ISO27001
Which of the options below is NOT necessary to have in mind when conducting effective interviews?
Using complex and abstract terminology
Which of the following activities of stage 1 audit does NOT take place during the auditor's on-site visit?
Validating the compliance of the management system with contractual and regulatory requirements
Which type of audit evidence is considered the least reliable?
Verbal
Audit evidence must be:
Verifiable
The scope of the management system and the responsibility of the auditee's top management should be validated during:
Stage 1 audit
Stage 1 audit should not be conducted too far from stage 2 audit.
Stage 1 audit should not be conducted too far from stage 2 audit.
Which documentation should be examined by the auditor first?
Strategic documentation (declaration of scope, objectives and policies, etc.)
Artificial general intelligence (AGI) is also known as:
Strong artificial intelligence
An example of structured data is:
Structured query language (SQL)
What type of evidence is the observation of a firewall configuration?
Technical
What does the integrity principle entail?
That information is accurate and safe from unauthorized access
Which of the statements below regarding the ISMS scope is correct?
The ISMS scope must be available as documented information
The opening meeting agenda can include information on:
The availability of resources
Which parties are involved in an audit offer?
The certification body and the auditor
Which of the following factors should be considered when determining the materiality of a system?
The conditions of service-level agreements
Which option below presents a vulnerability in Webos's client system?
The database encryption problems
What does "control risk" mean?
The risk that a significant defect could not be prevented by the organization's internal control mechanisms
Who is responsible for establishing the information security policy according to ISO/IEC 27001?
The top management
Which of the following is a characteristic of autocratic leaders?
They supervise and control their employees
What type of audit is AuditOrg conducting?
Third party audit
What is the role of an observer?
To accompany the audit team
Why should an auditor consider cultural aspects at every stage of the audit?
To avoid possible conflicts or misunderstandings
Webos conducted technical investigations after its partners reported security incidents. What is the aim of implementing this security control?
To correct the problems and prevent their recurrence
What is the main objective of stage 1 audit?
To determine if internal audits and management reviews are performed
Why should an organization draft a Statement of Applicability?
To document the justifications for the inclusion and exclusion of Annex A controls
What is the main purpose of the opening meeting in an audit?
To ensure that planned audit activities can be performed
What is the purpose of an initial contact with the auditee?
To establish the communication objectives
What is the main objective of stage 2 audit?
To evaluate the implementation of the ISMS
Which of the following is one of the objectives of the privacy protection policy?
To increase awareness regarding the legal requirements for protecting personal information
An organization has clearly defined the security procedures and uses an access control software to avoid unauthorized access of the personnel to its confidential data. What is the function of these security controls?
To prevent the occurrence of incidents
What is one of the main purposes of implementing an ISMS?
To reduce information security risks
Why should the auditor interview the person responsible for the ISMS in an organization?
To understand how the organization operates with the management system in place
A guide's responsibilities include maintaining logistics, ensuring that health and safety policies are observed, and facilitating audit activities.
True
A piece of audit evidence can be a combination of several types of evidence
True
A well-designed documentation standard improves the overall quality of the audit.
True
An auditor must have sufficient knowledge of and practical experience in the use of electronic media.
True
Webos's project failed due to the lack of segregation of duties during the maternity leave of the software development team leader. Which of the following is a threat that can impact Webos in this situation?
Unauthorized use of the system
Which of the options below represents an example of a vulnerability?
Unencrypted data
Leaders who are attentive to the needs and emotions of their employees and listen to their opinions but they themselves take the final decisions are categorized as:
Democratic leaders
Migration to the Windows Azure SQL database would solve the availability problems by reducing the _____________
Disruption of operations
How would you evaluate the level of responsibility demonstrated by AuditOrg's auditors?
No negligence, since the auditors have demonstrated due diligence during the audit
How many audit team leaders should be appointed for a joint audit?
One audit team leader
What can have an impact on the availability of information?
Performance degradation
Which is the most appropriate cloud computing solution when an organization wants to reduce the coding time?
Platform as a service (PaaS)
Which is the first phase of stage 1 audit?
Prepare for on-site activities
An audit team leader must be competent to:
Prepare the audit conclusions
What is the aim of laws with regard to intellectual property rights?
Protecting certain intangible assets
What can trigger the initiation of a change in the audit scope?
Recent changes in the existing processes
The auditor has accessed logs to the server room. What source of information was collected?
Records
What makes audit evidence appropriate?
Relevance and reliability
What does the ISO/IEC 27001 standard provide?
Requirements for an information security management system
The risk that remains after risk treatment is known as:
Residual risk
What step should an auditor follow to ensure the competence of staff in outsourced operations?
Review the service provider's processes and employees' contracts
An organization has decided to move its information-processing facilities to a place where the risk of flooding is low. What option of risk treatment is this?
Risk avoidance
Which type of audit approach focuses on matters that are significant for the auditee?
Risk-based approach
What is the difference between specifications and records?
Specifications are documents that state requirements, whereas records are documents that state achieved results
To which classification of security controls does the implementation of patches after the identification of system vulnerabilities belong?
Corrective by function and technical by type
What criteria should be considered when selecting a risk assessment methodology?
Costs and availability of supporting software tools
A third party that performs the assessment of conformity of management systems is:
A certification body
How often should audit team meetings be held?
A meeting held in the morning and another at the end of the day
A former employee of Company A has gained unauthorized access to the company's sensitive information. What does this present?
A threat that has the potential to harm the assets of the organization, such as information or systems
When does the surveillance audit take place?
After obtaining certification
By segregating the duties of the software development team, Webos implemented:
An administrative control
Your Market is a market research company which helps its customers determine which products and services are on demand. The company is currently evaluating the effectiveness of its information security controls through an ISMS audit. What is Your Market in this case?
An auditee
Which services can be managed by the user when using Platform as a Service (PaaS)?
Application and data
Auditors use the _______________ as a reference to determine conformity
Audit criteria
How does the audit team select processes and systems to be tested?
Based on materiality
How can an auditor verify conformity to control A.9.2.6 Removal or adjustment of access rights of ISO/IEC 27001 by using analytical evidence?
By analyzing results of the access rights removal procedure on a sample of users upon the termination of their contracts
How is audit evidence evaluated?
By comparing it against the audit criteria
How can big data technology tools be beneficial for auditors?
By retrieving data that may be considered sensitive
Which of the statements holds true with certification bodies?
Certification bodies are accredited by accreditation bodies
__________________ includes delivering hosted services over the internet, such as infrastructure as a service or platform as a service.
Cloud computing
Which of the following is a step in audit planning?
Conducting risk assessment
During the audit, documented information involving proprietary information was protected at all times. Which principle of maintaining audit work documents has been followed?
Confidentiality
With which of the following principles does an organization comply if it ensures that only authorized users have access to their sensitive data?
Confidentiality
What type of evidence is an external audit report?
Confirmative
AuditOrg's audit team members have collected all types of evidence below, except
Confirmative evidence
What factors should an auditor consider when evaluating the conformity of documented information?
Content and format
What must an auditor collect to ensure the relevance of an audit procedure?
Evidence
Which of the following options is NOT an audit procedure?
Evidence collection synthesis
Which auditing principle has AuditOrg applied in this case, "The findings helped the auditors support their conclusions and report all audit activities truthfully and accurately?"
Fair presentation
During an ISO/IEC 27001 audit, auditors must obtain absolute assurance that every single process is effective and conforms to the standard requirements.
False
ISO performs accreditation and certification activities
False
Organizations can obtain certification against the ISO/IEC 27002 standard if they implement all of its information security controls.
False
Supervised machine learning is used to group data based only on outputs and includes clustering, representation learning, and density estimation.
False
The auditee determines the audit objectives.
False
The certification agreement document formalizes the acceptance of an audit mandate from the auditor.
False
The implementation of ISO/IEC 27001 is a legal requirement in most countries.
False
The quality review of audit evidence will assure that the audit findings are reliable and valid.
False
What does ISO 19011 provide?
Fundamental principles of auditing
What action is taken during stage 1 audit when evaluating materiality during the audit?
Identifying the key processes to be audited
What is the impact of new technologies in auditing processes?
Increase audit efficiency and help in minimizing costs
The auditor issued an unfavorable report for Company 1 by strictly examining the audit evidence. He was not intimidated when Company 1, the main client of his audit firm, threated to terminate the contract if the audit report does not suit them. Which principle of auditing has the auditor followed?
Independence
Which type of audit risk is known as the risk that occurs in the management system despite the internal control mechanisms in an organization?
Inherent risk
Materiality is taken into account to determine the duration of the audit based on the risks inherent to the organization during:
Initial contact
Company X evaluated and improved its risk management and core processes by using the insights and recommendations provided by the _______________ activities.
Internal audit
What should an auditor do to evaluate the top management's commitment to the information security management system?
Interview the auditee's top management
According to ISO 9000, what is an asset?
Item or entity that has potential or actual value to an organization
Linear regression and logistic regression are algorithms utilized by:
Machine learning
Based on the scenario, can Finanvo request the replacement of the audit team members?
Yes, two of AuditOrg's auditors have worked for one of Finanvo's biggest competitors, which is a valid reason to request the replacement of audit team members
