PECB ISO-IEC-27001-LEAD-AUDITOR Online Practice Questions and Exam Preparation

PECB ISO-IEC-27001-LEAD-AUDITOR Online Questions & Answers

• Question 221:

  Scenario 6: Sinvestment is an insurance company that offers home, commercial, and life insurance. The company was founded in North Carolina, but have recently expanded in other locations, including Europe and Africa.

  Sinvestment is committed to complying with laws and regulations applicable to their industry and preventing any information security incident. They have implemented an ISMS based on ISO/IEC 27001 and have applied for ISO/IEC 27001 certification.

  Two auditors were assigned by the certification body to conduct the audit. After signing a confidentiality agreement with Sinvestment. they started the audit activities. First, they reviewed the documentation required by the standard, including the declaration of the ISMS scope, information security policies, and internal audits reports. The review process was not easy because, although Sinvestment stated that they had a documentation procedure in place, not all documents had the same format.

  Then, the audit team conducted several interviews with Sinvestment's top management to understand their role in the ISMS implementation. All activities of the stage 1 audit were performed remotely, except the review of documented information, which took place on-site, as requested by Sinvestment.

  During this stage, the auditors found out that there was no documentation related to information security training and awareness program. When asked, Sinvestment's representatives stated that the company has provided information security training sessions to all employees. Stage 1 audit gave the audit team a general understanding of Sinvestment's operations and ISMS.

  The stage 2 audit was conducted three weeks after stage 1 audit. The audit team observed that the marketing department (which was not included in the audit scope) had no procedures in place to control employees' access rights. Since controlling employees' access rights is one of the ISO/IEC 27001 requirements and was included in the information security policy of the company, the issue was included in the audit report. In addition, during stage 2 audit, the audit team observed that Sinvestment did not record logs of user activities. The procedures of the company stated that "Logs recording user activities should be retained and regularly reviewed," yet the company did not present any evidence of the implementation of such procedure.

  During all audit activities, the auditors used observation, interviews, documented information review, analysis, and technical verification to collect information and evidence. All the audit findings during stages 1 and 2 were analyzed and the audit team decided to issue a positive recommendation for certification.

  According to scenario 6, the marketing department employees were not following the access control policy.

  Which option is correct in this case?

  A. The marketing department is not included in the audit scope, so the issue should only be communicated to Sinvestment's representatives
  B. The employees' access right control is included in Sinvestment's information security policy, so the issue must be communicated to Sinvestment's representatives and included in the audit report
  C. Sinvestment is not controlling the employees' access rights, which represents a potential information security risk and should be reported as a major nonconformity
  B. The employees' access right control is included in Sinvestment's information security policy, so the issue must be communicated to Sinvestment's representatives and included in the audit report

  ---

  Explanation/Reference:

  Even though the marketing department was not included in the audit scope, the issue of employees' access rights control must be communicated to Sinvestment's representatives and included in the audit report because it is part of Sinvestment's information security policy. It reflects on the overall adherence to the ISMS requirements.

  References: ISO/IEC 27001:2013, Clause 9.2 (Internal audit)

• Question 222:

  You are conducting an ISMS audit in the despatch department of an international logistics organisation that provides shipping services to large organisations including local hospitals and government offices. Parcels typically contain pharmaceutical products, biological samples, and documents such as passports and driving licences. You note that the company records show a very large number of returned items with causes including misaddressed labels and, in 15% of cases, two or more labels for different addresses for the one package. You are interviewing the Shipping Manager (SM).

  You: Are items checked before being dispatched?

  SM: Any obviously damaged items are removed by the duty staff before being dispatched, but the small profit margin makes it uneconomic to implement a formal checking process.

  You: What action is taken when items are returned?

  SM: Most of these contracts are relatively low value, therefore it has been decided that it is easier and more convenient to simply reprint the label and re-send individual parcels than it is to implement an investigation.

  You raise a nonconformity against ISO 27001:2022 based on the lack of control of the labelling process. At the closing meeting, the Shipping Manager issues an apology to you that his comments may have been misunderstood.

  He says that he did not realise that there is a background IT process that automatically checks that the right label goes onto the right parcel otherwise the parcel is ejected at labelling. He asks that you withdraw your nonconformity.

  Select three options of the correct responses that you as the audit team leader would make to the request of the Shipping Manager.

  A. Advise the Shipping Manager that his request will be included in the audit report
  B. Advise management that the new information provided will be discussed when the auditors have more time
  C. Inform the Shipping Manager that the nonconformity is minor and should be quickly corrected
  D. Ask the audit team members to state what they think should happen
  E. Inform him of your understanding and withdraw the nonconformity
  F. Thank the Shipping Manager for his honesty but advise that withdrawing the nonconformity is not the right way to proceed
  G. Advise the Shipping Manager that the nonconformity must stand since the evidence obtained for it was dear
  H. Indicate that the nonconformity is evidence of a deeper system failure that needs to be rectified
  A. Advise the Shipping Manager that his request will be included in the audit report
  B. Advise management that the new information provided will be discussed when the auditors have more time
  F. Thank the Shipping Manager for his honesty but advise that withdrawing the nonconformity is not the right way to proceed

  ---

  Explanation/Reference:

  A. Advise the Shipping Manager that his request will be included in the audit report. This is true because the audit report should document all the relevant information and evidence related to the audit, including any requests or objections raised by the auditee. The audit report should also provide the rationale for the audit conclusions and recommendations.

  B. Advise management that the new information provided will be discussed when the auditors have more time. This is true because the auditors should not make hasty decisions based on incomplete or unverified information. The auditors should review and evaluate the new information in a systematic and objective manner, and determine whether it affects the audit findings, nonconformities, or conclusions F. Thank the Shipping Manager for his honesty but advise that withdrawing the nonconformity is not the right way to proceed. This is true because the auditors should acknowledge and appreciate the cooperation and transparency of the auditee, but also maintain their professional integrity and independence. The auditors should not withdraw a nonconformity unless they are satisfied that it was raised in error or that it has been effectively corrected and verified.

  References : ISO 19011:2022 Guidelines for auditing management systems ISO/IEC 17021-1:2022 Conformity assessment -- Requirements for bodies providing audit and certification of management systems -- Part 1: Requirements

• Question 223:

  You are performing an ISMS audit at a residential nursing home called ABC that provides healthcare services.

  The next step in your audit plan is to verify the information security of ABC's healthcare mobile app development, support, and lifecycle process. During the audit, you learned the organisation outsourced the mobile app development to a

  professional software development organisation with CMMI Level 5, ITSM (ISO/IEC 20000-1), BCMS (ISO 22301) and ISMS (ISO/IEC 27001) certified.

  The IT Manager presents the software security management procedure and summarises the process as follows:

  The mobile app development shall adopt "security-by-design" and "security-by-default" principles, as a minimum. The following security functions for personal data protection shall be available:

  Access control.

  Personal data encryption, i.e., Advanced Encryption Standard (AES) algorithm, key lengths: 256 bits; and Personal data pseudonymization.

  Vulnerability checked and no security backdoor

  You sample the latest Mobile App Test report - Reference ID: 0098, details as follows:

  

  You would like to investigate other areas further to collect more audit evidence. Select three options that will not be in your audit trail.

  A. Collect more evidence on how much residents' family members pay to install ABC's healthcare mobile app. (Relevant to clause 4.2)
  B. Collect more evidence by downloading and testing the mobile app on your phone. (Relevant to control 8.1)
  C. Collect more evidence to determine the number of users of ABC's healthcare mobile app. (relevant to clause 4.2)
  D. Collect more evidence on how the organisation performs testing of personal data handling. (Relevant to control A.5.34)
  E. Collect more evidence on the organisation's business continuity policy. (Relevant to control A.5.30)
  F. Collect more evidence on how the organisation manages information security in the selection of an external service provider. (Relevant to control A.5.19)
  G. Collect more evidence on how the developer trains its product support personnel. (Relevant to clause 7.2)
  H. Collect more evidence to verify the developer's CMMI Level 5, ITSM (ISO/IEC 20000-1), BCMS (ISO 22301) and ISMS (ISO/IEC 27001) certification. (Relevant to control A.5.21)
  A. Collect more evidence on how much residents' family members pay to install ABC's healthcare mobile app. (Relevant to clause 4.2)
  C. Collect more evidence to determine the number of users of ABC's healthcare mobile app. (relevant to clause 4.2)
  H. Collect more evidence to verify the developer's CMMI Level 5, ITSM (ISO/IEC 20000-1), BCMS (ISO 22301) and ISMS (ISO/IEC 27001) certification. (Relevant to control A.5.21)

  ---

  Explanation/Reference:

  The three options that will not be in your audit trail are A, C, and H. These options are either not relevant to the information security of ABC's healthcare mobile app development, support, and lifecycle process, or not within the scope of your audit. The amount of money that residents' family members pay to install the app (A) and the number of users of the app ?are not related to the information security aspects or objectives of the ISMS1. The verification of the developer's certifications (H) is not your responsibility as an ISMS auditor, as you should rely on the competence and impartiality of the certification bodies that issued them2. The other options are relevant and within the scope of your audit, as they relate to the security functions, testing, policies, and procedures of the mobile app development, support, and lifecycle process.

  References:

  1: ISO /IEC 27001:2022, Information technology -- Security techniques -- Information security management systems -- Requirements, Clause 4.2

  2: ISO/IEC 27006:2022, Information technology -- Security techniques -- Requirements for bodies providing audit and certification of information security management systems, Clause 4.1

  3: PECB Certified ISO/IEC 27001 Lead Auditor Exam Preparation Guide, Domain 5:Conducting an ISO/IEC 27001 audit

• Question 224:

  Which two of the following phrases would apply to "plan" in relation to the Plan-Do-Check-Act cycle for a business process?

  A. Retaining documentation
  B. Retaining documentation
  C. Organising changes
  D. Setting objectives
  E. Training staff
  F. Providing ICT assets
  A. Retaining documentation
  C. Organising changes
  D. Setting objectives
  E. Training staff

  ---

  may include setting SMART goals, identifying resources, defining roles and responsibilities, conducting risk assessments, and developing plans for training, communication, and monitoring.

  References:

  ISO/IEC 27001:2022 Lead Auditor (Information Security Management Systems) objectives and content from Quality.org and PECB

  ISO 19011:2018 Guidelines for auditing management systems [Section 5.3.1]

• Question 225:

  Scenario 1: Fintive is a distinguished security provider for online payments and protection solutions. Founded in 1999 by Thomas Fin in San Jose, California, Fintive offers services to companies that operate online and want to improve their information security, prevent fraud, and protect user information such as PII. Fintive centers its decision-making and operating process based on previous cases. They gather customer data, classify them depending on the case, and analyze them. The company needed a large number of employees to be able to conduct such complex analyses. After some years, however, the technology that assists in conducting such analyses advanced as well. Now, Fintive is planning on using a modern tool, a chatbot, to achieve pattern analyses toward preventing fraud in real-time. This tool would also be used to assist in improving customer service.

  This initial idea was communicated to the software development team, who supported it and were assigned to work on this project. They began integrating the chatbot on their existing system. In addition, the team set an objective regarding the chatbot which was to answer 85% of all chat queries.

  After the successful integration of the chatbot, the company immediately released it to their customers for use.

  The chatbot, however, appeared to have some issues.

  Due to insufficient testing and lack of samples provided to the chatbot during the training phase, in which it was supposed "to learn" the queries pattern, the chatbot failed to address user queries and provide the right answers. Furthermore, the chatbot sent random files to users when it received invalid inputs such as odd patterns of dots and special characters. Therefore, the chatbot was unable to properly answer customer queries and the traditional customer support was overwhelmed with chat queries and thus was unable to help customers with their requests.

  Consequently, Fintive established a software development policy. This policy specified that whether the software is developed in-house or outsourced, it will undergo a black box testing prior to its implementation on operational systems.

  Based on this scenario, answer the following question:

  The chatbot was supposed "to learn" the queries pattern to address user queries and provide the right answers.

  What type of technology enables this?

  A. Artificial intelligence
  B. Cloud computing
  C. Machine learning
  C. Machine learning

  ---

  Explanation/Reference:

  Machine learning is a subset of artificial intelligence that involves the use of algorithms and statistical models to enable systems to improve their performance on a specific task over time with experience or data, without being explicitly programmed. In the context of the scenario, machine learning would be the technology that allows the chatbot to learn from patterns in queries to provide the right answers.

• Question 226:

  DRAG DROP

  Auditors need to communicate effectively with auditees. Therefore, their personal behaviour is a key characteristic needed to ensure a successful audit. Below there are the characteristics and a brief related description. Match the characteristics to the descriptions.

  Select and Place:

  

  

  ---

  Explanation/Reference:

  Tenacious: Persistent and focused on objectives Ethical: Fair, truthful, sincere, honest, discreet Diplomatic: Tactful in dealing with individuals Observant: Actively observing surroundings/activities Perceptive: Aware of and able to understand situations Open to improvement: Willing to learn from situations

• Question 227:

  You are an ISMS audit team leader tasked with conducting a follow-up audit at a client's data centre. Following two days on-site you conclude that of the original 12 minor and 1 major nonconformities that prompted the follow-up audit, only 1 minor nonconformity still remains outstanding.

  Select four options for the actions you could take.

  A. Book another follow-up audit on-site to review the one outstanding minor nonconformity once it has been cleared
  B. Recommend that the outstanding minor nonconformity is dealt with at the next surveillance audit
  C. Advise the auditee that you will arrange an online audit to deal with the outstanding nonconformity
  D. Note the progress made but hold the audit open until all corrective action has been cleared
  E. Agree with the auditee/audit client how the remaining nonconformity will be cleared, by when, and how its clearance will be verified
  F. Advise the individual managing the audit programme of any decision taken regarding the outstanding nonconformity
  G. Recommend suspension of the organisation's certification as they have failed to implement the agreed corrections and corrective actions within the agreed timescale
  H. Close the follow-up audit as the organisation has demonstrated it is committed to clearing the nonconformities raised
  B. Recommend that the outstanding minor nonconformity is dealt with at the next surveillance audit
  E. Agree with the auditee/audit client how the remaining nonconformity will be cleared, by when, and how its clearance will be verified
  F. Advise the individual managing the audit programme of any decision taken regarding the outstanding nonconformity
  H. Close the follow-up audit as the organisation has demonstrated it is committed to clearing the nonconformities raised

  ---

  Explanation/Reference:

  According to ISO 19011:2018, which provides guidelines for auditing management systems, clause 6.7 requires the audit team leader to conduct a follow-up audit to verify the implementation and effectiveness of the corrective actions taken by the auditee in response to the nonconformities identified during a previous audit1. The follow-up audit should be conducted in accordance with the same principles and processes as the initial audit, and should result in a conclusion on the status of the nonconformities and any remaining issues1. Therefore, when conducting a follow-up audit, an ISMS auditor should consider the following actions:

  Recommend that the outstanding minor nonconformity is dealt with at the next surveillance audit: This action is appropriate because it reflects the fact that the auditee has cleared most of the nonconformities, including the major one, and only one minor nonconformity remains outstanding. A minor nonconformity is defined as a failure to achieve one or more requirements of ISO/IEC 27001:2022 or a situation which raises significant doubt about the ability of an ISMS process to achieve its intended output, but does not affect its overall effectiveness or conformity2. Therefore, this finding does not prevent or preclude the continuation of certification, as long as it is addressed by appropriate corrective actions within a reasonable time frame. The auditor should recommend that the outstanding minor nonconformity is dealt with at the next surveillance audit, which is a regular audit conducted by the certification body to confirm the ongoing conformity and effectiveness of an ISMS.

  Agree with the auditee/audit client how the remaining nonconformity will be cleared, by when, and how its clearance will be verified: This action is appropriate because it reflects the fact that the auditee has demonstrated commitment and capability to implement corrective actions for the nonconformities identified during the previous audit. The auditor should agree with the auditee/audit client on a realistic, achievable, and effective corrective action plan for the remaining nonconformity, including a clear deadline and verification method. The auditor should also document this agreement in the follow-up audit report.

  Advise the individual managing the audit programme of any decision taken regarding the outstanding nonconformity: This action is appropriate because it reflects the fact that the auditor has followed a systematic and consistent approach to conducting and reporting the follow-up audit. The auditor should advise the individual managing the audit programme of any decision taken regarding the outstanding nonconformity, such as recommending its closure at the next surveillance audit or agreeing on a corrective action plan with the auditee/audit client. The auditor should also provide sufficient information and evidence to support their decision.

  Close the follow-up audit as the organisation has demonstrated it is committed to clearing the nonconformities raised: This action is appropriate because it reflects the fact that the organisation has achieved satisfactory results in the follow-up audit. The auditor should close the follow-up audit as the organisation has demonstrated it is committed to clearing the nonconformities raised by implementing effective corrective actions for most of them and agreeing on a plan for the remaining one. The auditor should also communicate the follow-up audit conclusion to the auditee/audit client and other relevant parties.

• Question 228:

  Which is not a requirement of HR prior to hiring?

  A. Undergo background verification
  B. Applicant must complete pre-employment documentation requirements
  C. Must undergo Awareness training on information security.
  D. Must successfully pass Background Investigation
  C. Must undergo Awareness training on information security.

  ---

  Explanation/Reference:

  According to ISO/IEC 27001:2022, clause 7.2.2, the organization shall ensure that all persons who have access to information are aware of the information security policy and their contribution to the effectiveness of the ISMS, including the benefits of improved information security performance. Therefore, awareness training on information security is a requirement for all persons, not just new hires. References: ISO/IEC 27001:2022 Lead Auditor (Information Security Management Systems) | CQI | IRCA

• Question 229:

  You are performing an ISMS audit at a residential nursing home (ABC) that provides healthcare services. The next step in your audit plan is to verify the information security of ABC's healthcare mobile app development, support, and lifecycle process. During the audit, you learned the organization outsourced the mobile app development to a professional software development company with CMMI Level 5, ITSM (ISO/IEC 20000-1), BCMS (ISO 22301) and ISMS (ISO/IEC 27001) certified.

  The IT Manager presented the software security management procedure and summarised the process as following:

  The mobile app development shall adopt "security-by-design" and "security-by-default" principles, as a minimum.

  The following security functions for personal data protection shall be available:

  Access control.

  Personal data encryption, i.e., Advanced Encryption Standard (AES) algorithm, key lengths: 256 bits; and Personal data pseudonymization.

  Vulnerability checked and no security backdoor

  You sample the latest Mobile App Test report, details as follows:

  

  The IT Manager explains the test results should be approved by him according to the software security management procedure. The reason why the encryption and pseudonymisation functions failed is that these functions heavily slowed down the system and service performance. An extra 150% of resources are needed to cover this. The Service Manager agreed that access control is good enough and acceptable. That's why the Service Manager signed the approval.

  You are preparing the audit findings. Select the correct option.

  A. There is a nonconformity (NC). The organisation and developer do not perform acceptance tests. (Relevant to clause 8.1, control A.8.29)
  B. There is a nonconformity (NC). The organisation and developer perform security tests that fail. (Relevant to clause 8.1, control A.8.29)
  C. There is a nonconformity (NC). The Service Manager does not comply with the software security management procedure. (Relevant to clause 8.1, control A.8.30)
  D. There is NO nonconformity (NC). The Service Manager makes a good decision to continue the service. (Relevant to clause 8.1, control A.8.30)
  C. There is a nonconformity (NC). The Service Manager does not comply with the software security management procedure. (Relevant to clause 8.1, control A.8.30)

• Question 230:

  You are performing an ISMS initial certification audit at a residential nursing home that provides healthcare services. The next step in your audit plan is to conduct the closing meeting. During the final audit team meeting, as an audit team leader, you agree to report 2 minor nonconformities and 1 opportunity for improvement as below:

  

  During the closing meeting, the Management System Representative (MSR) updates you with the information that ABC is going to merge with WeCare medical devices manufacture within the next 3 months. ABC will be the organisation's name after the merger. He asks if it is possible to include WeCare medical devices manufacture location in the follow-up audit so that the certification will include it. He says that WeCare is certified to ISO/IEC 27001:2022.

  Select one option for the correct response to the request of the MSR.

  A. Advise that an initial audit would need to be carried out on WeCare but this could be combined with a follow-up audit of ABC
  B. Advise that any changes will impact the certified scope of the initial audit. The organisation has the responsibility to update the certification body within an agreed timeframe so that a decision can be taken about incorporating WeCare.
  C. Advise that there are no issues. The new business can be included within the certified scope immediately if WeCare can obtain the agreement of their certification body
  D. Suggest it would be better to postpone the certification process and wait until the business acquisitior is completed
  B. Advise that any changes will impact the certified scope of the initial audit. The organisation has the responsibility to update the certification body within an agreed timeframe so that a decision can be taken about incorporating WeCare.

  ---

  Explanation/Reference:

  According to ISO/IEC 27001 guidelines, any significant changes to the scope of the ISMS, such as a merger, must be communicated to the certification body. This ensures that the certification remains valid and that all locations and processes are included in the scope. The certification body will then decide the appropriate actions to incorporate the new entity into the existing certification.

  References: ISO/IEC 27001 Lead Auditor Reference Materials PECB Candidate Handbook for ISO 27001 Lead Auditor