(Oct-2023) Latest ISO-IEC-27001-Lead-Auditor Dumps for Success in Actual PECB Certified
Changing the Concept of ISO-IEC-27001-Lead-Auditor Exam Preparation 2023
PECB ISO-IEC-27001-Lead-Auditor (PECB Certified ISO/IEC 27001 Lead Auditor) certification exam is designed to test an individual's knowledge, skills, and competence to effectively plan and perform an audit of an information security management system (ISMS) based on the ISO/IEC 27001 standard. PECB Certified ISO/IEC 27001 Lead Auditor exam certification is recognized globally and is highly valued by organizations that prioritize information security.
NEW QUESTION # 77
A hacker gains access to a webserver and can view a file on the server containing credit card numbers.
Which of the Confidentiality, Integrity, Availability (CIA) principles of the credit card file are violated?
- A. Integrity
- B. Availability
- C. Confidentiality
- D. Compliance
Answer: C
Explanation:
Confidentiality is one of the Confidentiality, Integrity, Availability (CIA) principles of information security that states that only authorized parties should have access to information assets. Confidentiality protects the secrecy and privacy of information from unauthorized disclosure or exposure. A hacker gaining access to a web server and viewing a file containing credit card numbers violates the confidentiality principle, as he or she is not an authorized party and has access to sensitive information that belongs to others. Therefore, the correct answer is B. Reference: ISO/IEC 27000:2022, clause 3.8; Defining Security Principles - Pearson IT Certification.
NEW QUESTION # 78
Integrity of data means
- A. Accuracy and completeness of the data
- B. Data should be viewable at all times
- C. Data should be accessed by only the right people
Answer: A
Explanation:
Integrity of data means accuracy and completeness of the data. Integrity is one of the three main objectives of information security, along with confidentiality and availability. Integrity ensures that information and systems are not corrupted, modified, or deleted by unauthorized actions or events. Data should be viewable at all times is not related to integrity, but to availability. Data should be accessed by only the right people is not related to integrity, but to confidentiality. Reference: : CQI & IRCA ISO 27001:2022 Lead Auditor Course Handbook, page 24. : [ISO/IEC 27001 Brochures | PECB], page 4.
NEW QUESTION # 79
An employee caught temporarily storing an MP3 file in his workstation will not receive an IR.
- A. False
- B. True
Answer: A
NEW QUESTION # 80
Information or data that are classified as ______ do not require labeling.
- A. Confidential
- B. Highly Confidential
- C. Public
- D. Internal
Answer: C
Explanation:
Information or data that are classified as public do not require labeling. Public information or data are those that are intended for general disclosure and have no impact on the organization's operations or reputation if disclosed. Labeling is a method of implementing classification, which is a process of structuring information according to its sensitivity and value for the organization. Labeling helps to identify the level of protection and handling required for each type of information. Information or data that are classified as internal, confidential, or highly confidential require labeling, as they contain information that is not suitable for public disclosure and may cause harm or loss to the organization if disclosed. Reference: : CQI & IRCA ISO 27001:2022 Lead Auditor Course Handbook, page 34. : CQI & IRCA ISO 27001:2022 Lead Auditor Course Handbook, page 37. : [ISO/IEC 27001 LEAD AUDITOR - PECB], page 14.
NEW QUESTION # 81
You see a blue color sticker on certain physical assets. What does this signify?
- A. The asset with blue stickers should be kept air conditioned at all times
- B. The asset is critical and the impact is restricted to an employee only
- C. The asset is very high critical and its failure affects the entire organization
- D. The asset is high critical and its failure will affect a group/s/project's work in the organization
Answer: D
NEW QUESTION # 82
How is the purpose of information security policy best described?
- A. An information security policy provides direction and support to the management regarding information security.
- B. An information security policy provides insight into threats and the possible consequences.
- C. An information security policy makes the security plan concrete by providing it with the necessary details.
- D. An information security policy documents the analysis of risks and the search for countermeasures.
Answer: A
Explanation:
The purpose of information security policy is best described as providing direction and support to the management regarding information security. An information security policy is a high-level document that defines the organization's vision, objectives, principles and responsibilities for information security. It also sets the scope and context of the information security management system and aligns it with the organization's strategy and culture. An information security policy does not document the analysis of risks or the search for countermeasures, nor does it make the security plan concrete or provide insight into threats and consequences. These are tasks for other documents or processes within the information security management system. ISO/IEC 27001:2022 defines information security policy as "policy that provides direction and support for information security in accordance with business requirements and relevant laws and regulations" (see clause 3.29). Reference: [CQI & IRCA Certified ISO/IEC 27001:2022 Lead Auditor Training Course], ISO/IEC 27001:2022 Information technology - Security techniques - Information security management systems - Requirements, What is Information Security Policy?
NEW QUESTION # 83
In acceptable use of Information Assets, which is the best practice?
- A. Accessing phone or network transmissions, including wireless or wifi transmissions
- B. Playing any computer games during office hours
- C. Interfering with or denying service to any user other than the employee's host
- D. Access to information and communication systems are provided for business purpose only
Answer: D
NEW QUESTION # 84
In which order is an Information Security Management System set up?
- A. Establishment, operation, monitoring, improvement
- B. Implementation, operation, maintenance, establishment
- C. Establishment, implementation, operation, maintenance
- D. Implementation, operation, improvement, maintenance
Answer: C
Explanation:
The establishment phase of an ISMS involves defining the scope, context, objectives, and leadership commitment for information security management within an organization. It also involves identifying and assessing the risks and opportunities related to information security and selecting the appropriate controls to treat them. The implementation phase of an ISMS involves executing the plans and actions to achieve the information security objectives and implement the selected controls. It also involves ensuring the availability of resources and competencies for information security management. The operation phase of an ISMS involves monitoring and measuring the performance and effectiveness of the ISMS and reporting on the results. It also involves addressing nonconformities and taking corrective actions to prevent recurrence. The maintenance phase of an ISMS involves reviewing and evaluating the ISMS at planned intervals and identifying opportunities for improvement. It also involves updating the ISMS as necessary to reflect changes in the internal and external context of the organization. Therefore, an ISMS is set up in the following order: establishment, implementation, operation, maintenance. Reference: ISO/IEC 27001:2022, clauses 6-10; ISO/IEC 27000:2022, clause 4.
NEW QUESTION # 85
CEO sends a mail giving his views on the status of the company and the company's future strategy and the CEO's vision and the employee's part in it. The mail should be classified as
- A. Internal Mail
- B. Restricted Mail
- C. Confidential Mail
- D. Public Mail
Answer: A
NEW QUESTION # 86
A well-executed risk analysis provides a great deal of useful information. A risk analysis has four main objectives.
What is not one of the four main objectives of a risk analysis?
- A. Implementing counter measures
- B. Identifying assets and their value
- C. Determining relevant vulnerabilities and threats
- D. Establishing a balance between the costs of an incident and the costs of a security measure
Answer: A
Explanation:
Implementing countermeasures is not one of the four main objectives of a risk analysis. A risk analysis is a systematic process that involves identifying, assessing, and evaluating potential risks to understand their likelihood and impact. Its objective is to develop strategies to manage or mitigate those risks effectively. The four main objectives of a risk analysis are:
Identifying assets and their value: This involves determining what are the information assets that need to be protected and how valuable they are for the organization.
Determining relevant vulnerabilities and threats: This involves identifying what are the weaknesses or flaws in the information assets or systems that could be exploited by malicious actors or events and what are the sources or causes of those potential attacks or incidents.
Establishing a balance between the costs of an incident and the costs of a security measure: This involves estimating what are the potential consequences or impacts of a risk occurrence in terms of financial, operational, reputational, or legal losses and comparing them with what are the costs or benefits of implementing a security measure to prevent or reduce that risk.
Providing a basis for risk treatment decisions: This involves prioritizing the risks based on their likelihood and impact and selecting the most appropriate risk treatment options such as avoiding, transferring, reducing, or accepting the risk.
Implementing countermeasures is not an objective but an outcome of a risk analysis. Countermeasures are specific actions or controls that are designed to prevent or mitigate a risk occurrence or impact. Countermeasures are selected based on the results of a risk analysis and aligned with the organization's risk appetite and objectives. Therefore, the correct answer is B. Reference: [ISO/IEC 27005:2018], clauses 6-9; Risk Analysis - What Is It, Benefits, Example, Methods - WallStreetMojo.
NEW QUESTION # 87
Which of the following does an Asset Register contain? (Choose two)
- A. Asset Modifier
- B. Asset Type
- C. Asset Owner
- D. Process ID
Answer: B,C
Explanation:
An asset register is a document that contains information about the assets associated with information and information processing facilities within the scope of the information security management system. An asset register should include, among other things, the asset type and the asset owner. The asset type is a category or classification of the asset, such as hardware, software, data, document, service, etc. The asset owner is a person or entity that has been assigned the responsibility for managing and protecting the asset throughout its lifecycle. The asset type and the asset owner are important information for identifying and controlling the assets, as well as for performing risk assessments and applying security controls. ISO/IEC 27001:2022 requires the organization to maintain an inventory of assets within the scope of the information security management system (see clause A.8.1.1). Reference: CQI & IRCA Certified ISO/IEC 27001:2022 Lead Auditor Training Course, ISO/IEC 27001:2022 Information technology - Security techniques - Information security management systems - Requirements, What is an Asset Register?
NEW QUESTION # 88
In what part of the process to grant access to a system does the user present a token?
- A. Authorisation
- B. Verification
- C. Authentication
- D. Identification
Answer: D
NEW QUESTION # 89
What is the relationship between data and information?
- A. Data is structured information.
- B. Information is the meaning and value assigned to a collection of data.
Answer: B
NEW QUESTION # 90
Which two of the following are examples of audit methods that 'do' involve human interaction?
- A. Observing work performed by remote surveillance
- B. Analysing data by remotely accessing the auditee's server
- C. Reviewing the auditee's response to an audit finding
- D. Performing an independent review of procedures in preparation for an audit
- E. Analysing data by remotely accessing the auditee's server
Answer: C,D
Explanation:
Audit methods are techniques used by auditors to obtain audit evidence. Audit methods can be classified into two categories: those that involve human interaction and those that do not2. Audit methods that involve human interaction require direct communication between the auditor and the auditee or other relevant parties, such as interviews, questionnaires, surveys, meetings, etc. Audit methods that do not involve human interaction rely on observation, inspection, measurement, testing, sampling, analysis, etc., without requiring any verbal or written exchange2. Therefore, performing an independent review of procedures in preparation for an audit and reviewing the auditee's response to an audit finding are examples of audit methods that involve human interaction, as they require reading and evaluating documents provided by the auditee or other sources. On the other hand, analysing data by remotely accessing the auditee's server and observing work performed by remote surveillance are examples of audit methods that do not involve human interaction, as they do not require any direct communication with the auditee or other parties. Reference: ISO/IEC 27001:2022 Lead Auditor (Information Security Management Systems) | CQI | IRCA
NEW QUESTION # 91
You are preparing the audit findings. Select two options that are correct.
- A. There is an opportunity for improvement (OFI). The iLiirmation security incident training effectiveness can be improved. This is relevant to clause 7.2 and control A.6.3.
- B. There is a nonconformity (NC). The information security incident training has failed. This is not conforming with clause 7.2 and control A.6.3.
- C. There is an opportunity for improvement (OFI). The information security weaknesses, events, and madents are reported. This is relevant to clause 9.1 and control A.5.24.
- D. There is no nonconformance. The information security handling training has performed, and its effectiveness was evaluated. This conforms with clause 7.2 and control A.6.3.
- E. There is a nonconformity (NC). Based on sampling interview results, none of the interviewees were able to describe the incident management procedure reporting process including the role and responsibilities of personnel. This is not conforming with clause 9.1 and control A.5.24.
- F. There is no nonconformance. The information security weaknesses, events, and incidents are reported. This conforms with clause 9.1 and control A.5.24.
Answer: A,E
Explanation:
According to ISO/IEC 27001:2022, which specifies the requirements for establishing, implementing, maintaining and continually improving an information security management system (ISMS), clause 7.2 requires an organization to determine the necessary competence of persons doing work under its control that affects its ISMS performance, and to provide training or take other actions to acquire or maintain the necessary competence1. Control A.6.3 requires an organization to ensure that all employees and contractors are aware of information security threats and concerns, their responsibilities and liabilities, and are equipped to support organizational policies and procedures in this respect2. Therefore, if an ISMS auditor finds that the information security incident training effectiveness can be improved, this indicates an opportunity for improvement (OFI) that is relevant to clause 7.2 and control A.6.3.
According to ISO/IEC 27001:2022, clause 9.1 requires an organization to monitor, measure, analyze and evaluate its ISMS performance and effectiveness1. Control A.5.24 requires an organization to define and apply procedures for reporting information security events and weaknesses2. Therefore, if an ISMS auditor finds that based on sampling interview results, none of the interviewees were able to describe the incident management procedure reporting process including the role and responsibilities of personnel, this indicates a nonconformity (NC) that is not conforming with clause 9.1 and control A.5.24.
The other options are not correct options for preparing the audit findings based on the given information. For example, there is no nonconformance if the information security weaknesses, events, and incidents are reported, as this conforms with clause 9.1 and control A.5.24; there is no nonconformance if the information security handling training has performed, and its effectiveness was evaluated, as this conforms with clause 7.2 and control A.6.3; there is no nonconformity if the information security incident training has failed, as this may not necessarily indicate a lack of conformity with clause 7.2 or control A.6.3; there is no opportunity for improvement if the information security weaknesses, events, and incidents are reported, as this is already conforming with clause 9.1 and control A.5.24. Reference: ISO/IEC 27001:2022 - Information technology - Security techniques - Information security management systems - Requirements, ISO/IEC 27002:2013 - Information technology - Security techniques - Code of practice for information security controls
NEW QUESTION # 92
The data center at which you work is currently seeking ISO/IEC27001:2022 certification. In preparation for your initial certification visit a number of internal audits have been carried out by a colleague working at another data centre within your Group. They secured their ISO/IEC 27001:2022 certificate earlier in the year.
You have just qualified as an Internal ISMS auditor and your manager has asked you to review the audit process and audit findings as a final check before the external Certrfication Body arrives.
Which six of the following would cause you concern in respect of conformity to ISO/IEC 27001:2022 requirements?
- A. Audit reports are not held in hardcopy (i.e. on paper). They are only stored as ".POF documents on the organisation's intranet
- B. Top management commitment to the ISMS will not be audited before the certification visit, according to the audit programme
- C. The audit programme does not take into account the results of previous audits
- D. The audit programme mandates auditors must be independent of the areas they audit in order to satisfy the requirements of ISO/IEC 27001:2022
- E. Although the scope for each internal audit has been defined, there are no audit criteria defined for the audits carried out to date
- F. Audit reports to date have used key performance indicator information to focus solely on the efficiency of ISMS processes
- G. The audit programme does not reference audit methods or audit responsibilities
- H. The audit programme shows management reviews taking place at irregular intervals during the year
- I. The audit process states the results of audits will be made available to 'relevant' managers, not top management
- J. The audit programme does not take into account the relative importance of information security processes
Answer: B,C,E,F,H,J
Explanation:
According to ISO/IEC 27001:2022, which specifies the requirements for establishing, implementing, maintaining and continually improving an information security management system (ISMS), clause 9.3 requires top management to review the organization's ISMS at planned intervals to ensure its continuing suitability, adequacy and effectiveness1. Clause 9.2 requires the organization to conduct internal audits at planned intervals to provide information on whether the ISMS conforms to its own requirements and those of ISO/IEC 27001:2022, and is effectively implemented and maintained1. Therefore, when reviewing the audit process and audit findings as a final check before the external certification body arrives, an internal ISMS auditor should verify that these clauses are met in accordance with the audit criteria.
Six of the following statements would cause concern in respect of conformity to ISO/IEC 27001:2022 requirements:
The audit programme shows management reviews taking place at irregular intervals during the year: This statement would cause concern because it implies that the organization is not conducting management reviews at planned intervals, as required by clause 9.3. This may affect the ability of top management to ensure the continuing suitability, adequacy and effectiveness of the ISMS.
The audit programme does not take into account the relative importance of information security processes: This statement would cause concern because it implies that the organization is not applying a risk-based approach to determine the audit frequency, methods, scope and criteria, as recommended by ISO 19011:2018, which provides guidelines for auditing management systems2. This may affect the ability of the organization to identify and address the most significant risks and opportunities for its ISMS.
Although the scope for each internal audit has been defined, there are no audit criteria defined for the audits carried out to date: This statement would cause concern because it implies that the organization is not establishing audit criteria for each internal audit, as required by clause 9.2. Audit criteria are the set of policies, procedures or requirements used as a reference against which audit evidence is compared2. Without audit criteria, it is not possible to determine whether the ISMS conforms to its own requirements and those of ISO/IEC 27001:2022.
Audit reports to date have used key performance indicator information to focus solely on the efficiency of ISMS processes: This statement would cause concern because it implies that the organization is not evaluating the effectiveness of ISMS processes, as required by clause 9.1. Effectiveness is the extent to which planned activities are realized and planned results achieved2. Efficiency is the relationship between the result achieved and the resources used2. Both aspects are important for measuring and evaluating ISMS performance and improvement.
The audit programme does not take into account the results of previous audits: This statement would cause concern because it implies that the organization is not using the results of previous audits as an input for planning and conducting subsequent audits, as recommended by ISO 19011:20182. This may affect the ability of the organization to identify and address any recurring or unresolved issues or nonconformities related to its ISMS.
Top management commitment to the ISMS will not be audited before the certification visit, according to the audit programme: This statement would cause concern because it implies that the organization is not verifying that top management demonstrates leadership and commitment with respect to its ISMS, as required by clause 5.1. This may affect the ability of top management to ensure that the ISMS policy and objectives are established and compatible with the strategic direction of the organization; that roles, responsibilities and authorities for relevant roles are assigned and communicated; that resources needed for the ISMS are available; that communication about information security matters is established; that continual improvement of the ISMS is promoted; that other relevant management reviews are aligned with those of information security; and that support is provided to other relevant roles1.
The other statements would not cause concern in respect of conformity to ISO/IEC 27001:2022 requirements:
Audit reports are not held in hardcopy (i.e. on paper). They are only stored as ".POF documents on the organisation's intranet: This statement would not cause concern because it does not imply any nonconformity with ISO/IEC 27001:2022 requirements. The standard does not prescribe any specific format or media for documenting or storing audit reports, as long as they are controlled according to clause 7.5.
The audit programme mandates auditors must be independent of the areas they audit in order to satisfy the requirements of ISO/IEC 27001:2022: This statement would not cause concern because it does not imply any nonconformity with ISO/IEC 27001:2022 requirements. The standard does not prescribe any specific requirement for auditor independence, as long as the audit is conducted objectively and impartially, in accordance with ISO 19011:20182.
The audit programme does not reference audit methods or audit responsibilities: This statement would not cause concern because it does not imply any nonconformity with ISO/IEC 27001:2022 requirements. The standard does not prescribe any specific requirement for referencing audit methods or audit responsibilities in the audit programme, as long as they are defined and documented according to ISO 19011:20182.
The audit process states the results of audits will be made available to 'relevant' managers, not top management: This statement would not cause concern because it does not imply any nonconformity with ISO/IEC 27001:2022 requirements. The standard does not prescribe any specific requirement for communicating the results of audits to top management, as long as they are reported to the relevant parties and used as an input for management review, according to clause 9.3.
NEW QUESTION # 93
Who is authorized to change the classification of a document?
- A. The administrator of the document
- B. The owner of the document
- C. The manager of the owner of the document
- D. The author of the document
Answer: B
Explanation:
The owner of the document is authorized to change the classification of the document. The owner of the document is the person who has the ultimate responsibility for the creation, maintenance, and protection of the document. The author of the document is not necessarily the owner of the document, as they may create the document on behalf of someone else. The administrator of the document is not authorized to change the classification of the document, as they only provide technical support for managing and storing documents. The manager of the owner of the document is not authorized to change the classification of the document, unless they are delegated by the owner or have a higher authority in the organization. Reference: : CQI & IRCA ISO 27001:2022 Lead Auditor Course Handbook, page 37. : CQI & IRCA ISO 27001:2022 Lead Auditor Course Handbook, page 38. : CQI & IRCA ISO 27001:2022 Lead Auditor Course Handbook, page 39. : CQI & IRCA ISO 27001:2022 Lead Auditor Course Handbook, page 40. : CQI & IRCA ISO 27001:2022 Lead Auditor Course Handbook, page 41.
NEW QUESTION # 94
Which of the following is a preventive security measure?
- A. Storing sensitive information in a data save
- B. Shutting down the Internet connection after an attack
- C. Installing logging and monitoring software
Answer: A
NEW QUESTION # 95
After a fire has occurred, what repressive measure can be taken?
- A. Buying in a proper fire insurance policy
- B. Repairing all systems after the fire
- C. Extinguishing the fire after the fire alarm sounds
Answer: C
Explanation:
A repressive security measure is a measure that aims to stop or limit an ongoing incident from causing further harm, or to restore normal operations as soon as possible. A repressive security measure can be a policy, a procedure, a device, a technique or an action that responds to an incident and mitigates its consequences. Extinguishing the fire after the fire alarm sounds is an example of a repressive security measure, because it stops the fire from spreading and damaging more assets or endangering more people. ISO/IEC 27001:2022 defines repressive control as "control that modifies risk by reducing the consequences of an unwanted incident" (see clause 3.38). Reference: [CQI & IRCA Certified ISO/IEC 27001:2022 Lead Auditor Training Course], ISO/IEC 27001:2022 Information technology - Security techniques - Information security management systems - Requirements, [What is Repressive Security?]
NEW QUESTION # 96
Which of the following is a preventive security measure?
- A. Storing sensitive information in a data save
- B. Shutting down the Internet connection after an attack
- C. Installing logging and monitoring software
Answer: A
Explanation:
A preventive security measure is a measure that aims to prevent or deter potential incidents from occurring, or to reduce their likelihood or impact. A preventive security measure can be a policy, a procedure, a device, a technique or an action that reduces the exposure to threats and vulnerabilities. Storing sensitive information in a data safe is an example of a preventive security measure, because it protects the information from unauthorized access, disclosure, modification or destruction by physical means, such as theft, fire, flood, etc. ISO/IEC 27001:2022 defines preventive control as "control that modifies risk by avoiding an unwanted incident" (see clause 3.19). Reference: [CQI & IRCA Certified ISO/IEC 27001:2022 Lead Auditor Training Course], ISO/IEC 27001:2022 Information technology - Security techniques - Information security management systems - Requirements, [What is Preventive Security?]
NEW QUESTION # 97
You receive the following mail from the IT support team: Dear User,Starting next week, we will be deleting all inactive email accounts in order to create spaceshare the below details in order to continue using your account. In case of no response, Name:
Email ID:
Password:
DOB:
Kindly contact the webmail team for any further support. Thanks for your attention.
Which of the following is the best response?
- A. Ignore the email
- B. One should not respond to these mails and report such email to your supervisor
- C. Respond it by saying that one should not share the password with anyone
Answer: B
Explanation:
The best response to the email from the IT support team asking for personal details is to not respond to the email and report it to your supervisor. The email is likely a phishing attempt, which is a form of social engineering that uses deceptive emails or other messages to trick recipients into revealing sensitive information, such as passwords, credit card numbers, bank account details, etc. Phishing emails often impersonate legitimate organizations or individuals and create a sense of urgency or curiosity to lure the victims into clicking on malicious links, opening malicious attachments or providing personal information. The IT support team should never ask for your password or other personal details via email, as this is a violation of information security policies and best practices. Ignoring the email or responding to it by saying that one should not share the password with anyone are not sufficient responses, as they do not alert the IT support team or your supervisor about the phishing attempt, which could affect other users as well. Reporting the email to your supervisor is a responsible action that could help prevent further damage or compromise of information. ISO/IEC 27001:2022 requires the organization to implement awareness and training programs to make users aware of the risks of social engineering attacks, such as phishing, and how to avoid them (see clause A.7.2.2). Reference: CQI & IRCA Certified ISO/IEC 27001:2022 Lead Auditor Training Course, ISO/IEC 27001:2022 Information technology - Security techniques - Information security management systems - Requirements, What is Phishing?
NEW QUESTION # 98
-------------------------is an asset like other important business assets has value to an organization and consequently needs to be protected.
- A. Information
- B. Security
- C. Data
- D. Infrastructure
Answer: A
Explanation:
Information is an asset like other important business assets, as it has value to an organization and consequently needs to be protected. Information can be in any form, such as electronic, paper, or verbal. Information security is the protection of information from unauthorized access, use, disclosure, modification, or destruction2. Reference: ISO/IEC 27001:2022 Lead Auditor (Information Security Management Systems) | CQI | IRCA
NEW QUESTION # 99
Which of the following does an Asset Register contain? (Choose two)
- A. Asset Modifier
- B. Asset Type
- C. Asset Owner
- D. Process ID
Answer: B,C
NEW QUESTION # 100
A member of staff denies sending a particular message.
Which reliability aspect of information is in danger here?
- A. availability
- B. integrity
- C. correctness
- D. confidentiality
Answer: B
NEW QUESTION # 101
What is the standard definition of ISMS?
- A. A systematic approach for establishing, implementing, operating,monitoring, reviewing, maintaining and improving an organization's information security to achieve business objectives.
- B. A project-based approach to achieve business objectives for establishing, implementing, operating, monitoring, reviewing, maintaining and improving an organization's information security
- C. Is an information security systematic approach to achieve business objectives for implementation, establishing, reviewing,operating and maintaining organization's reputation.
- D. A company wide business objectives to achieve information security awareness for establishing, implementing, operating, monitoring, reviewing, maintaining and improving
Answer: A
NEW QUESTION # 102
......
ISO-IEC-27001-Lead-Auditor Exam Crack Test Engine Dumps Training With 140 Questions: https://www.passsureexam.com/ISO-IEC-27001-Lead-Auditor-pass4sure-exam-dumps.html
Getting ISO-IEC-27001-Lead-Auditor Certification Made Easy: https://drive.google.com/open?id=17OsbhTntNl556oBualEhuDRQUQzdR_ZF