Scenario: Clinic, founded in the 1990s, is a medical device company that specializes in treatments for heart-related conditions and complex surgical interventions. Based in Europe, it serves both patients and healthcare professionals. Clinic collects patient data to tailor treatments, monitor outcomes, and improve device functionality. To enhance data security and build trust, Clinic is implementing an information security management system (ISMS) based on ISO/IEC 27001. This initiative demonstrates Clinic's commitment to securely managing sensitive patient information and its proprietary technologies.Clinic established the scope of its ISMS by solely considering internal issues, interfaces and dependencies between activities conducted internally and those outsourced to other organizations, and the expectations of interested parties. This scope was carefully documented and made accessible. In defining its ISMS, Clinic chose to focus specifically on key processes within critical departments such as Research and Development, Patient Data Management, and Customer Support.Despite initial challenges. Clinic remained committed to its ISMS implementation, tailoring security controls to its unique needs. The project team excluded certain Annex A controls from ISO/IEC 27001, incorporating additional sector-specific controls to enhance security. The project team meticulously evaluated the applicability of these controls against internal and external factors, culminating in developing a comprehensive Statement of Applicability (SoA) detailing the rationale behind control selection and implementation.As preparations for certification progressed, Brian, appointed as the team leader for the project team, adopted a self-directed risk assessment methodology to identify and evaluate the company, strategic issues, and security practices. This proactive approach ensured that Clinic's risk assessment aligned with its objectives and missions.Based on scenario, Clinic initially defined its information security objectives and then conducted a risk assessment. Is this acceptable?
Answer(s): C
According to ISO/IEC 27001, information security objectives should be established after conducting a risk assessment. The risk assessment helps identify potential threats and vulnerabilities, which should then inform the setting of objectives. This ensures that the objectives are aligned with the actual risks the organization faces, leading to more effective and relevant security measures. Therefore, defining the objectives before conducting the risk assessment is not in line with ISO/IEC 27001 requirements.
Scenario: Clinic, founded in the 1990s, is a medical device company that specializes in treatments for heart-related conditions and complex surgical interventions. Based in Europe, it serves both patients and healthcare professionals. Clinic collects patient data to tailor treatments, monitor outcomes, and improve device functionality. To enhance data security and build trust, Clinic is implementing an information security management system (ISMS) based on ISO/IEC 27001. This initiative demonstrates Clinic's commitment to securely managing sensitive patient information and its proprietary technologies.Clinic established the scope of its ISMS by solely considering internal issues, interfaces and dependencies between activities conducted internally and those outsourced to other organizations, and the expectations of interested parties. This scope was carefully documented and made accessible. In defining its ISMS, Clinic chose to focus specifically on key processes within critical departments such as Research and Development, Patient Data Management, and Customer Support.Despite initial challenges. Clinic remained committed to its ISMS implementation, tailoring security controls to its unique needs. The project team excluded certain Annex A controls from ISO/IEC 27001, incorporating additional sector-specific controls to enhance security. The project team meticulously evaluated the applicability of these controls against internal and external factors, culminating in developing a comprehensive Statement of Applicability (SoA) detailing the rationale behind control selection and implementation.As preparations for certification progressed, Brian, appointed as the team leader for the project team, adopted a self-directed risk assessment methodology to identify and evaluate the company, strategic issues, and security practices. This proactive approach ensured that Clinic's risk assessment aligned with its objectives and missions.Based on scenario, the Clinic decided that the ISMS would cover only key processes and departments. Is this acceptable?
Answer(s): A
According to ISO/IEC 27001, an organization is allowed to define the scope of its ISMS to focus on specific processes and departments that are most critical to its information security objectives. However, if the scope excludes certain processes or departments, this exclusion must be properly justified. The scope should reflect the organization's risk assessment and business needs, ensuring that it is aligned with its overall security goals. The justification for exclusions is essential for transparency and clarity, especially in the certification process.
Scenario: Clinic, founded in the 1990s, is a medical device company that specializes in treatments for heart-related conditions and complex surgical interventions. Based in Europe, it serves both patients and healthcare professionals. Clinic collects patient data to tailor treatments, monitor outcomes, and improve device functionality. To enhance data security and build trust, Clinic is implementing an information security management system (ISMS) based on ISO/IEC 27001. This initiative demonstrates Clinic's commitment to securely managing sensitive patient information and its proprietary technologies.Clinic established the scope of its ISMS by solely considering internal issues, interfaces and dependencies between activities conducted internally and those outsourced to other organizations, and the expectations of interested parties. This scope was carefully documented and made accessible. In defining its ISMS, Clinic chose to focus specifically on key processes within critical departments such as Research and Development, Patient Data Management, and Customer Support.Despite initial challenges. Clinic remained committed to its ISMS implementation, tailoring security controls to its unique needs. The project team excluded certain Annex A controls from ISO/IEC 27001, incorporating additional sector-specific controls to enhance security. The project team meticulously evaluated the applicability of these controls against internal and external factors, culminating in developing a comprehensive Statement of Applicability (SoA) detailing the rationale behind control selection and implementation.As preparations for certification progressed, Brian, appointed as the team leader for the project team, adopted a self-directed risk assessment methodology to identify and evaluate the company, strategic issues, and security practices. This proactive approach ensured that Clinic's risk assessment aligned with its objectives and missions.Based on scenario, which methodology did Brian choose to conduct risk assessment?
The scenario mentions that Brian adopted a self-directed risk assessment methodology to align the company's strategic issues and security practices with its objectives. Among the options provided, EBIOS (Expression des Besoins et Identification des Objectifs de Sécurité) is a well-known methodology for risk assessment, particularly in the context of ISO/IEC 27001, and is focused on identifying security needs and objectives. This aligns with Brian’s approach in the scenario.OCTAVE and MEHARI are other well-known risk assessment methodologies, but based on the context and goals of the risk assessment described, EBIOS is the most likely choice.
According to ISO/IEC 27001, clause 5.1, Leadership and commitment, which of the following is NOT a responsibility of top management?
Answer(s): B
According to ISO/IEC 27001, top management is responsible for ensuring the availability of resources, promoting continual improvement, and directing and supporting individuals to contribute to the effectiveness of the ISMS. However, conducting regular internal audits is not typically the responsibility of top management. Internal audits are generally conducted by internal auditors or designated personnel, not directly by top management, although they may be involved in reviewing audit results and ensuring corrective actions are taken.
A marketing agency has developed its risk assessment approach as part of the ISMS implementation. Is this acceptable?
ISO/IEC 27001 allows organizations to use any risk assessment methodology as long as it complies with the requirements of the standard. The methodology must be systematic, aligned with the organization's risk context, and ensure that risks to information security are identified, evaluated, and managed effectively. There is no specific requirement to use a prescribed methodology; rather, the focus is on ensuring that the chosen methodology meets the needs of the ISMS and supports its objectives.
Share your comments for PECB ISO-IEC-27001-Lead-Auditor exam with other users:
american history 1
good level of questions
i need this dump kindly upload it
do we need c# coding to be az204 certified
excellent topics covered
are these really financial cloud questions and answers, seems these are basic admin question and answers
are these comments real
please upload the latest dumps
a company runs its workloads on premises. the company wants to forecast the cost of running a large application on aws. which aws service or tool can the company use to obtain this information? pricing calculator ... the aws pricing calculator is primarily used for estimating future costs
looks interesting
thanks! that’s amazing
the exam dumps are helping me get a solid foundation on the practical techniques and practices needed to be successful in the auditing world.
q 14 should be dmz sever1 and notepad.exe why does note pad have a 443 connection
question # 108, correct answers are business growth and risk reduction.
are these valid chfi questions
question: 162 should be dlp (b)
good exam questions
I have to say this is really close to real exam. Passed my exam with this.
good analytics question
this looks accurate
question 46, the answer should be data "virtualization" (not visualization).
its useful.
Pass this exam 3 days ago. The PDF version and the Xengine App is quite useful.
informative for me.
question 134s answer shoule be "dlp"
in 72 the answer must be [sys_user_has_role] table.
i appreciated the mix of multiple-choice and short answer questions. i passed my exam this morning.
great to find this website, thanks
examination questions seem to be relevant.
planning to take psm test
please allow to download
please provide dumps
is the answer to question 15 correct ? i feel like the answer should be b
its getting more technical