ISO-IEC-27001-Lead-Implementer Tested & Approved ISO 27001 Study Materials [Q20-Q38]

Posted byadminJanuary 1, 2023Leave a Comment on ISO-IEC-27001-Lead-Implementer Tested & Approved ISO 27001 Study Materials [Q20-Q38]

Rate this post

ISO-IEC-27001-Lead-Implementer Tested & Approved ISO 27001 Study Materials

Validate your Skills with Updated ISO 27001 Exam Questions & Answers and Test Engine

NO.20 The identified owner of an asset is always an individual

True

False

NO.21 Of the following, which is the best organization or set of organizations to contribute to compliance?

IT only

IT,business management, HR and legal

IT and management

IT and legal

NO.22 It is allowed that employees and contractors are provided with an anonymous reporting channel to report violations of information security policies or procedures (“whistle blowing”)

True

False

NO.23 Responsibilities for information security in projects should be defined and allocated to:

the project manager

specified roles defined in the used project management method of the organization

the InfoSec officer

the owner of the involved asset

NO.24 We can acquire and supply information in various ways. The value of the information depends on whether it is reliable. What are the reliability aspects of information?

Availability, Information Value and Confidentiality

Availability, Integrity and Confidentiality

Availability, Integrity and Completeness

Timeliness, Accuracy and Completeness

NO.25 Select risk control activities for domain “10. Encryption” of ISO / 27002: 2013 (Choose two)

Work in safe areas

Cryptographic Controls Use Policy

Physical security perimeter

Key management

NO.26 Which of these control objectives are NOT in the domain “12.OPERATIONAL SAFETY”?

Protection against malicious code

Redundancies

Test data

Technical vulnerability management

NO.27 The company Midwest Insurance has taken many measures to protect its information. It uses an Information Security Management System, the input and output of data in applications is validated, confidential documents are sent in encrypted form and staff use tokens to access information systems. Which of these is not a technical measure?

Information Security Management System

The use of tokens to gain access to information systems

Validation of input and output data in applications

Encryption ofinformation

NO.28 Why is compliance important forthe reliability of the information?

Compliance is another word for reliability. So, if a company indicates that it is compliant, it means that the information is managed properly.

By meeting the legislative requirements and theregulations of both the government and internal management, an organization shows that it manages its information in a sound manner.

When an organization employs a standard such as the ISO/IEC 27002 and uses it everywhere, it is compliant and thereforeit guarantees the reliability of its information.

When an organization is compliant, it meets the requirements of privacy legislation and, in doing so, protects the reliability of its information.

NO.29 You are a consultant and areregularly hired by the Ministry of Defense to perform analysis. Since the assignments are irregular, you outsource the administration of your business to temporary workers. You don’t want the temporary workers to have access to your reports.
Which reliability aspect of the information in your reports must you protect?

Availability

Integrity

Confidentiality

NO.30 Which of these reliability aspects is “completeness” a part of?

Availability

Exclusivity

Integrity

Confidentiality

NO.31 A non-human threat for computer systems is a flood. In which situation is a flood always a relevant threat?

If the riskanalysis has not been carried out.

When computer systems are kept in a cellar below ground level.

When the computer systems are not insured.

When the organization is located near a river.

NO.32 You apply for a position in another company and get the job. Along with your contract, you are asked to sign a code of conduct. What is a code of conduct?

A code ofconduct specifies how employees are expected to conduct themselves and is the same for all companies.

A code of conduct is a standard part of a labor contract.

A code of conduct differs from company to company and specifies, among other things, the rules of behavior with regard to the usage of information systems.

NO.33 Which of the following measures is a correctivemeasure?

Incorporating an Intrusion Detection System (IDS) in the design of a computer center

Installing a virus scanner in an information system

Making a backup of the data that has been created or altered that day

Restoring a backup of the correct database after a corrupt copy of the database was written over the original

NO.34 You have juststarted working at a large organization. You have been asked to sign a code of conduct as well as a contract. What does the organization wish to achieve with this?

A code of conduct helps to prevent the misuse of IT facilities.

A code of conduct is alegal obligation that organizations have to meet.

A code of conduct prevents a virus outbreak.

A code of conduct gives staff guidance on how to report suspected misuses of IT facilities.

NO.35 Logging in to a computer system is an access-granting process consisting of three steps: identification, authentication and authorization. What occurs during the first step of this process: identification?

Thefirst step consists of checking if the user is using the correct certificate.

The first step consists of checking if the user appears on the list of authorized users.

The first step consists of comparing the password with the registered password.

The first step consists of granting access to the information to which the user is authorized.

NO.36 Peter works at the company Midwest Insurance. His manager, Linda, asks him to send the terms and conditions for a life insurance policy to Rachel, a client. Who determines the value of the information in the insurance terms and conditions document?

The recipient, Rachel

The person who drafted the insurance terms and conditions

The manager, Linda

The sender, Peter

NO.37 What is the greatest risk for an organization ifno information security policy has been defined?

If everyone works with the same account, it is impossible to find out who worked on what.

Information security activities are carried out by only a few people.

Too many measures areimplemented.

It is not possible for an organization to implement information security in a consistent manner.

NO.38 Who is accountable to classify information assets?

the CEO

the CISO