Which of the following traits is NOT associated with an external audit?

• A.It is always conducted in a planned and timely manner
• B.It has no advisory role within the organization
• C.It assesses the effectiveness and efficiency of ISMS

Comment: *

Name: *

Email: *

Verification: *

What risk treatment option has Company A Implemented If it has decided not to collect information from users so that It is not necessary to implement information security controls?

• A.Risk modification
• B.Risk retention
• C.Risk avoidance

Comment: *

Name: *

Email: *

Verification: *

An organization that has an ISMS in place conducts management reviews at planned intervals, but does not retain documented information on the results. Is this in accordance with the requirements of ISO/IEC 27001?

• A.Yes. ISO/IEC 27001 does not require organizations to document the results of management reviews
• B.No, ISO/IEC 27001 requires organizations to document the results of management reviews
• C.Yes. ISO/IEC 27001 requires organizations to document the results of management reviews only if they are conducted ad hoc

Comment: *

Name: *

Email: *

Verification: *

Which of the following statements regarding information security risk is NOT correct?

• A.Information security risk cannot be accepted without being treated or during the process of risk treatment
• B.Information security risk is associated with the potential that the vulnerabilities of an information asset may be exploited by threats
• C.Information security risk can be expressed as the effect of uncertainty on information security objectives

Comment: *

Name: *

Email: *

Verification: *

Scenario 1: HealthGenic is a pediatric clinic that monitors the health and growth of individuals from infancy to early adulthood using a web-based medical software. The software is also used to schedule appointments, create customized medical reports, store patients' data and medical history, and communicate with all the
[^involved parties, including parents, other physicians, and the medical laboratory staff.
Last month, HealthGenic experienced a number of service interruptions due to the increased number of users accessing the software Another issue the company faced while using the software was the complicated user interface, which the untrained personnel found challenging to use.
The top management of HealthGenic immediately informed the company that had developed the software about the issue. The software company fixed the issue; however, in the process of doing so, it modified some files that comprised sensitive information related to HealthGenic's patients. The modifications that were made resulted in incomplete and incorrect medical reports and, more importantly, invaded the patients' privacy.
Based on the scenario above, answer the following question:
Which of the following indicates that the confidentiality of information was compromised?

• A.Invasion of patients' privacy
• B.Service interruptions due to the increased number of users
• C.Modification of patients' medical reports

Comment: *

Name: *

Email: *

Verification: *