Exercise - ISO27001 LEAD AUDITOR

1. Which statement below best describes the relationship between information security aspects?

• 1. Threats exploit vulnerabilities to damage or destroy assets

• 1. Controls protect assets by reducing threats

• 1. Risk is a function of vulnerabilities that harm assets

1. A data processing tool crashed when a user added more data in the buffer than its storage capacity allows.

2. The incident was caused by the tool's inability to bound check arrays. What kind of vulnerability is this?

• 1. Integrity and availability

• 1. Confidentiality and integrity

• 1. Confidentiality and availability

1. Which option below about the ISMS scope is correct?

• 1. ISMS scope should be available as documented information

• 1. ISMS scope should ensure continual improvement

• 1. ISMS scope should be compatible with the strategic orientation of the organization

What factors should an auditor consider when evaluating the conformity of documented information?

• Content and format

• Dates and signatures

• Alignment with policies

1. A marketing agency has developed its own risk assessment approach as part of theISMS implementation. Is this acceptable?

• 1. Yes, any risk assessment methodology that provides accurate and reliable results is acceptable

• 1. Yes, only if the risk assessment methodology is aligned with recognized risk assessment methodologies

• 1. No, when implementing an ISMS, the risk assessment methodology provided by

     ISO/IEC 27001 should be used

1. Which of options below is a control to the management of personnel that aims to avoid the occurrence of incidents?

• 1. The organization regularly provides security awareness and training sessions for its employees

• 1. The organization always reviews the security policy after the integration of a new division to the organization

• 1. The organization conducts regular user access reviews to verify that only authorized employees have access to confidential information

The auditor issued an unfavourable report for Company 1 by strictly examining the audit evidence. He was not intimidated when Company 1, the main client of his audit firm, threatened to terminate the contract if the audit report does not suit them. Which principle of auditing has the auditor followed?

• Independence

• Confidentiality

• Fair presentation

1. The Responsibilities of a ____ include facilitating audit activities, maintaining logistics, ensuring that health and safety policies are observed,

2. and witnessing the audit process on behalf of the auditee.

• 1. Internal auditor

• 1. Observer

• 1. Guide

7. What service model should organizations use to improve their business continuity capabilities and security?

• 1. Infrastructure as a Service

• 1. Platform as a service

• 1. Software as a service

7. Three auditors were assigned to conduct a certification audit in Company X. Before the commencement of the audit, the certification body provided the names and background information about the auditors to Company X. Company X requested the replacement of Bill, one of the auditors, claiming that Bill was a former employee of Company X.

8. Is this acceptable?

• 1. Yes, a situation of conflict of interest is a valid reason to request the replacement of the Auditor

• 1. No, the auditee can request the replacement of the auditor only if a valid reason is presented such as unprofessional conduct or situations with real conflict of interest

• 1. No, the auditee cannot request the replacement of auditors