Free ISO-IEC-27001-Lead-Implementer Exam Braindumps
ISO/IEC 27001 Lead Implementer Questions 56–60 (page: 13)

Scenario 9: OpenTech provides IT and communications services. It helps data communication enterprises and network operators become multi-service providers. During an internal audit, its internal auditor, Tim, has identified nonconformities related to the monitoring procedures. He identified and evaluated several system vulnerabilities.
Tim found out that user IDs for systems and services that process sensitive information have been reused and the access control policy has not been followed. After analyzing the root causes of this nonconformity, the ISMS project manager developed a list of possible actions to resolve the nonconformity. Then, the ISMS project manager analyzed the list and selected the activities that would allow the elimination of the root cause and the prevention of a similar situation in the future. These activities were included in an action plan. The action plan, approved by the top management, was written as follows:
A new version of the access control policy will be established and new restrictions will be created to ensure that network access is effectively managed and monitored by the Information and Communication Technology (ICT) Department.
The approved action plan was implemented and all actions described in the plan were documented.
Based on scenario 9, OpenTech has taken all the actions needed, except _______________.

Based on ISO/IEC 27001, what areas within the organization require establishing rules, procedures, and agreements for information transfer?

Scenario 34: BioLooVitalis is a biopharmaceutical firm headquartered in Singapore. Renowned for its pioneering work in the field of human therapeutics, BioLooVitalis places a strong emphasis on addressing critical healthcare concerns, particularly in the domains of cardiovascular diseases, oncology, bone health, and inflammation. BioLooVitalis has demonstrated its commitment to data security and integrity by maintaining an effective information security management system (ISMS) based on ISO/IEC 27001 for the past two years.
After noticing an increase in failed login attempts over several weeks, BioLooVitalis's IT security team reviewed log data, correlated it with user behavior patterns, and mapped it against known attack vectors to determine potential causes. Based on their findings, they prepared a technical report detailing the nature of the anomalies and submitted it to the compliance function. The compliance team then summarized the findings and presented them to the executive management during the quarterly ISMS performance review.
To proactively track system behavior following the spike in failed login attempts, BioLooVitalis's IT security team configured a dashboard showing real time login activity, system response times, and end point availability across departments. This helped the team quickly detect abnormal behavior without waiting for formal reporting cycles. Following the implementation of the real time access control dashboard, BioLooVitalis's internal audit team assessed whether the new processes and tools effectively reduced unauthorized access attempts and met both technical and policy-based requirements.
Lastly, the internal auditors collected system-generated access logs, reviewed user access reports, and conducted interviews with IT personnel. These data sources helped them verify whether the new controls were functioning as intended and aligned with internal ISMS objectives.
Based on the scenario above, answer the following question.
According to scenario 34, which reporting method was used by BioLooVitalis?

Scenario 7: InfoSec is a multinational corporation headquartered in Boston, MA, which provides professional electronics, gaming, and entertainment services. After facing numerous information security incidents, InfoSec has decided to establish teams and implement measures to prevent potential incidents in the future.
Emma, Bob, and Anna were hired as the new members of InfoSec’s information security team, which consists of a security architecture team, an incident response team (IRT) and a forensics team. Emma’s job is to create information security plans, policies, protocols, and training to prepare InfoSec to respond to incidents effectively. Emma and Bob would be full-time employees of InfoSec, whereas Anna was contracted as an external consultant.
Bob, a network expert, will deploy a screened subnet network architecture. This architecture will isolate the demilitarized zone (DMZ) to which hosted public services are attached and InfoSec’s publicly accessible resources from their private network. Thus, InfoSec will be able to block potential attackers from causing unwanted events inside the company’s network. Bob is also responsible for ensuring that a thorough evaluation of the nature of an unexpected event is conducted, including the details on how the event happened and what or whom it might affect.
Anna will create records of the data, reviews, analysis, and reports in order to keep evidence for the purpose of disciplinary and legal action, and use them to prevent future incidents. To do the work accordingly, she should be aware of the company’s information security incident management policy beforehand.
Among others, this policy specifies the type of records to be created, the place where they should be kept, and the format and content that specific record types should have.
According to scenario 7, a demilitarized zone (DMZ) is deployed within InfoSec’s network.
What type of control has InfoSec implemented in this case?

Scenario 17: InVid Electric is an American company that specializes in manufacturing, developing, and selling network hardware. The company has had an operational information security management system (ISMS) based on ISO/IEC 27001 requirements and a quality management system (QMS) based on ISO 9001 for approximately two years. Recently, it has applied for a combined certification audit in order to obtain certification against ISO/IEC 27001 and ISO 9001.
After selecting the certification body, InVid Electric prepared the employees for the audit. The company decided to not conduct a self-evaluation before the audit since, according to the top management, it was not necessary. In addition, it ensured the availability of documented information, including internal audit reports and management reviews, technologies in place, and the general operations of the ISMS and the QMS. However, the company requested from the certification body that the documentation could not be carried off-site.
Nonetheless, the audit was not performed within the scheduled time frame because InVid Electric rejected the assigned audit team leader and requested their replacement. According to the top management reasoning, the audit team leader represented a potential conflict of interest as the same audit team leader issued a recommendation for certification to InVid Electric’s main competitor.
Based on scenario 17, did InVid Electric provide a valid reason for requesting the replacement of the audit team leader?