Free Access to PECB.ISO-IEC-27001-Lead-Auditor.v2024-08-31.q185 with Valid Practice Test (Page 7)

Question 26

Someone from a large tech company calls you on behalf of your company to check the health of your PC, and therefore needs your user-id and password. What type of threat is this?

A.Social engineering threat
B.Organisational threat
C.Technical threat
D.Malware threat

Question 27

The following options are key actions involved in a first-party audit. Order the stages to show the sequence in which the actions should take place.

Question 28

What is the difference between a restricted and confidential document?

A.Restricted - to be shared among an authorized group
Confidential - to be shared among named individuals
B.Restricted - to be shared among named individuals
Confidential - to be shared among an authorized group
C.Restricted - to be shared among named individuals
Confidential - to be shared across the organization only
D.Restricted - to be shared among named individuals
Confidential - to be shared with friends and family

Question 29

You are an experienced ISMS audit team leader guiding an auditor in training. You are testing her understanding of follow-up audits by asking her a series of questions to which the answer is either "true* or
'false'. Which four of the following questions should the answer be true"'

A.A follow-up audit may be carried out where nonconformities are major
B.A follow-up audit may be carried out where nonconformities are minor
C.The outcomes of a follow-up audit should be reported to top management and the audit team leader who carried out the audit where the nonconformities were initially identified
D.The outcome of a follow-up audit could lower a major nonconformity to minor status
E.The outcome of a follow-up audit could be a recommendabon to suspend the client's certification
F.The outcomes of a follow-up audit should be reported to the individual managing the audit programme and the audit client
G.A follow-up audit is required in all instances where nonconformities have been identified
H.A follow-up audit is required only in instances where a major nonconformity has been identified

Correct Answer: A,B,C,F

* A follow-up audit may be carried out where nonconformities are major. This is true because a major nonconformity is a situation that raises significant doubt about the ability of the organization's management system to achieve its intended results, and therefore requires immediate corrective action. A follow-up audit is necessary to verify the effectiveness of the corrective action and the conformity of the management system12.
* A follow-up audit may be carried out where nonconformities are minor. This is true because a minor nonconformity is a situation that does not affect the capability of the management system to achieve its intended results, but represents a deviation from the specified requirements. A follow-up audit may be conducted to check the implementation of the corrective action and the improvement of the management system12.
* The outcomes of a follow-up audit should be reported to top management and the audit team leader who carried out the audit where the nonconformities were initially identified. This is true because the top management is responsible for ensuring the effectiveness and continual improvement of the management system, and the audit team leader is accountable for the audit process and the audit conclusions. The follow-up audit report should provide them with objective evidence of the status of the nonconformities and the corrective actions taken by the auditee13.
* The outcomes of a follow-up audit should be reported to the individual managing the audit programme and the audit client. This is true because the individual managing the audit programme is responsible for planning, implementing, monitoring and reviewing the audit activities, and the audit client is the organization or person requesting an audit. The follow-up audit report should inform them of the results of the follow-up audit and any changes in the certification status of the auditee13.
References :=
* ISO 19011:2022 Guidelines for auditing management systems
* ISO/IEC 27001:2022 Information technology - Security techniques - Information security management systems - Requirements
* ISO/IEC 17021-1:2022 Conformity assessment - Requirements for bodies providing audit and certification of management systems - Part 1: Requirements

Question 30

During an opening meeting of a Stage 2 audit, the Managing Director of the client organisation invites the audit team to view a new company video lasting 45 minutes. Which two of the following responses should the audit team leader make?

A.Advise the Managing Director that the audit team has to keep to the planned schedule
B.State that the audit team leader will stay behind after the opening meeting to view the video on behalf of the team
C.Invite the Managing Director to the auditors' hotel for a viewing that evening.
D.Suggest that the video could be viewed during a refreshment break
E.State that the audit team will make a decision on the viewing at a later time
F.Advise the Managing Director that the audit team agrees to his request

Correct Answer: A,D

Explanation
According to ISO 19011:2018, which provides guidelines for auditing management systems, an opening meeting is a formal communication between the audit team and the auditee at the start of an audit1. The purpose of the opening meeting is to confirm the audit objectives, scope and criteria, introduce the audit team and their roles, confirm the audit plan and logistics, explain the audit methods and procedures, and establish the communication channels1. Therefore, if the Managing Director of the client organization invites the audit team to view a new company video lasting 45 minutes during the opening meeting of a Stage 2 audit, the audit team leader should respond in a way that does not compromise the effectiveness and efficiency of the audit or create any misunderstanding or conflict with the auditee. Two possible ways to respond are to advise the Managing Director that the audit team has to keep to the planned schedule, as there may be limited time and resources available for the audit; or to suggest that the video could be viewed during a refreshment break, if it is relevant and useful for the audit and does not interfere with other audit activities1. The other options are not appropriate responses for the audit team leader to make in this situation. For example, stating that the audit team leader will stay behind after the opening meeting to view the video on behalf of the team may imply that the video is not important or relevant for the rest of the audit team; inviting the Managing Director to the auditors' hotel for a viewing that evening may create an impression of bias or favouritism; stating that the audit team will make a decision on the viewing at a later time may be vague or indecisive; and advising the Managing Director that the audit team agrees to his request may result in wasting valuable audit time or losing focus on the audit objectives1. References: ISO 19011:2018 - Guidelines for auditing management systems

Question 26

Question 27

Question 28

Question 29

Question 30

Download PDF File