QUESTION 39
Based on scenario 8. did the nonconformity report include all the necessary aspects?

QUESTION 40
Based on scenario 2, which information security principle is the IT team aiming to ensure by establishing a user authentication process that requires user identification and password when accessing sensitive information?

QUESTION 41
A non-human threat for computer systems is a flood. In which situation is a flood always a relevant threat?

QUESTION 42
NetworkFuse should_________________to ensure that employees are prepared for the audit. Refer to scenario
10.

QUESTION 43
Based on scenario 4, what type of assets were identified during risk assessment?

QUESTION 44
Socket Inc. has implemented a control for the effective use of cryptography and cryptographic key management. Is this compliant with ISO/IEC 27001′ Refer to scenario 3.

QUESTION 45
An organization documented each security control that it Implemented by describing their functions in detail.
Is this compliant with ISO/IEC 27001?

QUESTION 46
The identified owner of an asset is always an individual

QUESTION 47
Midwest Insurance grades the monthly report of all claimed losses per insured as confidential. What is accomplished if all other reports from this insurance office are also assigned the appropriate grading?

QUESTION 48
An organization has adopted a new authentication method to ensure secure access to sensitive areas and facilities of the company. It requires every employee to use a two-factor authentication (password and QR code). This control has been documented, standardized, and communicated to all employees, however its use has been “left to individual initiative, and it is likely that failures can be detected. Which level of maturity does this control refer to?

QUESTION 49
What risk treatment option has Company A implemented if it has required from its employees the change of email passwords at least once every 60 days?

QUESTION 50
You are the owner of the courier company SpeeDelivery. You have carried out a risk analysis and now want to determine your risk strategy. You decide to take measures for the large risks but not for the small risks. What is this risk strategy called?

QUESTION 51
According to scenario 8, Tessa created a plan for ISMS monitoring and measurement and presented it to the top management Is this acceptable?

QUESTION 52
Which of the following is NOT part of the steps required by ISO/IEC 27001 that an organization must take when a nonconformity is detected?

QUESTION 53
What sort of security does a Public Key Infrastructure (PKI) offer?

QUESTION 54
Scenario 5: Operaze is a small software development company that develops applications for various companies around the world. Recently, the company conducted a risk assessment to assess the information security risks that could arise from operating in a digital landscape. Using different testing methods, including penetration Resting and code review, the company identified some issues in its ICT systems, including improper user permissions, misconfigured security settings, and insecure network configurations. To resolve these issues and enhance information security, Operaze decided to implement an information security management system (ISMS) based on ISO/IEC 27001.
Considering that Operaze is a small company, the entire IT team was involved in the ISMS implementation project. Initially, the company analyzed the business requirements and the internal and external environment, identified its key processes and activities, and identified and analyzed the interested parties In addition, the top management of Operaze decided to Include most of the company’s departments within the ISMS scope. The defined scope included the organizational and physical boundaries. The IT team drafted an information security policy and communicated it to all relevant interested parties In addition, other specific policies were developed to elaborate on security issues and the roles and responsibilities were assigned to all interested parties.
Following that, the HR manager claimed that the paperwork created by ISMS does not justify its value and the implementation of the ISMS should be canceled However, the top management determined that this claim was invalid and organized an awareness session to explain the benefits of the ISMS to all interested parties.
Operaze decided to migrate Its physical servers to their virtual servers on third-party infrastructure. The new cloud computing solution brought additional changes to the company Operaze’s top management, on the other hand, aimed to not only implement an effective ISMS but also ensure the smooth running of the ISMS operations. In this situation, Operaze’s top management concluded that the services of external experts were required to implement their information security strategies. The IT team, on the other hand, decided to initiate a change in the ISMS scope and implemented the required modifications to the processes of the company.
Based on the scenario above, answer the following question:
What led Operaze to implement the ISMS?

QUESTION 55
What are the data protection principles set out in the GDPR?

QUESTION 56
Based on scenario 5. after migrating to cloud. Operaze’s IT team changed the ISMS scope and implemented all the required modifications Is this acceptable?

QUESTION 57
Based on scenario 4, the fact that TradeB defined the level of risk based on three nonnumerical categories indicates that;

QUESTION 58
Of the following, which is the best organization or set of organizations to contribute to compliance?