Free PECB ISO-IEC-27001-Lead-Auditor Exam Dumps Questions & Answers

A data processing tool crashed when a user added more data in the buffer than its storage capacity allows. The incident was caused by the tool's inability to bound check arrays. What kind of vulnerability is this?

• A.Intrinsic vulnerability, because inability to bound check arrays is a characteristic of the data processing tool
• B.Extrinsic vulnerability, because inability to bound check arrays is related to external factors
• C.None, the tool's inability to bound check arrays is not a vulnerability, but a threat

ISMS (1)---------------helps determine (2)--------------,

• A.Q (1) Management review, (2) opportunities for continual improvement
• B.(1) Continual improvement, (2) the effectiveness of corrective actions
• C.(1) Internal audit, (2) the ISMS scope

Scenario 8: Tessa. Malik, and Michael are an audit team of independent and qualified experts in the field of security, compliance, and business planning and strategies. They are assigned to conduct a certification audit in Clastus, a large web design company. They have previously shown excellent work ethics, including impartiality and objectiveness, while conducting audits. This time, Clastus is positive that they will be one step ahead if they get certified against ISO/IEC 27001.
Tessa, the audit team leader, has expertise in auditing and a very successful background in IT-related issues, compliance, and governance. Malik has an organizational planning and risk management background. His expertise relies on the level of synthesis and analysis of an organization's security controls and its risk tolerance in accurately characterizing the risk level within an organization On the other hand, Michael is an expert in the practical security of controls assessment by following rigorous standardized programs.
After performing the required auditing activities, Tessa initiated an audit team meeting They analyzed one of Michael s findings to decide on the issue objectively and accurately. The issue Michael had encountered was a minor nonconformity in the organization's daily operations, which he believed was caused by one of the organization's IT technicians As such, Tessa met with the top management and told them who was responsible for the nonconformity after they inquired about the names of the persons responsible To facilitate clarity and understanding, Tessa conducted the closing meeting on the last day of the audit.
During this meeting, she presented the identified nonconformities to the Clastus management. However, Tessa received advice to avoid providing unnecessary evidence in the audit report for the Clastus certification audit, ensuring that the report remains concise and focused on the critical findings.
Based on the evidence examined, the audit team drafted the audit conclusions and decided that two areas of the organization must be audited before the certification can be granted. These decisions were later presented to the auditee, who did not accept the findings and proposed to provide additional information. Despite the auditee's comments, the auditors, having already decided on the certification recommendation, did not accept the additional information. The auditee's top management insisted that the audit conclusions did not represent reality, but the audit team remained firm in their decision.
Based on the scenario above, answer the following question:
Question:
The audit team did not accept Clastus's additional information because they had already made the certification recommendation. Is this acceptable?

• A.Yes, once the audit team decides on a certification recommendation, they cannot accept any additional information
• B.No, the auditor should not consider revisions that resulted from discussions with the auditee in the certification recommendation decision
• C.No, the auditee can provide additional information if they disagree with the certification recommendation

Scenario 4
SendPay is a financial services company specializing in global money transfers through a network of agents and institutions. As a new company in the market, SendPay aims to deliver top-quality services with its fee- free digital platform, launched last year, enabling clients to send and receive money anytime via smartphones and laptops. At that time, SendPay outsourced software operations to an external team, which also managed the company's technology infrastructure.
Recently, the company applied for ISO/IEC 27001 certification after having an ISMS in place for almost a year.
During the audit, the auditors focused on reviewing SendPay's outsourced operations, specifically looking at the software development and technology infrastructure maintenance handled by the outsourced company.
They followed a structured approach, which included reviewing and evaluating SendPay's processes for monitoring the quality of these outsourced operations. This included verifying if the company met its contractual obligations, ensuring proper governance procedures for engaging outsourced entities, and assessing SendPay's plans in case of expected or unexpected termination of outsourcing agreements.
However, the auditors subtly noted that SendPay's protocols did not fully address contingencies for unanticipated cancellations of outsourcing agreements. Additionally, a technical expert appointed by SendPay assisted the auditors, providing specific knowledge and expertise related to the outsourced operations being audited.
The audit team calculated the number of training hours employees received on ISMS to ensure alignment with established objectives. They also computed the average resolution time of information security incidents based on a sample taken during the audit, which provided valuable insights into SendPay's incident management practices. In addition, the auditors evaluated the reliability of the evidence collected during the audit. They considered several factors influencing the reliability of audit evidence. For example, evidence from surveillance cameras provided more objective proof compared to photos. Timing also played a crucial role in reliability, with mechanisms like transaction recording enhancing the credibility of the evidence.
SendPay uses cloud-based platforms to make its operations more efficient and scalable. However, during the audit, the auditors did not request SendPay to provide an inventory of their cloud activities due to resource limitations, relying instead on SendPay's representations.
Question
What factor did the audit team primarily consider when evaluating the reliability of evidence during the audit process? Refer to Scenario 4.

• A.Objectivity of the evidence
• B.Evidence collection techniques
• C.Independence of the source

An auditor of organisation A performs an audit of supplier B. Which two of the following actions is likely to represent a breach of confidentiality by the auditor after having identified findings in B's information security management system?

• A.Shares the findings with B's other customers
• B.Shares the findings with other relevant managers in A
• C.Shares the findings with other relevant managers in B
• D.Shares the findings with B's Information Security Manager
• E.Shares the findings with B's certification body
• F.Shares the findings with A's supplier evaluation team