Get PECB ISO-IEC-27001-Lead-Implementer Exam Practice Questions - Real and Updated

Answer : A

The SABSA (Sherwood Applied Business Security Architecture) model is a widely accepted framework for developing risk-driven enterprise information security architectures. The model includes six layers: Contextual, Conceptual, Logical, Physical, Component, and Operational. Among these, Contextual architecture is the topmost layer and is designed specifically to align the security architecture with the business's goals, drivers, and requirements.

In detail, the Contextual architecture layer answers questions such as:

What is the business trying to achieve?

Who are the stakeholders?

What are the critical business assets?

What are the risk appetite and tolerance levels?This layer sets the foundation for all subsequent layers and ensures that the security strategy directly supports business objectives and strategic direction.

This makes Option A: Contextual architecture the correct answer, as it focuses on aligning the security architecture with business requirements and drivers.

Relevance to ISO/IEC 27001:2022While the SABSA model is not explicitly part of ISO/IEC 27001:2022, it complements the ISO standard, particularly in how it supports the design and implementation of an effective Information Security Management System (ISMS) aligned with business strategy.

Under ISO/IEC 27001:2022, the following clauses support the alignment of security architecture with business requirements:

Clause 4.1 -- ''Understanding the organization and its context'': 'The organization shall determine external and internal issues that are relevant to its purpose and that affect its ability to achieve the intended results of its ISMS.'

Clause 4.2 -- ''Understanding the needs and expectations of interested parties'': 'The organization shall determine the interested parties that are relevant to the ISMS and the requirements of these interested parties.'

These clauses emphasize the importance of understanding the broader business environment, stakeholder expectations, and strategic business drivers---exactly what the SABSA Contextual layer is designed to address.

In summary, the Contextual architecture layer in SABSA aligns directly with the intent and structure of ISO/IEC 27001:2022 Clause 4, making it the correct and verified choice for this question.

Answer : A

ISO/IEC 27001:2022 Clause 5.3 -- Organizational roles, responsibilities, and authorities clearly states:

'Top management shall assign the responsibility and authority for:

a) ensuring that the ISMS conforms to the requirements of this document;

b) reporting on the performance of the ISMS to top management.'

This means top management is not solely responsible for directly reporting on performance---it can assign this responsibility to a qualified individual (such as an ISMS manager, CISO, or another responsible party). Therefore, Option A is incorrect and violates the intent of Clause 5.3.

ISO/IEC 27001:2022 Clause 5.3===========

Answer : B

ISO/IEC 17788:2014 (Cloud Computing Overview and Vocabulary) defines:

Platform as a Service (PaaS):

''The capability provided to the consumer is to deploy onto the cloud infrastructure consumer-created or acquired applications... The consumer does not manage or control the underlying infrastructure.''

Jane's requirements precisely match the PaaS model, where she controls the app and environment (runtime, storage) but not the infrastructure (servers, OS).

ISO/IEC 17788:2014 Clause 6.2.4 -- Cloud service models

ISO/IEC 27017:2015 -- Security controls for cloud services===========

Answer : A

Confidentiality is the property that information is not made available or disclosed to unauthorized individuals, entities, or processes. A security control is a measure that is put in place to protect the confidentiality, integrity, and availability of information assets. In this scenario, FinanceX has implemented a security control that ensures the confidentiality of information by requiring clients to enter a one-time authorization code sent to their smartphone when they log in to their online banking platform. This control prevents unauthorized access to the clients' bank accounts and protects their sensitive information from being disclosed to third parties. The one-time authorization code is a form of two-factor authentication, which is a security technique that requires two pieces of evidence to verify the identity of a user. In this case, the two factors are something the user knows (their username and password) and something the user has (their smartphone). Two-factor authentication is a recommended security control for online banking platforms, as it provides a higher level of security than single-factor authentication, which relies only on one piece of evidence, such as a password.

ISO/IEC 27001:2022 Lead Implementer Course Content, Module 5: Introduction to Information Security Controls based on ISO/IEC 27001:20221; ISO/IEC 27001:2022 Information Security, Cybersecurity and Privacy Protection, Clause 3.6: Confidentiality2; ISO/IEC 27002:2022 Code of practice for information security controls, Clause 9.4: Access control3

Answer : A

According to the ISO/IEC 27001 : 2022 Lead Implementer course, one of the factors that can negatively affect the internal audit process is the lack of cooperation from the auditees, which can manifest as restricting the internal auditor's access to offices and documentation1.This can hinder the auditor's ability to collect sufficient and appropriate audit evidence, verify the conformity of the information security management system (ISMS) with the audit criteria, and identify any nonconformities or opportunities for improvement2.Therefore, the auditees should be informed of the audit objectives, scope, criteria, and schedule in advance, and should provide the auditor with all the necessary information and resources to conduct the audit effectively3.

1: PECB, ISO/IEC 27001 Lead Implementer Course, Module 9: Internal Audit, slide 222: PECB, ISO/IEC 27001 Lead Implementer Course, Module 9: Internal Audit, slide 233: PECB, ISO/IEC 27001 Lead Implementer Course, Module 9: Internal Audit, slide 24