PECB Certified ISO/IEC 27001 Lead Implementer Practice Test

PECB Certified ISO/IEC 27001 Lead Implementer Practice Test practice questions, page 7 of 12, with answer review and explanations.

Question 31

Which of the actions presented in scenario 4 is NOT compliant with the requirements of ISO/IEC 27001?

  1. TradeB selected only ISO/IEC 27001 controls deemed applicable to the company
  2. The Statement of Applicability was drafted before conducting the risk assessment
  3. The external experts selected security controls and drafted the Statement of Applicability

Question 32

What should TradeB do in order to deal with residual risks? Refer to scenario 4.

  1. TradeB should evaluate, calculate, and document the value of risk reduction following risk treatment
  2. TradeB should immediately implement new controls to treat all residual risks
  3. TradeB should accept the residual risks only above the acceptance level

Question 33

Scenario 5: Operaze is a small software development company that develops applications for various companies around the world. Recently, the company conducted a risk assessment to assess the information security risks that could arise from operating in a digital landscape. Using different testing methods, including penetration testing and code review, the company identified some issues in its ICT systems, including improper user permissions, misconfigured security settings, and insecure network configurations. To resolve these issues and enhance information security. Operaze decided to implement an information security management system (ISMS) based on ISO/IEC 27001.Considering that Operaze is a small company, the entire IT team was involved in the ISMS implementation project. Initially, the company analyzed the business requirements and the internal and external environment, identified its key processes and activities, and identified and analyzed the interested parties. In addition, the top management of Operaze decided to include most of the company’s departments within the ISMS scope. The defined scope included the organizational and physical boundaries. The IT team drafted an information security policy and communicated it to all relevant interested parties. In addition, other specific policies were developed to elaborate on security issues and the roles and responsibilities were assigned to all interested parties.Following that, the HR manager claimed that the paperwork created by ISMS does not justify its value and the implementation of the ISMS should be canceled. However, the top management determined that this claim was invalid and organized an awareness session to explain the benefits of the ISMS to all interested parties.Operaze decided to migrate its physical servers to their virtual servers on third-party infrastructure. The new cloud computing solution brought additional changes to the company. Operaze’s top management, on the other hand, aimed to not only implement an effective ISMS but also ensure the smooth running of the ISMS operations. In this situation, Operaze’s top management concluded that the services of external experts were required to implement their information security strategies. The IT team, on the other hand, decided to initiate a change in the ISMS scope and implemented the required modifications to the processes of the company.Based on the scenario above, answer the following question:What led Operaze to implement the ISMS?

  1. Identification of vulnerabilities
  2. Identification of threats
  3. Identification of assets

Question 34

Based on scenario 5, after migrating to cloud, Operaze’s IT team changed the ISMS scope and implemented all the required modifications. Is this acceptable?

  1. Yes, because the ISMS scope should be changed when there are changes to the external environment
  2. No, because the company has already defined the ISMS scope
  3. No, because any change in ISMS scope should be accepted by the management

Question 35

Based on scenario 5, in which category of the interested parties does the HR manager of Operaze belong?

  1. Positively influenced interested parties, because the ISMS will increase the effectiveness and efficiency of the HR Department
  2. Negatively influenced interested parties, because the HR Department will deal with more documentation
  3. Both A and B