Free PECB ISO-IEC-27035-Lead-Incident-Manager Practice Exam with Questions & Answers | Set: 3

Comprehensive and Detailed Explanation From Exact Extract:

According to ISO/IEC 27002:2022 (and earlier versions), information security controls can be broadly categorized into three types: technical (also called logical), physical, and administrative (or organizational) controls.

Technical controls (also known as logical controls) involve the use of software and hardware to protect assets. Examples include:

Firewalls

Intrusion detection systems

Encryption

Access control mechanisms

Physical controls are designed to prevent physical access to IT systems and include things such as:

Surveillance cameras

Security guards

Biometric access systems

Administrative controls, also called management or procedural controls, include the policies, procedures, and guidelines that govern the organization’s security practices. These include:

Security awareness training

Acceptable use policies

Password policies

Option A, “Implementing a policy for regular password changes,” is an administrative control, not a technical one. It dictates user behavior through rules and policy enforcement, but does not technically enforce the change itself unless paired with technical enforcement (like system settings).

Option B, surveillance cameras, are physical controls, and option C, installing a firewall, is a classic example of a technical control.

Reference Extracts:

ISO/IEC 27002:2022, Clause 5.1 – “Information security controls can be administrative (policy-based), technical, or physical depending on their form and implementation.”

NIST SP 800-53, Control Families – Differentiates between management, operational, and technical controls.

Therefore, the correct answer is A: Implementing a policy for regular password changes.

—

Comprehensive and Detailed Explanation From Exact Extract:

ISO/IEC 27035-1:2016 stresses the importance of continual review and improvement of the incident management process. Clause 7.1 specifically advises that organizations regularly evaluate their policies, procedures, and tools to ensure they remain effective in the face of evolving threats and business changes.

Moneda Vivo’s continuous review aligns perfectly with this guidance, reinforcing preparedness and adaptability. Options A and C, while related to broader security or HR practices, are not directly aligned with ISO/IEC 27035’s core recommendation regarding process review.

Comprehensive and Detailed Explanation:

According to ISO/IEC 27035-1:2016 and ISO/IEC 27001:2022, when defining the scope of an information security incident management system, organizations must consider all forms of information—whether digital or physical—that are relevant to the business. Incidents can affect hardcopy (e.g., paper-based records) and electronic data (e.g., emails, files), so both must be included in the scope assessment.

Comprehensive and Detailed Explanation From Exact Extract:

According to ISO/IEC 27035-2:2016, one of the technical requirements to support effective incident management is the capability to rapidly detect, collect, and process information about security events, incidents, and vulnerabilities. Timely acquisition of this data allows the organization to assess threats, determine the scope of incidents, and execute response measures quickly.

Clause 7.4.1 emphasizes the need for adequate tools and infrastructure to support the detection and acquisition of information security events and vulnerability reports. The collected data becomes the foundation for risk assessment, root cause analysis, and corrective action planning.

Option A (public disclosure of contact details) might be relevant for CERT/CSIRT public coordination but is not a core requirement in technical incident response. Option B (immediate deletion of reports) is contrary to best practices, as incident reports are critical for audits, compliance, and continuous improvement.

Reference Extracts:

ISO/IEC 27035-2:2016, Clause 7.4.1: “Organizations should ensure that technical means are in place to allow quick acquisition and analysis of information related to events, incidents, and vulnerabilities.”

Correct answer: C

—