Free ISO-IEC-27001-Lead-Implementer Exam Braindumps
ISO/IEC 27001 Lead Implementer Questions 76–80 (page: 17)

Scenario 38: BotanéBloom is a skincare brand specializing in plant-based formulations designed to nourish and enhance skin health. Founded on principles of sustainability and ethical sourcing, the company has established a reputation for science-backed, nature-inspired solutions that cater to a diverse clientele.
In response to evolving consumer shopping habits, BotanéBloom transitioned from traditional retail to a digital-first business model. Initially, its new online store began processing credit card payments directly. To comply with a relevant security standard, the company reviewed requirements such as encrypting cardholder data, limiting access, and maintaining a secure network.
As part of its digital transformation, BotanéBloom considered launching a chatbot powered by a third-party generative AI platform to handle customer service inquiries. However, a risk assessment revealed serious concerns related to data privacy, model unpredictability, and a lack of transparency regarding the processing and storage of customer inputs. The legal team also identified potential noncompliance with the General Data Protection Regulation (GDPR) due to uncertainties in the AI vendor data handling practices. Following internal reviews, executive leadership decided to postpone the chatbot deployment until a more secure and transparent solution could be guaranteed.
During the assessment, the company also identified that a sudden system crash caused by a malfunctioning server could lead to temporary loss of access to customer orders and inventory data. This malfunction was not linked to any malicious activity. To address risks identified in its new e-commerce operations, BotanéBloom implemented several security controls:
• Deployed a web application firewall (WAF) to protect against malicious traffic
• Initiated weekly management reviews focused on system uptime and incident response
• Revised job descriptions to reflect new digital security roles and responsibilities
Despite these initial security enhancements, BotanéBloom later experienced a data breach after an intern accidentally exposed a private administrative key on a public forum. In response, the company changed all system access credentials, updated onboarding procedures for interns, and implemented log analysis for account activity.
Based on the scenario above, answer the following question.
In scenario 38, BotanéBloom implemented several controls to address risks in its new e-commerce operations.
Which type of controls were NOT implemented as part of this effort?

Scenario 32: Nimbus Route, a cloud-native logistics optimization company based in the Netherlands, offers AI-driven route planning, fleet management tools, and real-time shipment tracking solutions to clients across Europe and North America. To safeguard sensitive logistics data and ensure resilience across its cloud services, Nimbus Route has implemented an information security management system (ISMS) based on ISO/IEC 27001. The company is also integrating intelligent transport systems and predictive analytics to increase operational efficiency and sustainability. As part of the ISMS implementation process, the company is determining the competence levels required to manage its ISMS. It has considered various factors when defining these competence requirements, including technological advancements, regulatory requirements, the company's mission, strategic objectives, available resources, as well as the needs and expectations of its customers. Furthermore, the company has established clear guidelines for internal and external communication related to the ISMS, defining what information to share, when to share it, with whom, and through which channels. However, not all communications have been formally documented; instead, the company classified and managed communication based on its needs, ensuring that documentation is maintained only to the extent necessary for the ISMS's effectiveness. To support its expanding digital services and ensure operational scalability, Nimbus Route utilizes virtualized computing resources provided by an external cloud service provider. This setup allows the company to configure and manage its operating systems, deploy applications, and control storage environments as needed while relying on the provider to maintain the underlying cloud environment. To further enhance its predictive capabilities, Nimbus Route is adopting machine learning techniques across several of its core services. Specifically, it uses machine learning for route optimization and delivery time estimation, leveraging algorithms such as logistic regression and support vector machines to identify patterns in historical transportation data. As Nimbus Route's ISMS matures, the company has chosen a phased approach to its transition into full operational mode. Rather than waiting for a formal launch, individual elements of the ISMS, such as risk treatment procedures, access controls, and audit logging, are being activated progressively as soon as they are developed and approved. Based on the scenario above, answer the following question.
Which type of machine learning is Nimbus Route using to enhance its delivery and scheduling accuracy? Refer to scenario 32.

An organization has implemented a control that enables the company to manage storage media through their life cycle of use, acquisition, transportation and disposal.
Which control category does this control belong to?

Scenario 11: Antiques is the biggest online antique shop in Scotland. Their products include jewelry, clothing, furniture, and technology. They decided to build their own custom platform in-house and outsource the payment process to PayPal, a company operating online payment systems that supports online money transfers.
Due to this transformation of the business model, a number of security controls were implemented based on the identified threats and vulnerabilities associated to critical assets. To protect customers’ information, employees of Antiques had to sign a confidentiality agreement. In addition, the company reviewed all user access rights so that only authorized personnel can have access to sensitive files and drafted a new segregation of duties chart.
However, the transition was difficult for the IT team, who had to deal with a security incident not long after transitioning to the e-commerce model. After investigating the incident, the team concluded that due to the out-of-date anti-malware software, an attacker gained access to their files and exposed customers’ information, including their names and home addresses.
The IT team decided to stop using the old anti-malware software and install a new one which would automatically remove malicious code in case of similar incidents. The new software was installed in every workstation within the company. After installing the new software, the team updated it with the latest malware definitions and enabled the automatic update feature to keep it up to date at all times. Additionally, they established an authentication process that requires a user identification and password when accessing sensitive information.
In addition, Antiques conducted a number of information security awareness sessions for the IT team and other employees that have access to confidential information in order to raise awareness on the importance of system and network security.
According to scenario 11, to detect (1) _______________ Antiques should have implemented (2) _______________.

Scenario 36: Mauve is a logistics and supply chain management company that specializes in warehousing, inventory control, and regional transportation services for retail and pharmaceutical clients. After successfully implementing an information security management system (ISMS) aligned with ISO/IEC 27001, Mauve is now preparing for an ISMS certification audit to formally demonstrate its commitment to information security. To prepare for the audit, the company first informed its employees about the upcoming visit and organized training sessions to ensure they were ready. It also prepared the necessary documented information in advance so that all relevant materials would be readily available when requested by the external auditors. In addition, the company identified staff members with the appropriate knowledge to support the auditors in understanding and evaluating the implemented processes. As part of its preparations, it also carried out an internal review to evaluate its level of readiness. During the planning phase for the audit, Mauve reviewed the list of assigned auditors provided by the certification body. Upon reviewing the list, Mauve identified a potential conflict of interest with one of the auditors, who had previously worked for Mauve's main competitor in the banking industry. To ensure the integrity of the audit process, Mauve refused to undergo the audit until a new audit member was assigned. In response, the certification body acknowledged the conflict of interest and made the necessary adjustments to ensure the audit team's impartiality. After the resolution of this issue, the auditors of Mauve visited the company's site to assess the implementation and effectiveness of its ISMS. They reviewed evidence of conformity with the standard's requirements, evaluated performance monitoring against objectives, and verified compliance with statutory, regulatory, and contractual obligations. The audit also included a review of operational controls, internal audits, management reviews, and top management's responsibility for the company's policies. After the on-site visit, the team prepared the audit conclusions and notified the auditee that no nonconformities had been detected. The audit team leader then issued a recommendation for certification upon filing of corrective action plans. After receiving the recommendation from the audit team leader, the certification body established a committee to decide on certification. The committee included one individual with auditing experience and two other experts from the certification body, none of whom were involved in conducting the audit. Based on the scenario above, answer the following question.
Which audit phase was conducted after the issue with the audit team was resolved?
Did Mauve follow all of the best practices while preparing for the certification audit? Refer to scenario 36.