Free Access PECB.ISO-IEC-27001-Lead-Auditor.v2024-07-04.q280 Practice Test (Page 53)

Question 256

You are an audit team leader who has just completed a third-party audit of a mobile telecommunication provider. You are preparing your audit report and are just about to complete a section headed 'confidentiality'.
An auditor in training on your team asks you if there are any circumstances under which the confidential report can be released to third parties.
Which four of the following responses are false?

A.Although we advise the client the report is confidential we can decide to release it to third parties if we feel this is justified. We would always tell the client afterwards

B.The report can be released to third parties but only with the explicit, prior approval of the audit client

C.There are no circumstances under which the report can be released to a third party. Confidential means confidential and releasing the document would be a breach of trust

D.The starting position is always that third parties have no automatic right to access an audit report

E.If the third party has gained a legal notice for us to disclose the report then we must do so. In all such cases we would advise the audit client and, as appropriate, the auditee

F.Any auditor employed by the auditing organisation can access the audit report

G.Our duty of confidentiality is not something that lasts forever. As a certification body, we can decide how long we wish to keep reports confidential. After this, they can be accessed by third parties making a subject access request

H.Subcontracted auditors are considered to be third parties regarding confidentiality and are therefore typically bound by confidentiality agreements

Correct Answer: A,F,G,H

Explanation
The audit report is a confidential document that contains sensitive information about the auditee's ISMS and its performance. The audit team has a duty to protect the confidentiality of the audit report and only disclose it to authorized parties, such as the audit client, the certification body, and the accreditation body. Therefore, the following responses are false:
A: The audit team cannot decide to release the report to third parties without the consent of the audit client, as this would breach the confidentiality agreement and the audit code of conduct. The audit team should always inform the audit client before disclosing the report to any third party, and obtain their explicit, prior approval.
F: Not every auditor employed by the auditing organization can access the audit report, as this would violate the principle of need-to-know. Only auditors who are involved in the audit process, such as the audit team leader, the audit team members, the audit programme manager, and the certification decision maker, can access the audit report. Other auditors who are not related to the audit have no legitimate reason to access the report, and should be prevented from doing so by appropriate security measures.
G: The duty of confidentiality does not expire after a certain period of time, as this would compromise the trust and integrity of the audit process. The audit report remains confidential indefinitely, unless there is a legal or contractual obligation to disclose it, or the audit client agrees to release it. Third parties cannot access the audit report by making a subject access request, as this would infringe the privacy and data protection rights of the audit client and the auditee.
H: Subcontracted auditors are not considered to be third parties regarding confidentiality, as they are part of the audit team and have a contractual relationship with the auditing organization. Subcontracted auditors are typically bound by the same confidentiality agreement and audit code of conduct as the employed auditors, and have the same rights and responsibilities to access and protect the audit report.
References: =
ISO/IEC 27001:2022, clause 9.2, Internal audit
ISO/IEC 27006:2015, clause 7.2.3, Confidentiality
PECB Candidate Handbook ISO 27001 Lead Auditor, page 22, Audit Report
PECB Candidate Handbook ISO 27001 Lead Auditor, page 24, Audit Code of Conduct

Question 257

Changes on project-managed applications or database should undergo the change control process as documented.

A.False

B.True

Question 258

All are prohibited in acceptable use of information assets, except:

A.Company-wide e-mails with supervisor/TL permission.

B.Messages with very large attachments or to a large number ofrecipients.

C.Electronic chain letters

D.E-mail copies to non-essential readers

Question 259

How is the purpose of information security policy best described?

A.An information security policy provides direction and support to the management regarding information security.

B.An information security policy provides insight into threats and the possible consequences.

C.An information security policy documents the analysis of risks and the search for countermeasures.

D.An information security policy makes the security plan concrete by providing it with the necessary details.

Question 260

You are an ISMS auditor conducting a third-party surveillance audit of a telecom's provider. You are in the equipment staging room where network switches are pre-programmed before being despatched to clients. You note that recently there has been a significant increase in the number of switches failing their initial configuration test and being returned for reprogramming.
You ask the Chief Tester why and she says, 'It's a result of the recent ISMS upgrade'. Before the upgrade each technician had their own hard copy work instructions. Now, the eight members of my team have to share two laptops to access the clients' configuration instructions online. These delays put pressure on the technicians, resulting in more mistakes being made'.
Based solely on the information above, which clause of ISO/IEC 27001:2022 would be the most appropriate to raise a nonconformity against? Select one.

A.Clause 7.2 - Competence

B.Clause 8.1 - Operational planning and control

C.Clause 7.5 - Documented information

D.Clause 10.2 - Nonconformity and corrective action

Other Version: 5114PECB.ISO-IEC-27001-Lead-Auditor.v2025-07-30.q306; 3520PECB.ISO-IEC-27001-Lead-Auditor.v2024-10-22.q296; 1823PECB.ISO-IEC-27001-Lead-Auditor.v2024-05-07.q128; 1633PECB.ISO-IEC-27001-Lead-Auditor.v2023-05-01.q35; 1624PECB.ISO-IEC-27001-Lead-Auditor.v2022-05-18.q33; 1863PECB.ISO-IEC-27001-Lead-Auditor.v2022-01-24.q33; 118PECB.Exams4sures.ISO-IEC-27001-Lead-Auditor.v2021-11-27.by.elva.33q.pdf

Latest Upload: 447PaloAltoNetworks.NGFW-Engineer.v2026-05-01.q43; 582Nokia.4A0-113.v2026-05-01.q69; 609EC-COUNCIL.312-49v11.v2026-04-30.q214; 584Microsoft.MB-820.v2026-04-30.q101; 437Salesforce.MC-202.v2026-04-30.q57; 479BICSI.INSTC_V8.v2026-04-29.q53; 579NMLS.MLO.v2026-04-28.q82; 403NCARB.Project-Management.v2026-04-28.q27; 756EMC.D-AV-DY-23.v2026-04-27.q184; 1979ServiceNow.CSA.v2026-04-27.q483

Question 256

Question 257

Question 258

Question 259

Question 260

Download PDF File