Free ISO-IEC-27001-LEAD-AUDITOR Web TestEngine Demo

Q18 Multiple choice

You are a certification body auditor, conducting a surveillance audit to ISO/IEC 27001:2022 of a data centre operated by a client who provides hosting services for ICT facilities.

You and your guide are currently in one of the private suites that the client rents out to customers. Access to each suite is controlled using a combination lock. CCTV is also installed in every suite.

Within each suite are three data cabinets in which the client can locate mission-critical servers and other items of networking equipment such as switches and routers.

You notice that whilst two of the cabinets in your suite are locked, the third is unlocked. You ask the guide why. They reply "This is because the client is currently swapping out a hard drive unit. Their technician is currently on a lunch break".

What three actions should you undertake next?

Select all that apply.

A
Do nothing, the room appears adequately protected so it is unlikely that a security incident has taken place.
B
Raise a nonconformity against control 5.16 'identity management' as it may not be possible to identify who left the cabinet unlocked.
C
Raise a nonconformity against control 7.2 'physical entry' as the area where the client's equipment is located is not protected.
D
Raise a nonconformity against control 7.4 'physical security monitoring' as the private suite is not being continuously monitored for unauthorised physical access.
E
Raise an opportunity for improvement suggesting cabinet doors are locked whenever clients leave their suites, even if they intend to return within a short time.
F
Review the CCTV records to ensure that only the client has accessed the cabinet since it was last confirmed as locked.
G
When the technician returns from lunch, reprimand them for leaving the cabinet open.
H
With the permission of the guide, speak to the customer to confirm that they are in the process of swapping out a drive.

ISO-IEC-27001-LEAD-AUDITOR Web TestEngine demo