Information or data that are classified as public do not require labeling. Public information or data are those that are intended for general disclosure and have no impact on the organization's operations or reputation if disclosed. Labeling is a method of implementing classification, which is a process of structuring information according to its sensitivity and value for the organization. Labeling helps to identify the level of protection and handling required for each type of information. Information or data that are classified as internal, confidential, or highly confidential require labeling, as they contain information that is not suitable for public disclosure and may cause harm or loss to the organization if disclosed. References: : CQI & IRCA ISO 27001: 2022 Lead Auditor Course Handbook, page 34. : CQI & IRCA ISO 27001:2022 Lead Auditor Course Handbook, page 37. : [ISO/IEC 27001 LEAD AUDITOR - PECB], page 14.
The best action to take in this scenario is to determine whether any additional effective arrangements are in place to verify individual access to secure areas, such as CCTV. This action is consistent with the audit principle of evidence-based approach, which requires the auditor to obtain sufficient and appropriate audit evidence to support the audit findings and conclusions1. By verifying the existence and effectiveness of other security controls, the auditor can assess the extent and impact of the nonconformity observed, and determine the appropriate audit finding and recommendation. The other options are not the best actions to take in this scenario, because they are either premature or inappropriate. For example: *Option A is inappropriate, because it is not the auditor's role to suggest specific solutions or improvements to the auditee, but rather to report the audit findings and recommendations based on the audit criteria and objectives2. A large sign in reception may not be an effective or feasible solution to address the issue of tailgating, and it may not reflect the root cause of the problem. *Option C is premature, because it assumes that the control A.7.1 'security perimeters' is not adequately implemented, without verifying the existence and effectiveness of other security controls that may compensate for the observed nonconformity. The auditor should not jump to conclusions based on a single observation, but rather gather sufficient and appropriate audit evidence to support the audit finding3. *Option D is premature, because it assumes that the control A.7.6 'working in secure areas' is not adequately implemented, without verifying the existence and effectiveness of other security controls that may compensate for the observed nonconformity. The auditor should not jump to conclusions based on a single observation, but rather gather sufficient and appropriate audit evidence to support the audit finding3. *Option E is inappropriate, because it is not related to the observed nonconformity, which is about the access control to secure areas, not the information security requirements agreed upon with the supplier. The auditor should not raise a nonconformity based on irrelevant or incorrect audit criteria4. *Option F is inappropriate, because it is not the auditor's role to suggest specific solutions or improvements to the auditee, but rather to report the audit findings and recommendations based on the audit criteria and objectives2. Requiring contractors to be accompanied at all times when accessing secure facilities may not be an effective or feasible solution to address the issue of tailgating, and it may not reflect the root cause of the problem. References: 1: ISO 19011:2018, 5.2; 2: ISO 19011:2018, 6.6; 3: ISO 19011:2018, 6.2; 4: ISO 19011:2018, 6.3; : ISO 19011:2018; : ISO 19011:2018; : ISO 19011:2018; : ISO 19011:2018
It was appropriate for the audit team to include the observed deficiency in the audit report, making option A the correct answer. ISO/IEC 17021-1 and ISO 19011 require auditors to report all relevant findings that relate to conformity with the audit criteria, regardless of whether the affected department is formally listed within the audit scope. What matters is whether the issue relates to ISMS requirements or policies. In this scenario, access rights control is explicitly included in Sinvestment's information security policy and is a core requirement of ISO/IEC 27001. The absence of access control procedures in the marketing department represents a weakness in the implementation of an ISMS requirement. Even though the marketing department was not part of the defined audit scope, the auditors became aware of a condition that could negatively affect the effectiveness of the ISMS as a whole. Option B is incorrect because merely communicating the issue informally would undermine transparency and traceability. Audit reports must provide a complete and accurate record of findings. Option C is incorrect because marketing departments frequently handle personal data and sensitive information, particularly in an insurance context, and therefore clearly pose potential ISMS risks. Auditors are required to report relevant findings objectively and without omission. Therefore, inclusion of the issue in the audit report was appropriate.
Question 94
下列哪一項關於資訊安全威脅和漏洞的敘述是不正確的？
Correct Answer: C
Comprehensive and Detailed In-Depth C . Incorrect Statement - Not all vulnerabilities require immediate remediation. Risk assessment determines whether controls are necessary. Some vulnerabilities pose low risks and may not need urgent fixes. A . Correct Statement - Vulnerabilities can be intrinsic (inherent flaws) or extrinsic (caused by external misconfigurations). B . Correct Statement - Threats must exploit vulnerabilities to cause harm. This aligns with ISO/IEC 27001:2022 Annex A Control A.8.8 (Management of Technical Vulnerabilities).
Question 95
審核方法可以與代表受審核方的個人互動，也可以不互動。下列哪兩種方法具有互動性？
Correct Answer: C,E
According to the PECB Candidate Handbook for ISO/IEC 27001 Lead Auditor, audit methods can be classified into two categories: with or without interaction with individuals representing the auditee (page 12). Audit methods with interaction include reviewing checklists with auditee and conducting interviews, as they involve direct communication and feedback from the auditee. Audit methods without interaction include sampling (e.g. products), observing work performed via live video streaming, checking legal compliance with local authorities, and analysing documents provided in advance of the audit, as they do not require any dialogue or exchange with the auditee. Reference: PECB Candidate Handbook for ISO/IEC 27001 Lead Auditor, page 12.
