참고: KoreaDumps에서 Google Drive로 공유하는 무료, 최신 ISO-IEC-27001-Lead-Auditor 시험 문제집이 있습니다: https://drive.google.com/open?id=1F6TU0eB6-nD0b4eQ3yKfrjlTpqVBpSGn
KoreaDumps덤프공부가이드는 업계에서 높은 인지도를 자랑하고 있습니다. KoreaDumps제품은 업데이트가 가장 빠르고 적중율이 가장 높아 업계의 다른 IT공부자료 사이트보다 출중합니다. KoreaDumps의PECB인증 ISO-IEC-27001-Lead-Auditor덤프는 이해하기 쉽고 모든PECB인증 ISO-IEC-27001-Lead-Auditor시험유형이 모두 포함되어 있어 덤프만 잘 이해하고 공부하시면 시험패스는 문제없습니다.
| Section | Objectives |
|---|---|
| Planning and Initiating an Audit | - Audit program and planning activities
|
| Conducting an Audit | - Audit execution
|
| Information Security Management System (ISMS) based on ISO/IEC 27001 | - ISO/IEC 27001 requirements (Clauses 4–10)
|
| Fundamentals of Information Security Auditing | - Audit principles based on ISO 19011
|
| Closing the Audit | - Audit reporting and follow-up
|
>> ISO-IEC-27001-Lead-Auditor 100％시험패스 자료 <<
KoreaDumps의PECB인증 ISO-IEC-27001-Lead-Auditor시험덤프 공부가이드는 시장에서 가장 최신버전이자 최고의 품질을 지닌 시험공부자료입니다.IT업계에 종사중이라면 IT자격증취득을 승진이나 연봉협상의 수단으로 간주하고 자격증취득을 공을 들여야 합니다.회사다니면서 공부까지 하려면 몸이 힘들어 스트레스가 많이 쌓인다는것을 헤아려주는KoreaDumps가 IT인증자격증에 도전하는데 성공하도록PECB인증 ISO-IEC-27001-Lead-Auditor시험대비덤프를 제공해드립니다.
질문 # 123
Select the words that best complete the sentence:
"The purpose of maintaining regulatory compliance in a management system is to To complete the sentence with the best word(s), click on the blank section you want to complete so that it is highlighted in red, and then click on the applicable text from the options below. Alternatively, you may drag and drop the option to the appropriate blank section.
정답：
설명：
Explanation:
According to ISO 27001:2013, clause 5.2, the top management of an organization must establish, implement and maintain an information security policy that is appropriate to the purpose of the organization and provides a framework for setting information security objectives. The information security policy must also include a commitment to comply with the applicable legal, regulatory and contractual requirements, as well as any other requirements that the organization subscribes to. Therefore, maintaining regulatory compliance is part of fulfilling the management system policy and ensuring its effectiveness and suitability. References:
* ISO/IEC 27001:2013, Information technology - Security techniques - Information security management systems - Requirements, clause 5.2
* PECB Candidate Handbook ISO 27001 Lead Auditor, page 10
* ISO 27001 Policy: How to write it according to ISO 27001
질문 # 124
During a third-party certification audit, you are presented with a list of issues by an auditee. Which four of the following constitute 'internal' issues in the context of a management system to ISO 27001:2022?
정답：D,F,G,H
설명：
According to ISO 27001:2022 clause 4.1, the organisation shall determine external and internal issues that are relevant to its purpose and that affect its ability to achieve the intended outcome(s) of its information security management system (ISMS)12 External issues are factors outside the organisation that it cannot control, but can influence or adapt to. They include political, economic, social, technological, legal, and environmental factors that may affect the organisation's information security objectives, risks, and opportunities12 Internal issues are factors within the organisation that it can control or change. They include the organisation's structure, culture, values, policies, objectives, strategies, capabilities, resources, processes, activities, relationships, and performance that may affect the organisation's information security management system12 Therefore, the following issues are considered 'internal' in the context of a management system to ISO
27001:2022:
* Poor levels of staff competence as a result of cuts in training expenditure: This is an internal issue because it relates to the organisation's capability, resource, and process of developing and maintaining the competence of its personnel involved in the ISMS. The organisation can control or change its training expenditure and its impact on staff competence12
* Poor morale as a result of staff holidays being reduced: This is an internal issue because it relates to the organisation's culture, value, and relationship with its employees. The organisation can control or
* change its staff holiday policy and its impact on staff morale12
* Increased absenteeism as a result of poor management: This is an internal issue because it relates to the organisation's performance, structure, and accountability of its management. The organisation can control or change its management practices and its impact on staff absenteeism12
* A fall in productivity linked to outdated production equipment: This is an internal issue because it relates to the organisation's capability, resource, and process of ensuring the availability and suitability of its production equipment. The organisation can control or change its equipment maintenance and upgrade and its impact on productivity12 The following issues are considered 'external' in the context of a management system to ISO 27001:2022:
* Higher labour costs as a result of an aging population: This is an external issue because it relates to the social and demographic factor that affects the availability and cost of labour in the market. The organisation cannot control or change the aging population, but can influence or adapt to its impact on labour costs12
* A rise in interest rates in response to high inflation: This is an external issue because it relates to the economic and monetary factor that affects the cost and availability of capital in the market. The organisation cannot control or change the interest rates or inflation, but can influence or adapt to its impact on capital costs12
* A reduction in grants as a result of a change in government policy: This is an external issue because it relates to the political and legal factor that affects the availability and conditions of public funding for the organisation. The organisation cannot control or change the government policy, but can influence or adapt to its impact on grants12
* Inability to source raw materials due to government sanctions: This is an external issue because it relates to the political and legal factor that affects the availability and cost of raw materials in the market. The organisation cannot control or change the government sanctions, but can influence or adapt to its impact on raw materials12 References:
1: ISO/IEC 27001:2022 Lead Auditor (Information Security Management Systems) Course by CQI and IRCA Certified Training 1 2: ISO/IEC 27001 Lead Auditor Training Course by PECB 2
질문 # 125 
정답：
설명：
Explanation:
An audit finding is the result of the evaluation of the collected audit evidence against audit criteria.
질문 # 126
Which two of the following phrases would apply to 'check' in the Plan-Do-Check-Act cycle for a business process?
정답：B,E
설명：
The two phrases that would apply to 'check' in the Plan-Do-Check-Act cycle for a business process are:
C. Verifying training
F. Auditing processes
C. This phrase applies to 'check' in the PDCA cycle because it involves measuring and evaluating the effectiveness of the training activities that were implemented in the 'do' phase. Training is an important aspect of information security awareness, education, and competence, which are required by clause 7.2 of ISO 27001:20221. Verifying training can help the organisation to assess whether the staff have acquired the necessary knowledge, skills, and behaviour to perform their roles and responsibilities in relation to information security. Verifying training can also help the organisation to identify any gaps or weaknesses in the training program and to plan for improvement actions.
F. This phrase applies to 'check' in the PDCA cycle because it involves examining and reviewing the performance and conformity of the processes that were implemented in the 'do' phase. Auditing is a systematic, independent, and documented process for obtaining objective evidence and evaluating it to determine the extent to which the audit criteria are fulfilled2. Auditing processes can help the organisation to verify whether the information security objectives and requirements are met, whether the information security controls are effective and efficient, and whether the information security risks are adequately managed. Auditing processes can also help the organisation to identify any nonconformities or opportunities for improvement and to plan for corrective or preventive actions.
References:
1: ISO/IEC 27001:2022 - Information technology - Security techniques - Information security management systems - Requirements, clause 7.2 2: ISO 19011:2018 - Guidelines for auditing management systems, clause 3.2
질문 # 127
Someone from a large tech company calls you on behalf of your company to check the health of your PC, and therefore needs your user-id and password. What type of threat is this?
정답：C
설명：
The type of threat that occurs when someone from a large tech company calls you on behalf of your company to check the health of your PC, and therefore needs your user-id and password, is a social engineering threat. Social engineering is a technique that manipulates people into revealing confidential or sensitive information, such as passwords, personal data, bank details, etc., by impersonating someone trustworthy or authoritative, such as an IT support staff, a manager, a colleague, etc. Social engineering can be done through various channels, such as phone calls, emails, text messages, etc., and can exploit human emotions, such as curiosity, fear, greed or sympathy. Social engineering is often used by hackers or cybercriminals to gain unauthorized access to information systems or networks, or to perform malicious or fraudulent activities. Reference: [CQI & IRCA Certified ISO/IEC 27001:2022 Lead Auditor Training Course], ISO/IEC 27001:2022 Information technology - Security techniques - Information security management systems - Requirements, What is Social Engineering?
질문 # 128
......
IT업종 종사자분들은 모두 승진이나 연봉인상을 위해 자격증을 취득하려고 최선을 다하고 계실것입니다. 하지만 쉴틈없는 야근에 시달려서 공부할 시간이 없어 스트레스가 많이 쌓였을것입니다. KoreaDumps의PECB인증 ISO-IEC-27001-Lead-Auditor덤프로PECB인증 ISO-IEC-27001-Lead-Auditor시험공부를 해보세요. 시험문제커버율이 높아 덤프에 있는 문제만 조금의 시간의 들여 공부하신다면 누구나 쉽게 시험패스가능합니다.
ISO-IEC-27001-Lead-Auditor시험합격: https://www.koreadumps.com/ISO-IEC-27001-Lead-Auditor_exam-braindumps.html
KoreaDumps ISO-IEC-27001-Lead-Auditor 최신 PDF 버전 시험 문제집을 무료로 Google Drive에서 다운로드하세요: https://drive.google.com/open?id=1F6TU0eB6-nD0b4eQ3yKfrjlTpqVBpSGn