Free ISO-IEC-27001-Lead-Implementer Exam Braindumps
ISO/IEC 27001 Lead Implementer Questions 36–40 (page: 9)

Scenario 8: SunDee is an American biopharmaceutical company, headquartered in California, the US. It specializes in developing novel human therapeutics, with a focus on cardiovascular diseases, oncology, bone health, and inflammation. The company has had an information security management system (ISMS) based on ISO/IEC 27001 in place for the past two years. However, it has not monitored or measured the performance and effectiveness of its ISMS and conducted management reviews regularly.
Just before the recertification audit, the company decided to conduct an internal audit. It also asked most of their staff to compile the written individual reports of the past two years for their departments. This left the Production Department with less than the optimum workforce, which decreased the company’s stock.
Tessa was SunDee’s internal auditor. With multiple reports written by 50 different employees, the internal audit process took much longer than planned, was very inconsistent, and had no qualitative measures whatsoever. Tessa concluded that SunDee must evaluate the performance of the ISMS adequately. She defined SunDee’s negligence of ISMS performance evaluation as a major nonconformity, so she wrote a nonconformity report including the description of the nonconformity, the audit findings, and recommendations. Additionally, Tessa created a new plan which would enable SunDee to resolve these issues and presented it to the top management.
How does SunDee’s negligence affect the ISMS certificate? Refer to scenario 8.

Scenario 23: NetworkFuse is a leading company that deals with the design, production, and distribution of network hardware products. Over the past two years, NetworkFuse has maintained an operational information security management system (ISMS) based on ISO/IEC 27001 requirements and a quality management system (QMS) based on ISO 9001. These systems are designed to ensure the company’s commitment to both information security and the highest quality standards.
To further demonstrate its dedication to best practices and industry standards, NetworkFuse recently scheduled a combined certification audit. This audit seeks to validate NetworkFuse’s compliance with both ISO/IEC 27001 and ISO 9001, demonstrating the company’s strong commitment to maintaining high standards in information security management and quality management. The process began with carefully selecting a certification body. Then, NetworkFuse took steps to prepare its employees for the audit, which was crucial in ensuring a smooth and successful audit process. Additionally, NetworkFuse appointed individuals to manage the ISMS and the QMS.
NetworkFuse decided to not conduct a self-evaluation before the audit, a step often taken by organizations to proactively identify potential areas of improvement. The company’s top management believed such an evaluation was unnecessary, confident in their existing systems and practices. This decision reflected their trust in the robustness of their ISMS and QMS. As part of the preparations, NetworkFuse took careful measures to ensure that all necessary documented information, including internal audit reports, management reviews, technological infrastructure, and the overall functioning of the ISMS and QMS, was readily available for the audit. This information would be vital in demonstrating their compliance with the ISO standards.
During the audit, NetworkFuse requested from the certification body to not carry documentation off-site. This request stemmed from their commitment to safeguarding sensitive and proprietary information, and reflecting their desire for maximum security and control during the audit process. Despite meticulous preparations, the actual audit did not proceed as ‘scheduled. NetworkFuse raised concerns about the assigned audit team leader and requested a replacement. The company asserted that the same audit team leader had previously issued a recommendation for certification to one of NetworkFuse’s main competitors. This potential conflict of interest raised concerns among the company’s top management. However, the certification body rejected NetworkFuse’s request for a replacement, and the audit process was canceled.
Based on scenario 23, which of the following actions is NOT a requirement for NetworkFuse in preparing for the certification audit?

Who should verify the effectiveness of the corrective actions taken by the auditee after an internal audit?

Scenario 27: TradeB is a newly established commercial bank located in Europe, with a diverse clientele. It provides services that encompass retail banking, corporate banking, wealth management, and digital banking, all tailored to meet the evolving financial needs of individuals and businesses in the region. Recognizing the critical importance of information security in the modern banking landscape, TradeB has initiated the implementation of an information security management system (ISMS) based on ISO/IEC 27001. To ensure the successful implementation of the ISMS, the top management decided to contract two experts to lead and oversee the ISMS implementation project.
As a primary strategy for implementing the ISMS, the experts chose an approach that emphasizes a swift implementation of the ISMS by initially meeting the minimum requirements of ISO/IEC 27001, followed by continual improvement over time. Additionally, under the guidance of the experts, TradeB opted for a methodological framework, which serves as a structured framework and a guideline that outlines the high-level stages of the ISMS implementation, the associated activities, and the deliverables without incorporating any specific tools.
The experts analyzed the ISO/IEC 27001 controls and listed only the security controls deemed applicable to the company and its objectives. Based on this analysis, they drafted the Statement of Applicability. Afterward, they conducted a risk assessment, during which they identified assets, such as hardware, software, and networks, as well as threats and vulnerabilities, assessed potential consequences and likelihood, and determined the level of risks based on a methodical approach that involved defining and characterizing the terms and criteria used in the assessment process, categorizing them into nonnumerical levels (e.g., very low, low, moderate, high, very high). Explanatory notes were thoughtfully crafted to justify assessed values, with the primary goal of enhancing repeatability and reproducibility.
Then, they evaluated the risks based on the risk evaluation criteria where they decided to treat only the risks of the high-risk category. Additionally, they focused primarily the unauthorized use of administrator rights and system interruptions due to several hardware failures. To address these issues, they established a new version of the access control policy, implemented controls to manage and control user access, and introduced a control for ICT readiness to ensure business continuity.
Their risk assessment report indicated that if the implemented security controls reduce the risk levels to an acceptable threshold, those risks will be accepted.
According to scenario 27, what type of assets were identified during risk assessment?

Scenario 28: InfoSec based in Boston, MA, is a multinational corporation offering professional electronics, gaming, and entertainment products. Following several information security incidents, InfoSec has decided to establish teams of experts and implement measures to prevent potential incidents in the future.
Emma, Bob, and Anna were hired as the new members of InfoSec’s information security team, which consists of a security architecture team, an incident response team (IRT), and a forensics team. Emma’s job is to create information security plans, policies, protocols, and training to prepare InfoSec to respond to incidents effectively. Emma and Bob would be full-time employees of InfoSec, whereas Anna was contracted as an external consultant.
Bob, a network expert, will implement a screened subnet network architecture. This architecture will isolate the demilitarized zone (DMZ) to which hosted public services are attached and InfoSec’s publicly accessible resources from their private network. Thus, InfoSec will be able to block potential attackers from causing unwanted events inside the company’s network. Bob is also responsible for ensuring a thorough evaluation of the nature of an unexpected event, including how the event happened and what or whom it might affect.
On the other hand, Anna will create records of the data, reviews, analyses, and reports to keep evidence for disciplinary and legal action and use them to prevent future incidents. To do the work accordingly, she should be aware of the company’s information security incident management policy beforehand. Among others, this policy specifies the type of records to be created, the place where they should be kept, and the format and content that specific record types should have.
As part of InfoSec’s initiative to strengthen information security measures, Anna will conduct information security risk assessments only when significant changes are proposed and will document the results of these risk assessments. Upon completion of the risk assessment process, Anna is responsible to develop and implement a plan for treating information security risks and document the risk treatment results.
Furthermore, while implementing the communication plan for information security, the InfoSec’s top management was responsible for creating a roadmap for new product development. This approach helps the company to align its security measures with the product development efforts, demonstrating a commitment to integrating security into every aspect of its business operations.
InfoSec uses a cloud service model that includes cloud-based apps accessed through the web or an application programming interface (API). All cloud services are provided by the cloud service provider, while data is managed by InfoSec. This introduces unique security considerations and becomes a primary focus for the information security team to ensure data and systems are protected in this environment.
Based on this scenario, answer the following question:
Which of the following cloud service model did InfoSec use?