Question 1

Why do we need to test a disaster recovery plan regularly, and keep it up to date?

Options :

A : Otherwise the measures taken and the incident procedures planned may not be adequate

B : Otherwise it is no longer up to date with the registration of daily occurring faults

C : Otherwise remotely stored backups may no longer be available to the security team

Answer: A

Question 2

Scenario 4: SendPay is a financial company that provides its services through a network of agents and

financial institutions. One of their main services is transferring money worldwide. SendPay, as a new

company, seeks to offer top quality services to its clients. Since the company offers international transactions,

it requires from their clients to provide personal information, such as their identity, the reason for the

transactions, and other details that might be needed to complete the transaction. Therefore, SendPay has

implemented security measures to protect their clients' information, including detecting, investigating, and

responding to any information security threats that may emerge. Their commitment to offering secure services

was also reflected during the ISMS implementation where the company invested a lot of time and resources.

Last year, SendPay unveiled their digital platform that allows money transactions through electronic devices,

such as smartphones or laptops, without requiring an additional fee. Through this platform, SendPay's clients

can send and receive money from anywhere and at any time. The digital platform helped SendPay to simplify

the company's operations and further expand its business. At the time, SendPay was outsourcing its software

operations, hence the project was completed by the software development team of the outsourced company.

The same team was also responsible for maintaining the technology infrastructure of SendPay.

Recently, the company applied for ISO/IEC 27001 certification after having an ISMS in place for almost a

year. They contracted a certification body that fit their criteria. Soon after, the certification body appointed a

team of four auditors to audit SendPay's ISMS.

During the audit, among others, the following situations were observed:

1.The outsourced software company had terminated the contract with SendPay without prior notice. As a

result, SendPay was unable to immediately bring the services back in-house and its operations were disrupted

for five days. The auditors requested from SendPay's representatives to provide evidence that they have a plan to follow in cases of contract terminations. The representatives did not provide any documentary evidence but

during an interview, they told the auditors that the top management of SendPay had identified two other

software development companies that could provide services immediately if similar situations happen again.

2.There was no evidence available regarding the monitoring of the activities that were outsourced to the

software development company. Once again, the representatives of SendPay told the auditors that they

regularly communicate with the software development company and that they are appropriately informed for

any possible change that might occur.

3.There was no nonconformity found during the firewall testing. The auditors tested the firewall configuration

in order to determine the level of security provided by

these services. They used a packet analyzer to test the firewall policies which enabled them to check the

packets sent or received in real-time.

Based on this scenario, answer the following question:

Regarding the third situation observed, auditors themselves tested the configuration of firewalls implemented

in SendPay's network. How do you describe this situation? Refer to scenario 4.

Options :

A : Acceptable, technical evidence is required to validate the operation of technical processes

B :

Unacceptable, the auditors should only observe the testing of system or equipment configurations and not test the system themselves

C :

Unacceptable, firewall configurations should not be tested during an audit since this can have an impact systems' operation

Answer: A

Question 3

During a third-party certification audit you are presented with a list of issues by an auditee. Which four of the following constitute 'external' issues in the context of a management system to ISO/IEC 27001:2022?

Options :

A : A rise in interest rates in response to high inflation

B : A reduction in grants as a result of a change in government policy

C : Poor levels of staff competence as a result of cuts in training expenditure

D : Increased absenteeism as a result of poor management

E : Higher labour costs as a result of an aging population

F : Inability to source raw materials due to government sanctions

G : Poor morale as a result of staff holidays being reduced

H : A fall in productivity linked to outdated production equipment

Answer: A,B,E,F

Question 4

We can leave laptops during weekdays or weekends in locked bins.

Options :

A : True

B : False

Answer: B

Question 5

During a follow-up audit, you notice that a nonconformity identified for completion before the follow-up audit

is still outstanding.

Which four of the following actions should you take?

Options :

A :

Report the failure to address the corrective action for the outstanding nonconformity to the organisation-s top management

B : Immediately raise an nonconformity as the date for completion has been exceeded

C :

If the delay is justified agree on a revised date for clearing the nonconformity with the auditee/audit client

D : Contact the individuals) managing the audit programme to seek their advice as to how to proceed

E : Decide whether the delay in addressing the nonconformity is justified

F :

Cancel the follow-up audit and return when an assurance has been received that the nonconformity has been cleared

G : Note the nonconformity is still outstanding and follow audit trails to determine why

H : If the delay is unjustified advise the auditee /audit client and agree on remedial action

Answer: A,C,E,G