Which one of the following conclusions in the audit report is not required by the certification body when deciding to grant certification?
Answer(s): B
The organization fully complies with all legal and other requirements applicable to the Information Security Management System: This is not typically required in the audit report for deciding whether certification can be granted. While legal and regulatory compliance is important and may be evaluated during the audit, the certification body is primarily concerned with whether the organization's Information Security Management System (ISMS) meets the ISO/IEC 27001 standard's requirements, not necessarily its compliance with all applicable legal and other requirements. Legal compliance may be considered, but it is not an absolute condition for certification against ISO/IEC 27001.
Select two of the following options that are the responsibility of a legal technical expert on the audit team during a certification audit. (Choose two.)
Answer(s): A,F
Advising on legal checkpoints for the audit team: The legal technical expert is responsible for providing advice on the relevant legal checkpoints during the audit. They ensure that the audit team is aware of the applicable laws, regulations, and legal requirements that may impact the Information Security Management System (ISMS) being audited.Verifying the legal status of the organization: The legal technical expert is also responsible for verifying the legal status of the organization. This ensures that the organization is compliant with any legal requirements relevant to the industry or region, and it may impact the audit process.
Select two options that describe an advantage of using a checklist. (Chose two.)
Answer(s): A,B
Ensuring relevant audit trails are followed: A checklist helps the auditor ensure that all necessary steps are covered during the audit, which assists in maintaining an organized and traceable audit trail. This is important for compliance and documentation purposes, ensuring that no critical steps are overlooked.Ensuring the audit plan is implemented: The checklist serves as a tool to help auditors follow the planned audit process, ensuring that all elements of the audit plan are covered systematically and in a structured manner.
DRAG DROP (Drag and Drop is not supported)You have just completed a scheduled information security audit of your organization when the IT Manager approaches you and asks for your assistance in the revision of the company's risk management process.He is attempting to update the current documentation to make it easier for other managers to understand, however, it is clear from your discussion he is confusing several key terms.You ask him to match each of the descriptions with the appropriate risk term. What should the correct answers be?Note: To complete the table, click on the blank section you want to complete so that it is highlighted in red, and then click on the applicable text from the options below. Alternatively, drag and drop each option to the appropriate blank section.Select and Place:
Answer(s): A
The strategy chosen to respond to a specific information security risk This is a definition of information security risk treatment.The effect of uncertainty on information security objectivesThis is a definition of information security risk.The requirements against which information security risks are evaluated This is a definition of information security risk criteria.A definition of the overall level of information security risk that is considered to be tolerable This is a definition of information security risk acceptance criteria.
You are an experienced ISMS audit team leader conducting a third-party surveillance visit.You notice that although the auditee is claiming conformity with ISO/IEC 27001:2022 they are still referring to Improvement as clause 10.2 (as it was in the 2013 edition) when this is now clause 10.1 in the 2022 edition. You have confirmed they are meeting all of the 2022 requirements set out in the standard.Select one option of the action you should take.
Answer(s): D
Although the auditee is meeting the requirements set out in the 2022 edition of ISO/IEC 27001, referring to clause 10.2 (from the 2013 version) is a minor inconsistency with the standard's new clause numbering. Since this does not affect the effectiveness of the ISMS, it should be raised as an opportunity for improvement, rather than as a nonconformity. This will help the organization align fully with the latest version of the standard.
Post your Comments and Discuss PECB ISO-IEC-27001-Lead-Auditor exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the ISO-IEC-27001-Lead-Auditor content, but please register or login to continue.