Free PECB ISO-IEC-27001-Lead-Auditor Actual Exam Questions

In the context of a third-party certification audit, it is very important to have effective
communication. Select an option that contains the correct answer about communication in an audit
context.

You are performing an ISMS audit at a residential nursing home called ABC that provides healthcare
services. You find all nursing home residents wear an electronic wristband for monitoring their
location, heartbeat, and blood pressure always. You learned that he electronic wristband
automatically uploads all data to the artificial intelligence (AI) cloud server for healthcare monitoring
and analysis by healthcare staff.
To verify the scope of ISMS, you interview the management system representative (MSR) who
explains that the ISMS scope covers an outsourced data center.
Select four options for the clauses and/or controls of ISO/IEC 27001:2022 that are directly relevant to
the verification of the scope of the ISMS.

You are performing an ISMS audit at a residential nursing home that provides healthcare services.
The next step in your audit plan is to verify the information security incident management process.
The IT Security Manager presents the information security incident management procedure and
explains that the process is based on ISO/IEC 27035-1:2016.
You review the document and notice a statement "any information security weakness, event, and
incident should be reported to the Point of Contact (PoC) within 1 hour after identification". When
interviewing staff, you found that there were differences in the understanding of the meaning of
"weakness, event, and incident".
You sample incident report records from the event tracking system for the last 6 months with
summarized results in the following table.

You would like to further investigate other areas to collect more audit evidence. Select two options
that will not be in your audit trail.

Scenario 6: Sinvestment is an insurance company that offers home, commercial, and life insurance.
The company was founded in North Carolina, but have recently expanded in other locations,
including Europe and Africa.
Sinvestment is committed to complying with laws and regulations applicable to their industry and
preventing any information security incident. They have implemented an ISMS based on ISO/IEC
27001 and have applied for ISO/IEC 27001 certification.
Two auditors were assigned by the certification body to conduct the audit. After signing a
confidentiality agreement with Sinvestment. they started the audit activities. First, they reviewed the
documentation required by the standard, including the declaration of the ISMS scope, information
security policies, and internal audits reports. The review process was not easy because, although
Sinvestment stated that they had a documentation procedure in place, not all documents had the
same format.
Then, the audit team conducted several interviews with Sinvestment's top management to
understand their role in the ISMS implementation. All activities of the stage 1 audit were performed
remotely, except the review of documented information, which took place on-site, as requested by
Sinvestment.
During this stage, the auditors found out that there was no documentation related to information
security training and awareness program. When asked, Sinvestment's representatives stated that the
company has provided information security training sessions to all employees. Stage 1 audit gave the
audit team a general understanding of Sinvestment's operations and ISMS.
The stage 2 audit was conducted three weeks after stage 1 audit. The audit team observed that the
marketing department (which was not included in the audit scope) had no procedures in place to
control employees’ access rights. Since controlling employees' access rights is one of the ISO/IEC
27001 requirements and was included in the information security policy of the company, the issue
was included in the audit report. In addition, during stage 2 audit, the audit team observed that
Sinvestment did not record logs of user activities. The procedures of the company stated that "Logs
recording user activities should be retained and regularly reviewed," yet the company did not
present any evidence of the implementation of such procedure.
During all audit activities, the auditors used observation, interviews, documented information
review, analysis, and technical verification to collect information and evidence. All the audit findings
during stages 1 and 2 were analyzed and the audit team decided to issue a positive recommendation
for certification.
According to scenario 6, the marketing department employees were not following the access control
policy. Which option is correct in this case?

Which six of the following actions are the individual(s) managing the audit programme responsible
for?

Scenario:
Northstorm is an online retail shop offering unique vintage and modern accessories. It initially
entered a small market but gradually grew thanks to the development of the overall e-commerce
landscape. Northstorm works exclusively online and ensures efficient payment processing, inventory
management, marketing tools, and shipment orders. It uses prioritized ordering to receive, restock,
and ship its most popular products.
Northstorm has traditionally managed its IT operations by hosting its website and maintaining full
control over its infrastructure, including hardware, software, and data administration. However, this
approach hindered its growth due to the lack of responsive infrastructure. Seeking to enhance its e-
commerce and payment systems, Northstorm opted to expand its in-house data centers, completing
the expansion in two phases over three months. Initially, the company upgraded its core servers,
point-of-sale, ordering, billing, database, and backup systems. The second phase involved improving
mail, payment, and network functionalities. Additionally, during this phase, Northstorm adopted an
international standard for personally identifiable information (PII) controllers and PII processors
regarding PII processing to ensure its data handling practices were secure and compliant with global
regulations.
Despite the expansion, Northstorm's upgraded data centers failed to meet its evolving business
demands. This inadequacy led to several new challenges, including issues with order prioritization.
Customers reported not receiving priority orders, and the company struggled with responsiveness.
This was largely due to the main server's inability to process orders from YouDecide, an application
designed to prioritize orders and simulate customer interactions. The application, reliant on
advanced algorithms, was incompatible with the new operating system (OS) installed during the
upgrade.
Faced with urgent compatibility issues, Northstorm quickly patched the application without proper
validation, leading to the installation of a compromised version. This security lapse resulted in the
main server being affected and the company's website going offline for a week. Recognizing the
need for a more reliable solution, the company decided to outsource its website hosting to an e-
commerce provider. The company signed a confidentiality agreement concerning product ownership
and conducted a thorough review of user access rights to enhance security before transitioning.
Based on Scenario 1, which international standard did Northstorm adopt during the second phase of
expansion?

In the context of a third-party certification audit, confidentiality is an issue in an audit programme.
Select two options which correctly state the function of confidentiality in an audit

You are performing an ISMS initial certification audit at a residential nursing home that provides
healthcare services. The next step in your audit plan is to conduct the closing meeting. During the
final audit team meeting, as an audit team leader, you agree to report 2 minor nonconformities and
1 opportunity for improvement as below:

Select one option of the recommendation to the audit programme manager you are going to advise
to the auditee at the closing meeting.

Scenario 4: Branding is a marketing company that works with some of the most famous companies in
the US. To reduce internal costs. Branding has outsourced the software development and IT helpdesk
operations to Techvology for over two years. Techvology. equipped with the necessary expertise,
manages Branding's software, network, and hardware needs. Branding has implemented an
information security management system (ISMS) and is certified against ISO/IEC 27001,
demonstrating its commitment to maintaining high standards of information security. It actively
conducts audits on Techvology to ensure that the security of its outsourced operations complies with
ISO/IEC 27001 certification requirements.
During the last audit. Branding's audit team defined the processes to be audited and the audit
schedule. They adopted an evidence based approach, particularly in light of two information security
incidents reported by Techvology in the past year The focus was on evaluating how these incidents
were addressed and ensuring compliance with the terms of the outsourcing agreement
The audit began with a comprehensive review of Techvology's methods for monitoring the quality of
outsourced operations, assessing whether the services provided met Branding's expectations and
agreed-upon standards The auditors also verified whether Techvology complied with the contractual
requirements established between the two entities This involved thoroughly examining the terms
and conditions in the outsourcing agreement to guarantee that all aspects, including information
security measures, are being adhered to.
Furthermore, the audit included a critical evaluation of the governance processes Techvology uses to
manage its outsourced operations and other organizations. This step is crucial for Branding to verify
that proper controls and oversight mechanisms are in place to mitigate potential risks associated
with the outsourcing arrangement.
The auditors conducted interviews with various levels of Techvology's personnel and analyzed the
incident resolution records. In addition, Techvology provided the records that served as evidence that
they conducted awareness sessions for the staff regarding incident management. Based on the
information gathered, they predicted that both information security incidents were caused by
incompetent personnel. Therefore, auditors requested to see the personnel files of the employees
involved in the incidents to review evidence of their competence, such as relevant experience,
certificates, and records of attended trainings.
Branding's auditors performed a critical evaluation of the validity of the evidence obtained and
remained alert for evidence that could contradict or question the reliability of the documented
information received. During the audit at Techvology, the auditors upheld this approach by critically
assessing the incident resolution records and conducting thorough interviews with employees at
different levels and functions. They did not merely take the word of Techvology's representatives for
facts; instead, they sought concrete evidence to support the representatives' claims about the
incident management processes.
Based on the scenario above, answer the following question:
According to Scenario 4, what type of audit evidence did the auditors collect to determine the source
of the information security incidents?

Select two of the following options that are the responsibility of a legal technical expert on the audit
team during a certification audit.

What is the difference between a restricted and confidential document?

When multiple offices of a certification body are involved, what must be ensured?

DRAG DROP
You are an experienced ISMS audit team leader providing instruction to an auditor in training. They
are unclear in their understanding of risk processes and ask you to provide them with an example of
each of the processes detailed below.
Match each of the descriptions provided to one of the following risk management processes.
To complete the table click on the blank section you want to complete so that it is highlighted in red,
and then click on the applicable text from the options below. Alternatively, you may drag and drop
each option to the appropriate blank section.

DRAG DROP
You have just completed a scheduled information security audit of your organisation when the IT
Manager approaches you and asks for your assistance in the revision of the company's risk
management process.
He is attempting to update the current documentation to make it easier for other managers to
understand, however, it is clear from your discussion he is confusing several key terms.
You ask him to match each of the descriptions with the appropriate risk term. What should the
correct answers be?

DRAG DROP
As the ISMS audit team leader, you are conducting a second-party audit of an international logistics
company on behalf of an online retailer. During the audit, one of your team members reports a
nonconformity relating to control 5.18 (Access rights) of Appendix A of ISO/IEC 27001:2022. She
found evidence that removing the server access protocols of 20 people who left in the last 3 months
took up to 1 week whereas the policy required removing access within 24 hours of their departure.
Complete the sentence with the best word(s), dick on the blank section you want to complete so that
it is highlighted in red, and then click on the applicable text from the options below. Alternatively,
you may drag and drop the option to the appropriate blank section.