Free ISO-IEC-27001-Lead-Implementer Exam Braindumps
ISO/IEC 27001 Lead Implementer Questions 26–30 (page: 7)

What risk treatment option has Company A implemented if it has required its employees to change their email passwords at least once every 60 days?

Scenario 38: BotanéBloom is a skincare brand specializing in plant-based formulations designed to nourish and enhance skin health. Founded on principles of sustainability and ethical sourcing, the company has established a reputation for science-backed, nature-inspired solutions that cater to a diverse clientele.
In response to evolving consumer shopping habits, BotanéBloom transitioned from traditional retail to a digital-first business model. Initially, its new online store began processing credit card payments directly. To comply with a relevant security standard, the company reviewed requirements such as encrypting cardholder data, limiting access, and maintaining a secure network.
As part of its digital transformation, BotanéBloom considered launching a chatbot powered by a third-party generative AI platform to handle customer service inquiries. However, a risk assessment revealed serious concerns related to data privacy, model unpredictability, and a lack of transparency regarding the processing and storage of customer inputs. The legal team also identified potential noncompliance with the General Data Protection Regulation (GDPR) due to uncertainties in the AI vendor data handling practices. Following internal reviews, executive leadership decided to postpone the chatbot deployment until a more secure and transparent solution could be guaranteed.
During the assessment, the company also identified that a sudden system crash caused by a malfunctioning server could lead to temporary loss of access to customer orders and inventory data. This malfunction was not linked to any malicious activity. To address risks identified in its new e-commerce operations, BotanéBloom implemented several security controls:
• Deployed a web application firewall (WAF) to protect against malicious traffic
• Initiated weekly management reviews focused on system uptime and incident response
• Revised job descriptions to reflect new digital security roles and responsibilities
Despite these initial security enhancements, BotanéBloom later experienced a data breach after an intern accidentally exposed a private administrative key on a public forum. In response, the company changed all system access credentials, updated onboarding procedures for interns, and implemented log analysis for account activity.
Based on the scenario above, answer the following question.
In response to the data breach, the company changed all system access credentials, updated onboarding procedures for interns, and implemented log analysis for account activity.
How can the sequence of the company's actions related to the data breach accident be categorized based on control function? Refer to scenario 38.

Scenario 22: OpenTech, with its headquarters in San Francisco, specializes in information and communication technology (ICT) solutions. Its clientele primarily includes data communication enterprises and network operators. The company’s core objective is to enable its clients a smooth transition into multi-service providers, aligning their operations with the complex demands of the digital landscape.
Recently, Tim, the internal auditor of OpenTech, conducted an internal audit which uncovered nonconformities related to their monitoring procedures and system vulnerabilities. In response to the identified nonconformities, OpenTech decided to employ a comprehensive problem-solving approach to solve these issues systematically. The method encompasses a team-oriented approach, aiming to identify, correct, and eliminate the root causes of issues. This approach involves several steps. First, establish a group of experts with deep knowledge of processes and controls. Next, break down the nonconformity into measurable components and implement interim containment measures. Then, identify potential root causes and select and verify permanent corrective actions. Finally, put those actions into practice, validate them, take steps to prevent recurrence, and recognize and acknowledge the team’s efforts.
Following the analysis of the root cause of the nonconformities, OpenTech’s ISMS project manager, Julia, developed a list of potential actions to address the identified nonconformities. Julia carefully evaluated the list to ensure that each action would effectively eliminate the root cause of the respective nonconformity.
While assessing potential corrective action for addressing a nonconformity, Julia identified the issue as significant and assessed a high likelihood of its reoccurrence. Consequently, she chose to implement temporary corrective actions. Afterward, Julia combined all the nonconformities into a single action plan and sought approval from the top management. The submitted action plan was written as follows:
A new version of the access control policy will be established and new restrictions will be created to ensure that network access is effectively managed and monitored by the Information and Communication Technology (ICT) Department.
However, Julia’s submitted action plan was not approved by top management. The reason cited was that a general action plan meant to address all nonconformities was deemed unacceptable. Consequently, Julia revised the action plan and submitted separate ones for approval. Unfortunately, Julia did not adhere to the organization’s specified deadline for submission, resulting in a delay in the corrective action process, and notably, the revised action plans lacked a defined schedule for execution.
Did OpenTech have a plan in place to implement permanent corrective action to address the identified nonconformities? Refer to scenario 22.

Scenario 31: DenNova is a digital infrastructure provider headquartered in Finland. It serves clients across Europe in sectors such as smart manufacturing, renewable energy, and public services, including digital infrastructure for government agencies, public healthcare, and transportation networks. In response to a growing number of cybersecurity threats targeting its cloud-based platforms and client networks, the company implemented an information security management system (ISMS) aligned with ISO/IEC 27001 to strengthen its data protection measures and enhance the security of its operational processes.
As part of the establishment of the ISMS scope, DenNova's ISMS project team collaborated with department heads and key business stakeholders to assess the company's business requirements and review its functional units.
While the review covered many essential areas, key business processes such as procurement and sales were not considered, nor were the roles and responsibilities of managers in certain departments thoroughly evaluated. The decision to exclude these areas was attributed to DenNova's decentralized organizational structure. Despite these omissions, the team proceeded with defining the ISMS scope.
In parallel, the team also decided that the ISMS would operate entirely independently from the existing ISO 9001-based quality management system (QMS), ensuring no overlap or integration between the two management systems. As a final step in this process, DenNova prepared a formal ISMS scope statement for internal and external stakeholders. The statement was designed to be simple, clear, and accessible to those with limited knowledge of the company's internal structure.
While subject matter experts, such as consultants and business analysts, gave their input, the final approval and release of the scope statement were carried out by top management.
Building on this foundational work, the project team developed a comprehensive information security policy aligned with the company's strategic goals, legal obligations, and the insights gained from risk assessments and business strategies. This overarching policy was supported by specific documents that addressed particular security concerns and clearly defined roles and responsibilities. The entire policy framework was communicated internally and shared with relevant external stakeholders. Top management played an active role throughout the policy's drafting, review, and approval process, reinforcing the company's commitment to a strong, collaborative approach to information protection. Additionally, DenNova customized the policy's format and naming conventions to reflect its unique operational needs and organizational structure, Lastly.
DenNova created an information security committee tasked with ensuring the proper operation of the ISMS, overseeing the company's risk assessment process, managing information security-related issues, recommending solutions to nonconformities, and monitoring the implementation of corrections and corrective actions. To optimize organizational resources and avoid the creation of multiple committees, the committee was also designated to serve as the emergency committee in the event of a major incident.
Based on the scenario above, answer the following question.
Based on scenario 31, was the approval process of the ISMS scope statement handled correctly?

According to ISO/IEC 27000, which of the following best describes the possible scope of a management system?