Free ISO-IEC-27001-Lead-Implementer Exam Braindumps
ISO/IEC 27001 Lead Implementer Questions 106–110 (page: 23)

A small organization that is implementing an ISMS based on ISO/IEC 27001 has decided to outsource the internal audit function to a third party. Is this acceptable?

What supports the continual improvement of an ISMS?

Scenario 2: Beauty is a cosmetics company that has recently switched to an e-commerce model, leaving the traditional retail. The top management has decided to build their own custom platform in-house and outsource the payment process to an external provider operating online payments systems that support online money transfers.
Due to this transformation of the business model, a number of security controls were implemented based on the identified threats and vulnerabilities associated to critical assets. To protect customers’ information. Beauty’s employees had to sign a confidentiality agreement. In addition, the company reviewed all user access rights so that only authorized personnel can have access to sensitive files and drafted a new segregation of duties chart.
However, the transition was difficult for the IT team, who had to deal with a security incident not long after transitioning to the e-commerce model. After investigating the incident, the team concluded that due to the out-of-date anti-malware software, an attacker gained access to their files and exposed customers’ information, including their names and home addresses.
The IT team decided to stop using the old anti-malware software and install a new one which would automatically remove malicious code in case of similar incidents. The new software was installed in every workstation within the company. After installing the new software, the team updated it with the latest malware definitions and enabled the automatic update feature to keep it up to date at all times. Additionally, they established an authentication process that requires a user identification and password when accessing sensitive information.
In addition, Beauty conducted a number of information security awareness sessions for the IT team and other employees that have access to confidential information in order to raise awareness on the importance of system and network security.
According to scenario 2, Beauty has reviewed all user access rights.
What type of control is this?

Scenario 12: Solena is an online retailer that offers technological products, such as desktops, laptops, and smartphones. Last year, Solena launched a new payment application which has improved the customer experience through the usage of machine learning algorithms which help the company to automatically charge customers.
Last month, attackers managed to breach the database and exposed the information of thousands Solena customers, including their names, addresses, and encrypted passwords.
Following the incident, the company received an increasingly high number of complaints. One of them involved Lucas, a loyal customer. He complained about not being able to access the website with his credentials and was continually asked to change his password. He would encounter the same problem every week and filed seven complaints toward Solena.
To address the complaints, Solena decided to deliver a press release, in which the representatives of Solena denied the attack. They claimed that the problem was technical and they were working toward a solution. The company asked for understanding from their customers and advised them to change their passwords every week until further notice. In the meantime, the attacker still had access to the data. After Solena investigated the incident, it was understood that the attackers used the credentials of the data-entry personnel to make the breach.
Based on scenario 12, attackers had a copy of Lucas’s home address.
Which information security principle has been affected in this case?

Scenario 17: InVid Electric is an American company that specializes in manufacturing, developing, and selling network hardware. The company has had an operational information security management system (ISMS) based on ISO/IEC 27001 requirements and a quality management system (QMS) based on ISO 9001 for approximately two years. Recently, it has applied for a combined certification audit in order to obtain certification against ISO/IEC 27001 and ISO 9001.
After selecting the certification body, InVid Electric prepared the employees for the audit. The company decided to not conduct a self-evaluation before the audit since, according to the top management, it was not necessary. In addition, it ensured the availability of documented information, including internal audit reports and management reviews, technologies in place, and the general operations of the ISMS and the QMS. However, the company requested from the certification body that the documentation could not be carried off-site.
Nonetheless, the audit was not performed within the scheduled time frame because InVid Electric rejected the assigned audit team leader and requested their replacement. According to the top management reasoning, the audit team leader represented a potential conflict of interest as the same audit team leader issued a recommendation for certification to InVid Electric’s main competitor.
According to scenario 17, InVid Electric requested from the certification body to review all the documentation only on-site. Is this acceptable?