PECB ISO-27001-LI Online Practice Questions and Exam Preparation

PECB ISO-27001-LI Online Questions & Answers

• Question 241:

  Is NyvMarketing required to follow the guidelines of ISO/IEC 27002 to attain ISO/IEC 27001 certification?

  A. No, adherence to ISO/IEC 27002 guidelines is not mandatory for ISO/IEC 27001 certification
  B. Yes, since it is a requirement according to ISO/IEC 27001
  C. Yes, since the controls provided in Annex A of ISO/IEC 27001 are aligned with ISO/IEC 27002 controls
  D. Yes, since ISO/IEC 27002 is an auditable standard
  A. No, adherence to ISO/IEC 27002 guidelines is not mandatory for ISO/IEC 27001 certification

  ---

  Explanation

• Question 242:

  What should an organization demonstrate through documentation?

  A. That the complexity of processes and their interactions is documented
  B. That the distribution of paper copies is regularly complete
  C. That Its security controls are implemented based on risk scenarios
  C. That Its security controls are implemented based on risk scenarios

  ---

  Explanation

• Question 243:

  Scenario 10: NetworkFuse develops, manufactures, and sells network hardware. The company has had an operational information security management system (ISMS) based on ISO/IEC 27001 requirements and a quality management system (QMS) based on ISO 9001 for approximately two years. Recently, it has applied for a j^ombined certification audit in order to obtain certification against ISO/IEC 27001 and ISO 9001. After selecting the certification body, NetworkFuse prepared the employees for the audit The company decided to not conduct a self-evaluation before the audit since, according to the top management, it was not necessary. In addition, it ensured the availability of documented information, including internal audit reports and management reviews, technologies in place, and the general operations of the ISMS and the QMS. However, the company requested from the certification body that the documentation could not be carried off-site

  However, the audit was not performed within the scheduled days because NetworkFuse rejected the audit team leader assigned and requested their replacement The company asserted that the same audit team leader issued a recommendation for certification to its main competitor, which, for the company's top management, was a potential conflict of interest. The request was not accepted by the certification body

  The certification body rejected NetworkFuse's request to change the audit team leader. Is this acceptable? Refer to scenario 10.

  A. No, because an auditee cannot request the rejection of an audit team member
  B. Yes, because NetworkFuse did not give a valid reason to support their claims
  C. No, auditee's requests for the replacement of auditors must be accepted
  B. Yes, because NetworkFuse did not give a valid reason to support their claims

  ---

  Explanation

  According to the ISO/IEC 27001 : 2022 Lead Implementer course, the certification body is responsible for selecting and appointing the audit team members, taking into account the competence, impartiality, and objectivity of the auditors1. The auditee can request the replacement of an audit team member only if there is a valid reason to doubt their competence or impartiality, such as a personal or professional conflict of interest, a lack of relevant experience or qualifications, or a previous involvement in the auditee's activities2. However, NetworkFuse did not give a valid reason to support their claims, as the fact that the audit team leader issued a recommendation for certification to their main competitor does not imply a conflict of interest or a bias. Therefore, the certification body rejected NetworkFuse's request to change the audit team leader, which is acceptable.

• Question 244:

  Which feedback relates specifically to information security performance during management review?

  A. Opportunities for continual improvement
  B. Risk assessment results
  C. Nonconformities and corrective actions
  B. Risk assessment results

  ---

  Explanation

• Question 245:

  Which statement is an example of risk retention?

  A. An organization has decided to release the software even though some minor bugs have not been fixed yet
  B. An organization has implemented a data loss protection software
  C. An organization terminates work in the construction site during a severe storm
  A. An organization has decided to release the software even though some minor bugs have not been fixed yet

  ---

  Explanation

  According to ISO/IEC 27001 : 2022 Lead Implementer, risk retention is one of the four risk treatment options that an organization can choose to deal with unacceptable risks. Risk retention means that the organization accepts the risk without taking any action to reduce its likelihood or impact. It applies to risks that are either too costly or impractical to address, or that have a low probability or impact. Therefore, an example of risk retention is when an organization decides to release the software even though some minor bugs have not been fixed yet. This implies that the organization has assessed the risk of releasing the software with bugs and has determined that it is acceptable, eitherbecause the bugs are not critical or because the cost of fixing them would outweigh the benefits.

• Question 246:

  Org Y. a well-known bank, uses an online banking platform that enables clients to easily and securely access their bank accounts. To log in. clients are required to enter the one-time authorization code sent to their smartphone. What can be concluded from this scenario?

  A. Org Y has implemented an integrity control that avoids the involuntary corruption of data
  B. Org Y has incorrectly implemented a security control that could become a vulnerability
  C. Org Y has implemented a security control that ensures the confidentiality of information
  C. Org Y has implemented a security control that ensures the confidentiality of information

  ---

  Explanation

• Question 247:

  HealthGenic is a pediatric clinic that monitors the health and growth of individuals from infancy to early adulthood using a web-based medical software. The software is also used to schedule appointments, create customized medical reports, store patients' data and medical history, and communicate with all the [^involved parties, including parents, other physicians, and the medical laboratory staff.

  Last month, HealthGenic experienced a number of service interruptions due to the increased number of users accessing the software Another issue the company faced while using the software was the complicated user interface, which the untrained personnel found challenging to use.

  The top management of HealthGenic immediately informed the company that had developed the software about the issue. The software company fixed the issue; however, in the process of doing so, it modified some files that comprised sensitive information related to HealthGenic's patients. The modifications that were made resulted in incomplete and incorrect medical reports and, more importantly, invaded the patients' privacy.

  Based on scenario 8. how does the HealthGenic's negligence affect the ISMS certificate?

  A. HealthGenic will be able to renew the ISMS certificate, as they did not detect any information security incident in the past two years
  B. HealthGenic might not be able to renew the ISMS certificate, as it has not conducted management reviews at planned intervals
  C. HealthGenic might not be able to renew the ISMS certificate, as the internal audit lasted longer than planned
  B. HealthGenic might not be able to renew the ISMS certificate, as it has not conducted management reviews at planned intervals

  ---

  Explanation

• Question 248:

  Scenario 5: Operaze is a small software development company that develops applications for various companies around the world. Recently, the company conducted a risk assessment to assess the information security risks that could arise from operating in a digital landscape. Using different testing methods, including penetration Resting and code review, the company identified some issues in its ICT systems, including improper user permissions, misconfigured security settings, and insecure network configurations. To resolve these issues and enhance information security, Operaze decided to implement an information security management system (ISMS) based on ISO/IEC 27001. Considering that Operaze is a small company, the entire IT team was involved in the ISMS implementation project. Initially, the company analyzed the business requirements and the internal and external environment, identified its key processes and activities, and identified and analyzed the interested parties In addition, the top management of Operaze decided to Include most of the company's departments within the ISMS scope. The defined scope included the organizational and physical boundaries. The IT team drafted an information security policy and communicated it to all relevant interested parties In addition, other specific policies were developed to elaborate on security issues and the roles and responsibilities were assigned to all interested parties. Following that, the HR manager claimed that the paperwork created by ISMS does not justify its value and the implementation of the ISMS should be canceled However, the top management determined that this claim was invalid and organized an awareness session to explain the benefits of the ISMS to all interested parties.

  Operaze decided to migrate Its physical servers to their virtual servers on third-party infrastructure. The new cloud computing solution brought additional changes to the company Operaze's top management, on the other hand, aimed to not only implement an effective ISMS but also ensure the smooth running of the ISMS operations. In this situation, Operaze's top management concluded that the services of external experts were required to implement their information security strategies. The IT team, on the other hand, decided to initiate a change in the ISMS scope and implemented the required modifications to the processes of the company. Based on scenario 5. in which category of the interested parties does the MR manager of Operaze belong?

  A. Positively influenced interested parties, because the ISMS will increase the effectiveness and efficiency of the HR Department
  B. Negatively influenced interested parties, because the HR Department will deal with more documentation
  C. Both A and B
  B. Negatively influenced interested parties, because the HR Department will deal with more documentation

  ---

  Explanation

  According to ISO/IEC 27001, interested parties are those who can affect, be affected by, or perceive themselves to be affected by the organization's information security activities, products, or services. Interested parties can be classified into four categories based on their influence and interest in the ISMS:

  Positively influenced interested parties: those who benefit from the ISMS and support its implementation and operation

  Negatively influenced interested parties: those who are adversely affected by the ISMS and oppose its implementation and operation

  High-interest interested parties: those who have a strong interest in the ISMS and its outcomes, regardless of their influence

  Low-interest interested parties: those who have a weak interest in the ISMS and its outcomes, regardless of their influence In scenario 5, the HR manager of Operaze belongs to the category of negatively influenced interested parties, because he/she perceives that the ISMS will create more paperwork and documentation for the HR Department, and therefore opposes its implementation and operation. The HR manager does not benefit from the ISMS and does not support its objectives and requirements.

• Question 249:

  Scenario 1: HealthGenic is a pediatric clinic that monitors the health and growth of individuals from infancy to early adulthood using a web-based medical software. The software is also used to schedule appointments, create customized medical reports, store patients' data and medical history, and communicate with all the [^involved parties, including parents, other physicians, and the medical laboratory staff.

  Last month, HealthGenic experienced a number of service interruptions due to the increased number of users accessing the software Another issue the company faced while using the software was the complicated user interface, which the untrained personnel found challenging to use.

  The top management of HealthGenic immediately informed the company that had developed the software about the issue. The software company fixed the issue; however, in the process of doing so, it modified some files that comprised sensitive information related to HealthGenic's patients. The modifications that were made resulted in incomplete and incorrect medical reports and, more importantly, invaded the patients' privacy.

  Based on the scenario above, answer the following question:

  According to scenario 1. to detect (1)____________________________, Antiques should have implemented (2)______________________________.

  A. (1) Patches. (2) an access control software
  B. (1) Intrusions on networks. (2) an intrusion detection system
  C. (1) Technical vulnerabilities. (2) network intrusions
  B. (1) Intrusions on networks. (2) an intrusion detection system

  ---

  Explanation

• Question 250:

  Which of the situations below can negatively affect the internal audit process?

  A. Restricting the internal auditor's access to offices and documentation
  B. Conducting internal audit interviews with all employees of the organization
  C. Reporting the internal audit results to the top management
  A. Restricting the internal auditor's access to offices and documentation

  ---

  Explanation

  According to the ISO/IEC 27001 : 2022 Lead Implementer course, one of the factors that can negatively affect the internal audit process is the lack of cooperation from the auditees, which can manifest as restricting the internal auditor's access to offices and documentation1. This can hinder the auditor's ability to collect sufficient and appropriate audit evidence, verify the conformity of the information security management system (ISMS) with the audit criteria, and identify any nonconformities or opportunities for improvement2. Therefore, the auditees should be informed of the audit objectives,scope, criteria, and schedule in advance, and should provide the auditor with all the necessary information and resources to conduct the audit effectively3.