PECB ISO-27001-LA Online Practice Questions and Exam Preparation

PECB ISO-27001-LA Online Questions & Answers

• Question 191:

  You received an email requiring you to send information such as name, email, and password in order to continue using your email account. If you do not send such information, your email account will be disabled. What does this scenario present?

  A. A personnel type of vulnerability
  B. An unauthorized action type of threat
  C. A compromise of information type of threat
  B. An unauthorized action type of threat

  ---

  The scenario described is a classic example of a phishing attack, which is a type of social engineering threat where attackers masquerade as a trustworthy entity in an electronic communication. The goal is to trick individuals into providing sensitive information. This represents an unauthorized action type of threat because it involves an attacker attempting to gain unauthorized access to personal information.

  References: = This understanding of phishing as a threat is consistent with the principles of information security management systems and is supported by resources that describe phishing attacks and their prevention

• Question 192:

  Below is Purpose of "Integrity", which is one of the Basic Components of Information Security

  A. the property that information is not made available or disclosed to unauthorized individuals
  B. the property of safeguarding the accuracy and completeness of assets.
  C. the property that information is not made available or disclosed to unauthorized individuals
  D. the property of being accessible and usable upon demand by an authorized entity.
  B. the property of safeguarding the accuracy and completeness of assets.

  ---

  Integrity is one of the basic components of information security, along with confidentiality and availability. Integrity means that information is safeguarded from unauthorized or accidental changes that could affect its accuracy and completeness. Integrity ensures that information is reliable and trustworthy3.

  References: ISO /IEC 27001:2022 Lead Auditor Training Course - BSI

• Question 193:

  Scenario:

  Tessa. Malik, and Michael are an audit team of independent and qualified experts in the field of security, compliance, and business planning and strategies. They are assigned to conduct a certification audit in Clastus, a large web design company. They have previously shown excellent work ethics, including impartiality and objectiveness, while conducting audits. This time, Clastus is positive that they will be one step ahead if they get certified against ISO/IEC 27001.

  Tessa, the audit team leader, has expertise in auditing and a very successful background in IT-related issues, compliance, and governance. Malik has an organizational planning and risk management background. His expertise relies on the level of synthesis and analysis of an organization's security controls and its risk tolerance in accurately characterizing the risk level within an organization On the other hand, Michael is an expert in the practical security of controls assessment by following rigorous

  standardized programs.

  After performing the required auditing activities, Tessa initiated an audit team meeting They analyzed one of Michael s findings to decide on the issue objectively and accurately. The issue Michael had encountered was a minor nonconformity in the organization's daily operations, which he believed was caused by one of the organization's IT technicians As such, Tessa met with the top management and told them who was responsible for the nonconformity after they inquired about the names of the persons

  responsible

  To facilitate clarity and understanding, Tessa conducted the closing meeting on the last day of the audit. During this meeting, she presented the identified nonconformities to the Clastus management. However, Tessa received advice to avoid providing unnecessary evidence in the audit report for the Clastus certification audit, ensuring that the report remains concise and focused on the critical findings. Based on the evidence examined, the audit team drafted the audit conclusions and decided that two areas

  of the organization must be audited before the certification can be granted. These decisions were later presented to the auditee, who did not accept the findings and proposed to provide additional information. Despite the auditee's comments, the auditors, having already decided on the certification recommendation, did not accept the additional information. The auditee's top management insisted that the audit conclusions did not represent reality, but the audit team remained firm in their decision.

  Based on the scenario above, answer the following question:

  Question:

  Was the closing meeting conducted accordingly?

  A. Yes, the closing meeting is conducted on the last day of the audit
  B. No, it should be conducted after the audit conclusions have been drafted
  C. No, it should be conducted several weeks after the on-site audit
  A. Yes, the closing meeting is conducted on the last day of the audit

  ---

  A.

  Correct Answer:

  ISO 19011:2018 requires that closing meetings occur at the end of the audit to present findings to the auditee.

  B. Incorrect:

  Audit conclusions can be drafted later, but the closing meeting must still happen immediately post-audit.

  C. Incorrect:

  Delaying the closing meeting beyond the audit timeline is improper.

  Relevant Standard Reference:

  ISO 19011:2018 Clause 6.6.2 (Closing Meeting Guidelines)

• Question 194:

  You have to carry out a third-party virtual audit. Which two of the following issues would you need to inform the auditee about before you start conducting the audit ?

  A. You will ask to see the ID card of the person that is on the screen.
  B. You will take photos of every person you interview.
  C. You will ask those being interviewed to state their name and position beforehand.
  D. You will ask for a 360-degree view of the room where the audit is being carried out.
  E. You will not record any part of the audit, unless permitted.
  F. You expect the auditee to have assessed all risks associated with online activities.
  C. You will ask those being interviewed to state their name and position beforehand.
  D. You will ask for a 360-degree view of the room where the audit is being carried out.

  ---

  A third-party virtual audit is an external audit conducted by an independent certification body using remote technology such as video conferencing, screen sharing, and electronic document exchange. The purpose of a third-party virtual audit is to verify the conformity and effectiveness of the information security management system (ISMS) and to issue a certificate of compliance

  Before you start conducting the audit, you would need to inform the auditee about the following issues:

  You will ask those being interviewed to state their name and position beforehand, i.e., to confirm their identity and role in the ISMS. This is to ensure that you are interviewing the relevant personnel and that they are authorized to provide information and evidence for the audit. You will ask for a 360-degree view of the room where the audit is being carried out, i.e., to verify the physical and environmental security of the audit location. This is to ensure that there are no unauthorized persons or devices in the

  vicinity that could compromise the confidentiality, integrity, or availability of the information being audited.

  The other issues are not relevant or appropriate for a third-party virtual audit, because:

  You will ask to see the ID card of the person that is on the screen, i.e., to verify their identity. This is not necessary if you have already asked them to state their name and position beforehand, and if you have access to the auditee's organizational chart or staff directory. Asking to see the ID card could also be seen as intrusive or disrespectful by the auditee.

  You will take photos of every person you interview, i.e., to document the audit process. This is not advisable as it could violate the privacy or consent of the auditee and the interviewees. Taking photos could also be seen as unprofessional or suspicious by the auditee. You should rely on the audit records and evidence provided by the auditee and the audit tool instead.

  You will not record any part of the audit, unless permitted, i.e., to respect the auditee's preferences and rights. This is not a valid issue to inform the auditee about, as you should always record the audit for quality assurance and verification purposes. Recording the audit is also a requirement of the ISO/IEC 27001 standard and the certification body. You should inform the auditee that you will record the audit and obtain their consent before the audit begins.

  You expect the auditee to have assessed all risks associated with online activities, i.e., to ensure the security of the audit process. This is not an issue to inform the auditee about, as it is part of the auditee' s responsibility and obligation to have a risk assessment and treatment process for their ISMS. You should assess the auditee's risk management practices and controls during the audit, not before it.

  References:

  1: ISO/IEC 27001:2022 Lead Auditor (Information Security Management Systems) Course by CQI and IRCA Certified Training

  2: ISO/IEC 27001 Lead Auditor Training Course by PECB 2

• Question 195:

  You are an experienced ISMS audit team leader who is currently conducting a third party initial certification audit of a new client, using ISO/IEC 27001:2022 as your criteria.

  It is the afternoon of the second day of a 2-day audit, and you are just about to start writing your audit report. So far no nonconformities have been identified and you and your team have been impressed with both the site and the organisation's ISMS.

  At this point, a member of your team approaches you and tells you that she has been unable to complete her assessment of leadership and commitment as she has spent too long reviewing the planning of changes.

  Which one of the following actions will you take in response to this information?

  A. Apologise to the client and tell them you will return at a later date to review leadership and commitment.
  B. Suggest to the client that if they are prepared to upgrade your return flight to first class you will audit leadership and commitment in your own time tomorrow.
  C. Advise the auditee and audit client that it is not possible to make a positive recommendation at this point.
  D. Advise the auditee that the certification audit will need to be terminated and rescheduled.
  E. Contact the individual managing the audit programme and seek their permission to record a positive recommendation in the audit report.
  F. Contact your head office and await their further instructions of how to proceed.
  G. Given there have been no nonconformities identified and the overall impression of the organisation has been a good one, record a positive recommendation for certification in the audit report.
  H. Review the audit plan and client availabilities to determine whether there is any opportunity for another member of your team to pick up this task before the closing meeting.
  C. Advise the auditee and audit client that it is not possible to make a positive recommendation at this point.

  ---

  Leadership and commitment is a key requirement of ISO/IEC 27001:2022, as it establishes the top management's role and responsibility in establishing, implementing, maintaining, and continually improving the ISMS. Without assessing this aspect, the audit team cannot conclude that the ISMS is effective and conforms to the standard. Therefore, the audit team leader should advise the auditee and audit client that it is not possible to make a positive recommendation at this point, and explain the reason and the implications. The audit team leader should also consult with the certification body and the audit programme manager on the next steps, such as extending the audit duration, conducting a follow-up audit, or issuing a conditional certification, depending on the certification body's policy and the audit client's agreement.

  References : ISO/IEC 27001:2022, clause 5, Leadership PECB Candidate Handbook ISO 27001 Lead Auditor, page 19, Audit Process PECB Candidate Handbook ISO 27001 Lead Auditor, page 22, Audit Report PECB Candidate Handbook ISO 27001 Lead Auditor, page 23, Audit Conclusion and Recommendation

• Question 196:

  Scenario: During an audit, a guide tells you "You cannot interview developers because they are busy," and denies access to change management records for a critical system in scope. The organization offers only verbal assurances. What is the most appropriate auditor action?

  A. Continue and conclude conformity based on verbal assurances
  B. Document the limitation as it may affect audit conclusions, and escalate per audit program/certification body process
  C. Immediately recommend certification suspension
  D. Remove the system from audit scope without agreement
  B. Document the limitation as it may affect audit conclusions, and escalate per audit program/certification body process

  ---

  B is correct. Denial of access is an audit limitation affecting sufficiency/appropriateness of evidence. Auditors should document it, assess materiality, and follow the certification body/audit programme process for resolving scope/access issues, including possible rescheduling or inability to conclude.

  A is incorrect because verbal assurances alone are insufficient.

  C is incorrect because suspension is a certification body decision and depends on context; the immediate appropriate step is to manage audit limitations.

  D is incorrect because scope changes require agreement and governance, not unilateral auditor changes.

  References: ISO 19011:2018 (managing audit limitations); ISO/IEC 17021-1 (audit process governance)

• Question 197:

  You receive the following mail from the IT support team: Dear User,Starting next week, we will be deleting all inactive email accounts in order to create spaceshare the below details in order to continue using your account. In case of no response,

  Name:

  Email ID:

  Password:

  DOB:

  Kindly contact the webmail team for any further support. Thanks for your attention.

  Which of the following is the best response?

  A. Ignore the email
  B. Respond it by saying that one should not share the password with anyone
  C. One should not respond to these mails and report such email to your supervisor
  C. One should not respond to these mails and report such email to your supervisor

  ---

  The best response to the email from the IT support team asking for personal details is to not respond to the email and report it to your supervisor. The email is likely a phishing attempt, which is a form of social engineering that uses deceptive emails or other messages to trick recipients into revealing sensitive information, such as passwords, credit card numbers, bank account details, etc. Phishing emails often impersonate legitimate organizations or individuals and create a sense of urgency or curiosity to lure the victims into clicking on malicious links, opening malicious attachments or providing personal information. The IT support team should never ask for your password or other personal details via email, as this is a violation of information security policies and best practices. Ignoring the email or responding to it by saying that one should not share the password with anyone are not sufficient responses, as they do not alert the IT support team or your supervisor about the phishing attempt, which could affect other users as well. Reporting the email to your supervisor is a responsible action that could help prevent further damage or compromise of information. ISO/IEC 27001:2022 requires the organization to implement awareness and training programs to make users aware of the risks of social engineering attacks, such as phishing, and how to avoid them (see clause A.7.2.2).

  References: CQI and IRCA Certified ISO/IEC 27001:2022 Lead Auditor Training Course, ISO /IEC 27001:2022 Information technology -- Security techniques -- Information security management systems -- Requirements, What is Phishing?

• Question 198:

  Scenario 3: NightCore is a multinational technology company based in the United States that focuses on e- commerce, cloud computing, digital streaming, and artificial intelligence. After having an information security management system (ISMS) implemented for over 8 months, they contracted a certification body to conduct a third party audit in order to get certified against ISO/IEC 27001.

  The certification body set up a team of seven auditors. Jack, the most experienced auditor, was assigned as the audit team leader. Over the years, he received many well known certifications, such as the ISO/IEC 27001 Lead Auditor, CISA, CISSP, and CISM.

  Jack conducted thorough analyses on each phase of the ISMS audit, by studying and evaluating every information security requirement and control that was implemented by NightCore. During stage 2 audit. Jack detected several nonconformities. After comparing the number of purchased invoices for software licenses with the software inventory, Jack found out that the company has been using the illegal versions of a software for many computers. He decided to ask for an explanation from the top

  management about this nonconformity and see whether they were aware about this. His next step was to audit NightCore's IT Department. The top management assigned Tom, NightCore's system administrator, to act as a guide and accompany Jack and the audit team toward the inner workings of their system and their digital assets infrastructure.

  While interviewing a member of the Department of Finance, the auditors discovered that the company had recently made some unusual large transactions to one of their consultants. After gathering all the necessary details regarding the transactions. Jack decided to directly interview the top management.

  When discussing about the first nonconformity, the top management told Jack that they willingly decided to use a copied software over the original one since it was cheaper. Jack explained to the top management of NightCore that using illegal versions of software is against the requirements of ISO/IEC 27001 and the national laws and regulations. However, they seemed to be fine with it.

  Several months after the audit, Jack sold some of NightCore's information that he collected during the audit for a huge amount of money to competitors of NightCore.

  Based on this scenario, answer the following question:

  Does ISO/IEC 27001 require organizations to comply with national laws and regulations?

  A. Yes, but relevant legal and contractual requirements do not need to be explicitly identified
  B. No, there is no clear indication in the standard as to whether the organization should comply with the national laws and regulations
  C. Yes, complying with the applicable legislation is a requirement of ISO/IEC 27001
  C. Yes, complying with the applicable legislation is a requirement of ISO/IEC 27001

  ---

  ISO/IEC 27001 requires organizations to comply with applicable legal, statutory, regulatory, and contractual requirements, including those pertaining to information security. These requirements must be identified, documented, and kept up to date as part of the organization's ISMS.

  References: ISO/IEC 27001:2013 Standard, Clause 6.1.3 (Information security requirements)

• Question 199:

  During a third-party certification audit you are presented with a list of issues by an auditee.

  Which four of the following constitute 'external' issues in the context of a management system to ISO/IEC 27001:2022?

  A. A rise in interest rates in response to high inflation
  B. A reduction in grants as a result of a change in government policy
  C. Poor levels of staff competence as a result of cuts in training expenditure
  D. Increased absenteeism as a result of poor management
  E. Higher labour costs as a result of an aging population
  F. Inability to source raw materials due to government sanctions
  G. Poor morale as a result of staff holidays being reduced
  H. A fall in productivity linked to outdated production equipment
  A. A rise in interest rates in response to high inflation
  B. A reduction in grants as a result of a change in government policy
  E. Higher labour costs as a result of an aging population
  F. Inability to source raw materials due to government sanctions

  ---

  According to ISO/IEC 27001:2022, which specifies the requirements for establishing, implementing, maintaining and continually improving an information security management system (ISMS), clause 4.1 requires an organization to determine external and internal issues that are relevant to its purpose and that affect its ability to achieve the intended outcomes of its ISMS2. External issues are those that originate from outside the organization, such as legal, regulatory, cultural, social, political, economic, natural and competitive factors. Internal issues are those that originate from within the organization, such as governance, structure, roles and responsibilities, policies, objectives, culture, capabilities, resources and information systems. Therefore, based on this definition, four examples of external issues in the context of a management system to ISO/IEC 27001:2022 are a rise in interest rates in response to high inflation (which affects the economic environment of the organization), a reduction in grants as a result of a change in government policy (which affects the political and legal environment of the organization), higher labour costs as a result of an aging population (which affects the social and demographic environment of the organization), and inability to source raw materials due to government sanctions (which affects the trade and supply environment of the organization). The other options are examples of internal issues, as they originate from within the organization or its activities. For example, poor levels of staff competence as a result of cuts in training expenditure (which affects the capabilities and resources of the organization), increased absenteeism as a result of poor management (which affects the culture and performance of the organization), poor morale as a result of staff holidays being reduced (which affects the motivation and satisfaction of the organization's personnel), and a fall in productivity linked to outdated production equipment (which affects the efficiency and quality of the organization's processes)

  2.

  References: ISO/IEC 27001:2022 - Information technology Security techniques ? Information security management systems ?Requirements

• Question 200:

  Scenario: Techmanic is a Belgian company founded in 1995 and currently operating in Brussels. It provides IT consultancy, software design, and hardware/software services, including deployment and maintenance. The company serves sectors like public services, finance, telecom, energy, healthcare, and education. As a customer-centered company, it prioritizes strong client relationships and leading security practices. Techmanic has been ISO/IEC 27001 certified for a year and regards this certification with pride. During the certification audit, the auditor found some inconsistencies in its ISMS implementation. Since the observed situations did not affect the capability of its ISMS to achieve the intended results, Techmanic was certified after auditors followed up on the root cause analysis and corrective actions remotely During that year, the company added hosting to its list of services and requested to expand its certification scope to include that area The auditor in charge approved the request and notified Techmanic that the extension audit would be conducted during the surveillance audit

  Techmanic underwent a surveillance audit to verify its iSMS's continued effectiveness and compliance with ISO/IEC 27001. The surveillance audit aimed to ensure that Techmanic's security practices, including the recent addition of hosting services, aligned seamlessly with the rigorous requirements of the certification

  The auditor strategically utilized the findings from previous surveillance audit reports in the recertification activity with the purpose of replacing the need for additional recertification audits, specifically in the IT consultancy sector. Recognizing the value of continual improvement and learning from past assessments. Techmanic implemented a practice of reviewing previous surveillance audit reports. This proactive approach not only facilitated identifying and resolving potential nonconformities but also aimed to

  streamline the recertification process in the IT consultancy sector.

  During the surveillance audit, several nonconformities were found. The ISMS continued to fulfill the ISO/IEC 27001*s requirements, but Techmanic failed to resolve the nonconformities related to the hosting services, as reported by its internal auditor. In addition, the internal audit report had several inconsistencies, which questioned the independence of the internal auditor during the audit of hosting services. Based on this, the extension certification was not granted. As a result. Techmanic requested a

  transfer to another certification body. In the meantime, the company released a statement to its clients stating that the ISO/IEC 27001 certification covers the IT services, as well as the hosting services.

  Based on the scenario above, answer the following question:

  Question:

  Is the purpose of reviewing previous surveillance audit reports in the recertification activity for Techmanic appropriately defined?

  A. Yes, the purpose of the recertification activity is to replace the need for recertification audits in the IT consultancy sector
  B. No, the purpose of the recertification activity is to compare Techmanic's software development with industry benchmarks
  C. No, the purpose of the recertification activity is to consider the performance of Techmanic's management system over the certification cycle
  C. No, the purpose of the recertification activity is to consider the performance of Techmanic's management system over the certification cycle

  ---

  C.

  Correct Answer:

  Recertification reviews the overall ISMS performance over the certification cycle, not just past audit findings.

  A. Incorrect:

  Previous audit findings do not replace the need for a full recertification audit.

  B. Incorrect:

  Recertification is not about industry benchmarking--it is about ISMS effectiveness.

  Relevant Standard Reference:

  ISO/IEC 17021-1:2015 Clause 9.6.4 (Recertification Process)