives of an information security management system (ISMS) based on ISO/IEC 27001:2022, which requires the organization to identify and evaluate the relevant legal, regulatory, and contractual requirements that apply to its scope and operations3. Reference: Oxford Languages; ISO/IEC 27000:2022, clause 3.9; ISO/IEC 27001:2022, clause 6.1.3.
NEW QUESTION # 83
You are performing an ISMS audit at a nursing home where residents always wear an electronic wristband for monitoring their location, heartbeat, and blood pressure. The wristband automatically uploads this data to a cloud server for healthcare monitoring and analysis by staff.
You now wish to verify that the information security policy and objectives have been established by top management. You are sampling the mobile device policy and identify a security objective of this policy is "to ensure the security of teleworking and use of mobile devices" The policy states the following controls will be applied in order to achieve this.
Personal mobile devices are prohibited from connecting to the nursing home network, processing, and storing residents' data.
The company's mobile devices within the ISMS scope shall be registered in the asset register.
The company's mobile devices shall implement or enable physical protection, i.e., pin-code protected screen lock/unlock, facial or fingerprint to unlock the device.
The company's mobile devices shall have a regular backup.
To verify that the mobile device policy and objectives are implemented and effective, select three options for your audit trail.
- A. Review visitors' register book to make sure no visitor can have their personal mobile phone in the nursing home
- B. Interview top management to verify their involvement in establishing the information security policy and the information security objectives
- C. Review the asset register to make sure all company's mobile devices are registered
- D. Review the asset register to make sure all personal mobile devices are registered
- E. Sampling some mobile devices from on-duty medical staff and validate the mobile device information with the asset register
- F. Interview the reception personnel to make sure all visitor and employee bags are checked before entering the nursing home
- G. Review the internal audit report to make sure the IT department has been audited
- H. Interview the supplier of the devices to make sure they are aware of the ISMS policy
Answer: C,E,G
Explanation:
According to ISO/IEC 27001:2022, which specifies the requirements for establishing, implementing, maintaining and continually improving an information security management system (ISMS), clause 5.2 requires top management to establish an information security policy that provides the framework for setting information security objectives1. Clause 6.2 requires top management to ensure that the information security objectives are established at relevant functions and levels1. Therefore, when verifying that the information security policy and objectives have been established by top management, an ISMS auditor should review relevant documents and records that demonstrate top management's involvement and commitment.
To verify that the mobile device policy and objectives are implemented and effective, an ISMS auditor should review relevant documents and records that demonstrate how the policy and objectives are communicated, monitored, measured, analyzed, and evaluated. The auditor should also sample and verify the implementation of the controls that are stated in the policy.
Three options for the audit trail that are relevant to verifying the mobile device policy and objectives are:
Review the internal audit report to make sure the IT department has been audited: This option is relevant because it can provide evidence of how the IT department, which is responsible for managing the mobile devices and their security, has been evaluated for its conformity and effectiveness in implementing the mobile device policy and objectives. The internal audit report can also reveal any nonconformities, corrective actions, or opportunities for improvement related to the mobile device policy and objectives.
Sampling some mobile devices from on-duty medical staff and validate the mobile device information with the asset register: This option is relevant because it can provide evidence of how the mobile devices that are used by the medical staff, who are involved in processing and storing residents' data, are registered in the asset register and have physical protection enabled. This can verify the implementation and effectiveness of two of the controls that are stated in the mobile device policy.
Review the asset register to make sure all company's mobile devices are registered: This option is relevant because it can provide evidence of how the company's mobile devices that are within the ISMS scope are identified and accounted for. This can verify the implementation and effectiveness of one of the controls that are stated in the mobile device policy.
The other options for the audit trail are not relevant to verifying the mobile device policy and objectives, as they are not related to the policy or objectives or their implementation or effectiveness. For example:
Interview the reception personnel to make sure all visitor and employee bags are checked before entering the nursing home: This option is not relevant because it does not provide evidence of how the mobile device policy and objectives are implemented or effective. It may be related to another policy or objective regarding physical security or access control, but not specifically to mobile devices.
Review visitors' register book to make sure no visitor can have their personal mobile phone in the nursing home: This option is not relevant because it does not provide evidence of how the mobile device policy and objectives are implemented or effective. It may be related to another policy or objective regarding information security awareness or compliance, but not specifically to mobile devices.
Interview the supplier of the devices to make sure they are aware of the ISMS policy: This option is not relevant because it does not provide evidence of how the mobile device policy and objectives are implemented or effective. It may be related to another policy or objective regarding information security within supplier relationships, but not specifically to mobile devices.
Interview top management to verify their involvement in establishing the information security policy and the information security objectives: This option is not relevant because it does not provide evidence of how the mobile device policy and objectives are implemented or effective. It may be related to verifying that the information security policy and objectives have been established by top management, but not specifically to mobile devices.
NEW QUESTION # 84
How are data and information related?
- A. Data is a collection of structured and unstructured information
- B. When meaning and value are assigned to data, it becomes information
- C. Information consists of facts and statistics collected together for reference or analysis
Answer: B
Explanation:
Data and information are related concepts, but they are not the same. Data are simply facts or figures that represent raw facts or figures and form the basis of information. Information is data that has been given value through analysis, interpretation, or compilation in a meaningful form. When meaning and value are assigned to data, it becomes information that can be used for decision making, problem solving, or communication. Therefore, the correct answer is C. Reference: ISO/IEC 27000:2022, clause 3.7; Data vs Information - Difference and Comparison | Diffen.
NEW QUESTION # 85
Which of the following is a preventive security measure?
- A. Installing logging and monitoring software
- B. Shutting down the Internet connection after an attack
- C. Storing sensitive information in a data save
Answer: C
NEW QUESTION # 86
In what part of the process to grant access to a system does the user present a token?
- A. Authorisation
- B. Authentication
- C. Verification
- D. Identification
Answer: D
NEW QUESTION # 87
All are prohibited in acceptable use of information assets, except:
- A. Electronic chain letters
- B. Messages with very large attachments or to a large number ofrecipients.
- C. Company-wide e-mails with supervisor/TL permission.
- D. E-mail copies to non-essential readers
Answer: C
NEW QUESTION # 88
You receive the following mail from the IT support team: Dear User,Starting next week, we will be deleting all inactive email accounts in order to create spaceshare the below details in order to continue using your account. In case of no response, Name:
Email ID:
Password:
DOB:
Kindly contact the webmail team for any further support. Thanks for your attention.
Which of the following is the best response?
- A. One should not respond to these mails and report such email to your supervisor
- B. Ignore the email
- C. Respond it by saying that one should not share the password with anyone
Answer: A
Explanation:
The best response to the email from the IT support team asking for personal details is to not respond to the email and report it to your supervisor. The email is likely a phishing attempt, which is a form of social engineering that uses deceptive emails or other messages to trick recipients into revealing sensitive information, such as passwords, credit card numbers, bank account details, etc. Phishing emails often impersonate legitimate organizations or individuals and create a sense of urgency or curiosity to lure the victims into clicking on malicious links, opening malicious attachments or providing personal information. The IT support team should never ask for your password or other personal details via email, as this is a violation of information security policies and best practices. Ignoring the email or responding to it by saying that one should not share the password with anyone are not sufficient responses, as they do not alert the IT support team or your supervisor about the phishing attempt, which could affect other users as well. Reporting the email to your supervisor is a responsible action that could help prevent further damage or compromise of information. ISO/IEC 27001:2022 requires the organization to implement awareness and training programs to make users aware of the risks of social engineering attacks, such as phishing, and how to avoid them (see clause A.7.2.2). Reference: CQI & IRCA Certified ISO/IEC 27001:2022 Lead Auditor Training Course, ISO/IEC 27001:2022 Information technology - Security techniques - Information security management systems - Requirements, What is Phishing?
NEW QUESTION # 89
......
New ISO-IEC-27001-Lead-Auditor Dumps - Real PECB Exam Questions: https://www.vce4plus.com/PECB/ISO-IEC-27001-Lead-Auditor-valid-vce-dumps.html
ISO-IEC-27001-Lead-Auditor Dumps Prepare Your Exam With 140 Questions: https://drive.google.com/open?id=1d0HV7PV3-WDKGGm824Hz9ergVFZrP6fS