A healthcare organization needs to ensure that patient records are available to the medical staff whenever needed. Which measure should it prioritize to achieve this?

• A.Establishing record retention policies
• B.Implementing multi-factor authentication
• C.Using version control systems for data management

Comment: *

Name: *

Email: *

Verification: *

According to scenario 7, the team prevented a potential attack based on knowledge gained from previous incidents. Is this acceptable?

• A.No, every information security incident is different, hence knowledge gained from previous incidents cannot prevent potential attacks
• B.Yes, in the absence of an information security incident management policy, lessons learned can be applied
• C.No, before responding to an information security incident, an information security incident management policy must be established

Comment: *

Name: *

Email: *

Verification: *

According to ISO/IEC 27001 controls, when planning audit tests and assurance activities involving operational systems, who should be involved in the agreement process except the tester?

• A.The top management
• B.The appropriate management
• C.The board of directors

Comment: *

Name: *

Email: *

Verification: *

Scenario 8: SunDee is an American biopharmaceutical company, headquartered in California, the US. It specializes in developing novel human therapeutics, with a focus on cardiovascular diseases, oncology, bone health, and inflammation. The company has had an information security management system (ISMS) based on SO/IEC 27001 in place for the past two years. However, it has not monitored or measured the performance and effectiveness of its ISMS and conducted management reviews regularly Just before the recertification audit, the company decided to conduct an internal audit. It also asked most of their staff to compile the written individual reports of the past two years for their departments. This left the Production Department with less than the optimum workforce, which decreased the company's stock.
Tessa was SunDee's internal auditor. With multiple reports written by 50 different employees, the internal audit process took much longer than planned, was very inconsistent, and had no qualitative measures whatsoever Tessa concluded that SunDee must evaluate the performance of the ISMS adequately. She defined SunDee's negligence of ISMS performance evaluation as a major nonconformity, so she wrote a nonconformity report including the description of the nonconformity, the audit findings, and recommendations. Additionally, Tessa created a new plan which would enable SunDee to resolve these issues and presented it to the top management Based on scenario 8. did the nonconformity report include all the necessary aspects?

• A.Yes, the report included all the necessary aspects
• B.No, the report must also specify the root cause of the nonconformity
• C.No, the report must also specify the audit criteria

Comment: *

Name: *

Email: *

Verification: *

What is the most important asset to Socket Inc. associated with the use of cloud storage? Refer to scenario 5.

• A.Employees with access to cloud storage files
• B.Customers' personal data
• C.IT provided network drives

Comment: *

Name: *

Email: *

Verification: *