Free ISO-IEC-27001-Lead-Implementer Exam Braindumps
ISO/IEC 27001 Lead Implementer Questions 111–115 (page: 24)

What distinguishes the internal auditor's role in evaluating the ISMS risk management process from that of an external auditor?

Scenario 14: TradeB is a consulting company headquartered in California. With years of expertise in creating business strategies, TradeB enables organizations to grow and build a competitive advantage through management consulting, technology, and design solutions. Since the company provides consultancy for many organizations performing in different sectors, it has established different teams with experts from various fields, including data scientists, designers, engineers, architects, linguists, which help organizations transform their business and achieve better results.
Due to the confidential nature of the information it handles, TradeB is obliged to ensure information security. To improve their information security, TradeB implemented an ISMS based on ISO/IEC 27001.
During the implementation process, TradeB was committed in ensuring that all staff members understand the importance of information security within the company. The information security training program was designed to ensure that employees of the company will consider the security aspects of their actions in their daily work.
Knowing that security threats are perpetual, TradeB decided to conduct weekly security awareness sessions at the beginning of the ISMS implementation process. Those awareness sessions were held by Alex, one of the information security experts contracted by TradeB. The training program was available for every employee of the company; however, its focus was to train employees outside the information security sector. Therefore, employees of the Finance Department were the first to be trained.
The training program covered threats faced by TradeB as well as best practices to be followed to mitigate those threats. Employees were trained to come up with and use strong passwords. In addition, by simulating realistic scenarios, employees were trained to recognize phishing or social engineering attacks. That way, they were able to put their skills into practice. The awareness sessions were also used to communicate information security processes and procedures within the company taking into account the confidentiality of the company’s information.
However, the awareness sessions did not result successful as expected. Most of the employees of the Finance Department lacked information security expertise, so they found it challenging to understand some of the concepts and terminology used. They claimed that some of the issues being discussed were too technical and as such, they did not understand the sessions fully. Moreover, they claimed that their questions were not answered appropriately from the trainer, Alex.
Some of the issues being discussed in the awareness session were too technical for the participants.
What does this situation indicate? Refer to scenario 14.

Scenario 3: Socket Inc. is a telecommunications company offering mainly wireless products and services. It uses MongoDB, a document model database that offers high availability, scalability, and flexibility.
Last month, Socket Inc. reported an information security incident. A group of hackers compromised its MongoDB database, because the database administrators did not change its default settings, leaving it without a password and publicly accessible.
Fortunately, Socket Inc. performed regular information backups in their MongoDB database, so no information was lost during the incident. In addition, a syslog server allowed Socket Inc. to centralize all logs in one server. The company found out that no persistent backdoor was placed and that the attack was not initiated from an employee inside the company by reviewing the event logs that record user faults and exceptions.
To prevent similar incidents in the future, Socket Inc. decided to use an access control system that grants access to authorized personnel only. The company also implemented a control in order to define and implement rules for the effective use of cryptography, including cryptographic key management, to protect the database from unauthorized access. The implementation was based on all relevant agreements, legislation, and regulations, and the information classification scheme. To improve security and reduce the administrative efforts, network segregation using VPNs was proposed.
Lastly, Socket Inc. implemented a new system to maintain, collect, and analyze information related to information security threats, and integrate information security into project management.
Can Socket Inc. find out that no persistent backdoor was placed and that the attack was initiated from an employee inside the company by reviewing event logs that record user faults and exceptions? Refer to scenario 3.

An organization that has an ISMS in place conducts management reviews at planned intervals, but does not retain documented information on the results. Is this in accordance with the requirements of ISO/IEC 27001?

Scenario 6: Skyver offers worldwide shipping of electronic products, including gaming consoles, flat-screen TVs, computers, and printers. In order to ensure information security, the company has decided to implement an information security management system (ISMS) based on the requirements of ISO/IEC 27001.
Colin, the company’s best information security expert, decided to hold a training and awareness session for the personnel of the company regarding the information security challenges and other information security-related controls. The session included topics such as Skyver’s information security approaches and techniques for mitigating phishing and malware.
One of the participants in the session is Lisa, who works in the HR Department. Although Colin explains the existing Skyver’s information security policies and procedures in an honest and fair manner, she finds some of the issues being discussed too technical and does not fully understand the session. Therefore, in a lot of cases, she requests additional help from the trainer and her colleagues.
Based on scenario 6, Lisa found some of the issues being discussed in the training and awareness session too technical, thus not fully understanding the session.
What does this indicate?