Free ISO-IEC-27001-Lead-Implementer Exam Braindumps
ISO/IEC 27001 Lead Implementer Questions 6–10 (page: 3)

Which service category provided by the incident response teams supports organizational functions such as training and auditing?

Scenario 37: NoAVision is a mid-sized cybersecurity solutions provider based in Tartu, Estonia, with satellite offices in Stockholm and Berlin. The company specializes in secure cloud hosting, identity and access management (IAM), and digital certificate life cycle management. Its clients span the government, financial services, and healthcare sectors. The company's clientele including national ministries, private hospitals, and fintech firms operating across the European Economic Area (EEA).
To have a structured approach to safeguarding sensitive information, NoAVision decided to implement an information security management system (ISMS) based on ISO/IEC 27001. During the planning and design phases, the company relied on an ISO guidance document that interpreted each clause of the standard. Rather than introducing additional requirements, the document offered practical recommendations, implementation alternatives, and contextual insights, enabling the company to avoid ambiguity and develop a functional ISM.
During risk assessment, the security team at NoAVision identified two critical vulnerabilities: inadequate maintenance and faulty installation of data storage media, and the absence of mechanisms to confirm the successful transmission and receipt of internal communications. These weaknesses posed threats to data integrity and availability, prompting the company to prioritize remediation.
Further analysis revealed a threat scenario involving the forging of user rights within the IAM system, which could enable unauthorized individuals to escalate privileges and access restricted data. Recognizing this as a serious threat, the team categorized it under a specific threat type that required targeted mitigation.
In response to these findings, NoAVision implemented more stringent policies and procedures around access provisioning, user activity monitoring, and role management. These improvements were reinforced through stricter internal review processes and clearly defined job roles and responsibilities. By strengthening these governance controls, the company aimed to reduce the risk of privilege abuse and internal fraud.
Based on the scenario above, answer the following question.
What category of vulnerabilities did NoAVision identify during its risk assessment? Refer to scenario 37.

Diana works as a customer service representative for a large e-commerce company. One day, she accidently modified the order details of a customer without their permission. Due to this error, the customer received an incorrect product.
Which information security principle was breached in this case?

Following a reported event, an information security event ticket has been completed and its priority has been assigned. Then, the event has been evaluated to determine if it is an information security incident.
Which phase of the incident management has been completed?

Scenario 4: TradeB, a commercial bank that has just entered the market, accepts deposits from its clients and offers basic financial services and loans for investments. TradeB has decided to implement an information security management system (ISMS) based on ISO/IEC 27001. Having no experience of a management system implementation, TradeB’s top management contracted two experts to direct and manage the ISMS implementation project.
First, the project team analyzed the 93 controls of ISO/IEC 27001 Annex A and listed only the security controls deemed applicable to the company and their objectives. Based on this analysis, they drafted the Statement of Applicability. Afterward, they conducted a risk assessment, during which they identified assets, such as hardware, software, and networks, as well as threats and vulnerabilities, assessed potential consequences and likelihood, and determined the level of risks based on three nonnumerical categories (low, medium, and high). They evaluated the risks based on the risk evaluation criteria and decided to treat only the high-risk category. They also decided to focus primarily on the unauthorized use of administrator rights and system interruptions due to several hardware failures by establishing a new version of the access control policy, implementing controls to manage and control user access, and implementing a control for ICT readiness for business continuity.
Lastly, they drafted a risk assessment report, in which they wrote that if after the implementation of these security controls the level of risk is below the acceptable level, the risks will be accepted.
Which of the actions presented in scenario 4 is NOT compliant with the requirements of ISO/IEC 27001?