PECB Certified ISO/IEC 27001 Lead Implementer Practice Test

PECB Certified ISO/IEC 27001 Lead Implementer Practice Test practice questions, page 9 of 12, with answer review and explanations.

Question 41

An organization has justified the exclusion of control 5.18 Access rights of ISO/IEC 27001 in the Statement of Applicability (SoA) as follows: “An access control reader is already installed at the main entrance of the building.” Which statement is correct?

  1. The justification for the exclusion of a control is not required to be included in the SoA
  2. The justification is not acceptable, because it does not reflect the purpose of control 5.18
  3. The justification is not acceptable because it does not indicate that it has been selected based on the risk assessment results

Question 42

Which statement is an example of risk retention?

  1. An organization has decided to release the software even though some minor bugs have not been fixed yet
  2. An organization has implemented a data loss protection software
  3. An organization terminates work in the construction site during a severe storm

Question 43

Which option below should be addressed in an information security policy?

  1. Actions to be performed after an information security incident
  2. Legal and regulatory obligations imposed upon the organization
  3. The complexity of information security processes and their interactions

Question 44

Which approach should organizations use to implement an ISMS based on ISO/IEC 27001?

  1. An approach that is suitable for organization’s scope
  2. Any approach that enables the ISMS implementation within the 12 month period
  3. Only the approach provided by the standard

Question 45

What risk treatment option has Company A implemented if it has required from its employees the change of email passwords at least once every 60 days?

  1. Risk modification
  2. Risk avoidance
  3. Risk retention