Select the words that best complete the sentence:
To complete the sentence with the word(s) click on the blank section you want to complete so that it is highlighted in red, and then click on the application text from the options below. Alternatively, you may drag and drop the option to the appropriate blank section.

Correct Answer:

Explanation:
competence of the audit team and decision made by the certification body According to ISO/IEC 17021-1, which specifies the requirements for bodies providing audit and certification of management systems, an accredited certification means that the certification body has been evaluated by an accreditation body against recognized standards to demonstrate its competence, impartiality and performance capability1. Therefore, an accredited certification assures the competence of the audit team that conducts the audit in accordance with ISO 19011 and ISO/IEC 27001:2022, and the decision made by the certification body that grants or maintains the certification based on the audit evidence and findings2. References: ISO/IEC
17021-1:2015 - Conformity assessment - Requirements for bodies providing audit and certification of management systems - Part 1: Requirements, ISO/IEC 27001:2022 Lead Auditor (Information Security Management Systems) | CQI | IRCA

Comment: *

Name: *

Email: *

Verification: *

After a fire has occurred, what repressive measure can be taken?

• A.Extinguishing the fire after the fire alarm sounds
• B.Buying in a proper fire insurance policy
• C.Repairing all systems after the fire

Comment: *

Name: *

Email: *

Verification: *

Which two of the following options do not participate in a first-party audit?

• A.A certification body auditor
• B.An audit team from an accreditation body
• C.An auditor certified by CQI and IRCA
• D.An auditor from a consultancy organisation
• E.An auditor trained in the CQI and IRCA scheme
• F.An auditor trained in the organization

Comment: *

Name: *

Email: *

Verification: *

In the event of an Information security incident, system users' roles and responsibilities are to be observed, except:

• A.Report suspected or known incidents upon discovery through the Servicedesk
• B.Preserve evidence if necessary
• C.Cooperate with investigative personnel during investigation if needed
• D.Make the information security incident details known to all employees

Comment: *

Name: *

Email: *

Verification: *

You are performing an ISO 27001 ISMS surveillance audit at a residential nursing home, ABC Healthcare Services. ABC uses a healthcare mobile app designed and maintained by a supplier, WeCare, to monitor residents' well-being. During the audit, you learn that 90% erf the residents' family members regularly receive medical device advertisements from WeCare, by email and SMS once a week. The service agreement between ABC and WeCare prohibits the supplier from using residents' personal data. ABC has received many complaints from residents and their family members.
The Service Manager says that the complaints were investigated as an information security incident which found that they were justified. Corrective actions have been planned and implemented according to the nonconformity and corrective action management procedure.
You write a nonconformity "ABC failed to comply with information security control A.5.34 (Privacy and protection of PII) relating to the personal data of residents' and their family members. A supplier, WeCare, used residents' personal information to send advertisements to family members" Select three options of the corrections and corrective actions listed that you would expect ABC to make in response to the nonconformity

• A.ABC confirms that information security control A.5.34 is contained in the Statement of Applicability (SoA)
• B.The Service Manager provides evidence of analysis of the cause of nonconformity and how the ABC evaluates the effectiveness of implemented corrective actions
• C.ABC instructs all staff to follow the signed healthcare service agreement with residents' family members
• D.ABC conducts a management review to take the feedback from residents' family members into consideration
• E.ABC needs to collect more evidence on how the organisation defines the management system scope and find out if they covered WeCare the medical device manufacturer
• F.ABC identifies and checks compliance with all applicable legislation and contractual requirements involving third parties
• G.The Service Manager implements the corrective actions and Customer Service Representatives evaluate the effectiveness of implemented corrective actions
• H.ABC needs to collect more evidence on how information security risk assessment relates to the identified nonconformities before concluding actions on the nonconformity

Comment: *

Name: *

Email: *

Verification: *