PECB ISO-27001-LA Online Practice Questions and Exam Preparation

PECB ISO-27001-LA Online Questions & Answers

• Question 181:

  You are conducting an ISMS audit in the despatch department of an international logistics organisation that provides shipping services to large organisations including local hospitals and government offices. Parcels typically contain pharmaceutical products, biological samples, and documents such as passports and driving licences. You note that the company records show a very large number of returned items with causes including mis- addressed labels and, in 15% of company cases, two or more labels

  for different addresses for the one package. You are interviewing the Shipping Manager (SM).

  You: Are items checked before being dispatched?

  SH: Any obviously damaged items are removed by the duty staff before being dispatched, but the small profit margin makes it uneconomic to implement a formal checking process.

  You: What action is taken when items are returned?

  SM: Most of these contracts are relatively low value, therefore it has been decided that it is easier and more convenient to simply reprint the label and re-send individual parcels than it is to implement an investigation.

  You raise a nonconformity. Referencing the scenario, which six of the following Appendix A controls would you expect the auditee to have implemented when you conduct the follow- up audit?

  A. 5.11 Return of assets
  B. 8.12 Data leakage protection
  C. 5.3 Segregation of duties
  D. 6.3 Information security awareness, education, and training
  E. 7.10 Storage media
  F. 8.3 Information access restriction
  G. 5.6 Contact with special interest groups
  H. 6.4 Disciplinary process
  I. 7.4 Physical security monitoring
  J. 5.13 Labelling of information K. 5.32 Intellectual property rights
  B. 8.12 Data leakage protection
  D. 6.3 Information security awareness, education, and training
  E. 7.10 Storage media
  F. 8.3 Information access restriction
  I. 7.4 Physical security monitoring
  J. 5.13 Labelling of information K. 5.32 Intellectual property rights

  ---

  8.12 Data leakage protection. This is true because the auditee should have implemented measures to prevent unauthorized disclosure of sensitive information, such as personal data, medical records, or official documents, that are contained in the parcels. Data leakage protection could include encryption, authentication, access control, logging, and monitoring of data transfers. 6.3 Information security awareness, education, and training. This is true because the auditee should have ensured that all employees and contractors involved in the shipping process are aware of the information security policies and procedures, and have received appropriate training on how to handle and protect the information assets in their custody. Information security awareness, education, and training could include induction programmes, periodic refreshers, awareness campaigns, e-learning modules, and feedback mechanisms.

  7.10 Storage media. This is true because the auditee should have implemented controls to protect the storage media that contain information assets from unauthorized access, misuse, theft, loss, or damage. Storage media could include paper documents, optical disks, magnetic tapes, flash drives, or hard disks. Storage media controls could include physical locks, encryption, backup, disposal, or destruction. 8.3 Information access restriction. This is true because the auditee should have implemented controls to restrict access to information assets based on the principle of least privilege and the need-to-know basis. Information access restriction could include identification, authentication, authorization, accountability, and auditability of users and systems that access information assets. 7.4 Physical security monitoring. This is true because the auditee should have implemented controls to monitor the physical security of the premises where information assets are stored or processed. Physical security monitoring could include CCTV cameras, alarms, sensors, guards, or patrols16. Physical security monitoring could help detect and deter unauthorized physical access or intrusion attempts. 5.13 Labelling of information. This is true because the auditee should have implemented controls to label information assets according to their classification level and handling instructions. Labelling of information could include markings, tags, stamps, stickers, or barcodes . Labelling of information could help identify and protect information assets from unauthorized disclosure or misuse .

  References: ISO/IEC 27002:2022 Information technology -- Security techniques -- Code of practice for information security controls ISO/IEC 27001:2022 Information technology -- Security techniques -- Information security management systems -- Requirements ISO/IEC 27003:2022 Information technology -- Security techniques -- Information security management systems -- Guidance ISO/IEC 27004:2022 Information technology -- Security techniques -- Information security management systems -- Monitoring measurement analysis and evaluation ISO/IEC 27005:2022 Information technology -- Security techniques -- Information security risk management ISO/IEC 27006:2022 Information technology -- Security techniques -- Requirements for bodies providing audit and certification of information security management systems [ISO/IEC 27007:2022 Information technology -- Security techniques -- Guidelines for information security management systems auditing]

• Question 182:

  Scenario: During a surveillance audit, the auditee uses ISO/IEC 27001:2013 clause numbering in their internal procedures (e.g., referring to "10.2 Improvement") but you confirm they are implementing the ISO/IEC 27001:2022 requirements correctly and have updated control content accordingly. What is the most appropriate action?

  A. Raise a major nonconformity against clause 7.5 because numbering is incorrect
  B. Raise a minor nonconformity because any reference to 2013 indicates nonconformity
  C. Raise an opportunity for improvement to update references for clarity and maintenance
  D. Take no action and do not document it
  C. Raise an opportunity for improvement to update references for clarity and maintenance

  ---

  C is correct. If requirements are met but documented references are outdated, this typically indicates a documentation clarity/maintenance improvement opportunity rather than a requirement failure--unless it causes misapplication or confusion.

  A and B are incorrect because incorrect numbering alone, without evidence of requirement failure, usually does not justify a nonconformity.

  D is incorrect because auditors should document relevant improvement opportunities to support continual improvement and reduce future confusion.

  References: ISO 19011:2018 (reporting opportunities for improvement); ISO/IEC 27001:2022 clause 7.5 (document control expectations)

• Question 183:

  Scenario 9: UpNet, a networking company, has been certified against ISO/IEC 27001. It provides network security, virtualization, cloud computing, network hardware, network management software, and networking technologies.

  The company's recognition has increased drastically since gaining ISO/IEC 27001 certification. The certification confirmed the maturity of UpNefs operations and its compliance with a widely recognized and accepted standard.

  But not everything ended after the certification. UpNet continually reviewed and enhanced its security controls and the overall effectiveness and efficiency of the ISMS by conducting internal audits. The top management was not willing to employ a full-time team of internal auditors, so they decided to outsource the internal audit function. This form of internal audits ensured independence, objectivity, and that they had an advisory role about the continual improvement of the ISMS.

  Not long after the initial certification audit, the company created a new department specialized in data and storage products. They offered routers and switches optimized for data centers and software-based networking devices, such as network virtualization and network security appliances. This caused changes to the operations of the other departments already covered in the ISMS certification scope.

  Therefore. UpNet initiated a risk assessment process and an internal audit. Following the internal audit result, the company confirmed the effectiveness and efficiency of the existing and new processes and controls.

  The top management decided to include the new department in the certification scope since it complies with ISO/IEC 27001 requirements. UpNet announced that it is ISO/IEC 27001 certified and the certification scope encompasses the whole company.

  One year after the initial certification audit, the certification body conducted another audit of UpNefs ISMS. This audit aimed to determine the UpNefs ISMS fulfillment of specified ISO/IEC 27001 requirements and ensure that the ISMS is being continually improved. The audit team confirmed that the certified ISMS continues to fulfill the requirements of the standard. Nonetheless, the new department caused a significant impact on governing the management system. Moreover, the certification body was not

  informed about any changes. Thus, the UpNefs certification was suspended.

  Based on the scenario above, answer the following question:

  UpNet outsourced the internal audit function, as provided in scenario 9. Does it impact the internal audit process?

  A. No, internal audits do not necessarily have to be independent and objective because they have an advisory role
  B. No, because the internal audit process can comprise more than an audit program
  C. Yes, it increases the independence and impartiality of the internal audit because auditors do not have operational roles related to the ISMS
  C. Yes, it increases the independence and impartiality of the internal audit because auditors do not have operational roles related to the ISMS

  ---

  Yes, outsourcing the internal audit function can positively impact the internal audit process by increasing its independence and impartiality. This helps ensure that the internal audits are conducted without any bias or influence from the company's internal management.

• Question 184:

  Scenario 4: SendPay is a financial company that provides its services through a network of agents and financial institutions. One of their main services is transferring money worldwide. SendPay, as a new company, seeks to offer top quality services to its clients. Since the company offers international transactions, it requires from their clients to provide personal information, such as their identity, the reason for the transactions, and other details that might be needed to complete the transaction. Therefore, SendPay has implemented security measures to protect their clients' information, including detecting, investigating, and responding to any information security threats that may emerge. Their commitment to offering secure services was also reflected during the ISMS implementation where the company invested a lot of time and resources.

  Last year, SendPay unveiled their digital platform that allows money transactions through electronic devices, such as smartphones or laptops, without requiring an additional fee. Through this platform, SendPay's clients can send and receive money from anywhere and at any time. The digital platform helped SendPay to simplify the company's operations and further expand its business. At the time, SendPay was outsourcing its software operations, hence the project was completed by the software development team of the outsourced company. The same team was also responsible for maintaining the technology infrastructure of SendPay.

  Recently, the company applied for ISO/IEC 27001 certification after having an ISMS in place for almost a year. They contracted a certification body that fit their criteria. Soon after, the certification body appointed a team of four auditors to audit SendPay's ISMS.

  During the audit, among others, the following situations were observed:

  1.The outsourced software company had terminated the contract with SendPay without prior notice. As a result, SendPay was unable to immediately bring the services back in-house and its operations were disrupted for five days. The auditors requested from SendPay's representatives to provide evidence that they have a plan to follow in cases of contract terminations. The representatives did not provide any documentary evidence but during an interview, they told the auditors that the top management of SendPay had identified two other software development companies that could provide services immediately if similar situations happen again.

  2.There was no evidence available regarding the monitoring of the activities that were outsourced to the software development company. Once again, the representatives of SendPay told the auditors that they regularly communicate with the software development company and that they are appropriately informed for any possible change that might occur.

  3.There was no nonconformity found during the firewall testing. The auditors tested the firewall configuration in order to determine the level of security provided by these services. They used a packet analyzer to test the firewall policies which enabled them to check the packets sent or received in real-time. Based on this scenario, answer the following question:

  Why could SendPay not restore their services back in-house after the contract termination? Refer to scenario 4.

  A. Because SendPay did not monitor the technology infrastructure of the outsourced software operations
  B. Because SendPay lacked a comprehensive business continuity plan with potential impact of contract terminations
  C. Because the outsourced software company terminated the contract with SendPay without prior notice
  B. Because SendPay lacked a comprehensive business continuity plan with potential impact of contract terminations

  ---

  SendPay's inability to restore their services immediately after the contract termination indicates a lack of a comprehensive business continuity plan that addresses the potential impacts of such terminations. This oversight can result in significant operational disruptions, as observed.

  References: ISO/IEC 27001:2013 Standard, Clause A.17 (Information security aspects of business continuity management)

• Question 185:

  Scenario:

  Rebuildy is a construction company located in Bangkok.. Thailand, that specializes in designing, building, and maintaining residential buildings. To ensure the security of sensitive project data and client information, Rebuildy decided to implement an ISMS based on ISO/IEC 27001. This included a comprehensive understanding of information security risks, a defined continual improvement approach, and robust business solutions.

  The ISMS implementation outcomes are presented below

  -

  Information security is achieved by applying a set of security controls and establishing policies, processes, and procedures.

  -

  Security controls are implemented based on risk assessment and aim to eliminate or reduce risks to an acceptable level.

  -

  All processes ensure the continual improvement of the ISMS based on the plan-do-check-act (PDCA) model.

  -

  The information security policy is part of a security manual drafted based on best security practices Therefore, it is not a stand-alone document.

  -

  Information security roles and responsibilities have been clearly stated in every employees job description

  -

  Management reviews of the ISMS are conducted at planned intervals.

  Rebuildy applied for certification after two midterm management reviews and one annual internal audit Before the certification audit one of Rebuildy's former employees approached one of the audit team members to tell them that Rebuildy has several security problems that the company is trying to conceal. The former employee presented the documented evidence to the audit team member Electra, a key client of Rebuildy, also submitted evidence on the same issues, and the auditor determined to retain this

  evidence instead of the former employee's. The audit team member remained in contact with Electra until the audit was completed, discussing the nonconformities found during the audit. Electra provided additional evidence to support these findings.

  At the beginning of the audit, the audit team interviewed the company's top management They discussed, among other things, the top management's commitment to the ISMS implementation. The evidence obtained from these discussions was documented in written confirmation, which was used to determine Rebuildy's conformity to several clauses of ISO/IEC 27001

  The documented evidence obtained from Electra was attached to the audit report, along with the nonconformities report. Among others, the following nonconformities were detected:

  -

  An instance of improper user access control settings was detected within the company's financial reporting system.

  -

  A stand-alone information security policy has not been established. Instead, the company uses a security manual drafted based on best security practices.

  After receiving these documents from the audit team, the team leader met Rebuildy's top management to present the audit findings. The audit team reported the findings related to the financial reporting system and the lack of a stand-alone information security policy. The top management expressed dissatisfaction with the findings and suggested that the audit team leader's conduct was unprofessional, implying they might request a replacement. Under pressure, the audit team leader decided to cooperate

  with top management to downplay the significance of the detected nonconformities. Consequently, the audit team leader adjusted the report to present a more favorable view, thus misrepresenting the true extent of Rebuildy's compliance issues.

  Based on the scenario above, answer the following question:

  Question:

  Is it acceptable for the auditor to prioritize keeping the evidence provided by Electra over the evidence provided by the former employee?

  A. No, because evidence from a former employee is always more reliable than that from a client
  B. No, both sources of evidence should be retained and evaluated equally
  C. Yes, because evidence from a client is considered more reliable due to their independent status
  B. No, both sources of evidence should be retained and evaluated equally

  ---

  B.

  Correct Answer: ISO 19011:2018 (Guidelines for Auditing Management Systems) states that all evidence must be treated equally and evaluated based on relevance, credibility, and objectivity.

  Both sources should have been retained, reviewed, and verified rather than selectively prioritizing one over the other.

  A. Incorrect:

  A former employee may have insider knowledge , but their credibility must be verified-- it is not inherently more reliable .

  C. Incorrect:

  While a client is independent , their evidence is not automatically more credible than a former employee's .

  Relevant Standard Reference:

  ISO 19011:2018 Clause 6.4.7 (Collecting and Verifying Information)

• Question 186:

  Which controls are related to the Annex A controls of ISO/IEC 27001 and are often selected from other guides and standards or defined by the organization to meet its specific needs?

  A. General controls
  B. Strategic controls
  C. Specific controls
  C. Specific controls

  ---

  Specific controls are tailored security controls chosen based on risk assessments, industry best practices, and regulatory requirements . These align with ISO/IEC 27001:2022 Annex A controls , which organizations select based on their risk landscape .

  General controls refer to broad security measures that apply to all organizations.

  Strategic controls focus on high-level governance and long-term security goals , not detailed security implementations.

• Question 187:

  The auditor should consider (1)-------when determining the (2)-------

  A. (1) Standard requirements. (2) audit criteria
  B. (1) Audit risks, (2) audit objectives
  C. (1) Penalties related to legal noncompliance, (2) materiality
  B. (1) Audit risks, (2) audit objectives

  ---

  The auditor should consider "audit risks" when determining the "audit objectives." Understanding the risks associated with the audit helps define the objectives clearly, ensuring that the audit focuses on the most significant areas of concern, aligns with the audit scope, and adequately addresses the risks identified.

  References: ISO 19011:2018, Guidelines for auditing management systems

• Question 188:

  The auditor discovered that two out of 15 employees of the IT Department have not received adequate information security training. What does this represent?

  A. Audit finding
  B. Audit evidence
  C. Information source
  A. Audit finding

  ---

  This scenario represents an "audit finding." An audit finding refers to results that indicate a deviation from the expected performance or standards. Discovering that two employees have not received the required training is an audit finding indicating noncompliance with the organization's training requirements.

  References: ISO 19011:2018, Guidelines for auditing management systems

• Question 189:

  Scenario: An organization implements a new customer portal that changes authentication from password-only to multi-factor authentication (MFA). They do not re-run risk assessment because "security improved." According to ISO/IEC 27001, what is the best audit conclusion?

  A. Acceptable, because improvements never require risk reassessment
  B. Unacceptable, because risk assessment must be performed when significant changes occur
  C. Acceptable, because MFA eliminates authentication risks
  D. Unacceptable, because MFA is not permitted by ISO/IEC 27001
  B. Unacceptable, because risk assessment must be performed when significant changes occur

  ---

  B is correct. ISO/IEC 27001 requires risk assessment to be maintained and updated when significant changes occur. Even if security is improved, changes may introduce new risks (implementation errors, availability impacts, user enrollment risks) and must be evaluated.

  A is incorrect because changes do require reassessment where significant.

  C is incorrect because MFA reduces some risks but does not eliminate all authentication-related risks.

  D is incorrect because ISO/IEC 27001 is technology-neutral and does not forbid MFA.

  References: ISO/IEC 27001:2022 clause 6.1.2; clause 8.1

• Question 190:

  Which four of the following are appropriate inputs to management review of an ISMS?

  A. Results of internal audits
  B. Status of corrective actions
  C. Changes in external and internal issues relevant to the ISMS
  D. Names of individual employees responsible for nonconformities for disciplinary action
  E. Information security performance and achievement of objectives
  F. Social media marketing performance unrelated to information security
  A. Results of internal audits
  B. Status of corrective actions
  C. Changes in external and internal issues relevant to the ISMS
  E. Information security performance and achievement of objectives

  ---

  A, B, C, and E are typical management review inputs required/expected by clause 9.3 (audit results, corrective action status, changes in issues, performance/objectives).

  D is incorrect because management review is not intended as a disciplinary forum; it focuses on suitability, adequacy, and effectiveness.

  F is incorrect because it is unrelated to the ISMS unless it affects information security context/objectives.

  References: ISO/IEC 27001:2022 clause 9.3