PECB ISO-27001-LA Online Practice Questions and Exam Preparation

PECB ISO-27001-LA Online Questions & Answers

• Question 1:

  -------------------------is an asset like other important business assets has value to an organization and consequently needs to be protected.

  A. Infrastructure
  B. Data
  C. Information
  D. Security
  C. Information

  ---

  Information is an asset like other important business assets, as it has value to an organization and consequently needs to be protected. Information can be in any form, such as electronic, paper, or verbal. Information security is the protection of information from unauthorized access, use, disclosure, modification, or destruction2.

  References: ISO/IEC 27001:2022 Lead Auditor (Information Security Management Systems) | CQI | IRCA

• Question 2:

  Which three of the following would be considered "interested parties" that may have relevant requirements affecting an ISMS?

  A. A financial regulator applicable to the organization's operations
  B. A cloud hosting supplier providing infrastructure services
  C. A competitor in the same market
  D. Customers whose data is processed by the organization
  E. Any social media follower of the organization
  A. A financial regulator applicable to the organization's operations
  B. A cloud hosting supplier providing infrastructure services
  D. Customers whose data is processed by the organization

  ---

  A is correct because regulators often impose legal/compliance requirements.

  B is correct because suppliers can impose contractual and operational requirements and dependencies.

  D is correct because customers may have contractual and privacy/security requirements.

  C is not necessarily an interested party with relevant requirements for the ISMS.

  E is not typically relevant unless they impose formal requirements (unlikely).

  References: ISO/IEC 27001:2022 clause 4.2

• Question 3:

  DRAG DROP

  Select the words that best complete the sentence:

  Select and Place:

  

  

  Explanation:

  A third-party audit is an independent assessment of an organisation's management system by an external auditor, who is not affiliated with the organisation or its customers. The auditor verifies that the management system meets the requirements of a specific standard, such as ISO 27001, and evaluates its effectiveness and performance. The auditor also identifies any strengths, weaknesses, opportunities, or risks of the management system, and provides recommendations for improvement. The purpose of

  a third-party audit is to provide an objective and impartial evaluation of the organisation's management system, and to inform a certification decision by a certification body. A certification body is an organisation that grants a certificate of conformity to the organisation, after reviewing the audit report and evidence, and confirming that the management system meets the certification criteria. A certification decision is the outcome of the certification process, which can be positive (granting, maintaining, renewing,

  or expanding the scope of certification) or negative (suspending, withdrawing, or reducing the scope of certification).

  References:

  PECB Candidate Handbook ISO 27001 Lead Auditor, pages 19-25 ISO 19011:2018 - Guidelines for auditing management systems The ISO 27001 audit process | ISMS.online

• Question 4:

  You are an ISMS audit team leader assigned by your certification body to carry out a follow-up audit of a Data Centre client. According to ISO 19011:2018, the purpose of a follow-up audit is to verify which one of the following?

  A. The effectiveness of the management system
  B. Implementation of ISMS objectives
  C. Implementation of risk treatment plans
  D. Completion and effectiveness of corrective actions
  D. Completion and effectiveness of corrective actions

  ---

  The purpose of a follow-up audit is to verify the completion and effectiveness of corrective actions taken by the auditee in response to the nonconformities identified in a previous audit. A follow-up audit is a type of audit that is conducted after an initial audit, and it focuses on the specific areas where nonconformities were found and corrective actions were agreed upon. A follow-up audit can be conducted as a separate audit or as part of a scheduled audit, depending on the nature and severity of the nonconformities and the audit programme objectives.

  The other options are not the purpose of a follow-up audit, but rather the purpose of other types of audits. For example:

  Option A is the purpose of a performance audit, which is a type of audit that evaluates the effectiveness of the management system in achieving its intended results. Option B is the purpose of a compliance audit, which is a type of audit that verifies the conformity of the management system with the specified requirements, such as the ISMS objectives. Option C is the purpose of a process audit, which is a type of audit that examines the inputs, activities, outputs, and interactions of a specific process within the

  management system, such as the risk treatment process.

  References:

  1: ISO 19011:2018, 6.7;

  2: ISO 19011:2018, 3.7;

  3: ISO 19011:2018, 5.5.2;

  4: ISO 19011:2018, 3.6;

  5: ISO 19011:2018, 3.5;

  ISO 19011:2018, 3.4; : ISO 19011:2018; : ISO 19011:2018; : ISO 19011:2018; : ISO 19011:2018; : ISO 19011:2018; : [ISO 19011:2018]

• Question 5:

  Scenario:

  Northstorm is an online retail shop offering unique vintage and modern accessories. It initially entered a small market but gradually grew thanks to the development of the overall e-commerce landscape. Northstorm works exclusively online and ensures efficient payment processing, inventory management, marketing tools, and shipment orders. It uses prioritized ordering to receive, restock, and ship its most popular products. Northstorm has traditionally managed its IT operations by hosting its website and

  maintaining full control over its infrastructure, including hardware, software, and data administration. However, this approach hindered its growth due to the lack of responsive infrastructure. Seeking to enhance its e-commerce and payment systems, Northstorm opted to expand its in-house data centers, completing the expansion in two phases over three months. Initially, the company upgraded its core servers, point-of-sale, ordering, billing, database, and backup systems. The second phase involved

  improving mail, payment, and network functionalities. Additionally, during this phase, Northstorm adopted an international standard for personally identifiable information (PII) controllers and PII processors regarding PII processing to ensure its data handling practices were secure and compliant with global regulations.

  Despite the expansion, Northstorm's upgraded data centers failed to meet its evolving business demands. This inadequacy led to several new challenges, including issues with order prioritization. Customers reported not receiving priority orders, and the company struggled with responsiveness. This was largely due to the main server's inability to process orders from YouDecide, an application designed to prioritize orders and simulate customer interactions. The application, reliant on advanced algorithms,

  was incompatible with the new operating system (OS) installed during the upgrade.

  Faced with urgent compatibility issues, Northstorm quickly patched the application without proper validation, leading to the installation of a compromised version. This security lapse resulted in the main server being affected and the company's website going offline for a week. Recognizing the need for a more reliable solution, the company decided to outsource its website hosting to an e-commerce provider. The company signed a confidentiality agreement concerning product ownership and conducted a

  thorough review of user access rights to enhance security before transitioning.

  Question:

  Based on Scenario, which international standard did Northstorm adopt during the second phase of expansion?

  A. ISO/IEC 27701
  B. ISO/IEC 27009
  C. ISO/IEC 27003
  A. ISO/IEC 27701

  ---

  Northstorm adopted an international standard for Personally Identifiable Information (PII) controllers and PII processors to ensure its data handling practices were secure and compliant with global regulations . This aligns directly with ISO/IEC 27701 , which extends ISO/IEC 27001 and ISO/IEC 27002 to cover Privacy Information Management Systems (PIMS) , specifically addressing the protection of PII .

  A. ISO/IEC 27701?Correct Answer. This standard is designed for organizations acting as PII controllers and processors and provides guidelines on privacy management, regulatory compliance, and data protection.

  B. ISO/IEC 27009?Incorrect because this standard provides guidance on sector-specific requirements for ISMS , not privacy or PII protection.

  C. ISO/IEC 27003?Incorrect because it provides general implementation guidance for ISMS , not specific controls for PII processing.

  This aligns with ISO/IEC 27001:2022 Annex A Control A.5.34 (Privacy and Protection of PII) , which focuses on ensuring compliance with privacy regulations and implementing privacy-enhancing security measures.

• Question 6:

  Which statement below best describes the relationship between information security aspects?

  A. Threats exploit vulnerabilities to damage or destroy assets
  B. Controls protect assets by reducing threats
  C. Risk is a function of vulnerabilities that harm assets
  A. Threats exploit vulnerabilities to damage or destroy assets

  ---

  This statement encapsulates the relationship between threats, vulnerabilities, and assets within the context of information security. Threats are potential causes of an unwanted incident, which may result in harm to a system or organization. Vulnerabilities are weaknesses that can be exploited by threats to cause harm. Assets are valuable resources to an organization that need protection. Therefore, when threats exploit vulnerabilities, they can damage or destroy assets.

  References: = The explanation is based on the foundational concepts of information security as outlined in ISO/IEC 27001, which includes understanding the interplay between threats, vulnerabilities, and assets as part of an information security management system (ISMS)

• Question 7:

  DRAG DROP

  You are an experienced ISMS audit team leader providing instruction to a class of auditors in training. The subject of today's lesson is the management of information security risk in accordance with the requirements of ISO/IEC 27001:2022.

  You provide the class with a series of activities. You then ask the class to sort these activities into the order in which they appear in the standard.

  What is the correct sequence they should report back to you?

  Select and Place:

  

  

  Explanation:

  The correct sequence of activities for the management of information security risk in accordance with the requirements of ISO/IEC 27001:2022 is as follows:

  1st: Create and maintain information security risk criteria 2nd: Identify the risks that need to be considered when planning for the information security management system 3rd: Assess the potential consequences that would arise if the risk were to materialise 4th: Select appropriate risk treatment options 5th: Carry out information security risk assessments at planned intervals 6th: Consider the results of risk assessment and the status of the risk treatment plan at management review

  This sequence is based on the information security risk management process described in ISO/IEC 27001:

  2022 clause 6.1, which includes the following activities:

  establishing and maintaining information security risk criteria;

  ensuring that repeated information security risk assessments produce consistent, valid and comparable results;

  identifying the information security risks;

  analyzing the information security risks;

  evaluating the information security risks

  treating the information security risks;

  accepting the information security risks and the residual information security risks;

  communicating and consulting with stakeholders throughout the process;

  monitoring and reviewing the information security risks and the risk treatment plan.

  References:

  ISO/IEC 27001:2022, clause 6.1

  [PECB Candidate Handbook ISO/IEC 27001 Lead Auditor], pages 14-15

  ISO 27001 Risk Management in Plain English

• Question 8:

  Which two of the following are examples of audit methods that 'do' involve human interaction?

  A. Performing an independent review of procedures in preparation for an audit
  B. Reviewing the auditee's response to an audit finding
  C. Analysing data by remotely accessing the auditee's server
  D. Observing work performed by remote surveillance
  E. Analysing data by remotely accessing the auditee's server
  A. Performing an independent review of procedures in preparation for an audit
  B. Reviewing the auditee's response to an audit finding

  ---

  Audit methods are techniques used by auditors to obtain audit evidence. Audit methods can be classified into two categories: those that involve human interaction and those that do not2. Audit methods that involve human interaction require direct communication between the auditor and the auditee or other relevant parties, such as interviews, questionnaires, surveys, meetings, etc. Audit methods that do not involve human interaction rely on observation, inspection, measurement, testing, sampling, analysis,

  etc., without requiring any verbal or written exchange2. Therefore, performing an independent review of procedures in preparation for an audit and reviewing the auditee's response to an audit finding are examples of audit methods that involve human interaction, as they require reading and evaluating documents provided by the auditee or other sources. On the other hand, analysing data by remotely accessing the auditee's server and observing work performed by remote surveillance are examples of audit

  methods that do not involve human interaction, as they do not require any direct communication with the auditee or other parties.

  References: ISO/IEC 27001:2022 Lead Auditor (Information Security Management Systems) | CQI | IRCA

• Question 9:

  You are an experienced audit team leader guiding an auditor in training.

  Your team is currently conducting a third-party surveillance audit of an organisation that stores data on behalf of external clients. The auditor in training has been tasked with reviewing the ORGANISATIONAL controls listed in the Statement of Applicability (SoA) and implemented at the site.

  Select four controls from the following that would you expect the auditor in training to review.

  A. Access to and from the loading bay
  B. Confidentiality and nondisclosure agreements
  C. How information security has been addressed within supplier agreements
  D. How power and data cables enter the building
  E. Rules for transferring information within the organisation and to other organisations
  F. The development and maintenance of an information asset inventory
  G. The operation of the site CCTV and door control systems
  H. The organisation's business continuity arrangements
  B. Confidentiality and nondisclosure agreements
  C. How information security has been addressed within supplier agreements
  E. Rules for transferring information within the organisation and to other organisations
  F. The development and maintenance of an information asset inventory

  ---

  According to the PECB Candidate Handbook for ISO/IEC 27001 Lead Auditor, the auditor in training should review the organisational controls that are related to the information security policy, the roles and responsibilities, the information classification, the information exchange, the supplier relationships, and the information asset management1. These controls are aligned with the ISO/IEC 27001 requirements for clauses 5, 7, 8.2, 8.3, and 8.42. The other controls (A, D, G, and H) are more relevant to the physical and environmental security, the communications security, or the business continuity management, which are not part of the organisational controls3.

  References: 1: PECB Candidate Handbook for ISO/ IEC 27001 Lead Auditor, page 42, section 5.2.32: ISO/IEC 27001:2022, clauses 5, 7, 8.2, 8.3, and 8.43: ISO/IEC 27001:2022, clauses 8.1, 8.5, and 8.6.

• Question 10:

  A cybersecurity company implemented an access control software that allows only authorized personnel to access sensitive files. Which type of control has the company implemented in this case?

  A. Preventive control
  B. Detective control
  C. Corrective control
  A. Preventive control

  ---

  A. Preventive Control - Correct Answer. Access control software is designed to prevent unauthorized access by enforcing authentication and authorization mechanisms. This aligns with ISO /IEC 27001:2022 Annex A Control

  A.5.18 (Access Rights) .

  B. Detective controls identify and log unauthorized access attempts , but do not prevent them.

  C. Corrective controls take action after a security event has occurred.