Del&Co has decided to improve their staff-related controls to prevent incidents. Which of the following is NOT a preventive control related to the Del&Co's staff?

• A.Video cameras
• B.Authentication and authorization
• C.Control of physical access to the equipment

Comment: *

Name: *

Email: *

Verification: *

Who should verily the effectiveness of the corrective actions taken by the auditee after an internal audit?

• A.An Independent auditor should be contracted to perform this evaluation
• B.The information security manager
• C.The internal auditor

Comment: *

Name: *

Email: *

Verification: *

Scenario 8: SunDee is an American biopharmaceutical company, headquartered in California, the US. It specializes in developing novel human therapeutics, with a focus on cardiovascular diseases, oncology, bone health, and inflammation. The company has had an information security management system (ISMS) based on SO/IEC 27001 in place for the past two years. However, it has not monitored or measured the performance and effectiveness of its ISMS and conducted management reviews regularly Just before the recertification audit, the company decided to conduct an internal audit. It also asked most of their staff to compile the written individual reports of the past two years for their departments. This left the Production Department with less than the optimum workforce, which decreased the company's stock.
Tessa was SunDee's internal auditor. With multiple reports written by 50 different employees, the internal audit process took much longer than planned, was very inconsistent, and had no qualitative measures whatsoever Tessa concluded that SunDee must evaluate the performance of the ISMS adequately. She defined SunDee's negligence of ISMS performance evaluation as a major nonconformity, so she wrote a nonconformity report including the description of the nonconformity, the audit findings, and recommendations. Additionally, Tessa created a new plan which would enable SunDee to resolve these issues and presented it to the top management Based on scenario 8. did the nonconformity report include all the necessary aspects?

• A.Yes, the report included all the necessary aspects
• B.No, the report must also specify the root cause of the nonconformity
• C.No, the report must also specify the audit criteria

Comment: *

Name: *

Email: *

Verification: *

According to scenario 9, TroNlcon SPEC aimed to eliminate the causes of adverse events By focusing on:

• A.Detecting information security incidents rather than correcting them
• B.Preventing information security incidents rather than correcting them
• C.Correcting information security Incidents rather than preventing them

Comment: *

Name: *

Email: *

Verification: *

What is an example of a security incident?

• A.A file is saved under an incorrect name.
• B.The lighting in the department no longer works.
• C.A member of staff loses a laptop.
• D.You cannot set the correct fonts in your word processing software.

Comment: *

Name: *

Email: *

Verification: *