PECB ISO-27001-LA Online Practice Questions and Exam Preparation

PECB ISO-27001-LA Online Questions & Answers

• Question 201:

  During an audit, the audit team leader reached timely conclusions based on logical reasoning and analysis. What professional behaviour was displayed by the audit team leader?

  A. Decisive
  B. Open minded
  C. Ethical
  D. Perceptive
  A. Decisive

  ---

  According to the PECB Candidate Handbook for ISO/IEC 27001 Lead Auditor, one of the professional behaviours expected from an audit team leader is to be decisive, which means to "reach timely conclusions based on logical reasoning and analysis" (page 8). Being open minded, ethical, and perceptive are also desirable qualities for an audit team leader, but they do not match the description given in the question.

  References: PECB Candidate Handbook for ISO/IEC 27001 Lead Auditor, page 8.

• Question 202:

  Scenario:

  Clinic, founded in the 1990s, is a medical device company that specializes in treatments for heart-related conditions and complex surgical interventions. Based in Europe, it serves both patients and healthcare professionals. Clinic collects patient data to tailor treatments, monitor outcomes, and improve device functionality. To enhance data security and build trust, Clinic is implementing an information security management system (ISMS) based on ISO/IEC 27001 . This initiative demonstrates Clinic's

  commitment to securely managing sensitive patient information and proprietary technologies .

  Clinic established the scope of its ISMS by solely considering internal issues, interfaces, dependencies between internal and outsourced activities, and the expectations of interested parties . This scope was carefully documented and made accessible. In defining its ISMS, Clinic chose to focus specifically on key processes within critical departments such as Research and Development, Patient Data Management, and Customer Support .

  Despite initial challenges, Clinic remained committed to its ISMS implementation, tailoring security controls to its unique needs. The project team excluded certain Annex A controls from ISO/IEC 27001 while incorporating additional sector-specific controls to enhance security. The team evaluated the applicability of these controls against internal and external factors, culminating in the development of a comprehensive Statement of Applicability (SoA) detailing the rationale behind control selection and

  implementation.

  As preparations for certification progressed, Brian, appointed as the team leader , adopted a self-directed risk assessment methodology to identify and evaluate the company's strategic issues and security practices . This proactive approach ensured that Clinic's risk assessment aligned with its objectives and mission.

  Question:

  Does the Clinic's SoA document meet the ISO/IEC 27001 requirements for the SoA?

  A. Yes, because it comprises an exhaustive list of controls considered applicable from Annex A of ISO /IEC 27001 and the other sources
  B. No, because security controls selected from sources other than Annex A of ISO/IEC 27001 are included
  C. No, because it does not contain the justification for the exclusion of controls from Annex A of ISO/IEC 27001
  C. No, because it does not contain the justification for the exclusion of controls from Annex A of ISO/IEC 27001

  ---

  The Statement of Applicability (SoA) is a mandatory document in ISO/IEC 27001:2022 that lists all Annex A controls, their applicability, and justifications for inclusion or exclusion .

  C.

  Correct Answer: The SoA must include justifications for excluding Annex A controls . The scenario states that the project team excluded certain controls but does not mention that justifications were documented . This violates ISO/IEC 27001 Clause 6.1.3 (Information Security Risk Treatment) , which requires documenting exclusions with reasons.

  A. Incorrect: While the SoA should include an exhaustive list of controls, simply listing applicable controls from Annex A and other sources does not meet the requirement if exclusions are not justified.

  B. Incorrect: Including security controls from other sources is allowed and does not invalidate the SoA, as organizations can define additional controls beyond Annex A based on their risk assessment. Thus, Clinic's SoA is incomplete because it does not provide a justification for the exclusions of Annex A controls , making it non-compliant with ISO/IEC 27001 requirements .

• Question 203:

  Why should materiality be considered during the initial contact?

  A. To determine the audit duration
  B. To obtain reasonable assurance that the audit can be successfully completed
  C. To define processes for minimizing detection risks
  B. To obtain reasonable assurance that the audit can be successfully completed

  ---

  Materiality should be considered during the initial contact to obtain reasonable assurance that the audit can be successfully completed. Determining materiality helps establish the threshold for the significance of audit findings, ensuring that the audit focuses on substantial issues that could impact the audit conclusions.

  References: ISO 19011:2018, Guidelines for auditing management systems

• Question 204:

  Scenario: Rebuildy is a construction company located in Bangkok.. Thailand, that specializes in designing, building, and maintaining residential buildings. To ensure the security of sensitive project data and client information, Rebuildy decided to implement an ISMS based on ISO/IEC 27001. This included a comprehensive understanding of information security risks, a defined continual improvement approach, and robust business solutions. The ISMS implementation outcomes are presented below

  -

  Information security is achieved by applying a set of security controls and establishing policies, processes, and procedures.

  -

  Security controls are implemented based on risk assessment and aim to eliminate or reduce risks to an acceptable level.

  -

  All processes ensure the continual improvement of the ISMS based on the plan-do-check-act (PDCA) model.

  -

  The information security policy is part of a security manual drafted based on best security practices Therefore, it is not a stand-alone document.

  -

  Information security roles and responsibilities have been clearly stated in every employees job description

  -

  Management reviews of the ISMS are conducted at planned intervals.

  Rebuildy applied for certification after two midterm management reviews and one annual internal audit Before the certification audit one of Rebuildy's former employees approached one of the audit team members to tell them that Rebuildy has several security problems that the company is trying to conceal. The former employee presented the documented evidence to the audit team member Electra, a key client of Rebuildy, also submitted evidence on the same issues, and the auditor determined to retain this

  evidence instead of the former employee's. The audit team member remained in contact with Electra until the audit was completed, discussing the nonconformities found during the audit. Electra provided additional evidence to support these findings.

  At the beginning of the audit, the audit team interviewed the company's top management They discussed, among other things, the top management's commitment to the ISMS implementation. The evidence obtained from these discussions was documented in written confirmation, which was used to determine Rebuildy's conformity to several clauses of ISO/IEC 27001

  The documented evidence obtained from Electra was attached to the audit report, along with the nonconformities report. Among others, the following nonconformities were detected:

  -

  An instance of improper user access control settings was detected within the company's financial reporting system.

  -

  A stand-alone information security policy has not been established. Instead, the company uses a security manual drafted based on best security practices.

  After receiving these documents from the audit team, the team leader met Rebuildy's top management to present the audit findings. The audit team reported the findings related to the financial reporting system and the lack of a stand-alone information security policy. The top management expressed dissatisfaction with the findings and suggested that the audit team leader's conduct was unprofessional, implying they might request a replacement. Under pressure, the audit team leader decided to cooperate

  with top management to downplay the significance of the detected nonconformities. Consequently, the audit team leader adjusted the report to present a more favorable view, thus misrepresenting the true extent of Rebuildy's compliance issues.

  Based on the scenario above, answer the following question:

  Question:

  Based on Scenario 3, the audit team used information obtained from interviews with top management to determine Rebuildy's conformity to several ISO/IEC 27001 clauses . Is this acceptable?

  A. No, the audit team should have used only documentary evidence, such as policies and procedures, to determine conformity
  B. Yes, the audit team obtained verbal evidence by written confirmations from the top management, which can be used to determine conformity to the standard
  C. Yes, interviews with top management are the most reliable form of audit evidence and can be used to determine conformity to the standard without further verification
  B. Yes, the audit team obtained verbal evidence by written confirmations from the top management, which can be used to determine conformity to the standard

  ---

  B.

  Correct Answer:

  Audit evidence can come from interviews, observations, and documentation.

  Verbal evidence from top management is acceptable if documented and confirmed in writing.

  A. Incorrect:

  ISO 19011 allows verbal evidence as long as it is substantiated.

  C. Incorrect:

  Interviews alone are not sufficient--additional verification is required.

  Relevant Standard Reference:

  ISO 19011:2018 Clause 6.4.6 (Reviewing Documented Information)

• Question 205:

  Which two of the following are required characteristics of documented ISMS scope (as documented information) under ISO/IEC 27001:2022?

  A. It shall state the boundaries and applicability of the ISMS
  B. It shall include the organization's detailed risk assessment methodology
  C. It shall be available as documented information
  D. It shall list every Annex A control and its implementation status
  A. It shall state the boundaries and applicability of the ISMS
  C. It shall be available as documented information

  ---

  A is correct because clause 4.3 requires scope to define boundaries and applicability.

  C is correct because clause 4.3 requires the scope to be available as documented information.

  B is incorrect because the risk assessment methodology is part of clause 6.1.2 documentation needs, not a mandatory part of the scope statement.

  D is incorrect because Annex A control listing belongs to the Statement of Applicability (SoA), not the scope statement.

  References: ISO/IEC 27001:2022 clause 4.3; clause 6.1.2; clause 6.1.3

• Question 206:

  The scope of an organization certified against ISO/IEC 27001 states that they provide editing and web hosting services. However, due to some changes in the organization, the technical support related to the web hosting services has been outsourced. Should a change in the scope be initiated in this case?

  A. Yes, because any change in the external environment initiates a change in the scope
  B. No, because the change does not require implementation of new security controls
  C. No, because the organization is already certified for its editing and web hosting services
  A. Yes, because any change in the external environment initiates a change in the scope

  ---

  Yes, a change in the scope should be initiated because outsourcing a significant part of the service, such as technical support related to web hosting, could impact the risk landscape and the controls needed to manage those risks. This change affects the external environment and how the ISMS operates, necessitating a scope review and possible adjustment.

  References: ISO/IEC 27001:2013, Clause 4.3 (Determining the scope of the information security management system)

• Question 207:

  Which one of the following is an example of quantitative audit evidence?

  A. An interview with a system administrator about patching practices
  B. A metric showing 98% of endpoints received patches within 14 days for the last quarter
  C. Auditor observation that a server room door was often left open
  D. A verbal statement from the CISO that training is effective
  B. A metric showing 98% of endpoints received patches within 14 days for the last quarter

  ---

  B is correct because it is numerical, measurable, and can be analyzed objectively as a performance indicator. A, C, and D are qualitative evidence (interviews, observations, statements) and require corroboration.

  References: ISO 19011:2018 (audit evidence concepts)

• Question 208:

  You are performing an ISMS audit at a residential nursing home that provides healthcare services. The next step in your audit plan is to verify the information security incident management process. The IT Security Manager presents the information security incident management procedure (Document reference ID: ISMS_L2_16, version 4).

  You review the document and notice a statement "Any information security weakness, event, and incident should be reported to the Point of Contact (PoC) within 1 hour after identification". When interviewing staff, you found that there were differences in the understanding of the meaning of the phrase "weakness, event, and incident". The IT Security Manager explained that an online "information security handling" training seminar was conducted 6 months ago. All the people interviewed participated in and passed the reporting exercise and course assessment.

  You would like to investigate other areas further to collect more audit evidence. Select three options that would not be valid audit trails.

  A. Collect more evidence on how areas subject to information security incidents are quarantined to maintain information security during disruption (relevant to control A.5.29)
  B. Collect more evidence on how information security incidents are reported via appropriate channels (relevant to control A.6.8)
  C. Collect more evidence on how the organisation conducts information security incident training and evaluates its effectiveness. (Relevant to clause 7.2)
  D. Collect more evidence on how the organisation learns from information security incidents and makes improvements. (Relevant to control A.5.27)
  E. Collect more evidence on how the organisation manages the Point of Contact (PoC) which monitors vulnerabilities. (Relevant to clause 8.1)
  F. Collect more evidence on how the organisation tests the business continuity plan. (Relevant to control 5.30)
  G. Collect more evidence on whether terms and definitions are contained in the information security policy. (Relevant to control 5.32)
  H. Collect more evidence to determine if ISO 27035 (Information security incident management) is used as internal audit criteria. (Relevant to clause 8.13)
  E. Collect more evidence on how the organisation manages the Point of Contact (PoC) which monitors vulnerabilities. (Relevant to clause 8.1)
  G. Collect more evidence on whether terms and definitions are contained in the information security policy. (Relevant to control 5.32)
  H. Collect more evidence to determine if ISO 27035 (Information security incident management) is used as internal audit criteria. (Relevant to clause 8.13)

  ---

  The three options that would not be valid audit trails are:

  Collect more evidence on how the organisation manages the Point of Contact (PoC) which monitors vulnerabilities. (Relevant to clause 8.1) Collect more evidence on whether terms and definitions are contained in the information security policy. (Relevant to control 5.32) Collect more evidence to determine if ISO 27035 (Information security incident management) is used as internal audit criteria. (Relevant to clause 8.13)

  These options are not valid audit trails because they are not directly related to the information security incident management process, which is the focus of the audit. The audit trails should be relevant to the objectives, scope, and criteria of the audit, and should provide sufficient and reliable evidence to support the audit findings and conclusions.

  Option E is not valid because the PoC is not a part of the information security incident management process, but rather a role that is responsible for reporting and escalating information security incidents to the appropriate authorities. The audit trail should focus on how the PoC performs this function, not how the organisation manages the PoC. Option G is not valid because the terms and definitions are not a part of the information security incident management process, but rather a part of the information security policy, which is a high-level document that defines the organisation's information security objectives, principles, and responsibilities. The audit trail should focus on how the information security policy is communicated, implemented, and reviewed, not whether it contains terms and definitions. Option H is not valid because ISO 27035 is not a part of the information security incident management process, but rather a guidance document that provides best practices for managing information security incidents. The audit trail should focus on how the organisation follows the requirements of ISO/IEC 27001:2022 for information security incident management, not whether it uses ISO 27035 as an internal audit criteria.

  The other options are valid audit trails because they are related to the information security incident management process, and they can provide useful evidence to evaluate the conformity and effectiveness of the process. For example:

  Option A is valid because it relates to control A.5.29, which requires the organisation to establish procedures to isolate and quarantine areas subject to information security incidents, in order to prevent further damage and preserve evidence. The audit trail should collect evidence on how the organisation implements and tests these procedures, and how they ensure the continuity of information security during disruption. Option B is valid because it relates to control A.6.8, which requires the organisation to establish mechanisms for reporting information security events and weaknesses, and to ensure that they are communicated in a timely manner to the appropriate levels within the organisation6. The audit trail should collect evidence on how the organisation defines and uses these mechanisms, and how they monitor and review the reporting process. Option C is valid because it relates to clause 7.2, which requires the organisation to provide information security awareness, education, and training to all persons under its control, and to evaluate the effectiveness of these activities. The audit trail should collect evidence on how the organisation identifies the information security training needs, how they deliver and record the training, and how they measure the learning outcomes and feedback. Option D is valid because it relates to control A.5.27, which requires the organisation to learn from information security incidents and to implement corrective actions to prevent recurrence or reduce impact. The audit trail should collect evidence on how the organisation analyses and documents the root causes and consequences of information security incidents, how they identify and implement corrective actions, and how they verify the effectiveness of these actions. Option F is valid because it relates to control A.5.30, which requires the organisation to establish and maintain a business continuity plan to ensure the availability of information and information processing facilities in the event of a severe information security incident. The audit trail should collect evidence on how the organisation develops and updates the business continuity plan, how they test and review the plan, and how they communicate and train the relevant personnel on the plan.

  References:

  1: ISO 19011:2018, 6.2;

  2: ISO/IEC 27001:2022, A.6.8.1;

  3: ISO/IEC 27001:2022, 5.2;

  4: ISO /IEC 27035:2016, Introduction;

  5: ISO/IEC 27001:2022, A.5.29;

  6: ISO/IEC 27001:2022, A.6.8;

  7: ISO/IEC 27001:2022, 7.2;

  8: ISO/IEC 27001:2022, A.5.27;

  9: ISO/IEC 27001:2022, A.5.30;

  ISO 19011:2018; : ISO /IEC 27001:2022; : ISO/IEC 27001:2022; : ISO/IEC 27035:2016; : ISO/IEC 27001:2022; : ISO/IEC 27001:2022; : ISO/IEC 27001:2022; : ISO/IEC 27001:2022; : ISO/IEC 27001:2022

• Question 209:

  Scenario:

  A data processing tool crashed when a user added more data to the buffer than its storage capacity allows. The incident was caused by the tool's inability to bound-check arrays. What kind of vulnerability is this?

  A. Intrinsic vulnerability, i.e., inability to bound-check arrays, is a characteristic of the data processing tool
  B. Extrinsic vulnerability, i.e., the exploit of the buffer overflow vulnerability, is caused by an external factor
  C. None; buffer overflow is not a vulnerability; it is a threat
  A. Intrinsic vulnerability, i.e., inability to bound-check arrays, is a characteristic of the data processing tool

  ---

  Intrinsic vulnerabilities are inherent flaws in a system, software, or tool. In this case, the inability to bound-check arrays is an inherent weakness of the software, making it an intrinsic vulnerability . This aligns with ISO/IEC 27001:2022 Annex A Control A.8.9 (Configuration Management) , which mandates secure software design and validation practices.

  Extrinsic vulnerabilities arise due to external factors (e.g., misconfigurations or lack of security patches).

  Buffer overflow is a vulnerability, not a threat, because it represents a weakness that can be exploited by an attacker.

• Question 210:

  You are an experience ISMS audit team leader carrying out a third-party certification audit of an organization specialising in the secure disposal of confidential documents and removable media. Both documents and media are shredded in military grade devices which make it impossible to reconstruct the original.

  The audit has gone well and you are just about to start to write the audit report, 30 minutes before the closing meeting. At this point one of the organization's employees knocks on your door and asks if they can speak to you. They tell you that when things get busy her manager tells her to use a lower grade industrial shredder instead as the organisation has more of these and they operate faster. You were not informed about the existence or use of these machines by the auditee.

  Select three options for how you should respond to this information.

  A. Advise the individual managing the audit programme of any recommendation by you to conduct a further auditprior to certification
  B. Cancel the production of the audit report and instead review the organization's contracts with its clients to determine whether they have permitted the use of lower grade machines
  C. Consider the need for a subsequent audit within 4 weeks based on the additional information that has come to light
  D. Do nothing. All audits are based on a sample and the sample you took did not include a planned review of the lower grade machines
  E. Extend the certification audit duration to create additional time to audit the use of the lower grade machines
  F. Raise a nonconformity against 8.1 Operational Planning and Control as the organization has not been open about its processes
  G. Verify with the auditee that lower grade machines are used in certain circumstances
  A. Advise the individual managing the audit programme of any recommendation by you to conduct a further auditprior to certification
  C. Consider the need for a subsequent audit within 4 weeks based on the additional information that has come to light
  G. Verify with the auditee that lower grade machines are used in certain circumstances

  ---

  According to ISO/IEC 27001:2022 clause 8.1, the organization must plan, implement and control the processes needed to meet the information security requirements, and to implement the actions determined in clause 6.1. The organization must also ensure that the outsourced processes are controlled or influenced. According to control A.5.24, the organization must establish and maintain an information security incident management process that includes reporting information security events and

  weaknesses. Therefore, the use of lower grade machines for the secure disposal of confidential documents and media could pose a significant information security risk and a potential breach of contract with the clients.

  The auditor should respond to this information by:

  A. Advising the individual managing the audit programme of any recommendation by you to conduct a further audit prior to certification. This is in accordance with ISO/IEC 27006:2022 clause 7.4.3, which states that the audit team leader shall report to the certification body any situation that may significantly affect the audit conclusions or the certification decision, and propose any necessary changes to the audit plan. C. Considering the need for a subsequent audit within 4 weeks based on the additional information that has come to light. This is in accordance with ISO/IEC 27006:2022 clause 7.5.2, which states that the audit team leader shall review the audit findings and any other appropriate information collected during the audit to determine the audit conclusions, and to identify any need for a subsequent audit. G. Verifying with the auditee that lower grade machines are used in certain circumstances. This is in accordance with ISO/IEC 27006:2022 clause 7.4.2, which states that the audit team leader shall ensure that the audit is conducted in accordance with the audit plan, and that any changes to the plan are agreed upon and documented.

  The other options are not appropriate responses, as they either ignore the information, exceed the scope of the audit, or prematurely raise a nonconformity without sufficient evidence. For example:

  B. Cancelling the production of the audit report and instead reviewing the organization's contracts with its clients to determine whether they have permitted the use of lower grade machines. This is not a suitable response, as it would delay the audit process and the certification decision, and it would involve reviewing documents that are outside the scope of the ISMS audit. The auditor should focus on verifying the information security risk assessment and treatment process, and the information security incident management process, as they relate to the use of lower grade machines.

  D. Doing nothing. All audits are based on a sample and the sample you took did not include a planned review of the lower grade machines. This is not a suitable response, as it would disregard a significant information security risk and a potential nonconformity that could affect the audit conclusions and the certification decision. The auditor should follow up on the information provided by the employee and verify its validity and impact. E. Extending the certification audit duration to create additional time to audit the use of the lower grade machines. This is not a suitable response, as it would disrupt the audit schedule and the availability of the audit team and the auditee. The auditor should report the situation to the certification body and propose any necessary changes to the audit plan, such as conducting a subsequent audit. F. Raising a nonconformity against 8.1 Operational Planning and Control as the organization has not been open about its processes. This is not a suitable response, as it would be based on a single source of information that has not been verified or corroborated. The auditor should collect sufficient and appropriate audit evidence to support any nonconformity, and should also consider the root cause and the severity of the nonconformity.

  References: ISO/IEC 27001:2022, clauses 8.1 and Annex A control A.5.24 ISO/IEC 27006:2022, clauses 7.4.2, 7.4.3, and 7.5.2 [PECB Candidate Handbook ISO/IEC 27001 Lead Auditor], pages 18-19, 23-24 A Step-by-Step Guide to Conducting an ISO 27001 Internal Audit ISO 27001 ?Annex A.16: Information Security Incident Management