PECB ISO-IEC-27001-Lead-Auditor Exam Dumps

PECB ISO-IEC-27001-Lead-Auditor Sample Question Answers

Question # 1

You are the lead auditor of the courier company SpeeDelivery. You have carried out a risk analysis and now want to determine your risk strategy. You decide to take measures for the large risks but not for the small risks. What is this risk strategy called? 

A. Risk bearing
 B. Risk avoidance
 C. Risk neutral 
D. Risk skipping 

Show Answer

Question # 2

Which of the following is a possible event that can have a disruptive effect on the reliability of information? 

A. Threat 
B. Risk 
C. Vulnerability 
D. Dependency

Show Answer

Question # 3

In what part of the process to grant access to a system does the user present a token? 

A. Authorisation 
B. Verification 
C. Authentication 
D. Identification 

Show Answer

Question # 4

In acceptable use of Information Assets, which is the best practice? 

A. Access to information and communication systems are provided for business purpose only 
B. Interfering with or denying service to any user other than the employee's host 
C. Playing any computer games during office hours 
D. Accessing phone or network transmissions, including wireless or wifi transmissions 

Show Answer

Question # 5

In the event of an Information security incident, system users' roles and responsibilities are to be observed, except: 

A. Report suspected or known incidents upon discovery through the Servicedesk 
B. Preserve evidence if necessary 
C. Cooperate with investigative personnel during investigation if needed 
D. Make the information security incident details known to all employees

Show Answer

Question # 6

Access Control System, CCTV and security guards are form of: 

A. Environment Security 
B. Access Control 
C. Physical Security
 D. Compliance 

Show Answer

Question # 7

What is the difference between a restricted and confidential document? 

A. Restricted - to be shared among an authorized group Confidential - to be shared among named individuals 
B. Restricted - to be shared among named individuals Confidential - to be shared among an authorized group 
C. Restricted - to be shared among named individuals Confidential - to be shared across the organization only 
D. Restricted - to be shared among named individuals Confidential - to be shared with friends and family 

Show Answer

Question # 8

A fire breaks out in a branch office of a health insurance company. The personnel are transferred to neighboring branches to continue their work. Where in the incident cycle is moving to a stand-by arrangements found? 

A. between threat and incident 
B. between recovery and threat 
C. between damage and recovery 
D. between incident and damage 

Show Answer

Question # 9

Which of the following does an Asset Register contain? (Choose two) 

A. Asset Type 
B. Asset Owner
 C. Asset Modifier 
D. Process ID

Show Answer

Question # 10

What type of system ensures a coherent Information Security organisation? 

A. Federal Information Security Management Act (FISMA)
 B. Information Technology Service Management System (ITSM)
 C. Information Security Management System (ISMS) 
D. Information Exchange Data System (IEDS) 

Show Answer

Question # 11

A planning process that introduced the concept of planning as a cycle that forms the basis for continuous improvement is called: 

A. time based planning. 
B. plan, do, check, act. 
C. planning for continuous improvement. 
D. RACI Matrix 

Show Answer

Question # 12

A member of staff denies sending a particular message. Which reliability aspect of information is in danger here? 

A. availability 
B. correctness 
C. integrity 
D. confidentiality 

Show Answer

Question # 13

Integrity of data means 

A. Accuracy and completeness of the data 
B. Data should be viewable at all times 
C. Data should be accessed by only the right people 

Show Answer

Question # 14

An employee caught with offense of abusing the internet, such as P2P file sharing or video/audio streaming, will not receive a warning for committing such act but will directly receive an IR.

 A. True 
. B False 

Show Answer

Question # 15

What type of measure involves the stopping of possible consequences of security incidents?

 A. Corrective 
B. Detective 
C. Repressive
 D. Preventive 

Show Answer

Question # 16

The following are purposes of Information Security, except: 

A. Ensure Business Continuity 
B. Minimize Business Risk 
C. Increase Business Assets 
D. Maximize Return on Investment 

Show Answer

Question # 17

Which of the following does a lack of adequate security controls represent? 

A. Asset 
B. Vulnerability 
C. Impact 
D. Threat 

Show Answer

Question # 18

As a new member of the IT department you have noticed that confidential information has been leaked several times. This may damage the reputation of the company. You have been asked to propose an organisational measure to protect laptop computers. What is the first step in a structured approach to come up with this measure? 

A. Appoint security staff 
B. Encrypt all sensitive information 
C. Formulate a policy 
D. Set up an access control procedure 

Show Answer

Question # 19

What is the goal of classification of information? 

A. To create a manual about how to handle mobile devices 
B. Applying labels making the information easier to recognize 
C. Structuring information according to its sensitivity 

Show Answer

Question # 20

An administration office is going to determine the dangers to which it is exposed. What do we call a possible event that can have a disruptive effect on the reliability of information? 

A. dependency 
B. threat 
C. vulnerability 
D. risk 

Show Answer

Question # 21

Changes to the information processing facilities shall be done in controlled manner

. A. True 
B. False 

Show Answer

Question # 22

A property of Information that has the ability to prove occurrence of a claimed event. 

A. Electronic chain letters
 B. Integrity 
C. Availability 
D. Accessibility 

Show Answer

Question # 23

After a fire has occurred, what repressive measure can be taken? 

A. Extinguishing the fire after the fire alarm sounds 
B. Buying in a proper fire insurance policy 
C. Repairing all systems after the fire

Show Answer

Question # 24

Which of the following factors does NOT contribute to the value of data for an organisation? 

A. The correctness of data 
B. The indispensability of data 
C. The importance of data for processes 
D. The content of data 

Show Answer

Question # 25

What would be the reference for you to know who should have access to data/document? 

A. Data Classification Label 
B. Access Control List (ACL) 
C. Masterlist of Project Records (MLPR) 
D. Information Rights Management (IRM) 

Show Answer

Question # 26

You have a hard copy of a customer design document that you want to dispose off. What would you do 

A. Throw it in any dustbin 
B. Shred it using a shredder 
C. Give it to the office boy to reuse it for other purposes
 D. Be environment friendly and reuse it for writing 

Show Answer

Question # 27

Backup media is kept in the same secure area as the servers. What risk may the organisation be exposed to? 

A. Unauthorised persons will have access to both the servers and backups 
B. Responsibility for the backups is not defined well 
C. After a fire, the information systems cannot be restored 
D. After a server crash, it will take extra time to bring it back up again 

Show Answer

Question # 28

How is the purpose of information security policy best described?

 A. An information security policy documents the analysis of risks and the search for countermeasures. 
B. An information security policy provides direction and support to the management regarding information security. 
C. An information security policy makes the security plan concrete by providing it with the necessary details. 
D. An information security policy provides insight into threats and the possible consequences. 

Show Answer

Question # 29

Often, people do not pick up their prints from a shared printer. How can this affect the confidentiality of information? 

A. Confidentiality cannot be guaranteed 
B. Integrity cannot be guaranteed 
C. Authenticity cannot be guaranteed 
D. Availability cannot be guaranteed

Show Answer

Question # 30

There is a network printer in the hallway of the company where you work. Many employees don’t pick up their printouts immediately and leave them on the printer. What are the consequences of this to the reliability of the information? 

A. The integrity of the information is no longer guaranteed. 
B. The availability of the information is no longer guaranteed. 
C. The confidentiality of the information is no longer guaranteed. 
D. The Security of the information is no longer guaranteed.

Show Answer

Question # 31

What type of legislation requires a proper controlled purchase process? 

A. Personal data protection act 
B. Computer criminality act 
C. Government information act
 D. Intellectual property rights act 

Show Answer

Question # 32

A scenario wherein the city or location where the building(s) reside is / are not accessible. 

A. Component 
B. Facility 
C. City
 D. Country 

Show Answer

Question # 33

In which order is an Information Security Management System set up?

 A. Implementation, operation, maintenance, establishment 
B. Implementation, operation, improvement, maintenance 
C. Establishment, implementation, operation, maintenance
 D. Establishment, operation, monitoring, improvement 

Show Answer

Question # 34

Who are allowed to access highly confidential files? 

A. Employees with a business need-to-know 
B. Contractors with a business need-to-know 
C. Employees with signed NDA have a business need-to-know 
D. Non-employees designated with approved access and have signed NDA 

Show Answer

Question # 35

What is an example of a human threat? 

A. a lightning strike 
B. fire 
C. phishing 
D. thunderstrom 

Show Answer

Question # 36

CEO sends a mail giving his views on the status of the company and the company’s future strategy and the CEO's vision and the employee's part in it. The mail should be classified as 

A. Internal Mail 
B. Public Mail 
C. Confidential Mail 
D. Restricted Mail

Show Answer

Question # 37

Which reliability aspect of information is compromised when a staff member denies having sent a message? 

A. Confidentiality 
B. Integrity 
C. Availability
 D. Correctness 

Show Answer

Question # 38

Who is responsible for Initial asset allocation to the user/custodian of the assets? 

A. Asset Manager 
B. Asset Owner 
C. Asset Practitioner 
D. Asset Stakeholder 

Show Answer

Question # 39

-------------------------is an asset like other important business assets has value to an organization and consequently needs to be protected.

 A. Infrastructure 
B. Data 
C. Information 
D. Security 

Show Answer

Question # 40

You receive the following mail from the IT support team: Dear User,Starting next week, we will be deleting all inactive email accounts in order to create spaceshare the below details in order to continue using your account. In case of no response, Name: Email ID: Password: DOB: Kindly contact the webmail team for any further support. Thanks for your attention. Which of the following is the best response? 

A. Ignore the email 
B. Respond it by saying that one should not share the password with anyone 
C. One should not respond to these mails and report such email to your supervisor 

Show Answer

Question # 41

A decent visitor is roaming around without visitor's ID. As an employee you should do the following, except:

 A. Say "hi" and offer coffee 
B. Call the receptionist and inform about the visitor
 C. Greet and ask him what is his business Question No : 58 Question No : 59 Question No : 60 PECB ISO-IEC-27001-Lead-Auditor : Practice Test 19 
D. Escort him to his destination 

Show Answer

Question # 42

What is the standard definition of ISMS? 

A. Is an information security systematic approach to achieve business objectives for implementation, establishing, reviewing,operating and maintaining organization's reputation.
 B. A company wide business objectives to achieve information security awareness for establishing, implementing, operating, monitoring, reviewing, maintaining and improving 
C. A project-based approach to achieve business objectives for establishing, implementing, operating, monitoring, reviewing, maintaining and improving an organization’s information security
 D. A systematic approach for establishing, implementing, operating,monitoring, reviewing, maintaining and improving an organization’s information security to achieve business objectives.

Show Answer