구매 전에 자료의 품질을 직접 확인하고 싶으시다면 Fast2test의 무료 샘플을 이용해 보시기 바랍니다. ISO-IEC-27001-Lead-Auditor 연습문제 418문항 중 일부를 미리 체험해 보고 PECB Certified ISO/IEC 27001 Lead Auditor 준비 방향을 잡으실 수 있습니다.

PECB ISO-IEC-27001-Lead-Auditor 시험 개요:

PECB ISO-IEC-27001-Lead-Auditor 시험 요강 주제:

PECB Certified ISO/IEC 27001 Lead Auditor 시험, 이런 질문이 가장 많습니다

최신 ISO 27001 ISO-IEC-27001-Lead-Auditor 무료샘플문제

문제 #1

Scenario 6: Sinvestment is an insurance company that offers home, commercial, and life insurance. The company was founded in North Carolina, but have recently expanded in other locations, including Europe and Africa.
Sinvestment is committed to complying with laws and regulations applicable to their industry and preventing any information security incident. They have implemented an ISMS based on ISO/IEC 27001 and have applied for ISO/IEC 27001 certification.
Two auditors were assigned by the certification body to conduct the audit. After signing a confidentiality agreement with Sinvestment. they started the audit activities. First, they reviewed the documentation required by the standard, including the declaration of the ISMS scope, information security policies, and internal audits reports. The review process was not easy because, although Sinvestment stated that they had a documentation procedure in place, not all documents had the same format.
Then, the audit team conducted several interviews with Sinvestment's top management to understand their role in the ISMS implementation. All activities of the stage 1 audit were performed remotely, except the review of documented information, which took place on-site, as requested by Sinvestment.
During this stage, the auditors found out that there was no documentation related to information security training and awareness program. When asked, Sinvestment's representatives stated that the company has provided information security training sessions to all employees. Stage 1 audit gave the audit team a general understanding of Sinvestment's operations and ISMS.
The stage 2 audit was conducted three weeks after stage 1 audit. The audit team observed that the marketing department (which was not included in the audit scope) had no procedures in place to control employees' access rights. Since controlling employees' access rights is one of the ISO/IEC 27001 requirements and was included in the information security policy of the company, the issue was included in the audit report. In addition, during stage 2 audit, the audit team observed that Sinvestment did not record logs of user activities.
The procedures of the company stated that "Logs recording user activities should be retained and regularly reviewed," yet the company did not present any evidence of the implementation of such procedure.
During all audit activities, the auditors used observation, interviews, documented information review, analysis, and technical verification to collect information and evidence. All the audit findings during stages 1 and 2 were analyzed and the audit team decided to issue a positive recommendation for certification.
Based on scenario 6, during stage 1 audit, the auditor found out that some documents regarding the ISMS had different format. What should the auditor do in this case?

A. Verify if the documented information has the appropriate format and is in accordance with the company's documentation procedure since this is a requirement of the standard
B. Document this observation as an issue that should be verified during stage 2 audit
C. Verify only if the information required by the standard is documented without taking into account the format since this is not a requirement of the standard

문제 #2

An audit team leader is planning a follow-up audit after the completion of a third-party surveillance audit earlier in the year. They have decided they will verify the nonconformities that require corrections before they move on to consider corrective actions.
Based on the descriptions below, which four of the following are corrections for nonconformities identified at the surveillance?

A. A signature missing from a client's contract for the supply of data services was added
B. An incorrectly dated purchase order for a new network switch was rectified
C. Scheduled management reviews, having been missed, were prioritised by the General Manager for holding on a specific date twice each following year
D. The documented process for product shipment, which did not reflect how this activity was conducted by the despatch team, was re-written and the team trained accordingly
E. A software installation guide which had not been sent to the client along with their new system was posted out
F. Data centre staff not carrying out backups in accordance with specified procedures were retrained
G. Hard drive HD302 which had been colour-coded green (available for use) instead of red (to be destroyed) was removed from the system
H. The organisation, having failed to maintain its Schedule of Applicability, re-allocated responsibility for its updating to the Technical Director

문제 #3

Scenario 9: Techmanic is a Belgian company founded in 1995 and currently operating in Brussels. It provides IT consultancy, software design, and hardware/software services, including deployment and maintenance. The company serves sectors like public services, finance, telecom, energy, healthcare, and education. As a customer-centered company, it prioritizes strong client relationships and leading security practices.
Techmanic has been ISO/IEC 27001 certified for a year and regards this certification with pride. During the certification audit, the auditor found some inconsistencies in its ISMS implementation. Since the observed situations did not affect the capability of its ISMS to achieve the intended results, Techmanic was certified after auditors followed up on the root cause analysis and corrective actions remotely During that year, the company added hosting to its list of services and requested to expand its certification scope to include that area The auditor in charge approved the request and notified Techmanic that the extension audit would be conducted during the surveillance audit Techmanic underwent a surveillance audit to verify its iSMS's continued effectiveness and compliance with ISO/IEC 27001. The surveillance audit aimed to ensure that Techmanic's security practices, including the recent addition of hosting services, aligned seamlessly with the rigorous requirements of the certification The auditor strategically utilized the findings from previous surveillance audit reports in the recertification activity with the purpose of replacing the need for additional recertification audits, specifically in the IT consultancy sector. Recognizing the value of continual improvement and learning from past assessments.
Techmanic implemented a practice of reviewing previous surveillance audit reports. This proactive approach not only facilitated identifying and resolving potential nonconformities but also aimed to streamline the recertification process in the IT consultancy sector.
During the surveillance audit, several nonconformities were found. The ISMS continued to fulfill the ISO/IEC
27001*s requirements, but Techmanic failed to resolve the nonconformities related to the hosting services, as reported by its internal auditor. In addition, the internal audit report had several inconsistencies, which questioned the independence of the internal auditor during the audit of hosting services. Based on this, the extension certification was not granted. As a result. Techmanic requested a transfer to another certification body. In the meantime, the company released a statement to its clients stating that the ISO/IEC 27001 certification covers the IT services, as well as the hosting services.
Based on the scenario above, answer the following question:
Question:
According to ISO/IEC 17021-1, what is the purpose of surveillance audits?

A. To evaluate the financial performance of the organization
B. To assess compliance and grant initial certification
C. To maintain confidence in the certified management system between audits

문제 #4

Objectives, criteria, and scope are critical features of a third-party ISMS audit. Which two issues are audit objectives?
* Evaluate customer processes and functions

A. Assess conformity with ISO/IEC 27001 requirements
B. Review organisation efficiency
C. Confirm sites operating the ISMS
D. Fulfil the audit plan
E. Determine the scope of the ISMS

문제 #5

You are an ISMS audit team leader who has been assigned by your certification body to carry out a follow-up audit of a client. You are preparing your audit plan for this audit.
Which two of the following statements are true?

A. Verification should focus on whether any action undertaken has been undertaken effectively
B. Corrective actions should be reviewed first, followed by corrections and finally opportunities for improvement
C. Corrections should be verified first, followed by corrective actions and finally opportunities for improvement
D. Verification should focus on whether any action undertaken is complete
E. Opportunities for improvement should be verified first, followed by corrections and finally corrective actions
F. Verification should focus on whether any action undertaken taken has been undertaken efficiently

질문과 대답: