Online Access Free ISO-IEC-27001-Lead-Auditor Practice Test

Select the words that best complete the sentence:
"The purpose of maintaining regulatory compliance in a management system is to To complete the sentence with the best word(s), click on the blank section you want to complete so that it is highlighted in red, and then click on the applicable text from the options below. Alternatively, you may drag and drop the option to the appropriate blank section.

Correct Answer:

Explanation:

According to ISO 27001:2013, clause 5.2, the top management of an organization must establish, implement and maintain an information security policy that is appropriate to the purpose of the organization and provides a framework for setting information security objectives. The information security policy must also include a commitment to comply with the applicable legal, regulatory and contractual requirements, as well as any other requirements that the organization subscribes to. Therefore, maintaining regulatory compliance is part of fulfilling the management system policy and ensuring its effectiveness and suitability. References:
* ISO/IEC 27001:2013, Information technology - Security techniques - Information security management systems - Requirements, clause 5.2
* PECB Candidate Handbook ISO 27001 Lead Auditor, page 10
* ISO 27001 Policy: How to write it according to ISO 27001

You are conducting a third-party surveillance audit when another member of the audit team approaches you seeking clarification. They have been asked to assess the organisation's application of control 5.7 - Threat Intelligence. They are aware that this is one of the new controls introduced in the 2022 edition of ISO/IEC
27001, and they want to make sure they audit the control correctly.
They have prepared a checklist to assist them with their audit and want you to confirm that their planned activities are aligned with the control's requirements.
Which three of the following options represent valid audit trails?

• A.I will ensure that the organisation's risk assessment process begins with effective threat intelligence
• B.I will ensure that appropriate measures have been introduced to inform top management as to the effectiveness of current threat intelligence arrangements
• C.I will speak to top management to make sure all staff are aware of the importance of reporting threats
• D.I will ensure that the task of producing threat intelligence is assigned to the organisation's internal audit team
• E.I will check that threat intelligence is actively used to protect the confidentiality, integrity and availability of the organisation's information assets
• F.I will check that the organisation has a fully documented threat intelligence process
• G.I will review how information relating to information security threats is collected and evaluated to produce threat intelligence
• H.I will determine whether internal and external sources of information are used in the production of threat intelligence

Question:
Why should materiality be considered during the initial contact?

• A.To determine the audit duration
• B.To define the audit team roles
• C.To set the audit objectives

You are an ISMS auditor conducting a third-party surveillance audit of a telecom's provider. You are in the equipment staging room where network switches are pre-programmed before being despatched to clients. You note that recently there has been a significant increase in the number of switches failing their initial configuration test and being returned for reprogramming.
You ask the Chief Tester why and she says, 'It's a result of the recent ISMS upgrade'. Before the upgrade each technician had their own hard copy work instructions. Now, the eight members of my team have to share two laptops to access the clients' configuration instructions online. These delays put pressure on the technicians, resulting in more mistakes being made'.
Based solely on the information above, which clause of ISO to raise a nonconformity against' Select one.

• A.Clause 7.2 - Competence
• B.Clause 7.4 - Communication
• C.Clause 7.3 - Awareness
• D.Clause 8.1 - Operational planning and control
• E.Clause 10.2 - Nonconformity and corrective action
• F.Clause 7.5 - Documented information

As an auditor, you have noticed that ABC Inc. has established a procedure to manage the removable storage media. The procedure is based on the classification scheme adopted by ABC Inc. Thus, if the information stored is classified as "confidential," the procedure applies. On the other hand, the information that is classified as "public," does not have confidentiality requirements: thus, only a procedure for ensuring its integrity and availability applies. What type of audit finding is this?

• A.Anomaly
• B.Nonconformity
• C.Conformity