PECB ISO-27001-LA Online Practice Questions and Exam Preparation

PECB ISO-27001-LA Online Questions & Answers

• Question 311:

  Scenario 2: Knight is an electronics company from Northern California, US that develops video game consoles. Knight has more than 300 employees worldwide. On the fifth anniversary of their establishment, they have decided to deliver the G-Console, a new generation video game console aimed for worldwide markets. G-Console is considered to be the ultimate media machine of 2021 which will give the best gaming experience to players.

  The console pack will include a pair of VR headset, two games, and other gifts.

  Over the years, the company has developed a good reputation by showing integrity, honesty, and respect toward their customers. This good reputation is one of the reasons why most passionate gamers aim to have Knight's G-console as soon as it is released in the market.

  Besides being a very customer-oriented company, Knight also gained wide recognition within the gaming industry because of the developing quality. Their prices are a bit higher than the reasonable standards allow.

  Nonetheless, that is not considered an issue for most loyal customers of Knight, as their quality is top-notch.

  Being one of the top video game console developers in the world, Knight is also often the center of attention for malicious activities. The company has had an operational ISMS for over a year. The ISMS scope includes all departments of Knight, except Finance and HR departments.

  Recently, a number of Knight's files containing proprietary information were leaked by hackers. Knight's incident response team (IRT) immediately started to analyze every part of the system and the details of the incident.

  The IRT's first suspicion was that Knight's employees used weak passwords and consequently were easily cracked by hackers who gained unauthorized access to their accounts. However, after carefully investigating the incident, the IRT determined that hackers accessed accounts by capturing the file transfer protocol (FTP) traffic.

  FTP is a network protocol for transferring files between accounts. It uses clear text passwords for authentication.

  Following the impact of this information security incident and with IRT's suggestion, Knight decided to replace the FTP with Secure Shell (SSH) protocol, so anyone capturing the traffic can only see encrypted data.

  Following these changes, Knight conducted a risk assessment to verify that the implementation of controls had minimized the risk of similar incidents. The results of the process were approved by the ISMS project manager who claimed that the level of risk after the implementation of new controls was in accordance with the company's risk acceptance levels.

  Based on this scenario, answer the following question:

  FTP uses clear text passwords for authentication. This is an FTP:

  A. Vulnerability
  B. Risk
  C. Threat
  A. Vulnerability

  ---

  The use of clear text passwords for authentication in FTP is a vulnerability because it is a weakness that can be exploited by threat actors. Clear text passwords can be intercepted easily by network sniffers or through man-in-the-middle attacks, making them a significant security risk1.

  References: = This explanation is consistent with the understanding of vulnerabilities within the field of information security, particularly as it relates to network protocols like FTP and their associated risks

• Question 312:

  You see a blue color sticker on certain physical assets. What does this signify?

  A. The asset is very high critical and its failure affects the entire organization
  B. The asset with blue stickers should be kept air conditioned at all times
  C. The asset is high critical and its failure will affect a group/s/project's work in the organization
  D. The asset is critical and the impact is restricted to an employee only
  C. The asset is high critical and its failure will affect a group/s/project's work in the organization

  ---

  You see a blue color sticker on certain physical assets. This signifies that the asset is high critical and its failure will affect a group/s/project's work in the organization. A blue color sticker is a type of label that indicates the level of criticality of an asset, which is a measure of how important an asset is for the organization's operations and objectives. A high critical asset is an asset that has a significant impact on the organization's activities, and its loss or damage would cause major disruption or loss of service.

  A blue color sticker also implies that the asset requires a high level of protection and security, and should be handled with care.

  References: CQI and IRCA ISO 27001:2022 Lead Auditor Course Handbook, page 36.

  : [ISO/IEC 27001 Brochures | PECB], page 6.

• Question 313:

  Which situation presented below represents a threat?

  A. An employee accesses unauthorized files using their legitimate credentials
  B. An organization fails to implement multi-factor authentication (MFA) for its cloud services
  C. Cyber attackers infiltrated the network by exploiting a zero-day vulnerability in the organization's firewall software
  C. Cyber attackers infiltrated the network by exploiting a zero-day vulnerability in the organization's firewall software

  ---

  C. Correct Answer - This is a Threat. A cyberattack exploiting a zero-day vulnerability is an active security threat , as it causes harm to the organization .

  A. Employee accessing unauthorized files is a vulnerability (insider risk) rather than an external threat .

  B. Lack of MFA is a security weakness (vulnerability), not a threat .

  This aligns with ISO/IEC 27001:2022 Annex A Control A.8.25 (Assessment and Decision on Information Security Events) .

• Question 314:

  Review the following statements and determine which two are false:

  A. Auditors approved for conducting onsite audits do not require additional training for virtual audits, as there are no significant differences in the skillset required
  B. Conducting a technology check in advance of a virtual audit can improve the effectiveness and efficiency of the audit
  C. Due to confidentiality and security concerns, screen sharing during a virtual audit is one method by which the audit team can review the auditee's documentation
  D. During a virtual audit, auditees participating in interviews are strongly recommended to keep their webcam enabled
  E. The number of days assigned to a third-party audit is determined by the auditee's availability
  F. The selection of onsite, virtual or combination audits should take into consideration historical performance and previous audit results
  A. Auditors approved for conducting onsite audits do not require additional training for virtual audits, as there are no significant differences in the skillset required
  E. The number of days assigned to a third-party audit is determined by the auditee's availability

  ---

  Auditors approved for conducting onsite audits do require additional training for virtual audits to ensure they are competent in using the technology and tools required for conducting audits remotely12. The number of days assigned to a third-party audit is not determined by the auditee's availability, but rather by factors such as the size and complexity of the organization, the scope of the audit, and the requirements of the certification body34.

  References: The answers are verified based on the content and objectives of the ISMS ISO/IEC 27001 Lead Auditor course, as well as the guidelines provided in the reference materials and documents related to the course.

• Question 315:

  You are an experienced audit team leader conducting a third-party surveillance audit of an organisation that designs websites for its clients. You are currently reviewing the organisation's Statement of Applicability. Based on the requirements of ISO/IEC 27001, which two of the following observations about the Statement of Applicability are false?

  A. A Statement of Applicability must be produced by organisations seeking ISO/IEC 27001 conformity
  B. Justification is only required for any controls that the organisations choses to exclude
  C. Justification for both the inclusion and exclusion of Annex A controls in the Statement of Applicability is required
  D. The Statement of Applicability is owned and amended by the organisation's top management
  E. Additional controls not included in Appendix A may be added to the Statement of Applicability if the organisation choses to do so
  F. The Statement of Applicability must include Organisational, Physical, People and Technological controls that are necessary
  B. Justification is only required for any controls that the organisations choses to exclude
  D. The Statement of Applicability is owned and amended by the organisation's top management

  ---

• Question 316:

  You are an experienced ISMS auditor conducting a third-party surveillance audit at an organisation which offers ICT reclamation services. ICT equipment which companies no longer require is processed by the organisation. It is either recommissioned and reused or is securely destroyed.

  You notice two servers on a bench in the corner of the room. Both have stickers on them with the server's name, IP address and admin password. You ask the ICT Manager about them, and he tells you they were part of a shipment received yesterday from a regular customer.

  Which one action should you take?

  A. Ask the auditee to remove the labels, then carry on with the audit
  B. Ask the ICT Manager to record an information security incident and initiate the information security incident management process
  C. Note the audit finding and check the process for dealing with incoming shipments relating to customer IT security
  D. Raise a nonconformity against control 5.31 'Legal, staturary, regulatory and contractual requirements'
  E. Raise a nonconformity against control 8.20 'network security' (networks and network devices shall be secured, managed and controlled to protect information in systems and applications)
  F. Record what you have seen in your audit findings, but take no further action
  C. Note the audit finding and check the process for dealing with incoming shipments relating to customer IT security

  ---

• Question 317:

  You are an audit team leader conducting a third-party surveillance audit of a telecom services provider. You have assigned responsibility for auditing the organisation's information security objectives to a junior member of your audit team. Before they begin their assessment, you ask them the following question to check their understanding of the requirements of ISO /IEC 27001:2022. Which four of the following criteria must Information security objectives fulfil?

  A. They must be communicated appropriately
  B. They must be available as documented information
  C. They must always be measured
  D. They must always be monitored
  E. They must be reviewed annually
  F. They must be clear and unambiguous
  G. They must be consistent with the IS Policy
  H. They must be achievable
  A. They must be communicated appropriately
  B. They must be available as documented information
  G. They must be consistent with the IS Policy
  H. They must be achievable

  ---

  According to ISO/IEC 27001:2022, clause 6.2, information security objectives are the specific results that an organisation intends to achieve with its information security management system (ISMS). The standard specifies that information security objectives must fulfil the following criteria:

  They must be communicated appropriately (A): The organisation must ensure that the relevant internal and external parties are informed about the information security objectives and their roles and responsibilities in achieving them. This can help to create awareness, commitment, and accountability for information security. This criterion is related to clause 6.2.2 of ISO/IEC 27001:2022. They must be available as documented information (B): The organisation must maintain and retain documented information on the information security objectives, including their scope, level, indicators, and time frame. This can help to provide evidence, traceability, and consistency for information security. This criterion is related to clause 6.2.1 of ISO/IEC 27001:2022.

  They must be consistent with the IS Policy (G): The organisation must ensure that the information security objectives are aligned with the information security policy, which is the top-level statement of the organisation's intentions and direction for information security. This can help to support the strategic objectives and the context of the organisation. This criterion is related to clause 5.2 of ISO/IEC 27001:2022.

  They must be achievable (H): The organisation must ensure that the information security objectives are realistic and attainable, considering the available resources, capabilities, and constraints. This can help to avoid setting unrealistic or unfeasible expectations and to monitor and measure the progress and performance of information security. This criterion is related to clause 6.2.1 of ISO/IEC 27001:2022.

  References: ISO/IEC 27001:2022, Information technology -- Security techniques -- Information security management systems -- Requirements PECB Candidate Handbook ISO/IEC 27001 Lead Auditor2 ISO 27001:2022 Lead Auditor - PECB3 ISO 27001:2022 certified ISMS lead auditor - Jisc4 ISO/IEC 27001:2022 Lead Auditor Transition Training Course5 ISO 27001 - Information Security Lead Auditor Course - PwC Training Academy6

• Question 318:

  Scenario 5: Data Grid Inc. is a well-known company that delivers security services across the entire information technology infrastructure. It provides cybersecurity software, including endpoint security, firewalls, and antivirus software. For two decades, Data Grid Inc. has helped various companies secure their networks through advanced products and services. Having achieved reputation in the information and network security field, Data Grid Inc. decided to obtain the ISO/IEC 27001 certification to better

  secure its internal and customer assets and gain competitive advantage.

  Data Grid Inc. appointed the audit team, who agreed on the terms of the audit mandate. In addition, Data Grid Inc. defined the audit scope, specified the audit criteria, and proposed to close the audit within five days. The audit team rejected Data Grid Inc.'s proposal to conduct the audit within five days, since the company has a large number of employees and complex processes. Data Grid Inc. insisted that they have planned to complete the audit within five days, so both parties agreed upon conducting the

  audit within the defined duration. The audit team followed a risk-based auditing approach.

  To gain an overview of the main business processes and controls, the audit team accessed process descriptions and organizational charts. They were unable to perform a deeper analysis of the IT risks and controls because their access to the IT infrastructure and applications was restricted. However, the audit team stated that the risk that a significant defect could occur to Data Grid Inc.'s ISMS was low since most of the company's processes were automated. They therefore evaluated that the ISMS, as a

  whole, conforms to the standard requirements by asking the representatives of Data Grid Inc. the following questions:

  How are responsibilities for IT and IT controls defined and assigned?

  How does Data Grid Inc. assess whether the controls have achieved the desired results?

  What controls does Data Grid Inc. have in place to protect the operating environment and data from malicious software?

  Are firewall-related controls implemented?

  Data Grid Inc.'s representatives provided sufficient and appropriate evidence to address all these questions.

  The audit team leader drafted the audit conclusions and reported them to Data Grid Inc.'s top management. Though Data Grid Inc. was recommended for certification by the auditors, misunderstandings were raised between Data Grid Inc. and the certification body in regards to audit objectives. Data Grid Inc. stated that even though the audit objectives included the identification of areas for potential improvement, the audit team did not provide such information.

  Based on this scenario, answer the following question:

  Based on scenario 5, the audit team assessed the ISMS as a whole, rather than assessing the effectiveness and conformity of each process. Is this acceptable?

  A. Yes, due to time constraints for the audit completion, the audit team must obtain absolute assurance by assessing the ISMS as a whole
  B. No, the audit team should obtain assurance that the ISMS conforms to the standard requirements by assessing each process
  C. Yes, if the audit team has obtained a reasonable assurance that helps them evaluate the ISMS conformity
  C. Yes, if the audit team has obtained a reasonable assurance that helps them evaluate the ISMS conformity

  ---

  Yes, assessing the ISMS as a whole can be acceptable if the audit team obtains reasonable assurance that the system conforms to the standard requirements. The approach taken by the audit team must still ensure that all significant aspects of the ISMS are evaluated adequately, and if this is achieved through a holistic assessment, it is considered sufficient.

  References: ISO 19011:2018, Guidelines for auditing management systems

• Question 319:

  Which is the glue that ties the triad together

  A. Process
  B. People
  C. Collaboration
  D. Technology
  D. Technology

  ---

  The triad refers to the three elements of information security: confidentiality, integrity and availability. Technology is the glue that ties the triad together, as it provides the means to implement various controls and measures to protect information from unauthorized access, modification or loss.

  References: ISO /IEC 27001:2022 Lead Auditor Training Course - BSI

• Question 320:

  You are performing an ISO 27001 ISMS surveillance audit at a residential nursing home, ABC Healthcare Services. ABC uses a healthcare mobile app designed and maintained by a supplier, WeCare, to monitor residents' well-being. During the audit, you learn that 90% erf the residents' family members regularly receive medical device advertisements from WeCare, by email and SMS once a week. The service agreement between ABC and WeCare prohibits the supplier from using residents' personal data.

  ABC has received many complaints from residents and their family members.

  The Service Manager says that the complaints were investigated as an information security incident which found that they were justified. Corrective actions have been planned and implemented according to the nonconformity and corrective action management procedure.

  You write a nonconformity "ABC failed to comply with information security control A.5.34 (Privacy and protection of PII) relating to the personal data of residents' and their family members. A supplier, WeCare, used residents' personal information to send advertisements to family members"

  Select three options of the corrections and corrective actions listed that you would expect ABC to make in response to the nonconformity

  A. ABC confirms that information security control A.5.34 is contained in the Statement of Applicability (SoA)
  B. The Service Manager provides evidence of analysis of the cause of nonconformity and how the ABC evaluates the effectiveness of implemented corrective actions
  C. ABC instructs all staff to follow the signed healthcare service agreement with residents' family members
  D. ABC conducts a management review to take the feedback from residents' family members into consideration
  E. ABC needs to collect more evidence on how the organisation defines the management system scope and find out if they covered WeCare the medical device manufacturer
  F. ABC identifies and checks compliance with all applicable legislation and contractual requirements involving third parties
  G. The Service Manager implements the corrective actions and Customer Service Representatives evaluate the effectiveness of implemented corrective actions
  H. ABC needs to collect more evidence on how information security risk assessment relates to the identified nonconformities before concluding actions on the nonconformity
  B. The Service Manager provides evidence of analysis of the cause of nonconformity and how the ABC evaluates the effectiveness of implemented corrective actions
  F. ABC identifies and checks compliance with all applicable legislation and contractual requirements involving third parties
  G. The Service Manager implements the corrective actions and Customer Service Representatives evaluate the effectiveness of implemented corrective actions

  ---

  According to the ISO/IEC 27001:2022 Lead Auditor (Information Security Management Systems) course, the following corrections and corrective actions are expected from ABC in response to the nonconformity:

  B. The Service Manager provides evidence of analysis of the cause of nonconformity and how the ABC evaluates the effectiveness of implemented corrective actions. This is part of the requirement of clause 10.1 of ISO/IEC 27001:2022, which states that the organization shall determine the causes of nonconformities and evaluate the need for action to ensure that they do not recur or occur elsewhere. The organization shall also evaluate the effectiveness of any corrective actions taken.

  F. ABC identifies and checks compliance with all applicable legislation and contractual requirements involving third parties. This is part of the requirement of clause 4.2 of ISO/IEC 27001:2022, which states that the organization shall determine the external and internal issues that are relevant to its purpose and that affect its ability to achieve the intended outcome(s) of its information security management system. This includes the legal and contractual requirements related to the information security aspects of the organization's activities, products and services.

  G. The Service Manager implements the corrective actions and Customer Service Representatives evaluate the effectiveness of implemented corrective actions. This is part of the requirement of clause 10.1 of ISO/IEC 27001:2022, which states that the organization shall implement any action needed and retain documented information as evidence of the results of any action taken. The organization shall also monitor, measure, analyze and evaluate the information security performance and the effectiveness of the information security management system.

  References:

  1: ISO/IEC 27001:2022 Lead Auditor (Information Security Management Systems) course, CQI and IRCA Certified Training, 1

  2: ISO/IEC 27001 Lead Auditor Training Course, PECB, 2