PECB ISO-27001-LI Online Practice Questions and Exam Preparation

PECB ISO-27001-LI Online Questions & Answers

• Question 41:

  Scenario 7: InfoSec is a multinational corporation headquartered in Boston, MA, which provides professional electronics, gaming, and entertainment services. After facing numerous information security incidents, InfoSec has decided to establish teams and implement measures to prevent potential incidents in the future

  Emma, Bob. and Anna were hired as the new members of InfoSec's information security team, which consists of a security architecture team, an incident response team (IRT) and a forensics team Emma's job is to create information security plans, policies, protocols, and training to prepare InfoSec to respond to incidents effectively Emma and Bob would be full-time employees of InfoSec, whereas Anna was contracted as an external consultant.

  Bob, a network expert, will deploy a screened subnet network architecture This architecture will isolate the demilitarized zone (OMZ) to which hosted public services are attached and InfoSec's publicly accessible resources from their private network Thus, InfoSec will be able to block potential attackers from causing unwanted events inside the company's network. Bob is also responsible for ensuring that a thorough evaluation of the nature of an unexpected event is conducted, including the details on how the event happened and what or whom it might affect.

  Anna will create records of the data, reviews, analysis, and reports in order to keep evidence for the purpose of disciplinary and legal action, and use them to prevent future incidents. To do the work accordingly, she should be aware of the company's information security incident management policy beforehand

  Among others, this policy specifies the type of records to be created, the place where they should be kept, and the format and content that specific record types should have.

  According to scenario 7, a demilitarized zone (DMZ) is deployed within InfoSec's network. What type of control has InfoSec implemented in this case?

  A. Detective
  B. Preventive
  C. Corrective
  B. Preventive

  ---

  Explanation

  A demilitarized zone (DMZ) is a network segment that separates the internal network from the external network, such as the Internet. It is used to host public services that need to be accessible from outside the organization, such as web servers, email servers, or DNS servers. A DMZ provides a layer of protection for the internal network by limiting the exposure of the public services and preventing unauthorized access from the external network. A DMZ is an example of a preventive control, which is a type of control that aims to prevent or deter the occurrence of an information security incident. Preventive controls reduce the likelihood of a threat exploiting a vulnerability and causing harm to the organization's information assets. Other examples of preventive controls are encryption, authentication, firewalls, antivirus software, and security awareness training.

• Question 42:

  The Incident Response Team (IRT) has been notified of a potential compromise in the organization's network. Which type of services would be most appropriate for the IRT to provide in this situation?

  A. Proactive services
  B. Reactive services
  C. Security quality management services
  B. Reactive services

  ---

  Explanation

• Question 43:

  SkyFleet did not submit action plans within the specified deadline and was not recommended for certification. Is this acceptable?

  A. No, SkyFleet should receive an extension
  B. No, SkyFleet should be recommended for certification
  C. Yes, SkyFleet should not be recommended for certification
  C. Yes, SkyFleet should not be recommended for certification

  ---

  Explanation

• Question 44:

  Which of the following is NOT part of the steps required by ISO/IEC 27001 that an organization must take when a nonconformity is detected?

  A. React to the nonconformity, take action to control and correct it. and deal with its consequences
  B. Evaluate the need for action to eliminate the causes of the nonconformity so that it does not recur or occur elsewhere
  C. Communicate the details of the nonconformity to every employee of the organization and suspend the employee that caused the nonconformity
  C. Communicate the details of the nonconformity to every employee of the organization and suspend the employee that caused the nonconformity

  ---

  Explanation

  According to the ISO/IEC 27001 : 2022 Lead Implementer course, the steps required by ISO/IEC 27001 that an organization must take when a nonconformity is detected are as follows: React to the nonconformity, take action to control and correct it, and deal with its consequences Evaluate the need for action to eliminate the causes of the nonconformity so that it does not recur or occur elsewhere Implement any action needed Review the effectiveness of the corrective action Make changes to the information security management system (ISMS) if necessary Therefore, communicating the details of the nonconformity to every employee of the organization and suspending the employee that caused the nonconformity is not part of the steps required by ISO/IEC 27001. This option is not only unnecessary, but also potentially harmful, as it could violate the principles of confidentiality, integrity, and availability of information, as well as the human rights and dignity of the employee involved2. Instead, the organization should follow the established procedures for reporting, recording, and analyzing nonconformities, and ensure that the corrective actions are appropriate, proportional, and fair.

• Question 45:

  Scenario 8: SunDee is an American biopharmaceutical company, headquartered in California, the US. It specializes in developing novel human therapeutics, with a focus on cardiovascular diseases, oncology, bone health, and inflammation. The company has had an information security management system (ISMS) based on SO/IEC 27001 in place for the past two years. However, it has not monitored or measured the performance and effectiveness of its ISMS and conducted management reviews regularly

  Just before the recertification audit, the company decided to conduct an internal audit. It also asked most of their staff to compile the written individual reports of the past two years for their departments. This left the Production Department with less than the optimum workforce, which decreased the company's stock.

  Tessa was SunDee's internal auditor. With multiple reports written by 50 different employees, the internal audit process took much longer than planned, was very inconsistent, and had no qualitative measures whatsoever Tessa concluded that SunDee must evaluate the performance of the ISMS adequately. She defined SunDee's negligence of ISMS performance evaluation as a major nonconformity, so she wrote a nonconformity report including the description of the nonconformity, the audit findings, and recommendations. Additionally, Tessa created a new plan which would enable SunDee to resolve these issues and presented it to the top management

  Based on the scenario above, answer the following question:

  What caused SunDee's workforce disruption?

  A. The negligence of performance evaluation and monitoring and measurement procedures
  B. The inconsistency of reports written by different employees
  C. The voluminous written reports
  A. The negligence of performance evaluation and monitoring and measurement procedures

  ---

  Explanation

  According to ISO/IEC 27001:2013, clause 9.1, an organization must monitor, measure, analyze and evaluate its information security performance and effectiveness. This includes determining what needs to be monitored and measured, the methods for doing so, when and by whom the monitoring and measurement shall be performed, when the results shall be analyzed and evaluated, and who shall be responsible for ensuring that the actions arising from the analysis and evaluation are taken 1. SunDee failed to comply with this requirement and did not monitor or measure the performance and effectiveness of its ISMS for the past two years. As a result, the company did not have any objective evidence or indicators to demonstrate the achievement of its information security objectives, the effectiveness of its controls, the satisfaction of its interested parties, or the identification and treatment of its risks. Thisalso meant that the company did not conduct regular management reviews of its ISMS, as required by clause 9.3, which would provide an opportunity for the top management to ensure the continuing suitability, adequacy and effectiveness of the ISMS, and to decide on any changes or improvements needed 1. Just before the recertification audit, the company decided to conduct an internal audit, as required by clause 9.2, which is a systematic, independent and documented processfor obtaining audit evidence and evaluating it objectively to determine the extent to which the audit criteria are fulfilled 1. However, the company did not have a well-defined audit program, scope, criteria, or methodology, and relied on the written reports of its staff for the past two years. This caused a disruption in the workforce, as most of the staff had to compile their reports for their departments, leaving the Production Department with less than the optimum workforce, which decreased the company's stock. Moreover, the internal audit process was very inconsistent, as the reports were written by different employees with different styles, formats, and levels of detail. The internal audit process also lacked any qualitative measures, such as performance indicators, metrics, or benchmarks, to evaluate the performance and effectiveness of the ISMS. Therefore, the cause of SunDee's workforce disruption was the negligence of performance evaluation and monitoring and measurement procedures, which led to a lack of objective evidence, a poorly planned and executed internal audit, and a decrease in the company's productivity and stock value.

• Question 46:

  Scenario 3: Auto Tsaab, a Swedish Car manufacturer founded in and headquartered in Sweden, iS well- known for its innovation in the automotive industry, Despite this Strong reputation, the company has faced considerable challenges managing its documented information.

  Although manual methods of handling this information may have been sufficient in the past, they now pose substantial challenges. particularly in efficiency, accuracy, and scalability.

  Moreover, entrusting the responsibility Of managing documented information to a single individual creates a critical vulnerability, introducing a potential single point Of failure within the organization's information management system,

  To address these challenges and reinforce its commitment to protecting information assets, Auto Tsaab implemented an information security management system ISMS aligned with ISO/IEC 27001. This move was critical 10 ensuring the security, confidentiality, and integrity of the companys information, particularly as it transitioned from manual to automated information management methods.

  initially, Auto Tsaab established automated checking Systems that detect and Correct corruption. By implementing these automated checks, Auto Tsaab not only improved its ability to maintain data accuracy and consistency but also significantly reduced the risk of undetected errors.

  Central to Auto ISMS ate documented processes. By documenting essential aspects and processes Such as the ISMS scope, information security policy, operational planning and control, information security risk assessment, internal audit. and management review. Auto Tsaab ensured that these documents were readily available and adequately protected. Moreover. Auto Tsaab utilizes a comprehensive framework incorporating 36 distinct categories spanning products, services. hardware, and software. This framework. organized in a two-dimensional matrix with six rows and six columns, facilitates the specification of technical details for components and assemblies in its small automobiles. underscoring the company's commitment to innovation and quality,

  TO maintain the industry standards. Auto Tsaab follows rigorous protocols in personnel selection. guaranteeing that every team member is not only eligible but also well-suited for their respective roles within the organization. Additionally, the company established formal procedures for handling policy violations and appointed an internal consultant to continuously enhance its documentation and security practices.

  After committing to ISO/IEC 27001 adherence, was the documented information in Auto Tsaab's information security management system managed in compliance with the standard?

  A. Yes, the company relied only on manual methods for managing documented information
  B. Yes, the company ensured that documented information was available and protected as needed
  C. Yes, the company delegated the responsibility of managing documented information to a single individual
  B. Yes, the company ensured that documented information was available and protected as needed

  ---

  Explanation

• Question 47:

  How should the level of detail in risk identification evolve over time?

  A. It should be refined gradually through iterative assessments, increasing the level of detail over time
  B. It should be performed in full detail only when significant changes occur in the organization
  C. It should focus on highly detailed assessments conducted on an ad-hoc basis rather than broad risk assessments
  A. It should be refined gradually through iterative assessments, increasing the level of detail over time

  ---

  Explanation

  ISO/IEC 27005:2022 (Clause 8.2.1 ?Risk Identification Process) and the ISMS Implementation Toolkit emphasize that risk identification is a cyclical and iterative process:

  "Risk identification should evolve with organizational maturity and environmental change, becoming more detailed and effective through each cycle." This aligns with Clause 10.1 of ISO/IEC 27001:2022, which requires continual improvement:

  "The organization shall continually improve the suitability, adequacy and effectiveness of the information security management system." Refining detail over time allows organizations to adjust to new threats and better understand their

  environment, promoting resilience and continual improvement .

• Question 48:

  Scenario 9: CoreBit Systems

  CoreBit Systems, with its headquarters m San Francisco, specializes in information and communication technology (ICT) solutions, its clientele primarily includes data communication enterprises and network operators. The company's core

  objective is to enable its clients a smooth transition into multi-service providers, aligning their operations with the complex demands of the digital landscape.

  Recently. John, the internal auditor of CoreBit Systems, conducted an internal audit which uncovered nonconformities related to their monitoring procedures and system vulnerabilities, in response to the identified nonconformities. CoreBit

  Systems decided to employ a comprehensive problem-solving approach to solve these issues systematically. The method encompasses a team-oriented approach, aiming to identify, correct, and eliminate the root causes of issues. This

  approach involves several steps. First, establish a group of experts with deep knowledge of processes and controls. Next, break down the nonconformity into measurable components and implement interim containment measures. Then,

  identify potential root causes and select and verify permanent corrective actions. Finally, put those actions into practice, validate them, take steps to prevent recurrence, and recognize and acknowledge the team's efforts.

  Following the analysis of the root cause of the nonconformities, CoreBit Systems's ISMS project manager. Julia, developed a list of potential actions to address the identified nonconformities. Julia carefully evaluated the list to ensure that

  each action would effectively eliminate the root cause of the respective nonconformity. While assessing potential corrective action for addressing a nonconformity, Julia identified the issue as significant and assessed a high likelihood of its

  reoccurrence Consequently, she chose to implement temporary corrective actions. Afterward. Julia combined all the nonconformities Into a single action plan and sought approval from the top management.

  The submitted action plan was written as follows:

  A new version of the access control policy will be established and new restrictions will be created to ensure that network access is effectively managed and monitored by the Information and Communication Technology (ICT) Department.

  However. Julia's submitted action plan was not approved by top management The reason cited was that a general action plan meant to address all nonconformities was deemed unacceptable. Consequently, Julia revised the action plan and

  submitted separate ones for approval Unfortunately, Julia did not adhere to the organization's specified deadline for submission, resulting in a delay in the corrective action process, and notably, the revised action plans lacked a defined

  schedule for execution.

  Which method did CoreBit Systems use to address and prevent reoccurring problems after identifying the nonconformities?

  A. The Eight Disciplines Problem Solving (8Ds) method
  B. DMAIC (Define, Measure, Analyze, Improve, Control) method
  C. Lean Six Sigma method
  A. The Eight Disciplines Problem Solving (8Ds) method

  ---

  Explanation

  The described process matches the 8D (Eight Disciplines) method , commonly used for quality and compliance management. The method includes: Forming a team Describing the problem Implementing containment Identifying root causes Choosing corrective actions

  Implementing actions Preventing recurrence Recognizing contributions

  This aligns exactly with CoreBit's approach.

• Question 49:

  Which option below should be addressed in an information security policy?

  A. Actions to be performed after an information security incident
  B. Legal and regulatory obligations imposed upon the organization
  C. The complexity of information security processes and their interactions
  B. Legal and regulatory obligations imposed upon the organization

  ---

  Explanation

  According to the ISO/IEC 27001:2022 standard, an information security policy is a high-level document that defines the management approach and objectives for information security within the organization. It should include, among other things, the legal and regulatory obligations imposed upon the organization, such as compliance with laws, contracts, agreements, and standards that are relevant to information security. The information security policy should also provide the basis for establishing, implementing, maintaining, and continually improving the information security management system (ISMS).

• Question 50:

  Scenario 4: UX Software, a company specializing in L.JXfUl design. QA and software testing. and mobile application development. recognized the need to improve its information security measures, As such. the company implemented an ISMS based on ISO/IEC 27001- This strategic move aimed to enhance the confidentiality. availability, and integrity Of information shared internally and externally, aligning with industry standards and best practices.

  The integration of ISMS into UX Software's existing processes and ensuring that these processes are adjusted in accordance with the framework of ISMS signified an important milestone. underscoring the organization'S commitment to information security. UX Software meticulously tailored these procedures to align with the ISMS framework, ensuring they ate contextually and culturally appropriate while avoiding mismatches. This proactive stance reassured their employees and instilled confidence in their clients, ensuring the protection of sensitive data throughout their operations.

  UX Software'S top management took action to define the Scope Of their ISMS to adhere to ISOflEC 27003 to drive this initiative forward. Sven, a key member Of the top management team at UX Software. assumed the role of project sponsor. a critical position responsible for ensuring the execution of ISMS implementation with adequate resources. Sven's leadership was pivotal in steering the project towards compliance with 27001, thus elevating the organization's information security posture to the highest level- In parallel with their dedication to information security. UX Software incorporated the technical specifications Of security controls within the justification section Of their Statement Of Applicability This approach demonstrated their Commitment to meeting ISO/IEC 27001 requirements and ensured thorough documentation and justification Of Security controls, thereby Strengthening the overall Security framework Of the organization. Additionally. UX Software established a committee responsible for ensuring the effectiveness of correctrve actions, managing the ISMS documented information, and continually improving the ISMS while addressing nonconformities.

  By implementing an ISMS based on ISO/IEC 27001, UX Software improved its information security and reinforced its position as a reliable partner. This dedication to information security serves as a testament to UX Software's commitment to delivering high-quality software solutions while safeguarding the interests of its internal stakeholders and valued clients.

  Based on scenario 4, the developers of UX Software incorporated the technical specifications of security controls within the justification section of their Statement of Applicability. Is this recommended?

  A. Yes, the technical specifications of security controls must be included within the justification section
  B. No, the justification section should encompass the rationale for the inclusion and exclusion of each security control
  C. No, the justification section should concisely overview previous software projects
  B. No, the justification section should encompass the rationale for the inclusion and exclusion of each security control

  ---

  Explanation