Free ISO-27001-LI Exam Dumps PDF Preview

Question 1

Single choice

In the SABSA framework, which layer is concerned with viewing the services at a high level?

A
Physical security architecture
B
Logical security architecture
C
Component security architecture

Reveal answer details Close answer details

Correct answerB

Question 2

Single choice

Scenario 3: Socket Inc. is a dynamic telecommunications company specializing in wireless products and services, committed to delivering high-quality and secure communication solutions. Socket Inc. leverages innovative technology, including the MongoDB database, renowned for its high availability, scalability, and flexibility, to provide reliable, accessible, efficient, and well-organized services to its customers. Recently, the company faced a security breach where external hackers exploited the default settings of its MongoDB database due to an oversight in the configuration settings, which had not been properly addressed.
Fortunately, diligent data backups and centralized logging through a server ensured no loss of information.
In response to this incident, Socket Inc. undertook a thorough evaluation of its security measures. The company recognized the urgent need to improve its information security and decided to implement an information security management system (ISMS) based on ISO/IEC 27001.

To improve its data security and protect its resources, Socket Inc. implemented entry controls and secure access points. These measures were designed to prevent unauthorized access to critical areas housing sensitive data and essential assets. In compliance with relevant laws, regulations, and ethical standards, Socket Inc. implemented pre-employment background checks tailored to business needs, information

classification, and associated risks. A formalized disciplinary procedure was also established to address policy violations. Additionally, security measures were implemented for personnel working remotely to safeguard information accessed, processed, or stored outside the organization's premises.

Socket Inc. safeguarded its information processing facilities against power failures and other disruptions.
Unauthorized access to critical records from external sources led to the implementation of data flow control services to prevent unauthorized access between departments and external networks. In addition, Socket
Inc. used data masking based on the organization's topic-level general policy on access control and other related topic-level general policies and business requirements, considering applicable legislation. It also updated and documented all operating procedures for information processing facilities and ensured that they were accessible to top management exclusively.

The company also implemented a control to define and implement rules for the effective use of cryptography, including cryptographic key management, to protect the database from unauthorized access. The implementation was based on all relevant agreements, legislation, regulations, and the information classification scheme. Network segregation using VPNs was proposed to improve security and reduce administrative efforts.

Regarding the design and description of its security controls, Socket Inc. has categorized them into groups, consolidating all controls within a single document. Lastly, Socket Inc. implemented a new system to maintain, collect, and analyze information about information security threats and integrate information security into project management.

Based on the scenario above, answer the following question:

Based on scenario 3, did Socket Inc.
adhere to the requirements of ISO/IEC 27001 regarding ISMS documented information?

A
No, Socket Inc. consolidated all controls of a group into a single document while the standard requires the controls to be documented in four groups
B
Yes, the standard requires that all security controls be included in a single document
C
Yes, there is no mandatory requirement on how to document processes or security controls in the standard

Reveal answer details Close answer details

Correct answerC

Question 3

Single choice

Scenario 7: InfoSec is a multinational corporation headquartered in Boston, MA, which provides professional electronics, gaming, and entertainment services.

After facing numerous information security incidents, InfoSec has decided to establish teams and implement measures to prevent potential incidents in the future Emma, Bob. and Anna were hired as the new members of InfoSec's information security team, which consists of a security architecture team, an incident response team (IRT) and a forensics team Emma's job is to create information security plans, policies, protocols, and training to prepare InfoSec to respond to incidents effectively Emma and Bob would be full-time employees of InfoSec, whereas Anna was contracted as an external consultant.

Bob, a network expert, will deploy a screened subnet network architecture.
This architecture will isolate the demilitarized zone (OMZ) to which hosted public services are attached and InfoSec's publicly accessible resources from their private network Thus, InfoSec will be able to block potential attackers from causing unwanted events inside the company's network. Bob is also responsible for ensuring that a thorough evaluation of the nature of an unexpected event is conducted, including the details on how the event happened and what or whom it might affect.

Anna will create records of the data, reviews, analysis, and reports in order to keep evidence for the purpose of disciplinary and legal action, and use them to prevent future incidents. To do the work accordingly, she should be aware of the company's information security incident management policy beforehand

Among others, this policy specifies the type of records to be created, the place where they should be kept, and the format and content that specific record types should have.

Based on this scenario, answer the following question:

Based on his tasks, which team is Bob part of?

A
Security architecture team
B
Forensics team
C
Incident response team

Reveal answer details Close answer details

Correct answerC

Explanation

Based on his tasks, Bob is part of the incident response team (IRT) of InfoSec. According to ISO/IEC 270352:2023, the IRT is a team of appropriately skilled and trusted members of an organization that responds to and resolves incidents in a coordinated way 1. One of the tasks of the IRT is to conduct an evaluation of the nature of an unexpected event, including the details on how the event happened and what or whom it might affect 1. This is consistent with Bob's responsibility of ensuring that a thorough evaluation of the nature of an unexpected event is conducted. Therefore, Bob belongs to the incident response team.

Question 4

Single choice

Scenario 9: SkyFleet specializes in air freight services, providing fast and reliable transportation solutions

for businesses that need quick delivery of goods across long distances. Given the confidential nature of the information it handles, SkyFleet is committed to maintaining the highest information security standards.
To achieve this, the company has had an information security management system (ISMS) based on ISO/ IEC 27001 in operation for a year. To enhance its reputation, SkyFleet is pursuing certification against ISO/
IEC 27001.

SkyFleet strongly emphasizes the ongoing maintenance of information security. In pursuit of this goal, it has established a rigorous review process, conducting in-depth assessments of the ISMS strategy every two years to ensure security measures remain robust and up to date. In addition, the company takes a balanced approach to nonconformities. For example, when employees fail to follow proper data encryption protocols for internal communications, SkyFleet assesses the nature and scale of this nonconformity. If this deviation is deemed minor and limited in scope, the company does not prioritize immediate resolution.
However, a significant action plan was developed to address a major nonconformity involving the revamp of the company's entire data management system to ensure the protection of client data. SkyFleet entrusted the approval of this action plan to the employees directly responsible for implementing the changes. This streamlined approach ensures that those closest to the issues actively engage in the resolution process. SkyFleet's blend of innovation, dedication to information security, and adaptability has built its reputation as a key player in the IT and communications services sector.

Despite initially not being recommended for certification due to missed deadlines for submitting required action plans, SkyFleet undertook corrective measures to address these deficiencies in preparation for the next certification process. These measures involved analyzing the root causes of the delay, developing a corrective action plan, reassessing ISMS implementation to ensure compliance with ISO/IEC 27001 requirements, intensifying internal audit activities, and engaging with a certification body for a follow-up audit.

According to scenario 9, has SkyFleet accurately outlined the responsible party for approving its action plan for the revamp of the company's entire data management system?

A
Yes, the employees directly involved in implementing the actions should approve the action plans
B
No, the responsibility for approving action plans lies on top management
C
No, an independent third party should be responsible for approving action plans
D
Yes, any employee can approve as long as they are part of the team

Reveal answer details Close answer details

Correct answerB

Question 5

Single choice

The Incident Response Team (IRT) has been notified of a potential compromise in the organization's network.

Which type of services would be most appropriate for the IRT to provide in this situation?

A
Proactive services
B
Reactive services
C
Security quality management services

Reveal answer details Close answer details

Correct answerB

Question 6

Single choice

Who is responsible for ensuring that the information security management system (ISMS) achieves its intended outcome(s)?

A
The organization's IT department
B
The top management of the organization
C
The ISMS project manager

Reveal answer details Close answer details

Correct answerB

Question 7

Single choice

Diana works as a customer service representative for a large e-commerce company. One day, she accidently modified the order details of a customer without their permission Due to this error, the customer received an incorrect product.

Which information security principle was breached in this case?

A
Availability
B
Confidentiality
C
Integrity

Reveal answer details Close answer details

Correct answerC

Explanation

According to ISO/IEC 27001:2022, information security controls are measures that are implemented to protect the confidentiality, integrity, and availability of information assets 1. Controls can be preventive, detective, or corrective, depending on their purpose and nature 2. Preventive controls aim to prevent or deter the occurrence of a security incident or reduce its likelihood. Detective controls aim to detect or discover the occurrence of a security incident or its symptoms. Corrective controls aim to correct or restore the normal state of an asset or a process after a security incident or mitigate its impact 2. In this scenario, Socket Inc. implemented several security controls to prevent information security incidents from recurring, such as:

Segregation of networks: This is a preventive and technical control that involves separating different parts of a network into smaller segments, using devices such as routers, firewalls, or VPNs, to limit the access and communication between them 3. This can enhance the security and performance of the network, as well as reduce the administrative efforts and costs 3.

Privileged access rights: This is a preventive and administrative control that involves granting access to information assets or systems only to authorized personnel who have a legitimate need to access them, based on their roles and responsibilities 4. This can reduce the risk of unauthorized access, misuse, or modification of information assets or systems 4.

Cryptographic controls: This is a preventive and technical control that involves the use of cryptography, which is the science of protecting information by transforming it into an unreadable format, to protect the confidentiality, integrity, and authenticity of information assets or systems. This can prevent unauthorized access, modification, or disclosure of information assets or systems.

Information security threat management: This is a preventive and administrative control that involves the identification, analysis, and response to information security threats, which are any incidents that could negatively affect the confidentiality, integrity, or availability of information assets or systems. This can help the organization to anticipate, prevent, or mitigate the impact of information security threats.

Information security integration into project management: This is a preventive and administrative control that involves the incorporation of information security requirements and controls into the planning, execution, and closure of projects, which are temporary endeavors undertaken to create a unique product, service, or result. This can ensure that information security risks and opportunities are identified and addressed throughout the project life cycle. However, information backup is not a preventive control, but a corrective control. Information backup is a corrective and technical control that involves the creation and maintenance of copies of information assets or systems, using dedicated software and utilities, to ensure that they can be recovered in case of data loss, corruption, accidental deletion, or cyber incidents. This can help the organization to restore the normal state of information assets or systems after a security incident or mitigate its impact. Therefore,information backup does not prevent information security incidents from recurring, but rather helps the organization to recover from them.

Question 8

Single choice

Scenario 8: SunDee is a biopharmaceutical firm headquartered in California, US. Renowned for its pioneering work in the field of human therapeutics, SunDee places a strong emphasis on addressing critical healthcare concerns, particularly in the domains of cardiovascular diseases, oncology, bone health, and inflammation. SunDee has demonstrated its commitment to data security and integrity by maintaining an effective information security management system (ISMS) based on ISO/IEC 27001 for the past two years.

In preparation for the recertification audit, SunDee conducted an internal audit. The company's top management appointed Alex, who has actively managed the Compliance Department's day-to-day operations for the last six months, as the internal auditor. With this dual role assignment, Alex is tasked with conducting an audit that ensures compliance and provides valuable recommendations to improve

operational efficiency.

During the internal audit, a few nonconformities were identified. To address them comprehensively, the company created action plans for each nonconformity, working closely with the audit team leader.

SunDee's senior management conducted a comprehensive review of the ISMS to evaluate its appropriateness, sufficiency, and efficiency. This was integrated into their regular management meetings.
Essential documents, including audit reports, action plans, and review outcomes, were distributed to all members before the meeting. The agenda covered the status of previous review actions, changes affecting the ISMS, feedback, stakeholder inputs, and opportunities for improvement. Decisions and actions targeting ISMS improvements were made, with a significant role played by the ISMS coordinator and the internal audit team in preparing follow-up action plans, which were then approved by top management.

In response to the review outcomes, SunDee promptly implemented corrective actions, strengthening its information security measures. Additionally, dashboard tools were introduced to provide a high-level overview of key performance indicators essential for monitoring the organization's information security management. These indicators included metrics on security incidents, their costs, system vulnerability tests, nonconformity detection, and resolution times, facilitating effective recording, reporting, and tracking of monitoring activities. Furthermore, SunDee embarked on a comprehensive measurement process to assess the progress and outcomes of ongoing projects, implementing extensive measures across all processes. The top management determined that the individual responsible for the information, aside from owning the data that contributes to the measures, would also be designated accountable for executing these measurement activities. Based on the scenario above, answer the following question:

Based on scenario 8, which of the following dashboards did SunDee utilize?

A
Operational dashboards
B
Tactical dashboards
C
Strategic dashboards

Reveal answer details Close answer details

Correct answerC

Question 9

Single choice

Refer to Scenario 4 (FinSecure)

Finsecure is a financial institution based in Finland, providing services to a diverse clientele, encompassing retail banking, corporate banking, wealth management, and digital banking, all tailored to meet the evolving financial needs of individuals and businesses in the region. Recognizing the critical importance of information security in the modern banking landscape, FinSecure has initiated the implementation of an information security management system (ISMS) based on ISO/IEC 27001. To ensure the successful implementation of the ISMS, the top management decided to contract two experts to lead and oversee the ISMS implementation project. As a primary strategy for implementing the ISMS, the experts chose an approach that emphasizes a swift implementation of the ISMS by initially meeting the minimum requirements of ISO/IEC 27001, followed by continual improvement over time. Additionally, under the guidance of experts, FinSecure opted for a methodological framework, which serves as a structured framework that outlines the high-level stages of the ISMS implementation, the associated activities, and the deliverables without incorporating any specific tools.

The experts conducted a risk assessment, identifying all the supporting assets, which were the most tangible ones. They assessed the potential consequences and likelihood of various risks, determining the level of risks using a methodical approach that involved defining and characterizing the terms and criteria used in the assessment process. These risks were categorized into nonnumerical levels (e g., very low, low. moderate, high, very high). Explanatory notes were thoughtfully crafted to justify assessed values, with the primary goal of enhancing repeatability and reproducibility.

After completing the risk assessment, the experts reviewed a selected number of the security controls from Annex A of ISO/IEC 27001 to determine which ones were applicable to the company's specific context.
The decision to implement security controls was justified by the risk assessment results. Based on this review, they drafted the Statement of Applicability (SoA). They focused on treating only the high-risk category particularly addressing unauthorized use of administrator rights and system interruptions due to several hardware failures. To address these issues, they established a new version of the access control policy, implemented controls to manage and control user access, and introduced a control for ICT readiness to ensure business continuity.

Their risk assessment report indicated that if the implemented security controls reduce the risk levels to an acceptable threshold, those risks will be accepted Did the experts draft the Statement of Applicability (SoA) in accordance with ISO/IEC 27001?

A
Yes - because they reviewed a selected number of the controls from Annex A of ISO/IEC 27001
B
No - because they did not review all of the controls from Annex A of ISO/IEC 27001
C
No - because the SoA should have been drafted just before the risk assessment was finalized

Reveal answer details Close answer details

Correct answerA

Explanation

ISO/IEC 27001:2022 Clause 6.1.3 (c) states:
"Compare the controls determined in 6.1.3 b) with those in Annex A and verify thatno necessary controls have been omitted ."
Clause 6.1.3 (d) continues:
"Produce a Statement of Applicability that contains the necessary controls, justification for inclusion, whether implemented, and justification for exclusion." The SoA does not require selection of all controls , but rather only those that are applicable based on the context, risk assessment, and needs of the organization. FinSecure's experts complied byselecting relevant controls and documenting justifications-thus aligning with the standard.

Question 10

Single choice

Scenario 6: Skyver offers worldwide shipping of electronic products, including gaming consoles, flat-screen TVs. computers, and printers. In order to ensure information security, the company has decided to implement an information security management system (ISMS) based on the requirements of ISO/IEC
27001.

Colin, the company's best information security expert, decided to hold a training and awareness session for the personnel of the company regarding the information security challenges and other informationsecurity-related controls. The session included topics such as Skyver's information security approaches and techniques for mitigating phishing and malware.

One of the participants in the session is Lisa, who works in the HR Department. Although Colin explains the existing Skyver's information security policies and procedures in an honest and fair manner, she finds some of the issues being discussed too technical and does not fully understand the session. Therefore, in a lot of cases, she requests additional help from the trainer and her colleagues.

What is the difference between training and awareness? Refer to scenario 6.

A
Training helps acquire certain skills, whereas awareness develops certain habits and behaviors.
B
Training helps acquire a skill, whereas awareness helps apply it in practice
C
Training helps transfer a message with the intent of informing, whereas awareness helps change the behavior toward the message

Reveal answer details Close answer details

Correct answerA

Explanation

According to ISO/IEC 27001, training and awareness are two different but complementary activities that aim to enhance the information security competence and performance of the organization's personnel.
Training is the process of providing instruction and guidance to help individuals acquire certain skills, knowledge, or abilities related to information security. Awareness is the process of raising the level of consciousness and understanding of the importance and benefits of information security, and developing certain habits and behaviors that support the information security objectives and requirements. In scenario 6, Colin is holding a training and awareness session for the personnel of Skyver, which means he is combining both activities to achieve a more effective and comprehensive information security education.
The training part of the session covers topics such as Skyver's information security policies and procedures, and techniques for mitigating phishing and malware. The awareness part of the session covers topics such as Skyver's information security approaches and challenges, and the benefits of information security for the organization and its customers. The purpose of the session is to help the personnel acquire the necessary skills to perform their information security roles and responsibilities, and to develop the appropriate habits and behaviors to protect the information assets of the organization.

Question 11

Single choice

What is the primary requirement for the documented information of an ISMS?

A
It must exist solely in a digital format to ensure modern compatibility
B
It must be sufficiently flexible to adapt to any identified change triggers
C
It must be accessible to the public at all times to maintain transparency

Reveal answer details Close answer details

Correct answerB

Question 12

Single choice

Scenario 2: Beauty is a cosmetics company that has recently switched to an e-commerce model, leaving the traditional retail. The top management has decided to build their own custom platform in-house and outsource the payment process to an external provider operating online payments systems that support online money transfers.

Due to this transformation of the business model, a number of security controls were implemented based on the identified threats and vulnerabilities associated to critical assets. To protect customers' information.
Beauty's employees had to sign a confidentiality agreement. In addition, the company reviewed all user access rights so that only authorized personnel can have access to sensitive files and drafted a new segregation of duties chart.

However, the transition was difficult for the IT team, who had to deal with a security incident not long after transitioning to the e commerce model. After investigating the incident, the team concluded that due to the out-of-date anti-malware software, an attacker gamed access to their files and exposed customers' information, including their names and home addresses.

The IT team decided to stop using the old anti-malware software and install a new one which would automatically remove malicious code in case of similar incidents. The new software was installed in every workstation within the company. After installing the new software, the team updated it with the latest malware definitions and enabled the automatic update feature to keep it up to date at all times.
Additionally, they established an authentication process that requires a user identification and password when accessing sensitive information.

In addition, Beauty conducted a number of information security awareness sessions for the IT team and other employees that have access to confidential information in order to raise awareness on the importance of system and network security.

Based on the scenario above, answer the following question:

After investigating the incident. Beauty decided to install a new anti-malware software.

What type of security control has been implemented in this case?

A
Preventive
B
Detective
C
Corrective

Reveal answer details Close answer details

Correct answerA

Explanation

In the scenario described, Beauty's decision to install new anti-malware software after a security incident is aPreventivecontrol. This type of control is aimed at preventing future security incidents by removing malicious code and protecting against malware infections. The purpose of the new anti-malware software is to proactively protect the company's systems and data from potential threats, thus it falls under the category of preventive measures.

Question 13

Single choice

Which of the following is the most suitable option for presenting raw data in a user-friendly, easy-to-read format?

A
Scorecards
B
Reports
C
Gages

Reveal answer details Close answer details

Correct answerA

Question 14

Single choice

Scenario 10: ProEBank
ProEBank is an Austrian financial institution known for its comprehensive range of banking services.
Headquartered in Vienna, it leaverages the city's advanced technological and financial ecosystem To
enhance its security posture,

ProEBank has implementied an information security management system (ISMS) based on the ISO/IEC
27001. After a year of having the ISMS in place, the company decided to apply for a certification audit to obtain certification against ISO/ IEC 27001.

To prepare for the audit, the company first informed its employees for the audit and organized training sessions to prepare them. It also prepared documented information in advance, so that the documents would be ready when external auditors asked to review them Additionally, it determined which of its employees have the knowledge to help the external auditors understand and evaluate the processes.

During the planning phase for the audit, ProEBank reviewed the list of assigned auditors provided by the certification body. Upon reviewing the list, ProEBank identified a potential conflict of interest with one of the auditors, who had previously worked for ProEBank's mein competitor in the banking industry To ensure the integrity of the audit process. ProEBank refused to undergo the audit until a completely new audit team was assigned. In response, the certification body acknowledged the conflict of interest and made the necessary adjustments to ensure the impartiality of the audit team

After the resolution of this issue, the audit team assessed whether the ISMS met both the standard's requirements and the company's objectives. During this process, the audit team focused on reviewing documented information.

Three weeks later, the team conducted an on-site visit to the auditee's location where they aimed to evaluate whether the ISMS conformed to the requirements of ISO/IEC 27001. was effectively implemented, and enabled the auditee to reach its information security objectives. After the on-site visit the team prepared the audit conclusions and notified the auditee that some minor nonconformities had been detected.
The audit team leader then issued a recommendation for certification.
After receiving the recommendation from the audit team leader, the certification body established a committee to make the decision for certification. The committee included one member from the audit team and two other experts working for the certification body.

To prepare for their ISO/IEC 27001 certification audit, ProEBank trained employees, prepared documentation, and identified key personnel to support the audit. However, they did not conduct aself-assessment before the audit.

Did ProEBank follow all of the best practices while preparing for the certification audit?

A
Yes - the company followed all of the best practices in preparation for the certification audit
B
No - the company should have also conducted a self-assessment to prepare for the audit
C
No - the company should not have informed its employees regarding the upcoming audit

Reveal answer details Close answer details

Correct answerB

Explanation

While ISO/IEC 27001:2022 doesn't require a formal self-assessment , it is a widely recognized best practice found in implementation guides, such as ISO/IEC 27003 and the ISMS Implementation Toolkit. A self-assessment or internal audit simulation : "Helps organizations identify gaps, test readiness, and build auditor confidence prior to formal audit stages."
ProEBank took several good steps, but omitting a self-assessment leaves a potential gap in preparedness and can delay certification if unexpected issues arise.

Question 15

Single choice

Org Y. a well-known bank, uses an online banking platform that enables clients to easily and securely access their bank accounts. To log in. clients are required to enter the one-time authorization code sent to their smartphone.

What can be concluded from this scenario?

A
Org Y has implemented an integrity control that avoids the involuntary corruption of data
B
Org Y has incorrectly implemented a security control that could become a vulnerability
C
Org Y has implemented a security control that ensures the confidentiality of information

Reveal answer details Close answer details

Correct answerC

Question 16

Single choice

Scenario 4: UX Software, a company specializing in L.JXfUl design. QA and software testing. and mobile application development. recognized the need to improve its information security measures, As such. the company implemented an ISMS based on ISO/IEC 27001- This strategic move aimed to enhance the confidentiality. availability, and integrity Of information shared internally and externally, aligning with industry standards and best practices.

The integration of ISMS into UX Software's existing processes and ensuring that these processes are adjusted in accordance with the framework of ISMS signified an important milestone. underscoring the organization'S commitment to information security. UX Software meticulously tailored these procedures to align with the ISMS framework, ensuring they ate contextually and culturally appropriate while avoiding mismatches. This proactive stance reassured their employees and instilled confidence in their clients, ensuring the protection of sensitive data throughout their operations.

UX Software'S top management took action to define the Scope Of their ISMS to adhere to ISOflEC 27003 to drive this initiative forward. Sven, a key member Of the top management team at UX Software. assumed the role of project sponsor. a critical position responsible for ensuring the execution of ISMS implementation with adequate resources. Sven's leadership was pivotal in steering the project towards compliance with 27001, thus elevating the organization's information security posture to the highest level-
In parallel with their dedication to information security. UX Software incorporated the technical specifications Of security controls within the justification section Of their Statement Of Applicability.
This approach demonstrated their Commitment to meeting ISO/IEC 27001 requirements and ensured thorough documentation and justification Of Security controls, thereby Strengthening the overall Security framework
Of the organization. Additionally. UX Software established a committee responsible for ensuring the effectiveness of correctrve actions, managing the ISMS documented information, and continually

improving the ISMS while addressing nonconformities.

By implementing an ISMS based on ISO/IEC 27001, UX Software improved its information security and reinforced its position as a reliable partner. This dedication to information security serves as a testament to UX Software's commitment to delivering high-quality software solutions while safeguarding the interests of its internal stakeholders and valued clients.

According to scenario 4, what is the role of Sven in the UX Software?

A
ISMS project manager
B
ISMS project champion
C
Member of the project team

Reveal answer details Close answer details

Correct answerB

Question 17

Single choice

What does the organization still need to manage when using Platform as a Service (PaaS)?

A
Operating system and virtualization
B
Servers and storage
C
Application and data

Reveal answer details Close answer details

Correct answerC

Question 18

Single choice

Why should the security testing processes be defined and implemented in the development life cycle?

A
To protect the production environment and data from compromise by development and test activities
B
To validate if information security requirements are met when applications are deployed to the production environment
C
To Identify organizational assets and define appropriate protection responsibilities

Reveal answer details Close answer details

Correct answerC

Question 19

Single choice

How can SkyFleet demonstrate its ongoing commitment to continual improvement in information security?

A
By letting employees take independent action ensures swift problem resolution
B
By outsourcing its information security responsibilities to a third-party vendor
C
By publishing an annual report on information security performance

Reveal answer details Close answer details

Correct answerC

Question 20

Single choice

Scenario 1: HealthGenic is a pediatric clinic that monitors the health and growth of individuals from infancy to early adulthood using a web-based medical software.

The software is also used to schedule appointments, create customized medical reports, store patients' data and medical history, and communicate with all the [^involved parties, including parents, other physicians, and the medical laboratory staff.

Last month, HealthGenic experienced a number of service interruptions due to the increased number of users accessing the software Another issue the company faced while using the software was the complicated user interface, which the untrained personnel found challenging to use.

The top management of HealthGenic immediately informed the company that had developed the software
about the issue. The software company fixed the issue; however, in the process of doing so, it modified
some files that comprised sensitive information related to HealthGenic's patients.

The modifications that were made resulted in incomplete and incorrect medical reports and, more importantly, invaded the patients' privacy.

Which situation described in scenario 1 represents a threat to HealthGenic?

A
HealthGenic did not train its personnel to use the software
B
The software company modified information related to HealthGenic's patients
C
HealthGenic used a web-based medical software for storing patients' confidential information

Reveal answer details Close answer details

Correct answerB

Explanation

According to ISO/IEC 27001:2022, a threat is any incident that could negatively affect the confidentiality, integrity or availability of an asset 1. In this scenario, the asset is the information related to HealthGenic's patients, which is stored and processed by the web-based medical software. The software company's modification of some files that comprised sensitive information related to HealthGenic's patients is an incident that could negatively affect the confidentiality and integrity of the asset, as it resulted in incomplete and incorrect medical reports and invaded the patients' privacy. Therefore, this situation represents a threat to HealthGenic.

Question 21

Single choice

Which dashboard did SecureLynx use to report the results of implemented processes and controls?

A
Operational dashboards
B
Tactical dashboards
C
Strategic dashboard

Reveal answer details Close answer details

Correct answerA

Question 22

Single choice

Which of the following is the information security committee responsible for?

A
Ensure smooth running of the ISMS
B
Set annual objectives and the ISMS strategy
C
Treat the nonconformities

Reveal answer details Close answer details

Correct answerB

Question 23

Single choice

Scenario 2: NyvMarketing is a marketing firm that provides different services to clients across various industries. With expertise in digital marketing. branding, and market research, NyvMarketing has built a solid reputation for delivering innovative and impactful marketing campaigns. With the growing Significance Of data Security and information protection within the marketing landscape, the company decided to implement an ISMS based on 27001.

While implementing its ISMS NyvMarketing encountered a significant challenge; the threat of insufficient
resources, This challenge posed a risk to effectively executing its ISMS objectives and could potentially undermine the company'S efforts to safeguard Sensitive information. TO address this threat, NyvMarketing adopted a proactive approach by appointing Michael to manage the risks related to resource Constraints.

Michael was pivotal in identifying and addressing resource gaps. strategizing risk mitigation. and allocating resources effectively for ISMS implementation at NyvMarketing, strengthening the company's resilience against resource challenges.
Furthermore, NyvMarketing prioritized industry standards and best practices in information security, diligently following ISOfIEC 27002 guidelines. This commitment, driven by excellence and ISO/IEC 27001 requirements, underscored NyvMafketinq dedication to upholding the highest Standards Of information security governance.

While working on the ISMS implementation, NyvMarketing opted to exclude one Of the requirements related to competence (as stipulated in ISO/IEC 27001, Clause 7.2). The company believed that its existing workforce possessed the necessary competence to fulfill ISMS telated tasks_However, it did not provide a valid justification for this omission. Moreover. when specific controls from Annex A Of ISO/IEC 27001 were not implemented. NyvMarketing neglected to provide an acceptable justification for these

exclusions.

During the ISMS implementation, NFMarketing thoroughly assessed vulnerabilities that could affect its information Security These vulnerabilities included insufficient maintenance and faulty installation Of storage media, insufficient periodic replacement schemes for equipment, Inadequate software testing. and unprotected communication lines. Recognizing that these vulnerabilities could pose risks to its data security. NBMarketing took steps to address these specific weaknesses by implementing the necessary controls and countermeasures-Based on the scenario above, answer the following question.

In the scenario 2. NyvMarketing faced the threat of insufficient resources during the ISMS implementation.
In which of the following categories does this threat fall?

Which of the following categories of vulnerabilities did NyvMarketing address during its ISMS implementation? Refer to scenario 2.

A
Network, personnel, and site vulnerabilities
B
Organizational and site vulnerabilities
C
Hardware, software, and network vulnerabilities
D
Physical and administrative vulnerabilities

Reveal answer details Close answer details

Correct answerC

Question 24

Single choice

Scenario 10: CircuitLinking is a company specializing in water purification solutions, designing and manufacturing efficient filtration and treatment systems for both residential and commercial applications.
Over the past two years, the company has actively implemented an integrated management system (IMS) that aligns with both ISO/IEC 27001 for information security and ISO 9001 for quality management.
Recently, the company has taken a significant step forward by applying for a combined audit, aiming to achieve certification against both ISO/IEC 27001 and ISO 9001.

In preparation for the certification audit, CircuitLinking ensured a clear understanding of ISO/IEC 27001 within the company and identified key subject-matter experts to assist the auditors. It also allocated sufficient resources and performed a self-assessment to verify that processes were clearly defined, roles and responsibilities were segregated, and documented information was maintained. To avoid delays, the company gathered all necessary documentation in advance to provide evidence that procedures were in place and effective.

Following the successful completion of the Stage 1 audit, which focused on verifying the design of the management system, the Stage 2 audit was conducted to examine the implementation and effectiveness of the information security and quality management systems.

One of the auditors, Megan, was a previous employee of the company. To uphold the integrity of the certification process, the company notified the certification body about the potential conflict of interest and requested an auditor change. Subsequently, the certification body selected a replacement, ensuring
impartiality. Additionally, the company requested a background check of the audit team members;
however, the certification body denied this request. The necessary adjustments to the audit plan were made, and transparent communication with stakeholders was maintained.

The audit process continued seamlessly under the new auditor's guidance. Upon audit completion, the certification body evaluated the results and conclusions of the audit and CircuitLinking's public information and awarded CircuitLinking the combined certification.

A recertification audit for CircuitLinking was conducted to verify that the company's management system continued to meet the required standards and remained effective within the defined scope of certification.
CircuitLinking had implemented significant changes to its management system, including a major overhaul of its information security processes, the adoption of new technology platforms, and adjustments to comply with recent changes in industry legislation. Due to these substantial updates, the recertification audit required a Stage 1 assessment to evaluate the impact of these changes.

According to Scenario 10, the certification body evaluated the results and conclusions of the audit and CircuitLinking's public information when making the certification decision.
Is this acceptable?

A
No, the certification body should also consider the auditor's opinions when making the certification decision
B
No, the certification decision must be based solely on the audit findings, and no external information can be considered
C
Yes, the certification body must make the certification decision based on other relevant information, such as public information
D
No, only top management's input should be considered

Reveal answer details Close answer details

Correct answerC

Question 25

Single choice

Scenario 8: SecureLynx is one Of the largest cybersecurity advisory and consulting companies that helps private sector organizations prevent security threats. improve security systems. and achieve business SecureLynr is committed to complying with national and international standards to enhance the company'S resilience and credibility_SecureLynx has Started implementing an ISMS based on ISO/IEC 27001 as part of its relentless pursuit of security.

As part of the internal audit activities. the top management reviewed and approved the audit objectives to assess the effectiveness of SecureLynx ISMS During the audit, the internal auditor evaluated whether top management Supports activities associated with the ISMS and if the toles and responsibilities Of relevant parties are Clearly defined. This rigorous examination is a testament to SecureLynx'S commitment to continuous improvernent and alignment of security measures with organizational goals.

SecureLynx employs an innovative dashboard that visually represents implemented processes and controls to ensure transparency and accountability within the Organization. This tool Offers stakeholders a real-time overview of security measures. empowering them to make informed decisions and swiftly respond to emerging threats. As part of this initiative, Paula was appointed to a new position entrusted with the responsibility Of collecting, recordlng, and Stoting data to measure the effectiveness Of the ISMS-

Furthermore, SecureLynx conducts management reviews every six months to ensure its Systems are robust and continually improving. These reviews serve as a crucial mechanism for assessing the efficacy
Of security measures and identifying areas for enhancement. SecureLynx's dedication to implementing and maintaining a robust ISMS exemplifies its commitment to innovation and Client satisfaction. Based on the scenario above, answer the following question.

Based on the description of Paula's responsibilities at SecureLynx, her role is known as:

A
Information collector
B
Information analyst
C
Information communicator

Reveal answer details Close answer details

Correct answerB

Question 26

Single choice

Scenario 8: SunDee is a biopharmaceutical firm headquartered in California, US. Renowned for its pioneering work in the field of human therapeutics, SunDee places a strong emphasis on addressing critical healthcare concerns, particularly in the domains of cardiovascular diseases, oncology, bone health, and inflammation. SunDee has demonstrated its commitment to data security and integrity by maintaining an effective information security management system (ISMS) based on ISO/IEC 27001 for the past two years.

In preparation for the recertification audit, SunDee conducted an internal audit. The company's topmanagement appointed Alex, who has actively managed the Compliance Department's day-to-day operations for the last six months, as the internal auditor. With this dual role assignment, Alex is tasked with conducting an audit that ensures compliance and provides valuable recommendations to improve operational efficiency.

During the internal audit, a few nonconformities were identified. To address them comprehensively, the company created action plans for each nonconformity, working closely with the audit team leader.

SunDee's senior management conducted a comprehensive review of the ISMS to evaluate its appropriateness, sufficiency, and efficiency. This was integrated into their regular management meetings.
Essential documents, including audit reports, action plans, and review outcomes, were distributed to all members before the meeting. The agenda covered the status of previous review actions, changes affecting the ISMS, feedback, stakeholder inputs, and opportunities for improvement. Decisions and actions targeting ISMS improvements were made, with a significant role played by the ISMS coordinator and the internal audit team in preparing follow-up action plans, which were then approved by top management.

In response to the review outcomes, SunDee promptly implemented corrective actions, strengthening its information security measures. Additionally, dashboard tools were introduced to provide a high-level overview of key performance indicators essential for monitoring the organization's information security management. These indicators included metrics on security incidents, their costs, system vulnerability tests, nonconformity detection, and resolution times, facilitating effective recording, reporting, and tracking of monitoring activities. Furthermore, SunDee embarked on a comprehensive measurement process to assess the progress and outcomes of ongoing projects, implementing extensive measures across all processes. The top management determined that the individual responsible for the information, aside from owning the data that contributes to the measures, would also be designated accountable for executing these measurement activities.

Based on the scenario above, answer the following question:

Is Alex suitable for the position of internal auditor within the company?

A
Yes, Alex's recent experience in the day-to-day operations of the Compliance Department would benefit the internal auditor role
B
No, Alex should wait for a reasonable period of time to pass before transitioning to the internal auditor position
C
No, the internal audit can be conducted only by individuals who have not had operational roles

Reveal answer details Close answer details

Correct answerC

Question 27

Single choice

Scenario 8: SunDee is an American biopharmaceutical company, headquartered in California, the US. It specializes in developing novel human therapeutics, with a focus on cardiovascular diseases, oncology, bone health, and inflammation.

The company has had an information security management system(ISMS) based on SO/IEC 27001 in place for the past two years. However, it has not monitored or measured the performance and effectiveness of its ISMS and conducted management reviews regularly Just before the recertification audit, the company decided to conduct an internal audit. It also asked most of their staff to compile the written individual reports of the past two years for their departments. This left the Production Department with less than the optimum workforce, which decreased the company's stock.

Tessa was SunDee's internal auditor. With multiple reports written by 50 different employees, the internal audit process took much longer than planned, was very inconsistent, and had no qualitative measures whatsoever Tessa concluded that SunDee must evaluate the performance of the ISMS adequately. She defined SunDee's negligence of ISMS performance evaluation as a major nonconformity, so she wrote a nonconformity report including the description of the nonconformity, the audit findings, and recommendations.
Additionally, Tessa created a new plan which would enable SunDee to resolve these issues and presented it to the top management How does SunDee's negligence affect the ISMS certificate?
Refer to scenario 8.

A
SunDee will renew the ISMS certificate, because it has conducted an Internal audit to evaluate the ISMS effectiveness
B
SunDee might not be able to renew the ISMS certificate, because it has not conducted management reviews at planned intervals
C
SunDee might not be able to renew the ISMS certificate, because the internal audit lasted longer than planned

Reveal answer details Close answer details

Correct answerB

Explanation

According to ISO/IEC 27001:2013, clause 9.3, the top management of an organization must review the ISMS at planned intervals to ensure its continuing suitability, adequacy and effectiveness. The management review must consider the status of actions from previous management reviews, changes in external and internal issues, the performance and effectiveness of the ISMS, feedback from interested parties, results of risk assessment and treatment, and opportunities for continual improvement. The management review must also result in decisions and actions related to the ISMS policy and objectives, resources, risks and opportunities, and improvement. The management review is a critical process that demonstrates the commitment and involvement of the top management in the ISMS and its alignment with the strategic direction of the organization. The management review also provides input for the internal audit and the certification audit. SunDee has neglected to conduct management reviews regularly, which means that it has not fulfilled the requirement of clause 9.3. This is a major nonconformity that could jeopardize the renewal of the ISMS certificate. The certification body will verify whether SunDee has conducted management reviews and whether they have been effective and documented. If SunDee cannot provide evidence of management reviews, it will have to take corrective actions and undergo a follow-up audit before the certificate can be renewed. Alternatively, the certification body may decide to suspend or withdraw the certificate if SunDee fails to address the nonconformity within a specified time frame.

Question 28

Single choice

Scenario 9: OpenTech provides IT and communications services. It helps data communication enterprises and network operators become multi-service providers During an internal audit, its internal auditor, Tim, has identified nonconformities related to the monitoring procedures He identified and evaluated several system Invulnerabilities.

Tim found out that user IDs for systems and services that process sensitive information have been reused and the access control policy has not been followed After analyzing the root causes of this nonconformity, the ISMS project manager developed a list of possible actions to resolve the nonconformity. Then, the ISMS project manager analyzed the list and selected the activities that would allow the elimination of the root cause and the prevention of a similar situation in the future. These activities were included in an action plan The action plan, approved by the top management, was written as follows:

A new version of the access control policy will be established and new restrictions will be created to ensure that network access is effectively managed and monitored by the Information and Communication Technology (ICT) Department

The approved action plan was implemented and all actions described in the plan were documented.

Based on scenario 9.
is the action plan for the identified nonconformities sufficient to eliminate the detected nonconformities?

A
Yes, because a separate action plan has been created for the identified nonconformity
B
No, because the action plan does not include a timeframe for implementation
C
No, because the action plan does not address the root cause of the identified nonconformity

Reveal answer details Close answer details

Correct answerB

Explanation

According to ISO/IEC 27001:2022, clause 10.1, an action plan for nonconformities and corrective actions should include the following elements1:

What needs to be done

Who is responsible for doing it

When it will be completed

How the effectiveness of the actions will be evaluated

How the results of the actions will be documented
In scenario 9, the action plan only describes what needs to be done and who is responsible for doing it, but it does not specify when it will be completed, how the effectiveness of the actions will be evaluated, and how the results of the actions will be documented. Therefore, the action plan is not sufficient to eliminate the detected nonconformities.

Question 29

Single choice

Scenario 2: Beauty is a cosmetics company that has recently switched to an e-commerce model, leaving the traditional retail. The top management has decided to build their own custom platform in-house and outsource the payment process to an external provider operating online payments systems that support online money transfers.

Due to this transformation of the business model, a number of security controls were implemented based on the identified threats and vulnerabilities associated to critical assets. To protect customers' information.
Beauty's employees had to sign a confidentiality agreement. In addition, the company reviewed all user access rights so that only authorized personnel can have access to sensitive files and drafted a new segregation of duties chart.

However, the transition was difficult for the IT team, who had to deal with a security incident not long after transitioning to the e commerce model. After investigating the incident, the team concluded that due to the out-of-date anti-malware software, an attacker gamed access to their files and exposed customers' information, including their names and home addresses.

The IT team decided to stop using the old anti-malware software and install a new one which would automatically remove malicious code in case of similar incidents. The new software was installed in every workstation within the company. After installing the new software, the team updated it with the latest malware definitions and enabled the automatic update feature to keep it up to date at all times.
Additionally, they established an authentication process that requires a user identification and password when accessing sensitive information.

In addition, Beauty conducted a number of information security awareness sessions for the IT team and other employees that have access to confidential information in order to raise awareness on the importance of system and network security.

Based on scenario 2, which information security principle is the IT team aiming to ensure by establishing a user authentication process that requires user identification and password when accessing sensitive information?

A
Integrity
B
Confidentiality
C
Availability

Reveal answer details Close answer details

Correct answerB

Explanation

Confidentiality is one of the three information security principles, along with integrity and availability, that form the CIA triad. Confidentiality means protecting information from unauthorized access or disclosure, and ensuring that only those who are authorized to view or use it can do so. Confidentiality is essential for preserving the privacy and trust of the information owners, such as customers, employees, or business partners. The IT team of Beauty is aiming to ensure confidentiality by establishing a user authentication process that requires user identification and password when accessing sensitive information. User authentication is a security control that verifies the identity and credentials of the users who attempt to access a system or network, and grants or denies them access based on their authorization level. User authentication helps to prevent unauthorized users, such as hackers, competitors, or malicious insiders, from accessing confidential information that they are not supposed to see or use. User authentication also helps to create an audit trail that records who accessed what information and when, which can be useful for accountability and compliance purposes.

Question 30

Single choice

Scenario 1: HealthGenic is a pediatric clinic that monitors the health and growth of individuals from infancy to early adulthood using a web-based medical software. The software is also used to schedule appointments, create customized medical reports, store patients' data and medical history, and communicate with all the [^involved parties, including parents, other physicians, and the medical laboratory staff.

Last month, HealthGenic experienced a number of service interruptions due to the increased number of users accessing the software Another issue the company faced while using the software was the complicated user interface, which the untrained personnel found challenging to use.

The top management of HealthGenic immediately informed the company that had developed the software
about the issue. The software company fixed the issue; however, in the process of doing so, it modified
some files that comprised sensitive information related to HealthGenic's patients. The modifications that were made resulted in incomplete and incorrect medical reports and, more importantly, invaded the patients' privacy.

Based on the scenario above, answer the following question:

According to scenario 1. to detect (1)____________________________, Antiques should have implemented (2)______________________________.

A
(1) Patches.
(2) an access control software
B
(1) Intrusions on networks.
(2) an intrusion detection system
C
(1) Technical vulnerabilities.
(2) network intrusions

Reveal answer details Close answer details

Correct answerB

Question 31

Single choice

Scenario 8: BioVitalis

BioVitalis is a biopharmaceutical firm headquartered in California, the US Renowned for its pioneering work in the field of human therapeutics, BioVitalis places a strong emphasis on addressing critical healthcare concerns, particularly in the domains of cardiovascular diseases, oncology, bone health, and inflammation BioVitalis has demonstrated its commitment to data security and integrity by maintaining an effective information security management system (ISMS) based on ISO/IEC 27001 for the past two years.

In preparation for the recertification audit. BioVitalis conducted an internal audit. The company's top management appointed Alex, who has actively managed the Compliance Department's day-to-day operations for the last six months, as the internal auditor. With this dual role assignment. Alex is tasked with conducting an audit that ensures compliance and provides valuable recommendations to improve operational efficiency.

During the internal audit, a few nonconformities were identified. To address them comprehensively, the company created action plans for each nonconformity, working closely with the audit team leader BioVitalis's senior management conducted a comprehensive review of the ISMS to evaluate its appropriateness, sufficiency, and efficiency. This was integrated into their regular management meetings.
Essential documents, including audit reports, action plans, and review outcomes, were distributed to all members before the meeting. The agenda covered the status of previous review actions, changes affecting the ISMS, feedback, stakeholder inputs, and opportunities for improvement Decisions and actions targeting ISMS improvements were made, with a significant role played by the ISMS coordinator and the internal audit team in preparing follow up action plans, which were then approved by top management.

In response to the review outcomes. BioVitalis promptly implemented corrective actions, strengthening its Information security measures Additionally, dashboard tools were Introduced to provide a high-level overview of key performance indicators essential for monitoring the organization's information security management. These indicators included metrics on security incidents, their costs, system vulnerability tests, nonconformity detection, and resolution times, facilitating effective recording, reporting, and tracking of monitoring activities.

Furthermore. BioVitalis embarked on a comprehensive measurement process to assess the progress and outcomes of ongoing projects, implementing extensive measures across all processes.
The top management determined that the individual responsible for the information, aside from owning the data that contributes to the measures, would also be designated accountable for executing these measurement activities

BioVitalis is a biopharma company with an ISMS certified under ISO/IEC 27001. For recertification, itreviewed ISMS performance, created dashboards to monitor KPIs such as incident cost, vulnerability tests, and resolution times.

What type of dashboards did BioVitalis utilize?

A
Operational
B
Tactical
C
Strategic

Reveal answer details Close answer details

Correct answerC

Explanation

Strategic dashboards focus on high-level KPIs and long-term objectives, as per ISO/IEC 27004:2016 ?
Monitoring, measurement, analysis, and evaluation.
"Strategic dashboards provide an overview of organizational performance and help top management in decision-making."
BioVitalis used dashboards that track ISMS effectiveness across key performance indicators (incidents, costs, etc.), aligning with strategic objectives and management reviews under Clause 9.3.

Question 32

Single choice

Upon the risk assessment outcomes. Socket Inc. decided to:

1. Require the use of passwords with at least 12 characters containing uppercase and lowercase letters, symbols, and numbers
2. Require the change of passwords at least once every 60 days
3. Keep backup copies of files on IT-provided network drives
4. Assign users to a separate network when they have access to cloud storage files storing customers' personal data.

Based on scenario 5, what can be considered as a residual risk to Socket Inc.
?

A
Files arc decrypted once the user is authenticated
B
Users with access to cloud storage files are segregated on a separate network
C
The use of passwords with at least 12 characters containing a mixture of uppercase and lowercase letters, symbols, and numbers

Reveal answer details Close answer details

Correct answerA

Question 33

Single choice

Company X restricted the access of the internal auditor of some of its documentation taking into account its confidentiality.
Is this acceptable?

A
Yes. it is up to the company to determine what an internal auditor can access
B
Yes. confidential information should not be increased by internal auditors
C
No. restricting the internal auditor's access to offices and documentation can negatively affect the internal audit process

Reveal answer details Close answer details

Correct answerC

Question 34

Single choice

Scenario 2: Beauty is a cosmetics company that has recently switched to an e-commerce model, leaving the traditional retail. The top management has decided to build their own custom platform in-house and outsource the payment process to an external provider operating online payments systems that support online money transfers.

Due to this transformation of the business model, a number of security controls were implemented based on the identified threats and vulnerabilities associated to critical assets. To protect customers' information.
Beauty's employees had to sign a confidentiality agreement. In addition, the company reviewed all user access rights so that only authorized personnel can have access to sensitive files and drafted a new segregation of duties chart.

However, the transition was difficult for the IT team, who had to deal with a security incident not long after transitioning to the e commerce model. After investigating the incident, the team concluded that due to the out-of-date anti-malware software, an attacker gamed access to their files and exposed customers' information, including their names and home addresses.

The IT team decided to stop using the old anti-malware software and install a new one which would automatically remove malicious code in case of similar incidents. The new software was installed in every workstation within the company. After installing the new software, the team updated it with the latest malware definitions and enabled the automatic update feature to keep it up to date at all times.
Additionally, they established an authentication process that requires a user identification and password when accessing sensitive information.

In addition, Beauty conducted a number of information security awareness sessions for the IT team and other employees that have access to confidential information in order to raise awareness on the importance of system and network security.

Which statement below suggests that Beauty has implemented a managerial control that helps avoid the occurrence of incidents? Refer to scenario 2.

A
Beauty's employees signed a confidentiality agreement
B
Beauty conducted a number of information security awareness sessions for the IT team and other employees that have access to confidential information
C
Beauty updated the segregation of duties chart

Reveal answer details Close answer details

Correct answerB

Explanation

Managerial controls are administrative actions that are designed to prevent or reduce the likelihood of security incidents by influencing human behavior. They include policies, procedures, guidelines, standards, training, and awareness programs. In scenario 2, Beauty has implemented a managerial control by conducting information security awareness sessions for the IT team and other employees that have access to confidential information. These sessions aim to educate the staff on the importance of system and network security, the potential threats and vulnerabilities, and the best practices to follow to avoid the occurrence of incidents. By raising the level of awareness andknowledge of the employees, Beauty can reduce the human errors and negligence that might compromise the security of the information assets.

Question 35

Single choice

What is the first phase in the information security policy development life cycle?

A
Policy construction
B
Policy implementation
C
Risk assessment
D
Policy planning / Needs assessment

Reveal answer details Close answer details

Correct answerD

Question 36

Single choice

Which security controls must be implemented to comply with ISO/IEC 27001?

A
Those designed by the organization only
B
Those included in the risk treatment plan
C
Those listed in Annex A of ISO/IEC 27001, without any exception

Reveal answer details Close answer details

Correct answerB

Explanation

ISO/IEC 27001:2022 does not prescribe a specific set of security controls that must be implemented by all organizations. Instead, it allows organizations to select and implement the controls that are appropriate for their context, based on the results of a risk assessment and a risk treatment plan. The risk treatment plan is a document that specifies the actions to be taken to address the identified risks, including the selection of controls from Annex A or other sources, the allocation of responsibilities, the expected outcomes, the priorities and the resources. Therefore, the security controls that must be implemented to comply with ISO /IEC 27001 are those that are included in the risk treatment plan, which may vary from one organization to another.

Question 37

Single choice

What category of decision-making does the implementation of an ISMS belong to within an organization's framework?

A
Tactical
B
Operational
C
Strategic

Reveal answer details Close answer details

Correct answerC

Question 38

Single choice

Scenario 4: TradeB is a newly established commercial bank located in Europe, with a diverse clientele. It provides services that encompass retail banking, corporate banking, wealth management, and digital banking, all tailored to meet the evolving financial needs of individuals and businesses in the region.
Recognizing the critical importance of information security in the modern banking landscape, TradeB has initiated the implementation of an information security management system (ISMS) based on ISO/IEC
27001. To ensure the successful implementation of the ISMS, the top management decided to contract two experts to lead and oversee the ISMS implementation project.

As a primary strategy for implementing the ISMS, the experts chose an approach that emphasizes a swift implementation of the ISMS by initially meeting the minimum requirements of ISO/IEC 27001, followed by continual improvement over time. Additionally, under the guidance of the experts, TradeB opted for a methodological framework, which serves as a structured framework and a guideline that outlines the high-level stages of the ISMS implementation, the associated activities, and the deliverables without
incorporating any specific tools.

The experts analyzed the ISO/IEC 27001 controls and listed only the security controls deemed applicable to the company and its objectives. Based on this analysis, they drafted the Statement of Applicability.Afterward, they conducted a risk assessment, during which they identified assets, such as hardware, software, and networks, as well as threats and vulnerabilities, assessed potential consequences and likelihood, and determined the level of risks based on a methodical approach that involved defining and characterizing the terms and criteria used in the assessment process, categorizing them into non-numerical levels (e.g., very low, low, moderate, high, very high). Explanatory notes were thoughtfully crafted to justify assessed values, with the primary goal of enhancing repeatability and reproducibility.

Then, they evaluated the risks based on the risk evaluation criteria, where they decided to treat only the risks of the high-risk category. Additionally, they focused primarily on the unauthorized use of administrator rights and system interruptions due to several hardware failures. To address these issues, they established a new version of the access control policy, implemented controls to manage and control user access, and introduced a control for ICT readiness to ensure business continuity.

Their risk assessment report indicated that if the implemented security controls reduce the risk levels to an acceptable threshold, those risks will be accepted.

Based on the scenario above, answer the following question:

Which risk analysis technique did the experts use to determine the level of risk? Refer to scenario 4.

A
Qualitative risk analysis
B
Semi-quantitative analysis
C
Quantitative risk analysis

Reveal answer details Close answer details

Correct answerA

Question 39

Single choice

Scenario 5: Operaze is a small software development company that develops applications for various companies around the world. Recently, the company conducted a risk assessment to assess the information security risks that could arise from operating in a digital landscape. Using different testing methods, including penetration Resting and code review, the company identified some issues in its ICT systems, including improper user permissions, misconfigured security settings, and insecure network configurations. To resolve these issues and enhance information security, Operaze decided to implement an information security management system (ISMS) based on ISO/IEC 27001.

Considering that Operaze is a small company, the entire IT team was involved in the ISMS implementation project. Initially, the company analyzed the business requirements and the internal and external environment, identified its key processes and activities, and identified and analyzed the interested parties
In addition, the top management of Operaze decided to Include most of the company's departments within the ISMS scope. The defined scope included the organizational and physical boundaries. The IT team drafted an information security policy and communicated it to all relevant interested parties In addition, other specific policies were developed to elaborate on security issues and the roles and responsibilities were assigned to all interested parties.
Following that, the HR manager claimed that the paperwork created by ISMS does not justify its value and the implementation of the ISMS should be canceled.
However, the top management determined that this claim was invalid and organized an awareness session to explain the benefits of the ISMS to all interested parties.

Operaze decided to migrate Its physical servers to their virtual servers on third-party infrastructure. The new cloud computing solution brought additional changes to the company Operaze's top management, on

the other hand, aimed to not only implement an effective ISMS but also ensure the smooth running of the ISMS operations. In this situation, Operaze's top management concluded that the services of external experts were required to implement their information security strategies. The IT team, on the other hand, decided to initiate a change in the ISMS scope and implemented the required modifications to the processes of the company.

Based on the scenario above, answer the following question:

What led Operaze to implement the ISMS?

A
Identification of vulnerabilities
B
Identification of threats
C
Identification of assets

Reveal answer details Close answer details

Correct answerA

Explanation

According to the scenario, Operaze conducted a risk assessment to assess the information security risks that could arise from operating in a digital landscape. Using different testing methods, including penetration testing and code review, the company identified some issues in its ICT systems, such as improper user permissions, misconfigured security settings, and insecure network configurations. These issues are examples of vulnerabilities, which are weaknesses or gaps in the protection of an asset that can be exploited by a threat. Therefore, the identification of vulnerabilities led Operaze to implement the ISMS.

Question 40

Single choice

What is the purpose of ISO/IEC 27002:2022 Clause 8.28?

A
To ensure all security requirements are addressed during application development
B
To ensure software is written securely to reduce information security vulnerabilities
C
To ensure secure system design principles are followed

Reveal answer details Close answer details

Correct answerC

Explanation

Clause 8.28 of ISO/IEC 27002:2022 addresses "Secure system architecture and engineering principles," which includes secure design principles throughout the system lifecycle.
The purpose is:
"To ensure that security is built into systems and processes by following recognized engineering and design principles, minimizing vulnerabilities." This clause ensures secure system architecture is embedded early, aligning with secure-by-design practices.

Question 41

Single choice

Scenario:

An employee at Reyae Ltd unintentionally sent an email containing critical business strategies to a competitor due to an autofill email suggestion error.

The email included proprietary trade secrets and confidential client data. Upon receiving the email, the competitor altered the information and attempted to use it to mislead clients into switching services.

Which of the following statements correctly describes the security principles affected in this situation?

A
Reyae Ltd's confidentiality was compromised first, while the competitor's actions led to an integrity violation
B
Reyae Ltd's integrity was compromised first, while the competitor's actions led to an availability violation
C
Reyae Ltd's availability was compromised first, while the competitor's actions led to an integrity violation

Reveal answer details Close answer details

Correct answerA

Explanation

According to ISO/IEC 27002:2022, information security is based on the principles of confidentiality, integrity, and availability (CIA). Confidentiality refers to preventing unauthorized disclosure, integrity ensures information accuracy and trustworthiness, and availability ensures information is accessible when needed.
In this case:
Confidentialitywas compromised when the sensitive email was mistakenly sent to the competitor. The integrity was violated when the competitor altered the proprietary data to mislead clients. This directly aligns with the definitions in ISO/IEC 27002:2022, clause 3.1.7 (Confidential Information) and 3.1.13 (Information Security Breach).

Question 42

Single choice

Scenario 4: UX Software, a company specializing in L.JXfUl design. QA and software testing. and mobile application development. recognized the need to improve its information security measures, As such. the

company implemented an ISMS based on ISO/IEC 27001- This strategic move aimed to enhance the confidentiality. availability, and integrity Of information shared internally and externally, aligning with industry standards and best practices.

The integration of ISMS into UX Software's existing processes and ensuring that these processes are adjusted in accordance with the framework of ISMS signified an important milestone. underscoring the organization'S commitment to information security. UX Software meticulously tailored these procedures to align with the ISMS framework, ensuring they ate contextually and culturally appropriate while avoiding mismatches. This proactive stance reassured their employees and instilled confidence in their clients, ensuring the protection of sensitive data throughout their operations.

UX Software'S top management took action to define the Scope Of their ISMS to adhere to ISOflEC 27003 to drive this initiative forward. Sven, a key member Of the top management team at UX Software. assumed the role of project sponsor. a critical position responsible for ensuring the execution of ISMS implementation with adequate resources. Sven's leadership was pivotal in steering the project towards compliance with 27001, thus elevating the organization's information security posture to the highest level-
In parallel with their dedication to information security. UX Software incorporated the technical specifications Of security controls within the justification section Of their Statement Of Applicability.
This approach demonstrated their Commitment to meeting ISO/IEC 27001 requirements and ensured thorough documentation and justification Of Security controls, thereby Strengthening the overall Security framework
Of the organization. Additionally. UX Software established a committee responsible for ensuring the effectiveness of correctrve actions, managing the ISMS documented information, and continually improving the ISMS while addressing nonconformities.

By implementing an ISMS based on ISO/IEC 27001, UX Software improved its information security and reinforced its position as a reliable partner. This dedication to information security serves as a testament to UX Software's commitment to delivering high-quality software solutions while safeguarding the interests of its internal stakeholders and valued clients.

Based on scenario 4, the developers of UX Software incorporated the technical specifications of security controls within the justification section of their Statement of Applicability.
Is this recommended?

A
Yes, the technical specifications of security controls must be included within the justification section
B
No, the justification section should encompass the rationale for the inclusion and exclusion of each security control
C
No, the justification section should concisely overview previous software projects

Reveal answer details Close answer details

Correct answerB

Question 43

Single choice

The application used by an organization has a complicated user interface.

What does the complicated user interface represent in this case?

A
An intrinsic vulnerability, since it is a characteristic of the asset
B
An extrinsic vulnerability, since it is fin external factor that impacts the asset
C
A type of threat, since it may result in an unwanted incident

Reveal answer details Close answer details

Correct answerA