ISO Beingcert ISO/IEC 20000 Lead Implementer Sample Questions:

1. Based on scenario 5, what can be considered as a residual risk to Socket Inc.?

A) Files arc decrypted once the user is authenticated
B) The use of passwords with at least 12 characters containing a mixture of uppercase and lowercase letters, symbols, and numbers
C) Users with access to cloud storage files are segregated on a separate network

2. Scenario 4: TradeB. a commercial bank that has just entered the market, accepts deposits from its clients and offers basic financial services and loans for investments. TradeB has decided to implement an information security management system (ISMS) based on ISO/IEC 27001 Having no experience of a management
[^system implementation, TradeB's top management contracted two experts to direct and manage the ISMS implementation project.
First, the project team analyzed the 93 controls of ISO/IEC 27001 Annex A and listed only the security controls deemed applicable to the company and their objectives Based on this analysis, they drafted the Statement of Applicability. Afterward, they conducted a risk assessment, during which they identified assets, such as hardware, software, and networks, as well as threats and vulnerabilities, assessed potential consequences and likelihood, and determined the level of risks based on three nonnumerical categories (low, medium, and high). They evaluated the risks based on the risk evaluation criteria and decided to treat only the high risk category They also decided to focus primarily on the unauthorized use of administrator rights and system interruptions due to several hardware failures by establishing a new version of the access control policy, implementing controls to manage and control user access, and implementing a control for ICT readiness for business continuity Lastly, they drafted a risk assessment report, in which they wrote that if after the implementation of these security controls the level of risk is below the acceptable level, the risks will be accepted Which of the actions presented in scenario 4 is NOT compliant with the requirements of ISO/IEC 27001?

A) The external experts selected security controls and drafted the Statement of Applicability
B) TradeB selected only ISO/IEC 27001 controls deemed applicable to the company
C) The Statement of Applicability was drafted before conducting the risk assessment

3. What is the most important asset to Socket Inc. associated with the use of cloud storage? Refer to scenario 5.

A) Customers' personal data
B) IT provided network drives
C) Employees with access to cloud storage files

4. Scenario 9: OpenTech provides IT and communications services. It helps data communication enterprises and network operators become multi-service providers During an internal audit, its internal auditor, Tim, has identified nonconformities related to the monitoring procedures He identified and evaluated several system Invulnerabilities.
Tim found out that user IDs for systems and services that process sensitive information have been reused and the access control policy has not been followed After analyzing the root causes of this nonconformity, the ISMS project manager developed a list of possible actions to resolve the nonconformity. Then, the ISMS project manager analyzed the list and selected the activities that wouldallow the elimination of the root cause and the prevention of a similar situation in the future. These activities were included in an action plan The action plan, approved by the top management, was written as follows:
A new version of the access control policy will be established and new restrictions will be created to ensure that network access is effectively managed and monitored by the Information and Communication Technology (ICT) Department The approved action plan was implemented and all actions described in the plan were documented.
Based on scenario 9. is the action plan for the identified nonconformities sufficient to eliminate the detected nonconformities?

A) No, because the action plan does not address the root cause of the identified nonconformity
B) Yes, because a separate action plan has been created for the identified nonconformity
C) No, because the action plan does not include a timeframe for implementation

5. What should an organization allocate to ensure the maintenance and improvement of the information security management system?

A) The documented information required by ISO/IEC 27001
B) Sufficient resources, such as the budget, qualified personnel, and required tools
C) The appropriate transfer to operations

Solutions: