QUESTION: 57

Scenario: Webvue, headquartered in Japan, is a technology company specializing in the development, support, and maintenance of computer software Webvue provides solutions across various technology fields and business sectors. Its flagship service is CloudWebvue, a comprehensive cloud computing platform offering storage, networking, and virtual computing services. Designed for both businesses and individual users, CloudWebvue is known for its flexibility, scalability, and reliability.

Webvue has decided to only include CloudWebvue in its ISO/IEC 27001 certification scope. Thus, the stage 1 and 2 audits were performed simultaneously. Webvue takes pride in its strictness regarding asset confidentiality. They protect the information stored in CloudWebvue by using appropriate cryptographic controls. Every piece of information of any classification level, whether for internal use, restricted, or confidential, is first encrypted with a unique corresponding hash and then stored in the cloud.

The audit team comprised five persons Keith, Sean, Layla, Sam, and Tina. Keith, the most experienced auditor on the IT and information security auditing team, was the audit team leader. His responsibilities included planning the audit and managing the audit team. Sean and Layla were experienced in project planning, business analysis, and IT systems (hardware and application). Their tasks included audit planning according to Webvue's internal systems and processes. Sam and Tina, on the other hand, who had recently completed their education, were responsible for completing the day-to-day tasks while developing their audit skills.

While verifying conformity to control 8.24 Use of cryptography of ISO/IEC 27001 Annex A through interviews with the relevant staff, the audit team found out that the cryptographic keys have been initially generated based on random bit generator (RBG) and other best practices for the generation of the cryptographic keys. After checking Webvue's cryptography policy, they concluded that the information obtained by the interviews was true. However, the cryptographic keys are still in use because the policy does not address the use and lifetime of cryptographic keys.

As later agreed upon between Webvue and the certification body, the audit team opted to conduct a virtual audit specifically focused on verifying conformity to control 8.11 Data Masking of ISO/IEC 27001 within Webvue, aligning with the certification scope and audit objectives. They examined the processes involved in protecting data within CloudWebvue, focusing on how the company adhered to its policies and regulatory standards. As part of this process, Keith, the audit team leader, took screenshot copies of relevant documents and cryptographic key management procedures to document and analyze the effectiveness of Webvue's practices.

Webvue uses generated test data for testing purposes. However, as determined by both the interview with the manager of the QA Department and the procedures used by this department, sometimes live system data are used. In such scenarios, large amounts of data are generated while producing more accurate results. The test data is protected and controlled, as verified by the simulation of the encryption process performed by Webvue's personnel during the audit.

While interviewing the manager of the QA Department, Keith observed that employees in the Security Training Department were not following proper procedures, even though this department fell outside the audit scope. Despite the exclusion in the audit scope, the nonconformity in the Security Training Department has potential implications for the processes within the audit scope, specifically impacting data security and cryptographic practices in CloudWebvue. Therefore, Keith incorporated this finding into the audit report and accordingly informed the auditee.

Based on scenario, was Keith's choice regarding the incorporation of the Security Training Department in the audit report appropriate?

Yes, he should have incorporated the Security Training Department in the audit report
No, he should have included it without informing the auditee about the observed situation
No, he should not have included it and only informed the auditee about the observed situation

Answer(s): A

Explanation:

Although the Security Training Department was outside the audit scope, Keith's decision to include the findings in the audit report was appropriate. The issue observed in the Security Training Department has potential implications for data security and cryptographic practices in CloudWebvue, which are part of the audit scope. ISO/IEC 27001 requires auditors to report issues that could impact the effectiveness of the Information Security Management System (ISMS), even if they fall outside the immediate audit scope. By documenting and informing the auditee about the observed nonconformity, Keith ensured transparency and upheld the integrity of the audit process. This action reflects a responsible and thorough approach to auditing, addressing risks that could affect the overall security framework.

Reveal Solution Next Question

QUESTION: 58

As an auditor, you have noticed that ABC Inc. has established a procedure to manage the removable storage media. The procedure is based on the classification scheme adopted by ABC Inc. Thus, if the information stored is classified as "confidential," the procedure applies. On the other hand, information classified as "public" does not have confidentiality requirements; thus, only a procedure for ensuring its integrity and availability applies. What type of audit finding is this?

Nonconformity
Anomaly
Conformity

Answer(s): A

Explanation:

A nonconformity refers to a situation where an organization's practices, processes, or procedures do not comply with established requirements or standards. In this case, the procedure for managing removable storage media seems to be inadequate because it treats "public" information differently and does not apply confidentiality requirements, even though ISO/IEC 27001 mandates that security controls (including confidentiality) should be applied based on the risk assessment, not just the classification of the information. By allowing "public" information to not be covered under confidentiality controls, this represents a nonconformity with the security requirements of ISO/IEC 27001.

Reveal Solution Next Question

QUESTION: 59

EquiBank is undergoing an external audit of its financial management system. The auditors are evaluating the logic of transactions processed by EquiBank's financial software. To ensure accuracy, they use simulations to validate operations, calculations, and controls programmed in the software applications. What type of computer assisted audit technique (CAAT) is used by the auditors?

Plotting and cartography software applications
Utility software
Data test

Answer(s): C

Explanation:

Data test is a type of Computer Assisted Audit Technique (CAAT) that is used to validate and evaluate the logic, operations, calculations, and controls of software applications by simulating transactions and checking their correctness. This approach helps auditors test whether the software functions as expected and whether the calculations and processes are accurate, ensuring that the system operates in compliance with requirements.

Reveal Solution Next Question

QUESTION: 60

What is the purpose of using a combination of audit test plans?

To verify compliance with standards and criteria through multiple methods
To ensure that all areas of the organization are audited equally
To reduce the need for frequent audits

Answer(s): A

Explanation:

The purpose of using a combination of audit test plans is to employ multiple methods to verify compliance with standards and criteria. This approach helps auditors gather more comprehensive evidence, ensuring that different aspects of the system or process are evaluated thoroughly. By using various methods (such as documentation reviews, interviews, sampling, and testing), auditors can assess compliance from different angles, leading to more accurate and reliable audit results.

Reveal Solution Next Question

Free ISO/IEC 27001 Lead Auditor Exam Braindumps (page: 16)

QUESTION: 57

Explanation:

QUESTION: 58

Explanation:

QUESTION: 59

Explanation:

QUESTION: 60

Explanation:

ISO/IEC 27001 Lead Auditor Discussions & Posts