Scenario 9: OpenTech provides IT and communications services. It helps data communication enterprises and network operators become multi-service providers During an internal audit, its internal auditor, Tim, has identified nonconformities related to the monitoring procedures He identified and evaluated several system Invulnerabilities.
Tim found out that user IDs for systems and services that process sensitive information have been reused and the access control policy has not been followed After analyzing the root causes of this nonconformity, the ISMS project manager developed a list of possible actions to resolve the nonconformity. Then, the ISMS project manager analyzed the list and selected the activities that would allow the elimination of the root cause and the prevention of a similar situation in the future. These activities were included in an action plan The action plan, approved by the top management, was written as follows:
A new version of the access control policy will be established and new restrictions will be created to ensure that network access is effectively managed and monitored by the Information and Communication Technology (ICT) Department The approved action plan was implemented and all actions described in the plan were documented.
Based on scenario 9. is the action plan for the identified nonconformities sufficient to eliminate the detected nonconformities?

• A.Yes, because a separate action plan has been created for the identified nonconformity
• B.No, because the action plan does not include a timeframe for implementation
• C.No, because the action plan does not address the root cause of the identified nonconformity

Comment: *

Name: *

Email: *

Verification: *

Scenario 10: ProEBank
ProEBank, an Austrian financial institution, implemented an ISMS and prepared for ISO/IEC 27001 certification. During planning, the company identified aconflict of interestwith one auditor, who had previously worked with their main competitor. ProEBankrefused to undergo the audituntil a new audit team was assigned. The certification body acknowledged the issue and replaced the team.
ProEBank is an Austrian financial institution known for its comprehensive range of banking services.
Headquartered in Vienna, it leaverages the city's advanced technological and financial ecosystem To enhance its security posture, ProEBank has implementied an information security management system (ISMS) based on the ISO/IEC 27001. After a year of having the ISMS in place, the company decided to apply for a certification audit to obtain certification against ISO/IEC 27001.
To prepare for the audit, the company first informed its employees for the audit and organized training sessions to prepare them. It also prepared documented information in advance, so that the documents would be ready when external auditors asked to review them Additionally, it determined which of its employees have the knowledge to help the external auditors understand and evaluate the processes.
During the planning phase for the audit, ProEBank reviewed the list of assigned auditors provided by the certification body. Upon reviewing the list, ProEBank identified a potential conflict of interest with one of the auditors, who had previously worked for ProEBank's mein competitor in the banking industry To ensure the integrity of the audit process. ProEBank refused to undergo the audit until a completely new audit team was assigned. In response, the certification body acknowledged the conflict of interest and made the necessary adjustments to ensure the impartiality of the audit team After the resolution of this issue, the audit team assessed whether the ISMS met both the standard's requirements and the company's objectives. During this process, the audit team focused on reviewing documented information.
Three weeks later, the team conducted an on-site visit to the auditee's location where they aimed to evaluate whether the ISMS conformed to the requirements of ISO/IEC 27001. was effectively implemented, and enabled the auditee to reach its information security objectives. After the on-site visit the team prepared the audit conclusions and notified the auditee that some minor nonconformities had been detected The audit team leader then issued a recommendation for certification.
After receiving the recommendation from the audit team leader, the certification body established a committee to make the decision for certification. The committee included one member from the audit team and two other experts working for the certification body.
Question:
Is ProEBank's decision to require a new audit team due to a perceived conflict of interest acceptable?

• A.No - they should have requested only the replacement of the auditor
• B.No - the auditee does not have the right to reject the auditors selected by the certification body
• C.Yes - the auditee is allowed to refuse to undergo the audit until a new audit team is established

Comment: *

Name: *

Email: *

Verification: *

According to scenario 9, TroNlcon SPEC aimed to eliminate the causes of adverse events By focusing on:

• A.Preventing information security incidents rather than correcting them
• B.Correcting information security Incidents rather than preventing them
• C.Detecting information security incidents rather than correcting them

Comment: *

Name: *

Email: *

Verification: *

What is the main purpose of Annex A 7.1 Physical security perimeters of ISO/IEC 27001?

• A.To ensure access to information and other associated assets is defined and authorized
• B.To maintain the confidentiality of information that is accessible by personnel or external parties
• C.To prevent unauthorized physical access, damage, and interference to the organization's information and other associated assets

Comment: *

Name: *

Email: *

Verification: *

Which tool is used to identify, analyze, and manage interested parties?

• A.The likelihood/severity matrix
• B.The power/interest matrix
• C.The probability/impact matrix

Comment: *

Name: *

Email: *

Verification: *