Instant Access PECB.ISO-IEC-27001-Lead-Auditor-CN.v2026-03-23.q289 Actual Practice Test Engine for Free (Page 34)

Question 161

您正在作為審核組組長進行您的第一次第三方 ISMS 監督審核。您目前與審核團隊的另一位成員一起在被審核方的資料中心。
您的同事似乎不確定資訊安全事件和資訊安全事件之間的差異。您嘗試透過提供範例來解釋差異。
下列哪三種場景可以定義為資訊安全事件？

A.組織的惡意軟體防護軟體可防止病毒
B.硬碟機在建議更換日期之後使用
C.組織收到網路釣魚電子郵件
D.員工在輪班結束時未能清理辦公桌
E.未收到付款的承包商刪除了高階管理人員 ICT 帳戶
F.不滿意的員工未經許可更改薪資記錄
G.組織未通過第三方滲透測試
H.組織的行銷資料被駭客複製並出售給競爭對手

Correct Answer: E,F,H

According to ISO/IEC 27000:2018, which provides an overview and vocabulary of information security management systems, an information security event is an identified occurrence of a system, service or network state indicating a possible breach of information security policy or failure of safeguards, or a previously unknown situation that may be security relevant1. An information security incident is a single or a series of unwanted or unexpected information security events that have a significant probability of compromising business operations and threatening information security1. Therefore, based on this definition, three examples of information security incidents are:
* A contractor who has not been paid deletes top management ICT accounts: This is an example of an unwanted or unexpected information security event that has a significant probability of compromising business operations and threatening information security, as it may result in loss of access, data, or functionality for the top management.
* An unhappy employee changes payroll records without permission: This is an example of an unwanted or unexpected information security event that has a significant probability of compromising business operations and threatening information security, as it may result in financial fraud, legal liability, or reputational damage for the organization.
* The organisation's marketing data is copied by hackers and sold to a competitor: This is an example of an unwanted or unexpected information security event that has a significant probability of compromising business operations and threatening information security, as it may result in loss of confidentiality, competitive advantage, or customer trust for the organization.
The other options are not examples of information security incidents, but rather information security events that may or may not lead to incidents depending on their impact and severity. For example:
* The organisation's malware protection software prevents a virus: This is an example of an identified occurrence of a system state indicating a possible breach of information security policy or failure of safeguards, but it does not have a significant probability of compromising business operations and threatening information security, as it is prevented by the malware protection software.
* A hard drive is used after its recommended replacement date: This is an example of an identified occurrence of a system state indicating a possible breach of information security policy or failure of safeguards, but it does not have a significant probability of compromising business operations and threatening information security, unless it fails or causes other problems.
* The organisation receives a phishing email: This is an example of an identified occurrence of a network state indicating a possible breach of information security policy or failure of safeguards, but it does not have a significant probability of compromising business operations and threatening information security, unless it is opened or responded to by the recipient.
* An employee fails to clear their desk at the end of their shift: This is an example of an identified occurrence of a service state indicating a possible breach of information security policy or failure of safeguards, but it does not have a significant probability of compromising business operations and threatening information security, unless the desk contains sensitive or confidential information that is accessed by unauthorized persons.
* The organisation fails a third-party penetration test: This is an example of an identified occurrence of a system state indicating a possible breach of information security policy or failure of safeguards, but it does not have a significant probability of compromising business operations and threatening information security, unless the penetration test reveals serious vulnerabilities that are exploited by malicious actors.
References: ISO/IEC 27000:2018 - Information technology - Security techniques - Information security management systems - Overview and vocabulary

Question 162

您是一位審核小組組長，剛完成了對行動電信供應商的第三方審核。您正在準備審計報告，並即將完成標題為「保密」的部分。
您團隊中受訓的審核員會詢問您是否在任何情況下可以將機密報告發佈給第三方。
以下哪四個答案是錯的？

A.雖然我們建議客戶該報告是保密的，但如果我們認為合理，我們可以決定將其發佈給第三方。我們總是事後告訴客戶
B.報告可以發佈給第三方，但必須經過審計客戶的明確事先批准
C.在任何情況下都不能將報告發佈給第三方。機密意味著機密，洩漏該文件將構成違反信任
D.起始立場始終是第三方沒有自動存取審核報告的權利
E.如果第三方已獲得我們揭露報告的法律通知，那麼我們必須這樣做。在所有此類情況下，我們都會向審核客戶以及受審核方（如適用）提供建議
F.審核機構僱用的任何審核員都可以存取審核報告
G.我們的保密義務並不是永遠持續的。作為認證機構，我們可以決定將報告保密多久。此後，第三方可以透過提出主題存取請求來存取它們
H.分包審核員被視為保密方面的第三方，因此通常受保密協議的約束

Correct Answer: A,F,G,H

The audit report is a confidential document that contains sensitive information about the auditee's ISMS and its performance. The audit team has a duty to protect the confidentiality of the audit report and only disclose it to authorized parties, such as the audit client, the certification body, and the accreditation body. Therefore, the following responses are false:
* A: The audit team cannot decide to release the report to third parties without the consent of the audit client, as this would breach the confidentiality agreement and the audit code of conduct. The audit team should always inform the audit client before disclosing the report to any third party, and obtain their explicit, prior approval.
* F: Not every auditor employed by the auditing organization can access the audit report, as this would violate the principle of need-to-know. Only auditors who are involved in the audit process, such as the audit team leader, the audit team members, the audit programme manager, and the certification decision maker, can access the audit report. Other auditors who are not related to the audit have no legitimate reason to access the report, and should be prevented from doing so by appropriate security measures.
* G: The duty of confidentiality does not expire after a certain period of time, as this would compromise the trust and integrity of the audit process. The audit report remains confidential indefinitely, unless there is a legal or contractual obligation to disclose it, or the audit client agrees to release it. Third parties cannot access the audit report by making a subject access request, as this would infringe the privacy and data protection rights of the audit client and the auditee.
* H: Subcontracted auditors are not considered to be third parties regarding confidentiality, as they are part of the audit team and have a contractual relationship with the auditing organization. Subcontracted auditors are typically bound by the same confidentiality agreement and audit code of conduct as the employed auditors, and have the same rights and responsibilities to access and protect the audit report.
References: =
* ISO/IEC 27001:2022, clause 9.2, Internal audit
* ISO/IEC 27006:2015, clause 7.2.3, Confidentiality
* PECB Candidate Handbook ISO 27001 Lead Auditor, page 22, Audit Report
* PECB Candidate Handbook ISO 27001 Lead Auditor, page 24, Audit Code of Conduct

Question 163

問題
在審計結論最終確定之前，認證機構指定的另一位審計員會審核審計組長的工作文件。根據良好的審計實踐，下列哪一項敘述是正確的？

A.如果審核員由認證機構指定並具備執行審核的資格，則此類審核是可以接受的。
B.審計組長的工作只有在審計結論最終確定後才能進行審查。
C.審計團隊負責人獨自負責審核自己的工作文件，無需任何外部審核。

Question 164

在啟動審計活動之前，審計員會考慮被審計方的背景、關鍵流程和期望。運用了哪一項審計原則？

A.應有的專業謹慎
B.專業懷疑論
C.誠信

Question 165

情境 6：Sinvestment 是一家提供家庭保險、商業保險和人壽保險的保險公司。該公司成立於北卡羅來納州，但最近在其他地區進行了擴張，包括歐洲和非洲。
Sinvestment 致力於遵守適用於其行業的法律法規，並防止任何資訊安全事件。他們實施了基於 ISO/IEC 27001 的 ISMS 並申請了 ISO/IEC 27001 認證。
認證機構指派兩名審核員進行審核。與Sinvestment簽訂保密協議後。他們開始了審計活動。首先，他們審查了標準要求的文件，包括 ISMS 範圍聲明、資訊安全政策和內部稽核報告。審查過程並不容易，因為儘管 Sinvestment 表示他們已製定文件程序，但並非所有文件都具有相同的格式。
隨後，審計小組對Sinvestment的高階主管進行了多次訪談，以了解他們在ISMS實施中的作用。第一階段審計的所有活動都是遠端進行的，除了根據 Sinvestment 的要求在現場進行的文件資訊審查之外。
在此階段，審計人員發現沒有與資訊安全培訓和意識計劃相關的文件。被問及時，Sinvestment代表表示，公司已為所有員工提供資訊安全培訓課程。第一階段審計讓審計團隊對 Sinvestment 的營運和 ISMS 有了整體了解。
第二階段審核在第一階段審核三週後進行。審計小組觀察到，行銷部門（未包含在審計範圍內）沒有適當的程序來控制員工的存取權限。由於控制員工的存取權限是ISO/IEC 27001的要求之一，並且已包含在公司的資訊安全政策中，因此該問題包含在審計報告中。此外，在第二階段審計中，審計小組觀察到Sinvestment沒有記錄使用者活動日誌。
該公司的程序規定“記錄用戶活動的日誌應保留並定期審查”，但該公司沒有提供任何執行該程序的證據。
在所有審核活動中，審核員透過觀察、訪談、文件化資訊審查、分析和技術驗證來收集資訊和證據。對第一階段和第二階段的所有審核結果進行了分析，審核小組決定發布積極的認證建議。
根據情境 6，在第一階段審核期間，審核員發現一些有關 ISMS 的文件具有不同的格式。在這種情況下，審計師該做什麼？

A.驗證記錄的資訊是否具有適當的格式並且符合公司的記錄程序，因為這是標準的要求
B.僅驗證是否記錄了標準要求的信息，而不考慮格式，因為這不是標準的要求
C.將此觀察結果記錄為第 2 階段應在審核期間驗證的問題

Question 161

Question 162

Question 163

Question 164

Question 165

Download PDF File