Higher Test Marks with Free Online ISO-IEC-27001-Lead-Auditor Exam Practice

Scenario 5: Data Grid Inc. is a well-known company that delivers security services across the entire

information technology infrastructure. It provides cybersecurity software, including endpoint security,

firewalls, and antivirus software. For two decades, Data Grid Inc. has helped various companies secure their

networks through advanced products and services. Having achieved reputation in the information and network

security field, Data Grid Inc. decided to obtain the ISO/IEC 27001 certification to better secure its internal and

customer assets and gain competitive advantage.

Data Grid Inc. appointed the audit team, who agreed on the terms of the audit mandate. In addition, Data Grid

Inc. defined the audit scope, specified the audit criteria, and proposed to close the audit within five days. The

audit team rejected Data Grid Inc.'s proposal to conduct the audit within five days, since the company has a

large number of employees and complex processes. Data Grid Inc. insisted that they have planned to complete

the audit within five days, so both parties agreed upon conducting the audit within the defined duration. The

audit team followed a risk-based auditing approach.

To gain an overview of the main business processes and controls, the audit team accessed process descriptions

and organizational charts. They were unable to perform a deeper analysis of the IT risks and controls because

their access to the IT infrastructure and applications was restricted. However, the audit team stated that the risk

that a significant defect could occur to Data Grid Inc.'s ISMS was low since most of the company's processes

were automated. They therefore evaluated that the ISMS, as a whole, conforms to the standard requirements

by asking the representatives of Data Grid Inc. the following questions:

•How are responsibilities for IT and IT controls defined and assigned?

•How does Data Grid Inc. assess whether the controls have achieved the desired results?

•What controls does Data Grid Inc. have in place to protect the operating environment and data from malicious

software?

•Are firewall-related controls implemented?

Data Grid Inc.'s representatives provided sufficient and appropriate evidence to address all these questions.

The audit team leader drafted the audit conclusions and reported them to Data Grid Inc.'s top management.

Though Data Grid Inc. was recommended for certification by the auditors, misunderstandings were raised

between Data Grid Inc. and the certification body in regards to audit objectives. Data Grid Inc. stated that even

though the audit objectives included the identification of areas for potential improvement, the audit team did

not provide such information.

Based on this scenario, answer the following question:

Based on scenario 5, the audit team disagreed with the proposed audit duration by Data Grid Inc. for the ISMS

audit. How do you describe such a situation? 

CEO sends a mail giving his views on the status of the company and the company’s future strategy and the CEO's vision and the employee's part in it. The mail should be classified as

Scenario 6: Sinvestment is an insurance company that offers home, commercial, and life insurance. The

company was founded in North Carolina, but have recently expanded in other locations, including Europe and

Africa.

Sinvestment is committed to complying with laws and regulations applicable to their industry and preventing

any information security incident. They have implemented an ISMS based on ISO/IEC 27001 and have

applied for ISO/IEC 27001 certification.

Two auditors were assigned by the certification body to conduct the audit. After signing a confidentiality agreement with Sinvestment. they started the audit activities. First, they reviewed the documentation required

by the standard, including the declaration of the ISMS scope, information security policies, and internal audits

reports. The review process was not easy because, although Sinvestment stated that they had a documentation

procedure in place, not all documents had the same format.

Then, the audit team conducted several interviews with Sinvestment's top management to understand their role

in the ISMS implementation. All activities of the stage 1 audit were performed remotely, except the review of

documented information, which took place on-site, as requested by Sinvestment.

During this stage, the auditors found out that there was no documentation related to information security

training and awareness program. When asked, Sinvestment's representatives stated that the company has

provided information security training sessions to all employees. Stage 1 audit gave the audit team a general

understanding of Sinvestment's operations and ISMS.

The stage 2 audit was conducted three weeks after stage 1 audit. The audit team observed that the marketing

department (which was not included in the audit scope) had no procedures in place to control employees’

access rights. Since controlling employees' access rights is one of the ISO/IEC 27001 requirements and was

included in the information security policy of the company, the issue was included in the audit report. In

addition, during stage 2 audit, the audit team observed that Sinvestment did not record logs of user activities.

The procedures of the company stated that "Logs recording user activities should be retained and regularly

reviewed," yet the company did not present any evidence of the implementation of such procedure.

During all audit activities, the auditors used observation, interviews, documented information review, analysis,

and technical verification to collect information and evidence. All the audit findings during stages 1 and 2

were analyzed and the audit team decided to issue a positive recommendation for certification.

During stage 1 audit, the audit team found out that Sinvestment did not have records on information security

training and awareness. What Sinvestment do in this case? Refer to scenario 6.

Scenario 9: UpNet, a networking company, has been certified against ISO/IEC 27001. It provides network

security, virtualization, cloud computing, network hardware, network management software, and networking

technologies.

The company's recognition has increased drastically since gaining ISO/IEC 27001 certification. The

certification confirmed the maturity of UpNefs operations and its compliance with a widely recognized and

accepted standard.

But not everything ended after the certification. UpNet continually reviewed and enhanced its security controls

and the overall effectiveness and efficiency of the ISMS by conducting internal audits. The top management

was not willing to employ a full-time team of internal auditors, so they decided to outsource the internal audit

function. This form of internal audits ensured independence, objectivity, and that they had an advisory role

about the continual improvement of the ISMS.

Not long after the initial certification audit, the company created a new department specialized in data and

storage products. They offered routers and switches optimized for data centers and software-based networking

devices, such as network virtualization and network security appliances. This caused changes to the operations

of the other departments already covered in the ISMS certification scope.

Therefore. UpNet initiated a risk assessment process and an internal audit. Following the internal audit result,

the company confirmed the effectiveness and efficiency of the existing and new processes and controls.

The top management decided to include the new department in the certification scope since it complies with

ISO/IEC 27001 requirements. UpNet announced that it is ISO/IEC 27001 certified and the certification scope

encompasses the whole company One year after the initial certification audit, the certification body conducted another audit of UpNefs ISMS.

This audit aimed to determine the UpNefs ISMS fulfillment of specified ISO/IEC 27001 requirements and

ensure that the ISMS is being continually improved. The audit team confirmed that the certified ISMS

continues to fulfill

the requirements of the standard. Nonetheless, the new department caused a significant impact on governing

the management system. Moreover, the certification body was not informed about any changes. Thus, the

UpNefs certification was suspended.

Based on the scenario above, answer the following question:

Based on scenario 9, why was UpNefs certification suspended?

During a follow-up audit, you notice that a nonconformity identified for completion before the follow-up audit

is still outstanding.

Which four of the following actions should you take?