PECB PECB Certifications ISO-IEC-27001-LEAD-AUDITOR Questions & Answers

• Question 1:

  You are the lead auditor of the courier company SpeeDelivery. You have carried out a risk analysis and now want to determine your risk strategy. You decide to take measures for the large risks but not for the small risks.

  What is this risk strategy called?

  A. Risk bearing

  B. Risk avoidance

  C. Risk neutral

  D. Risk skipping

  Correct Answer: A

• Question 2:

  In acceptable use of Information Assets, which is the best practice?

  A. Access to information and communication systems are provided for business purpose only

  B. Interfering with or denying service to any user other than the employee's host

  C. Playing any computer games during office hours

  D. Accessing phone or network transmissions, including wireless or wifi transmissions

  Correct Answer: A

• Question 3:

  In what part of the process to grant access to a system does the user present a token?

  A. Authorisation

  B. Verification

  C. Authentication

  D. Identification

  Correct Answer: D

• Question 4:

  Which of the following is a possible event that can have a disruptive effect on the reliability of information?

  A. Threat

  B. Risk

  C. Vulnerability

  D. Dependency

  Correct Answer: A

• Question 5:

  What type of system ensures a coherent Information Security organisation?

  A. Federal Information Security Management Act (FISMA)

  B. Information Technology Service Management System (ITSM)

  C. Information Security Management System (ISMS)

  D. Information Exchange Data System (IEDS)

  Correct Answer: C

• Question 6:

  Which of the following does an Asset Register contain? (Choose two)

  A. Asset Type

  B. Asset Owner

  C. Asset Modifier

  D. Process ID

  Correct Answer: AB

• Question 7:

  A fire breaks out in a branch office of a health insurance company. The personnel are transferred to neighboring branches to continue their work.

  Where in the incident cycle is moving to a stand-by arrangements found?

  A. between threat and incident

  B. between recovery and threat

  C. between damage and recovery

  D. between incident and damage

  Correct Answer: D

• Question 8:

  What is the difference between a restricted and confidential document?

  A. Restricted - to be shared among an authorized group Confidential - to be shared among named individuals

  B. Restricted - to be shared among named individuals Confidential - to be shared among an authorized group

  C. Restricted - to be shared among named individuals Confidential - to be shared across the organization only

  D. Restricted - to be shared among named individuals Confidential - to be shared with friends and family

  Correct Answer: B

• Question 9:

  Access Control System, CCTV and security guards are form of:

  A. Environment Security

  B. Access Control

  C. Physical Security

  D. Compliance

  Correct Answer: C

• Question 10:

  In the event of an Information security incident, system users' roles and responsibilities are to be observed, except:

  A. Report suspected or known incidents upon discovery through the Servicedesk

  B. Preserve evidence if necessary

  C. Cooperate with investigative personnel during investigation if needed

  D. Make the information security incident details known to all employees

  Correct Answer: D