PECB ISO-IEC-27001-Lead-Auditor 問題集

質問 1：
You are conducting an Information Security Management System audit in the despatch department of an international logistics organisation that provides shipping services to large organisations including local hospitals and government offices.
Parcels typically contain pharmaceutical products, biological samples and documents such as passports and driving licences.
You note that the company records show a very large number of returned items with causes including misaddressed labels and, in 15% of cases, two or more labels for different addresses for the one package. You are interviewing the Shipping Manager (SM).
You: Are items checked before being dispatched?
SM: Any obviously damaged items are removed by the duty staff before being dispatched, but the small profit margin makes it uneconomic to implement a formal checking process.
You: What action is taken when items are returned?
SM: Most of these contracts are relatively low value, therefore it has been decided that it is easier and more convenient to simply reprint the label and re-send individual parcels than it is to implement an investigation.
You raise a non-conformity against clause 8.1 of ISO 27001:2022.
Which one option below that best describes the non-conformity you have identified?
A. The organisation does not have an effective process in place that ensures service requirements and regulatory requirements for data protection are met. Records show that 15% of returned parcels have disclosed information intended for another party to the recipient (which may include sensitive medical information or government department communications) without adequate operational controls to meet information security requirements.
B. The organisation does not have an efficient process in place that ensures service requirements and regulatory requirements for data protection are met. Records show that 15% of returned parcels have detailed information intended for another party to the recipient (which may include sensitive medical information or government department communications) without adequate operational procedures to meet information security requirements.
C. The organisation does not have an efficient process in place that ensures service requirements and regulatory requirements for data protection are met. Records show that 15% of returned parcels have protected information intended for another party to the recipient (which may include sensitive medical information or government department communications) without adequate operational processes to meet information security requirements.
D. The organisation does not have an audited process in place that ensures service requirements and regulatory requirements for data protection are met. Records show that 15% of returned parcels have inaccurate information intended for another party to the recipient (which may include sensitive medical information or government department communications) without adequate operational rules to meet information security requirements.
E. The organisation does not have an approved process in place that ensures service requirements and regulatory requirements for data protection are met. Records show that 15% of returned parcels have corrected information intended for another party to the recipient (which may include sensitive medical information or government department communications) without adequate operational methods to meet information security requirements.
正解：A
解説: (Topexam メンバーにのみ表示されます)

質問 2：
AppFolk, a software development company, is seeking certification against ISO/IEC 27001. In the initial phases of the external audit, the certification body in discussion with the company excluded the marketing division from the audit scope, although they stated in their ISMS scope that the whole company is included. Is this acceptable?
A. Yes, audit and ISMS scope do not necessarily need to be the same
B. No, divisions that are not critical for the industrial sector in which the auditee operates can be excluded from the audit scope
C. No, audit scope should reflect all of the organization's divisions covered by the ISMS
正解：C
解説: (Topexam メンバーにのみ表示されます)

質問 3：
Question:
Prior to initiating the audit activities, the auditors considered the auditee's context, critical processes, and expectations. Which auditing principle has been applied?
A. Integrity
B. Professional skepticism
C. Due professional care
正解：C
解説: (Topexam メンバーにのみ表示されます)

質問 4：
You are an experienced ISMS audit team leader providing guidance to an auditor in training.
The auditor in training appears to be confused about the interpretation of competence in ISO 27001:2022 and is seeking clarification from you that his understanding is correct. He sets out a series of mini scenarios and asks you which of these you would attribute to a lack of competence. Select four correct options.
A. An IT technician failed to configure a new model of server correctly as a result of not reading the supplied instructions
B. A new starter was unable to switch on CCTV monitoring because they had not been shown how to do this
C. A system administrator deleted two live accounts as well as five redundant accounts as a result of receiving an incorrect instruction
D. An experienced receptionist allowed a contractor she recognised to enter the data centre without his access card
E. An employee recently transferred from the IT networks team to Software development was unaware of the need to complete product release forms prior to shipping
F. A data centre operator inadvertently placed a backup tape into an incorrect drive because they were in a hurry to move on to another task
G. A senior programmer did not check their coding for errors as they were running late for a doctor's appointment
H. A senior manager could not assist in the organisation's information security incident recovery process as she had not received the required training
正解：A,B,E,H
解説: (Topexam メンバーにのみ表示されます)

質問 5：
You are an experienced ISMS audit team leader guiding an auditor in training. Your team has just completed a third-party surveillance audit of a mobile telecom provider. The auditor in training asks you how you intend to prepare for the Closing meeting. Which four of the following are appropriate responses?
A. I will instruct my audit team to wait outside the auditee's offices so we can leave as quickly as possible after the closing meeting. This saves our time and the client's time too
B. I will review and, as appropriate, approve my teams audit conclusions
C. I will contact head office to ensure our invoice has been paid, If not, I will cancel the closing meeting and temporarily withhold the audit report
D. I will discuss any follow-up required with my audit team
E. I will schedule a closing meeting with the auditee's representatives at which the audit conclusions will be presented
F. I will review the audit evidence and the audit findings with the rest of the team
G. It is not necessary to prepare for the closing meeting. Once you have carried out as many audits as I have you already know what needs to be discussed
H. I will advise the auditee that the purpose of the closing meeting is for the audit team to communicate our findings. It is not an opportunity for the auditee to challenge the findings
正解：D,E,F,H
解説: (Topexam メンバーにのみ表示されます)

質問 6：
Scenario 5: Cobt. an insurance company in London, offers various commercial, industrial, and life insurance solutions. In recent years, the number of Cobt's clients has increased enormously. Having a huge amount of data to process, the company decided that certifying against ISO/IEC 27001 would bring many benefits to securing information and show its commitment to continual improvement. While the company was well- versed in conducting regular risk assessments, implementing an ISMS brought major changes to its daily operations. During the risk assessment process, a risk was identified where significant defects occurred without being detected or prevented by the organizations internal control mechanisms.
The company followed a methodology to implement the ISMS and had an operational ISMS in place after only a few months After successfully implementing the ISMS, Cobt applied for ISO/IEC 27001 certification Sarah, an experienced auditor, was assigned to the audit Upon thoroughly analyzing the audit offer, Sarah accepted her responsibilities as an audit team leader and immediately started to obtain general information about Cobt She established the audit criteria and objective, planned the audit, and assigned the audit team members' responsibilities.
Sarah acknowledged that although Cobt has expanded significantly by offering diverse commercial and insurance solutions, it still relies on some manual processes Therefore, her initial focus was to gather information on how the company manages its information security risks Sarah contacted Cobt's representatives to request access to information related to risk management for the off-site review, as initially agreed upon for part of the audit However, Cobt later refused, claiming that such information is too sensitive to be accessed outside of the company This refusal raised concerns about the audit's feasibility, particularly regarding the availability and cooperation of the auditee and access to evidence Moreover, Cobt raised concerns about the audit schedule, stating that it does not properly reflect the recent changes the company made It pointed out that the actions to be performed during the audit apply only to the initial scope and do not encompass the latest changes made in the audit scope Sarah also evaluated the materiality of the situation, considering the significance of the information denied for the audit objectives. In this case, the refusal by Cobt raised questions about the completeness of the audit and its ability to provide reasonable assurance. Following these situations, Sarah decided to withdraw from the audit before a certification agreement was signed and communicated her decision to Cobt and the certification body. This decision was made to ensure adherence to audit principles and maintain transparency, highlighting her commitment to consistently upholding these principles.
Based on the scenario above, answer the following question:
Question:
Based on Scenario 5, Sarah decided to withdraw from the audit before a certification agreement was signed. Is this acceptable?
A. No, the certification agreement is directly tied to the auditor's presence
B. Yes, Sarah can withdraw from the audit but only if the certification body approves her withdrawal
C. Yes, there is no relation between Sarah's withdrawal from the audit and the certification agreement
正解：C
解説: (Topexam メンバーにのみ表示されます)

質問 7：
You are performing an ISMS audit at a residential nursing home called ABC that provides healthcare services. You find all nursing home residents wear an electronic wristband for monitoring their location, heartbeat, and blood pressure always. You learned that the electronic wristband automatically uploads all data to the artificial intelligence (AI) cloud server for healthcare monitoring and analysis by healthcare staff.
To verify the scope of ISMS, you interview the management system representative (MSR) who explains that the ISMS scope covers an outsourced data center.
Select three options for the audit evidence you need to find to verify the scope of the ISMS.
A. The IT service agreement with the data center where the artificial intelligence (AI) cloud server is located
B. The auditee has identified the governmental authorities' needs and expectations on healthcare services and patient data handling
C. The auditee has identified the resident's needs and expectations on how they should protect the resident's personal data
D. The auditee is considering the purchase of a healthcare monitoring app from an external software company
E. The auditee has identified the resident's needs and expectations on healthcare medical treatment services
F. The auditee has identified the resident's needs and expectations on the facility and environmental safety
G. The auditee has ISO 9001 certification
H. The auditee has identified the resident's needs and expectations on the comfort facility, medical professional's competence, and clean environment
正解：A,B,C
解説: (Topexam メンバーにのみ表示されます)