PECB ISO-27001-LA Online Practice Questions and Exam Preparation

PECB ISO-27001-LA Online Questions & Answers

• Question 211:

  You are an experienced audit team leader guiding an auditor in training.

  Your team is currently conducting a third-party surveillance audit of an organisation that stores data on behalf of external clients. The auditor in training has been tasked with reviewing the PEOPLE controls listed in the

  Statement of Applicability (SoA) and implemented at the site.

  Select four controls from the following that would you expect the auditor in training to review.

  A. Confidentiality and nondisclosure agreements
  B. How protection against malware is implemented
  C. Information security awareness, education and training
  D. Remote working arrangements
  E. The conducting of verification checks on personnel
  F. The operation of the site CCTV and door control systems
  G. The organisation's arrangements for information deletion
  H. The organisation's business continuity arrangements
  A. Confidentiality and nondisclosure agreements
  C. Information security awareness, education and training
  D. Remote working arrangements
  E. The conducting of verification checks on personnel

  ---

  The four controls from the list that the auditor in training should review are:

  Confidentiality and nondisclosure agreements: This control requires the organisation to ensure that all employees, contractors, and third parties who have access to sensitive information sign appropriate agreements that oblige them to protect the confidentiality and integrity of such information. This is especially important for an organisation that stores data on behalf of external clients, as it demonstrates its commitment to safeguarding their information assets and complying with their contractual obligations.

  Information security awareness, education and training: This control requires the organisation to provide regular and relevant information security awareness, education and training to all employees, contractors, and third parties who have access to the organisation's information systems and information assets. This is essential for ensuring that they are aware of their roles and responsibilities, the information security policies and procedures, the potential threats and risks, and the best practices for preventing

  and responding to information security incidents.

  Remote working arrangements: This control requires the organisation to establish and implement policies and procedures for managing the information security risks associated with remote working arrangements, such as teleworking, mobile working, or working from home. This includes defining the conditions and requirements for remote working, such as the authorised devices, applications, and networks, the encryption and authentication methods, the backup and recovery procedures, and the reporting

  and monitoring mechanisms. This is important for an organisation that stores data on behalf of external clients, as it ensures that the information security level is maintained regardless of the location of the workers and the devices they use.

  The conducting of verification checks on personnel: This control requires the organisation to conduct appropriate verification checks on the background, qualifications, and references of all employees, contractors, and third parties who have access to the organisation's information systems and information assets. This is necessary for verifying their identity, suitability, and trustworthiness, and for preventing the hiring of unauthorised or malicious individuals who could compromise the information security of the

  organisation and its clients.

  References:

  ISO/IEC 27001:2022, Annex A, clauses A.5.7, A.7.2, A.7.3, and A.7.4; ISO 27001 People Controls: How personnel ensures information security; What are the 11 new security controls in ISO 27001:2022? - Advisera.

• Question 212:

  Which two activities align with the "Check'' stage of the Plan-Do-Check-Act cycle when applied to the process of managing an internal audit program as described in ISO 19011?

  A. Retains records of internal audits
  B. Define audit criteria and scope for each internal audit
  C. Update the internal audit programme
  D. Establish a risk-based internal audit programme
  E. Conduct internal audits
  F. Verify effectiveness of the internal audit programme
  G. Review trends in internal audit result
  F. Verify effectiveness of the internal audit programme
  G. Review trends in internal audit result

  ---

  The Check stage of the PDCA cycle involves monitoring and measuring the performance of the process and comparing it with the planned objectives and criteria. In the context of managing an internal audit programme, this stage includes verifying the effectiveness of the internal audit programme by evaluating whether it meets its objectives, scope, and criteria, and whether it is implemented in accordance with ISO 19011 guidelines. It also includes reviewing the trends in internal audit results by analyzing the data collected from the audits, such as audit findings, nonconformities, corrective actions, opportunities for improvement, and customer feedback.

  References: ISO 19011:2018 - Guidelines for auditing management systems

• Question 213:

  Which one of the following options is the definition of the context of an organisation?

  A. The control of internal and external issues that can have an effect on an organisation's desire to achieve its objectives
  B. Complexity of internal and external issues that can have an effect on an organisation's approach to developing and achieving its purpose
  C. A combination of internal and external issues that can have an effect on an organisation's approach to developing and achieving its objectives
  D. The coordination of internal and external issues that can have a positive or negative effect on an organisation's success
  C. A combination of internal and external issues that can have an effect on an organisation's approach to developing and achieving its objectives

  ---

  The context of the organisation is the business environment in which the organisation operates and defines its information security management system (ISMS). It includes the internal and external factors and conditions that can influence the organisation's information security objectives, strategies, and policies. The context of the organisation helps the organisation to identify the scope, boundaries, and requirements of the ISMS, as well as the interested parties and their expectations. The context of the organisation is determined by considering both internal and external issues, such as the organisational structure, culture, values, mission, vision, objectives, strategies, resources, capabilities, processes, activities, products, services, markets, customers, competitors, suppliers, partners, regulators, laws, regulations, standards, guidelines, best practices, risks, opportunities, threats, vulnerabilities, etc.

  References: ISO 27001:2022 Clause 4 Context of the organization, ISO 27001 Requirement 4.1 ? Understanding the Context of the Organisation, ISO 27001 context of the organization ?How to define it - Advisera

• Question 214:

  Which situation presented below represents a threat?

  A. HackX uses and distributes pirated software
  B. The information security training was provided to only the IT team members of the organization
  C. Hackers compromised the administrator's account by cracking the password
  C. Hackers compromised the administrator's account by cracking the password

  ---

  A threat in information security is any circumstance or event with the potential to cause harm to an information system through unauthorized access, destruction, disclosure, modification of data, and/or denial of service. The situation where hackers compromise an administrator's account by cracking the password represents a direct threat to the security of the information system.

  References: = This explanation is based on general information security principles and the typical content covered in ISMS ISO/ IEC 27001 Lead Auditor training and certification programs. It aligns with the knowledge expected of a professional with an ISO/IEC 27001 Lead Auditor certification

• Question 215:

  The following are purposes of Information Security, except:

  A. Ensure Business Continuity
  B. Minimize Business Risk
  C. Increase Business Assets
  D. Maximize Return on Investment
  C. Increase Business Assets

  ---

  The following are purposes of information security, except increasing business assets. Increasing business assets is not a purpose of information security, as it is not directly related to protecting information and systems from threats and risks. Information security may contribute to increasing business assets by enhancing customer trust, reputation, compliance, and efficiency, but it is not its primary goal. Ensuring business continuity is a purpose of information security, as it aims to prevent or minimize

  disruptions or losses caused by incidents affecting information and systems. Minimizing business risk is a purpose of information security, as it aims to identify and reduce threats and vulnerabilities that may compromise information and systems. Maximizing return on investment is a purpose of information security, as it aims to optimize the costs and benefits of implementing and maintaining information security controls and measures.

  References: CQI and IRCA ISO 27001:2022 Lead Auditor Course Handbook, page 23. : [ISO/IEC 27001 Brochures | PECB], page 4.

• Question 216:

  Which one of the following options is the definition of an interested party?

  A. A third party can appeal to an organisation when it perceives itself to be affected by a decision or activity
  B. A person or organisation that can affect, be affected by or perceive itself to be affected by a decision or activity
  C. A group or organisation that can interfere in or perceive itself to be interfered with by a management decision
  D. An individual or organisation that can control, be controlled by, or perceive itself to be controlled by a decision or activity
  B. A person or organisation that can affect, be affected by or perceive itself to be affected by a decision or activity

  ---

  This is the definition of an interested party according to ISO 27001:2013, clause 3.16. An interested party is essentially a stakeholder, i.e., a person or organization that can influence or be influenced by the information security management system (ISMS) or its activities. Interested parties can have different needs and expectations regarding the ISMS, and these should be identified and addressed by the organization.

  References:

  ISO/IEC 27001:2013, Information technology -- Security techniques -- Information security management systems -- Requirements, clause 3.16 PECB Candidate Handbook ISO 27001 Lead Auditor, page 10 Identifying interested parties and their expectations for an ISO 27001 ISMS Examples of ISO 27001 interested parties

• Question 217:

  Scenario:

  Clinic, founded in the 1990s, is a medical device company that specializes in treatments for heart-related conditions and complex surgical interventions. Based in Europe, it serves both patients and healthcare professionals. Clinic collects patient data to tailor treatments, monitor outcomes, and improve device functionality. To enhance data security and build trust, Clinic is implementing an information security management system (ISMS) based on ISO/IEC 27001 . This initiative demonstrates Clinic's

  commitment to securely managing sensitive patient information and proprietary technologies .

  Clinic established the scope of its ISMS by solely considering internal issues, interfaces, dependencies between internal and outsourced activities, and the expectations of interested parties . This scope was carefully documented and made accessible. In defining its ISMS, Clinic chose to focus specifically on key processes within critical departments such as Research and Development, Patient Data Management, and Customer Support .

  Despite initial challenges, Clinic remained committed to its ISMS implementation, tailoring security controls to its unique needs. The project team excluded certain Annex A controls from ISO/IEC 27001 while incorporating additional sector-specific controls to enhance security. The team evaluated the applicability of these controls against internal and external factors, culminating in the development of a comprehensive Statement of Applicability (SoA) detailing the rationale behind control selection and

  implementation.

  As preparations for certification progressed, Brian, appointed as the team leader , adopted a self-directed risk assessment methodology to identify and evaluate the company's strategic issues and security practices . This proactive approach ensured that Clinic's risk assessment aligned with its objectives and mission.

  Question:

  Based on Scenario, which methodology did Brian choose to conduct a risk assessment?

  A. OCTAVE
  B. MEHARI
  C. EBIOS
  A. OCTAVE

  ---

  A. OCTAVE (Operationally Critical Threat, Asset, and Vulnerability Evaluation)?Correct Answer . OCTAVE is a self-directed risk assessment methodology where organizations identify, evaluate, and manage information security risks based on their strategic objectives , aligning with Brian's approach.

  B. MEHARI is a quantitative risk analysis method not self-directed , .

  C. EBIOS is focused on regulatory compliance and external risk factors , which Brian's methodology did not emphasize. Thus, Brian's approach aligns best with OCTAVE, as it is self-directed and focuses on organizational security practices .

• Question 218:

  Scenario 5: Data Grid Inc. is a well-known company that delivers security services across the entire information technology infrastructure. It provides cybersecurity software, including endpoint security, firewalls, and antivirus software. For two decades, Data Grid Inc. has helped various companies secure their networks through advanced products and services. Having achieved reputation in the information and network security field, Data Grid Inc. decided to obtain the ISO/IEC 27001 certification to better secure its internal and customer assets and gain competitive advantage.

  Data Grid Inc. appointed the audit team, who agreed on the terms of the audit mandate. In addition, Data Grid Inc. defined the audit scope, specified the audit criteria, and proposed to close the audit within five days. The audit team rejected Data Grid Inc.'s proposal to conduct the audit within five days, since the company has a large number of employees and complex processes. Data Grid Inc. insisted that they have planned to complete the audit within five days, so both parties agreed upon conducting the audit within the defined duration. The audit team followed a risk-based auditing approach.

  To gain an overview of the main business processes and controls, the audit team accessed process descriptions and organizational charts. They were unable to perform a deeper analysis of the IT risks and controls because their access to the IT infrastructure and applications was restricted. However, the audit team stated that the risk that a significant defect could occur to Data Grid Inc.'s ISMS was low since most of the company's processes were automated. They therefore evaluated that the ISMS, as a whole, conforms to the standard requirements by asking the representatives of Data Grid Inc. the following questions:

  How are responsibilities for IT and IT controls defined and assigned?

  How does Data Grid Inc. assess whether the controls have achieved the desired results?

  What controls does Data Grid Inc. have in place to protect the operating environment and data from malicious software?

  Are firewall-related controls implemented?

  Data Grid Inc.'s representatives provided sufficient and appropriate evidence to address all these questions.

  The audit team leader drafted the audit conclusions and reported them to Data Grid Inc.'s top management. Though Data Grid Inc. was recommended for certification by the auditors, misunderstandings were raised between Data Grid Inc. and the certification body in regards to audit objectives. Data Grid Inc. stated that even though the audit objectives included the identification of areas for potential improvement, the audit team did not provide such information.

  Based on this scenario, answer the following question:

  Based on scenario 5, the audit team disagreed with the proposed audit duration by Data Grid Inc. for the ISMS audit.

  How do you describe such a situation?

  A. Acceptable, auditors have the right to object, even refuse the audit mandate, if they deem that the audit duration is not sufficient
  B. Unacceptable, the audit duration is defined by the auditee and cannot be changed by the auditors
  C. Unacceptable, once the audit mandate is accepted, the audit duration cannot be changed
  A. Acceptable, auditors have the right to object, even refuse the audit mandate, if they deem that the audit duration is not sufficient

  ---

  Auditors have the authority to object or even refuse an audit mandate if they believe that the audit duration proposed by the auditee is not sufficient to thoroughly assess the ISMS. It is crucial for the audit to be comprehensive enough to cover all necessary aspects of the system, ensuring its effectiveness and compliance.

  References: ISO 19011:2018, Guidelines for auditing management systems

• Question 219:

  You are reviewing an organization's information security objectives. Which three findings would most likely indicate nonconformity with ISO/IEC 27001:2022 clause 6.2?

  A. Objectives are consistent with the information security policy
  B. Objectives exist but are not communicated to relevant functions
  C. Objectives are defined but no method exists to evaluate achievement
  D. Objectives are updated only when management review occurs
  E. Objectives are documented and monitored monthly
  F. Objectives exist but there is no evidence they are monitored
  B. Objectives exist but are not communicated to relevant functions
  C. Objectives are defined but no method exists to evaluate achievement
  F. Objectives exist but there is no evidence they are monitored

  ---

  B is a concern because clause 6.2 requires objectives to be communicated as appropriate.

  C is a concern because objectives must be measurable (if practicable) or otherwise capable of evaluation.

  F is a concern because clause 6.2 requires objectives to be monitored.

  A and E describe conforming characteristics.

  D may be acceptable depending on justification; the standard requires objectives to be updated as appropriate, and update frequency may align with management review if suitable.

  References: ISO/IEC 27001:2022 clause 6.2

• Question 220:

  Scenario 2: Knight is an electronics company from Northern California, US that develops video game consoles. Knight has more than 300 employees worldwide. On the fifth anniversary of their establishment, they have decided to deliver the G-Console, a new generation video game console aimed for worldwide markets. G-Console is considered to be the ultimate media machine of 2021 which will give the best gaming experience to players.

  The console pack will include a pair of VR headset, two games, and other gifts.

  Over the years, the company has developed a good reputation by showing integrity, honesty, and respect toward their customers. This good reputation is one of the reasons why most passionate gamers aim to have Knight's G-console as soon as it is released in the market.

  Besides being a very customer-oriented company, Knight also gained wide recognition within the gaming industry because of the developing quality. Their prices are a bit higher than the reasonable standards allow.

  Nonetheless, that is not considered an issue for most loyal customers of Knight, as their quality is top-notch.

  Being one of the top video game console developers in the world, Knight is also often the center of attention for malicious activities. The company has had an operational ISMS for over a year. The ISMS scope includes all departments of Knight, except Finance and HR departments.

  Recently, a number of Knight's files containing proprietary information were leaked by hackers. Knight's incident response team (IRT) immediately started to analyze every part of the system and the details of the incident.

  The IRT's first suspicion was that Knight's employees used weak passwords and consequently were easily cracked by hackers who gained unauthorized access to their accounts. However, after carefully investigating the incident, the IRT determined that hackers accessed accounts by capturing the file transfer protocol (FTP) traffic.

  FTP is a network protocol for transferring files between accounts. It uses clear text passwords for authentication.

  Following the impact of this information security incident and with IRT's suggestion, Knight decided to replace the FTP with Secure Shell (SSH) protocol, so anyone capturing the traffic can only see encrypted data.

  Following these changes, Knight conducted a risk assessment to verify that the implementation of controls had minimized the risk of similar incidents. The results of the process were approved by the ISMS project manager who claimed that the level of risk after the implementation of new controls was in accordance with the company's risk acceptance levels.

  Based on this scenario, answer the following question:

  According to scenario 2, the ISMS scope was not applied to the Finance and HR Department of Knight. Is this acceptable?

  A. Yes, the ISMS must be applied only to processes and assets that may directly impact information security
  B. Yes, the ISMS scope can include the whole organization or only particular departments within the organization
  C. No, the ISMS scope must include all organizational units and processes
  B. Yes, the ISMS scope can include the whole organization or only particular departments within the organization

  ---