PECB ISO-27001-LI Online Practice Questions and Exam Preparation

PECB ISO-27001-LI Online Questions & Answers

• Question 31:

  The purpose of control 5.9 inventory of Information and other associated assets of ISO/IEC 27001 is to identify organization's information and other associated assets in order to preserve their information security and assign ownership. Which of the following actions docs NOT fulfill this purpose?

  A. Conducting regular reviews of identified information and other associated assets
  B. Establishing rules to control physical and logical access to Information and other associated assets
  C. Assigning the responsibility for appropriately classifying and protecting information and other associated assets to the asset owners
  B. Establishing rules to control physical and logical access to Information and other associated assets

  ---

  Explanation

• Question 32:

  Scenario 10: NetworkFuse develops, manufactures, and sells network hardware. The company has had an operational information security management system (ISMS) based on ISO/IEC 27001 requirements and a quality management system (QMS) based on ISO 9001 for approximately two years. Recently, it has applied for a j^ombined certification audit in order to obtain certification against ISO/IEC 27001 and ISO 9001. After selecting the certification body, NetworkFuse prepared the employees for the audit The company decided to not conduct a self-evaluation before the audit since, according to the top management, it was not necessary. In addition, it ensured the availability of documented information, including internal audit reports and management reviews, technologies in place, and the general operations of the ISMS and the QMS. However, the company requested from the certification body that the documentation could not be carried off-site

  However, the audit was not performed within the scheduled days because NetworkFuse rejected the audit team leader assigned and requested their replacement

  The company asserted that the same audit team leader issued a recommendation for certification to its main competitor, which, for the company's top management, was a potential conflict of interest.

  The request was not accepted by the certification body According to scenario 10, NetworkFuse requested from the certification body to review all the documentation only on-site. Is this acceptable?

  A. Yes, the auditee may request that the review of the documentation takes place on-site
  B. Yes, only if a confidentiality agreement is formerly signed by the audit team
  C. No, the certification body decides whether the documentation review takes place on-site or off-site
  A. Yes, the auditee may request that the review of the documentation takes place on-site

  ---

  Explanation

  According to the ISO/IEC 27001:2022 standard, the certification body is responsible for planning and conducting the audit, including the review of the documented information. The certification body may decide to review the documentation on- site or off-site, depending on the audit objectives, scope, criteria, and risks. The auditee may not impose any restrictions on the access to the documentation, unless there are valid reasons for confidentiality or security. However, such restrictions should be agreed upon before the audit and should not compromise the effectiveness and impartiality of the audit.

• Question 33:

  According to ISO/IEC 27001 controls, why should the use of privileged utility programs be restricted and tightly controlled?

  A. To ensure that utility programs are compatible with existing system software
  B. To prevent misuse of utility programs that could override system and application controls
  C. To enable the correlation and analysis of security-related events
  B. To prevent misuse of utility programs that could override system and application controls

  ---

  Explanation

  ISO/IEC 27002:2022 Clause 8.11 addresses "Use of privileged utility programs":

  "The use of utility programs that might be capable of overriding system and application controls should be restricted and tightly controlled to prevent misuse." Such tools can provide powerful access or modification capabilities, which if

  misused can compromise the integrity and confidentiality of systems.

• Question 34:

  According to ISO/IEC 27000, which of the following best describes the possible scope of a management system?

  A. It should cover the entire organization without exceptions
  B. It can vary to include the entire organization or specific sections, depending on the needs
  C. It is limited to IT infrastructure and cannot include non-technical departments
  B. It can vary to include the entire organization or specific sections, depending on the needs

  ---

  Explanation

• Question 35:

  Scenario 5: Operaze is a small software development company that develops applications for various companies around the world.

  Recently, the company conducted a risk assessment to assess the information security risks that could arise from operating in a digital landscape.

  Using different testing methods, including penetration Resting and code review, the company identified some issues in its ICT systems, including improper user permissions, misconfigured security settings, and insecure network configurations.

  To resolve these issues and enhance information security, Operaze decided to implement an information security management system (ISMS) based on ISO/IEC 27001. Considering that Operaze is a small company, the entire IT team was involved in the ISMS implementation project. Initially, the company analyzed the business requirements and the internal and external environment, identified its key processes and activities, and identified and analyzed the interested parties In addition, the top management of Operaze decided to Include most of the company's departments within the ISMS scope. The defined scope included the organizational and physical boundaries. The IT team drafted an information security policy and communicated it to all relevant interested parties In addition, other specific policies were developed to elaborate on security issues and the roles and responsibilities were assigned to all interested parties.

  Following that, the HR manager claimed that the paperwork created by ISMS does not justify its value and the implementation of the ISMS should be canceled However, the top management determined that this claim was invalid and organized an awareness session to explain the benefits of the ISMS to all interested parties.

  Operaze decided to migrate Its physical servers to their virtual servers on third-party infrastructure. The new cloud computing solution brought additional changes to the company Operaze's top management, on the other hand, aimed to not only implement an effective ISMS but also ensure the smooth running of the ISMS operations.

  In this situation, Operaze's top management concluded that the services of external experts were required to implement their information security strategies. The IT team, on the other hand, decided to initiate a change in the ISMS scope and implemented the required modifications to the processes of the company.

  Based on scenario 5. which committee should Operaze create to ensure the smooth running of the ISMS?

  A. Information security committee
  B. Management committee
  C. Operational committee
  A. Information security committee

  ---

  Explanation

  According to ISO/IEC 27001:2022, clause 5.1, the top management of an organization is responsible for ensuring the leadership and commitment for the ISMS. However, the top management may delegate some of its responsibilities to an information security committee, which is a group of people who oversee the ISMS and provide guidance and support for its implementation and operation. The information security committee may include representatives from different departments, functions, or levels of the organization, as well as external experts or consultants. The information security committee may have various roles and responsibilities, such as: Establishing the information security policy and objectives Approving the risk assessment and risk treatment methodology and criteria Reviewing and approving the risk assessment and risk treatment results and plans Monitoring and evaluating the performance and effectiveness of the ISMS Reviewing and approving the internal and external audit plans and reports Initiating and approving corrective and preventive actions Communicating and promoting the ISMS to all interested parties Ensuring the alignment of the ISMS with the strategic direction and objectives of the organization Ensuring the availability of resources and competencies for the ISMS Ensuring the continual improvement of the ISMS Therefore, in scenario 5, Operaze should create an information security committee to ensure the smooth running of the ISMS, as this committee would provide the necessary leadership, guidance, and support for the ISMS implementation and operation.

• Question 36:

  Scenario 6: GreenWave

  GreenWave, a manufacturer of sustainable and energy efficient home appliances, specializes in solar-powered devices, EV chargers, and smart thermostats. To ensure the protection of customer data and internal operations against digital threats, the company has implemented an ISO/IEC 27001-basedinformation security management system (ISMS). GreenWave is also exploring innovative loT solutions to further improve energy efficiency in buildings

  GreenWave is committed to maintaining a high standard of information security within its operations As part of its continuous improvement approach, the company is in the process of determining the competence levels required to manage its ISMS. GreenWave considered various factors when defining these competence requirements, including technological advancements, regulatory requirements, the company's mission, strategic objectives, available resources, as well as the needs and expecations of its customers

  Furthermore, the company remained committed to complying with ISO/IEC 27001's communication requirements. It established clear guidelines for internal and external communication related to the ISMS, defining what information to share, when to share it. with whom, and through which channels. However, not all communications were formally documented; instead, the company classified and managed communication based on its needs, ensuring that documentation was maintained only to the extent necessary for the ISMS effectiveness .

  GreenWave has been exploring the implementation of Al solutions to help understand customer preferences and provide personalized recommendations for electronic products. The aim was to utilize Al technologies to enhance problem-solving capabilities and provide suggestions to customers. This strategic initiative aligned with GreenWave's commitment to improving the customer experience through data-driven insights.

  Additionally, GreenWave looked for a flexible cloud infrastructure that allows the company to host certain services on internal and secure infrastructure and other services on external and scalable platforms that can be accessed from anywhere. This setup would enable various deployment options and enhance information security, crucial for GreenWave's electronic product development According to GreenWave, implementing additional controls in the ISMS implementation plan has been successfully executed, and the company was ready to transition into operational mode. GreenWave assigned Colin the responsibility of determining the materiality of this change within the company.

  Did GreenWave appropriately determine the competence levels required to support their ISMS?

  A. Yes - because GreenWave considered only the internal factors, which are the most important for its operations
  B. No - because GreenWave did not consider external issues, which are relevant to the ISMS
  C. Yes - because GreenWave considered external issues, internal factors, and needs and expectations of relevant interested parties
  C. Yes - because GreenWave considered external issues, internal factors, and needs and expectations of relevant interested parties

  ---

  Explanation

  ISO/IEC 27001:2022 Clause 7.2 - Competence states:

  "The organization shall determine the necessary competence of persons... consideringinternal and external issues , and the needs and expectations of interested parties relevant to the ISMS." GreenWave followed this clause by factoring in

  both internal and external influences, including regulatory and customer requirements. This comprehensive view ensures that assigned personnel are adequately equipped to manage ISMS functions.

• Question 37:

  Scenario 2: Beauty is a cosmetics company that has recently switched to an e-commerce model, leaving the traditional retail. The top management has decided to build their own custom platform in-house and outsource the payment process to an external provider operating online payments systems that support online money transfers.

  Due to this transformation of the business model, a number of security controls were implemented based on the identified threats and vulnerabilities associated to critical assets. To protect customers' information. Beauty's employees had to sign a confidentiality agreement. In addition, the company reviewed all user access rights so that only authorized personnel can have access to sensitive files and drafted a new segregation of duties chart.

  However, the transition was difficult for the IT team, who had to deal with a security incident not long after transitioning to the e commerce model. After investigating the incident, the team concluded that due to the out-of-date anti-malware software, an attacker gamed access to their files and exposed customers' information, including their names and home addresses.

  The IT team decided to stop using the old anti-malware software and install a new one which would automatically remove malicious code in case of similar incidents. The new software was installed in every workstation within the company. After installing the new software, the team updated it with the latest malware definitions and enabled the automatic update feature to keep it up to date at all times. Additionally, they established an authentication process that requires a user identification and password when accessing sensitive information.

  In addition, Beauty conducted a number of information security awareness sessions for the IT team and other employees that have access to confidential information in order to raise awareness on the importance of system and network security.

  Based on scenario 2, which information security principle is the IT team aiming to ensure by establishing a user authentication process that requires user identification and password when accessing sensitive information?

  A. Integrity
  B. Confidentiality
  C. Availability
  B. Confidentiality

  ---

  Explanation

  Confidentiality is one of the three information security principles, along with integrity and availability, that form the CIA triad. Confidentiality means protecting information from unauthorized access or disclosure, and ensuring that only those who are authorized to view or use it can do so. Confidentiality is essential for preserving the privacy and trust of the information owners, such as customers, employees, or business partners. The IT team of Beauty is aiming to ensure confidentiality by establishing a user authentication process that requires user identification and password when accessing sensitive information. User authentication is a security control that verifies the identity and credentials of the users who attempt to access a system or network, and grants or denies them access based on their authorization level. User authentication helps to prevent unauthorized users, such as hackers, competitors, or malicious insiders, from accessing confidential information that they are not supposed to see or use. User authentication also helps to create an audit trail that records who accessed what information and when, which can be useful for accountability and compliance purposes.

• Question 38:

  Scenario 8: SunDee is an American biopharmaceutical company, headquartered in California, the US. It specializes in developing novel human therapeutics, with a focus on cardiovascular diseases, oncology, bone health, and inflammation. The company has had an information security management system (ISMS) based on SO/IEC 27001 in place for the past two years. However, it has not monitored or measured the performance and effectiveness of its ISMS and conducted management reviews regularly

  Just before the recertification audit, the company decided to conduct an internal audit. It also asked most of their staff to compile the written individual reports of the past two years for their departments. This left the Production Department with less than the optimum workforce, which decreased the company's stock.

  Tessa was SunDee's internal auditor. With multiple reports written by 50 different employees, the internal audit process took much longer than planned, was very inconsistent, and had no qualitative measures whatsoever Tessa concluded that SunDee must evaluate the performance of the ISMS adequately. She defined SunDee's negligence of ISMS performance evaluation as a major nonconformity, so she wrote a nonconformity report including the description of the nonconformity, the audit findings, and recommendations. Additionally, Tessa created a new plan which would enable SunDee to resolve these issues and presented it to the top management

  Based on scenario 8. did the nonconformity report include all the necessary aspects?

  A. Yes, the report included all the necessary aspects
  B. No, the report must also specify the root cause of the nonconformity
  C. No, the report must also specify the audit criteria
  B. No, the report must also specify the root cause of the nonconformity

  ---

  Explanation

  According to ISO/IEC 27001:2022, a nonconformity report is a document that records the details of any deviation from the audit criteria that is identified during an audit2. The audit criteria are the set of policies, procedures, requirements, or specifications that are used as a reference against which audit evidence is compared3. Therefore, a nonconformity report must include the following aspects:

  The description of the nonconformity, which should clearly state what the deviation is, where it occurred, and when it was detected

  The audit findings, which should provide the objective evidence that supports the identification of the nonconformity

  The audit criteria, which should specify the reference document or standard that the nonconformity deviates from

  The recommendations, which should suggest the possible corrective actions or improvements that can be taken to address the nonconformity

  In scenario 8, Tessa's nonconformity report included the description of the nonconformity, the audit findings, and the recommendations, but it did not specify the audit criteria. Therefore, the report did not include all the necessary aspects and was incomplete.

• Question 39:

  Scenario 1: HealthGenic is a pediatric clinic that monitors the health and growth of individuals from infancy to early adulthood using a web-based medical software. The software is also used to schedule appointments, create customized medical reports, store patients' data and medical history, and communicate with all the involved parties, including parents, other physicians, and the medical laboratory staff.

  Last month, HealthGenic experienced a number of service interruptions due to the increased number of users accessing the software Another issue the company faced while using the software was the complicated user interface, which the untrained personnel found challenging to use.

  The top management of HealthGenic immediately informed the company that had developed the software about the issue. The software company fixed the issue; however, in the process of doing so, it modified some files that comprised sensitive information related to HealthGenic's patients. The modifications that were made resulted in incomplete and incorrect medical reports and, more importantly, invaded the patients' privacy.

  Based on the scenario above, answer the following question:

  Which of the following indicates that the confidentiality of information was compromised?

  A. Service interruptions due to the increased number of users
  B. Invasion of patients' privacy
  C. Modification of patients' medical reports
  B. Invasion of patients' privacy

  ---

  Explanation

  Confidentiality of information is the property that information is not made available or disclosed to unauthorized individuals, entities, or processes. In other words, confidentiality ensures that only those who are authorized to access the information can do so. In the scenario, the confidentiality of information was compromised when the software company modified some files that contained sensitive information related to HealthGenic's patients. This modification resulted in the invasion of patients' privacy, which means that their personal and medical information was exposed to unauthorized parties. Therefore, the correct answer is

  B.

• Question 40:

  Scenario 6: Skyver offers worldwide shipping of electronic products, including gaming consoles, flat-screen TVs. computers, and printers. In order to ensure information security, the company has decided to implement an information security management system (ISMS) based on the requirements of ISO/IEC 27001. Colin, the company's best information security expert, decided to hold a training and awareness session for the personnel of the company regarding the information security challenges and other information security-related controls. The session included topics such as Skyver's information security approaches and techniques for mitigating phishing and malware.

  One of the participants in the session is Lisa, who works in the HR Department. Although Colin explains the existing Skyver's information security policies and procedures in an honest and fair manner, she finds some of the issues being discussed too technical and does not fully understand the session.

  Therefore, in a lot of cases, she requests additional help from the trainer and her colleagues Based on the last paragraph of scenario 6, which principles of an effective communication strategy did Colin NOT follow?

  A. Transparency and credibility
  B. Credibility and responsiveness
  C. Appropriateness and clarity
  C. Appropriateness and clarity

  ---

  Explanation

  According to ISO/IEC 27001 : 2022 Lead Implementer, an effective communication strategy should follow some principles, such as transparency, credibility, appropriateness, clarity, responsiveness, and consistency. These principles help to ensure that the communication is relevant, accurate, understandable, timely, and coherent. Based on the last paragraph of scenario 6, it seems that Colin did not follow the principles of appropriateness and clarity. Appropriateness means that the communication should be tailored to the needs, expectations, and level of understanding of the audience. Clarity means that the communication should be simple, concise, and precise, avoiding ambiguity and jargon. However, Colin explained the information security issues in a too technical manner, which made Lisa confused and unable to comprehend the session. Therefore, Colin should have adapted his communication style and content to suit the HR personnel, who may not have the same technical background as him.