Free PECB ISO-IEC-27001-Lead-Implementer Practice Exam with Questions & Answers | Set: 9

 According to the ISO/IEC 27001:2022 standard, the organization should establish, implement and maintain a process to manage changes that affect the information security management system (ISMS) and to continually improve the suitability, adequacy and effectiveness of the ISMS (section 8.1.3 and 10.2). The standard also states that the organization should update the documented information of the ISMS as necessary to reflect the changes and the results of the improvement process (section 8.1.3.2 and 10.2.2). Therefore, the update of documented information supports the continual improvement of the ISMS by ensuring that the ISMS is aligned with the current and future needs and expectations of the organization and its interested parties.

ISO/IEC 27001:2022, Information security, cybersecurity and privacy protection — Information security management systems — Requirements1

ISO/IEC 27001 Lead Implementer Info Kit

Continual Improvement For ISO 27001 Requirement 10.22

Based on his tasks, Bob is part of the incident response team (IRT) of InfoSec. According to the ISO/IEC 27001:2022 standard, an IRT is a group of individuals who are responsible for responding to information security incidents in a timely and effective manner. The IRT should have the authority, skills, and resources to perform the following activities:

Identify and analyze information security incidents and their impact

Contain, eradicate, and recover from information security incidents

Communicate with relevant stakeholders and authorities

Document and report on information security incidents and their outcomes

Review and improve the information security incident management process and controls

Bob’s job is to deploy a network architecture that can prevent potential attackers from accessing InfoSec’s private network, and to conduct a thorough evaluation of the nature and impact of any unexpected events that might occur. These tasks are aligned with the objectives and responsibilities of an IRT, as defined by the ISO/IEC 27001:2022 standard.

ISO/IEC 27001:2022, Information technology — Security techniques — Information security management systems — Requirements, Clause 10.2, Information security incident management

ISO/IEC 27035-1:2023, Information technology — Information security incident management — Part 1: Principles of incident management

ISO/IEC 27035-2:2023, Information technology — Information security incident management — Part 2: Guidelines to plan and prepare for incident response

PECB, ISO/IEC 27001 Lead Implementer Course, Module 10, Information security incident management

According to ISO/IEC 27001:2022, clause 8.2.3, the organization shall establish and maintain an incident response process that includes the following activities:

a) planning and preparing for incident response, including defining roles and responsibilities, establishing communication channels, and providing training and awareness;

b) detecting and reporting information security events and weaknesses;

c) assessing and deciding on information security incidents;

d) responding to information security incidents according to predefined procedures;

e) learning from information security incidents, including identifying root causes, taking corrective actions, and improving the incident response process;

f) collecting evidence, where applicable.

The standard does not specify whether the incident response process should be performed internally or externally, as long as the organization ensures that the process is effective and meets the information security objectives. Therefore, the organization may decide to use external consultants for forensic investigation, as long as they comply with the organization’s policies and procedures, and protect the confidentiality, integrity, and availability of the information involved.

ISO/IEC 27001:2022, clause 8.2.3; PECB ISO/IEC 27001 Lead Implementer Study Guide, section 8.2.3.

The correct and verified answer is A. Technological, based on the nature of the controls implemented by Infralink in Scenario 3.

The controls implemented—A.5.15 Access control, A.5.16 Identity management, and A.5.18 Access rights—are enforced primarily through technical mechanisms, such as:

Centralized identity systems

Authentication platforms

Access control lists

Role-based access control

System-enforced provisioning and revocation

Although these controls are classified under “Organizational controls” in Annex A’s grouping, their implementation and enforcement mechanisms are technological in nature. ISO/IEC 27001:2022 emphasizes that effective security requires technical enforcement, not reliance on human behavior alone.

These controls are supported by technological services such as identity and access management (IAM), directory services, and authentication systems, which automatically enforce restrictions.

People controls relate to awareness, training, and disciplinary processes.

Organizational controls define policy and governance.

Technological controls enforce access restrictions, identity validation, and authorization at system level.

Given that the scenario focuses on centralized identification, shared authentication mechanisms, and system-enforced access control, the implemented controls fall under the Technological category in practice.

 Event logs are records of events that occur in a system or network, such as user actions, faults, exceptions, errors, warnings, or security incidents. They can provide valuable information for monitoring, auditing, and troubleshooting purposes. Event logs can be categorized into different types, depending on the source and nature of the events. For example, user activity logs record the actions performed by users, such as login, logout, file access, or command execution. User fault and exception logs record the errors or anomalies that occur due to user input or behavior, such as invalid data entry, unauthorized access attempts, or system crashes. In scenario 3, Socket Inc. used a syslog server to centralize all logs in one server, which is a good practice for log management. However, to find out that no persistent backdoor was placed and that the attack was not initiated from an employee inside the company, Socket Inc. should have reviewed not only the user fault and exception logs, but also the user activity logs. The user activity logs could reveal any suspicious or malicious actions performed by the hackers or the employees, such as creating, modifying, or deleting files, executing commands, or installing software. By reviewing both types of logs, Socket Inc. could have a more complete picture of the incident and its root cause. Reviewing all the logs on the syslog server might not be necessary or feasible, as some logs might be irrelevant or too voluminous to analyze.

ISO/IEC 27001:2022 Lead Implementer Course Content, Module 8: Performance Evaluation, Monitoring and Measurement of an ISMS based on ISO/IEC 27001:20221; ISO/IEC 27001:2022 Information Security, Cybersecurity and Privacy Protection, Clause 9.1: Monitoring, measurement, analysis and evaluation2; ISO/IEC 27002:2022 Code of practice for information security controls, Clause 12.4: Logging and monitoring3

According to ISO/IEC 27001:2022, clause 7.5.1, the organization shall ensure that the documented information required by the ISMS and by this document is controlled to ensure that it is available and suitable for use, where and when it is needed, and that it is adequately protected. This includes ensuring that the documented information is reviewed and approved for suitability and adequacy. The information security procedures are part of the documented information that supports the operation of the ISMS processes and the implementation of the information security controls. Therefore, they should be drafted, reviewed, and validated by the information security committee, which is the group of people responsible for overseeing the ISMS and ensuring its alignment with the organization’s objectives and strategy. The information security committee should include representatives from different functions and levels of the organization, as well as external experts if needed. The information security committee should also ensure that the information security procedures are communicated to the relevant employees and other interested parties, and that they are periodically reviewed and updated as necessary.

ISO/IEC 27001:2022, Information security, cybersecurity and privacy protection — Information security management systems — Requirements, clauses 5.3, 7.5.1, and 9.3

ISO/IEC 27001:2022 Lead Implementer objectives and content, 4 and 5

ISO/IEC 17788:2014 (Cloud Computing Overview and Vocabulary) defines:

Platform as a Service (PaaS):

“The capability provided to the consumer is to deploy onto the cloud infrastructure consumer-created or acquired applications... The consumer does not manage or control the underlying infrastructure.”

Jane ' s requirements precisely match the PaaS model, where she controls the app and environment (runtime, storage) but not the infrastructure (servers, OS).

ISO/IEC 27002:2022 Clause 8.11 addresses “Use of privileged utility programs”:

" The use of utility programs that might be capable of overriding system and application controls should be restricted and tightly controlled to prevent misuse. "

Such tools can provide powerful access or modification capabilities, which if misused can compromise the integrity and confidentiality of systems.

Preventive controls: These are controls that aim to prevent or deter the occurrence of a security incident or reduce its likelihood. Examples of preventive controls are encryption, firewalls, locks, policies, etc.

Detective controls: These are controls that aim to detect or discover the occurrence of a security incident or its symptoms. Examples of detective controls are logs, alarms, audits, etc.

Corrective controls: These are controls that aim to correct or restore the normal state of an asset or a process after a security incident or mitigate its impact. Examples of corrective controls are backups, recovery plans, incident response teams, etc.

Administrative controls: These are controls that involve the management and governance of information security, such as policies, procedures, roles, responsibilities, awareness, training, etc.

Technical controls: These are controls that involve the use of technology or software to implement information security, such as encryption, firewalls, anti-malware, authentication, etc.

Physical controls: These are controls that involve the protection of physical assets or locations from unauthorized access, damage, or theft, such as locks, fences, cameras, guards, etc.

Legal controls: These are controls that involve the compliance with laws, regulations, contracts, or agreements related to information security, such as privacy laws, data protection laws, confidentiality agreements, etc.

In scenario 2, the action of Beauty reviewing all user access rights is best described as a " Preventive and Administrative " control.

Preventive Control: The review of user access rights is a preventive measure. It is designed to prevent unauthorized access to sensitive information by ensuring that only authorized personnel have access to specific files. By controlling access rights, the organization aims to prevent potential security breaches and protect sensitive data.

Administrative Control: This action also falls under administrative controls, sometimes referred to as managerial controls. These controls involve policies, procedures, and practices related to the management of the organization and its employees. In this case, the review of access rights is a part of the company’s administrative procedures to manage the security of information systems.

ISO/IEC 27001:2022 - Information security, cybersecurity and privacy protection — Information security management systems — Requirements

In Scenario 3, the measure that would help Socket Inc. address similar information security incidents in the future is " B. Using cryptographic keys to protect the database from unauthorized access. " Implementing cryptographic controls, including cryptographic key management, is a proactive measure to secure the data in the MongoDB database against unauthorized access. It ensures that even if attackers gain access to the database, they cannot read or misuse the data without the appropriate cryptographic keys. This approach aligns with best practices for securing sensitive data and is part of a comprehensive security strategy.

ISO 27001 - Annex A.10 – Cryptography

ISO 27001 Annex A.10 - Cryptography | ISMS.online

ISO 27001 cryptographic controls policy | What needs to be included?