Free PECB ISO-IEC-27001-Lead-Auditor Exam Questions

Question 1

A couple of years ago you started your company which has now grown from 1 to 20 employees. Your

company’s information is worth more and more and gone are the days when you could keep control yourself.

You are aware that you have to take measures, but what should they be? You hire a consultant who advises

you to start with a qualitative risk analysis.

What is a qualitative risk analysis?

A : is analysis follows a precise statistical probability calculation in order to calculate exact loss caused by damage.

B : is analysis is based on scenarios and situations and produces a subjective view of the possible threats.

Answer: B

Question 2

In the event of an Information security incident, system users' roles and responsibilities are to be observed, except:

A : Report suspected or known incidents upon discovery through the Servicedesk

B : Preserve evidence if necessary

C : Cooperate with investigative personnel during investigation if needed

D : Make the information security incident details known to all employees

Answer: D

Question 3

__________ is a software used or created by hackers to disrupt computer operation, gather sensitive information, or gain access to private computer systems.

A : ojan

B : erating System

C : rus

D : lware

Answer: D

Question 4

Scenario 6: Sinvestment is an insurance company that offers home, commercial, and life insurance. The

company was founded in North Carolina, but have recently expanded in other locations, including Europe and

Africa.

Sinvestment is committed to complying with laws and regulations applicable to their industry and preventing

any information security incident. They have implemented an ISMS based on ISO/IEC 27001 and have

applied for ISO/IEC 27001 certification.

Two auditors were assigned by the certification body to conduct the audit. After signing a confidentiality agreement with Sinvestment. they started the audit activities. First, they reviewed the documentation required

by the standard, including the declaration of the ISMS scope, information security policies, and internal audits

reports. The review process was not easy because, although Sinvestment stated that they had a documentation

procedure in place, not all documents had the same format.

Then, the audit team conducted several interviews with Sinvestment's top management to understand their role

in the ISMS implementation. All activities of the stage 1 audit were performed remotely, except the review of

documented information, which took place on-site, as requested by Sinvestment.

During this stage, the auditors found out that there was no documentation related to information security

training and awareness program. When asked, Sinvestment's representatives stated that the company has

provided information security training sessions to all employees. Stage 1 audit gave the audit team a general

understanding of Sinvestment's operations and ISMS.

The stage 2 audit was conducted three weeks after stage 1 audit. The audit team observed that the marketing

department (which was not included in the audit scope) had no procedures in place to control employees’

access rights. Since controlling employees' access rights is one of the ISO/IEC 27001 requirements and was

included in the information security policy of the company, the issue was included in the audit report. In

addition, during stage 2 audit, the audit team observed that Sinvestment did not record logs of user activities.

The procedures of the company stated that "Logs recording user activities should be retained and regularly

reviewed," yet the company did not present any evidence of the implementation of such procedure.

During all audit activities, the auditors used observation, interviews, documented information review, analysis,

and technical verification to collect information and evidence. All the audit findings during stages 1 and 2

were analyzed and the audit team decided to issue a positive recommendation for certification.

During stage 1 audit, the audit team found out that Sinvestment did not have records on information security

training and awareness. What Sinvestment do in this case? Refer to scenario 6.

A : Correct the identified issue before the stage 2 audit

B : Document the identified issue and correct it after the certification audit is completed

C : Perform a new risk assessment process to understand whether the issue needs modification or not

Answer: A

Question 5

What is the standard definition of ISMS?

A : an information security systematic approach to achieve business objectives for implementation, establishing, reviewing,operating and maintaining organization's reputation.

B : company wide business objectives to achieve information security awareness for establishing, implementing, operating, monitoring, reviewing, maintaining and improving

C : project-based approach to achieve business objectives for establishing, implementing, operating, monitoring, reviewing, maintaining and improving an organization’s information security

D : ystematic approach for establishing, implementing, operating,monitoring, reviewing, maintaining and improving an organization’s information security to achieve business objectives.

Answer: D