PECB ISO-IEC-27001-Lead-Implementer 問題集

質問 1：
Scenario 9: SkyFleet specializes in air freight services, providing fast and reliable transportation solutions for businesses that need quick delivery of goods across long distances. Given the confidential nature of the information it handles, SkyFleet is committed to maintaining the highest information security standards. To achieve this, the company has had an information security management system (ISMS) based on ISO/IEC
27001 in operation for a year. To enhance its reputation, SkyFleet is pursuing certification against ISO/IEC
27001.
SkyFleet strongly emphasizes the ongoing maintenance of information security. In pursuit of this goal, it has established a rigorous review process, conducting in-depth assessments of the ISMS strategy every two years to ensure security measures remain robust and up to date. In addition, the company takes a balanced approach to nonconformities. For example, when employees fail to follow proper data encryption protocols for internal communications, SkyFleet assesses the nature and scale of this nonconformity. If this deviation is deemed minor and limited in scope, the company does not prioritize immediate resolution. However, a significant action plan was developed to address a major nonconformity involving the revamp of the company ' s entire data management system to ensure the protection of client data. SkyFleet entrusted the approval of this action plan to the employees directly responsible for implementing the changes. This streamlined approach ensures that those closest to the issues actively engage in the resolution process. SkyFleet ' s blend of innovation, dedication to information security, and adaptability has built its reputation as a key player in the IT and communications services sector.
Despite initially not being recommended for certification due to missed deadlines for submitting required action plans, SkyFleet undertook corrective measures to address these deficiencies in preparation for the next certification process. These measures involved analyzing the root causes of the delay, developing a corrective action plan, reassessing ISMS implementation to ensure compliance with ISO/IEC 27001 requirements, intensifying internal audit activities, and engaging with a certification body for a follow-up audit.
Based on Scenario 9, SkyFleet did not take any measures in certain situations when the employees do not behave as expected by procedures and policies. Is this acceptable?
A. No, they should have taken action to control and correct it
B. Yes, as it pertains to a limited number of employees and is not deemed a significant concern
C. Yes, it is acceptable when the issues are limited in scope
D. Yes, if the ISMS review is pending
正解：A
解説: (Topexam メンバーにのみ表示されます)

質問 2：
What distinguishes the internal auditor ' s role in evaluating the ISMS risk management process from that of an external auditor?
A. The internal auditor only observes and reports risks without engagement.
B. The internal auditor must defer all risk evaluations to the external audit team.
C. The internal auditor may actively participate in identifying and assessing risks as an interested party.
正解：C
解説: (Topexam メンバーにのみ表示されます)

質問 3：
NoAVision is a mid-sized cybersecurity solutions provider based in Tartu, Estonia, with satellite offices in Stockholm and Berlin. The company specializes in secure cloud hosting, identity and access management (IAM), and digital certificate lifecycle management. Its clients span the government, financial services, and healthcare sectors, including national ministries, private hospitals, and fintech firms operating across the European Economic Area (EEA). To have a structured approach to safeguarding sensitive information, NoAVision decided to implement an information security management system (ISMS) based on ISO/IEC
27001. During the planning and design phases, the company relied on an ISO guidance document that interpreted each clause of the standard. Rather than introducing additional requirements, the document offered practical recommendations, implementation alternatives, and contextual insights, enabling the company to avoid ambiguity and develop a functional ISMS.
Which document did NoAVision rely on during the planning and design phases of the ISMS implementation?
A. ISO/IEC 27701
B. PCI DSS
C. ISO/IEC 27003
正解：C
解説: (Topexam メンバーにのみ表示されます)

質問 4：
Question:
An organization has implemented additional controls from other sources alongside the ISO/IEC 27001 Annex A controls. Is this acceptable?
A. No, organizations must only implement the controls listed in Annex A
B. Yes, organizations can incorporate additional controls from other sources
C. Yes, but only if the additional controls replace existing Annex A controls
正解：B
解説: (Topexam メンバーにのみ表示されます)

質問 5：
In the context of management reviews, what does " suitability " refer to?
A. Whether the ISMS aligns with international certification standards
B. Whether the ISMS is appropriately designed and embedded in the organization
C. Whether the ISMS continues to align with the organization ' s objectives
正解：C
解説: (Topexam メンバーにのみ表示されます)

質問 6：
Once they made sure that the attackers do not have access in their system, the security administrators decided to proceed with the forensic analysis. They concluded that their access security system was not designed tor threat detection, including the detection of malicious files which could be the cause of possible future attacks.
Based on these findings. Texas H$H inc, decided to modify its access security system to avoid future incidents and integrate an incident management policy in their Information security policy that could serve as guidance for employees on how to respond to similar incidents.
Based on the scenario above, answer the following question:
Texas M & H Inc. decided to integrate the incident management policy to the existent information security policy. How do you define this situation?
A. Acceptable, the incident management policy may be integrated into the overall information security policy of the organization
B. Acceptable, but only if the incident management policy addresses environmental, or health and safety issues
C. Unacceptable, the incident management policy should be drafted as a separate document in order to be clear and effective
正解：A

質問 7：
Scenario 10: ProEBank
ProEBank is an Austrian financial institution known for its comprehensive range of banking services.
Headquartered in Vienna, it leaverages the city ' s advanced technological and financial ecosystem To enhance its security posture, ProEBank has implementied an information security management system (ISMS) based on the ISO/IEC 27001. After a year of having the ISMS in place, the company decided to apply for a certification audit to obtain certification against ISO/IEC 27001.
To prepare for the audit, the company first informed its employees for the audit and organized training sessions to prepare them. It also prepared documented information in advance, so that the documents would be ready when external auditors asked to review them Additionally, it determined which of its employees have the knowledge to help the external auditors understand and evaluate the processes.
During the planning phase for the audit, ProEBank reviewed the list of assigned auditors provided by the certification body. Upon reviewing the list, ProEBank identified a potential conflict of interest with one of the auditors, who had previously worked for ProEBank ' s mein competitor in the banking industry To ensure the integrity of the audit process. ProEBank refused to undergo the audit until a completely new audit team was assigned. In response, the certification body acknowledged the conflict of interest and made the necessary adjustments to ensure the impartiality of the audit team After the resolution of this issue, the audit team assessed whether the ISMS met both the standard ' s requirements and the company ' s objectives. During this process, the audit team focused on reviewing documented information.
Three weeks later, the team conducted an on-site visit to the auditee's location where they aimed to evaluate whether the ISMS conformed to the requirements of ISO/IEC 27001. was effectively implemented, and enabled the auditee to reach its information security objectives. After the on- site visit the team prepared the audit conclusions and notified the auditee that some minor nonconformities had been detected The audit team leader then issued a recommendation for certification.
After receiving the recommendation from the audit team leader, the certification body established a committee to make the decision for certification. The committee included one member from the audit team and two other experts working for the certification body.
The certification body's final decision for certification was made by a committee that included one auditor from the audit team and two other experts.
Question:
Is this acceptable?
A. No - the committee should have included only members from the audit team and not other experts that were not part of the audit
B. No - the certification body must ensure that persons that make the decision for certification are different from those who carried out the audit
C. Yes - the committee must include one member from the audit team and other individuals working for the certification body
正解：B
解説: (Topexam メンバーにのみ表示されます)

質問 8：
An organization that is implementing the ISMS based on ISO/IEC 27001 has defined and communicated secure system architecture and engineering principles. However, there is no documented information related to these principles. Is this acceptable?
A. Yes, the standard requires organizations to only communicate secure system architecture and engineering principles
B. Yes, documented information related to secure system architecture and engineering principles is not directly required by the standard
C. No, documenting secure system architecture and engineering principles is required by the standard
正解：B