[UPDATED 2026] ISO-IEC-27001-Lead-Auditor-CN dumps Free Test Engine Verified By Certified Experts
Realistic ISO-IEC-27001-Lead-Auditor-CN Accurate & Verified Answers As Experienced in the Actual Test!
NEW QUESTION # 216
審計人員無法辨識 A 公司隱藏了不安全的網路架構。這是什麼類型的審計風險？
- A. 控制
- B. 檢測
- C. 固有的
Answer: B
Explanation:
Detection risk refers to the risk that the auditor will not detect a material misstatement or significant issue within the organization's ISMS. In this case, the auditor's inability to identify Company A's insecure network architecture is a detection risk.
NEW QUESTION # 217
組織 A 的審核員對供應商 B 進行審核。
- A. 與 B 的其他客戶分享調查結果
- B. 與 A 的供應商評估團隊分享調查結果
- C. 與 B 的認證機構分享調查結果
- D. 與 A 中的其他相關經理分享調查結果
- E. 與 B 中的其他相關經理分享調查結果
- F. 與 B 的資安經理分享調查結果
Answer: A,D
Explanation:
According to the PECB Candidate Handbook1, one of the principles of auditing is confidentiality, which means that auditors should respect the confidentiality of information obtained during the audit and not disclose it to unauthorized parties. The handbook also states that auditors should only report audit results to those who have a legitimate need to know, such as the client, the auditee, and the certification body.
Therefore, sharing the findings with other relevant managers in A or B's other customers would be a breach of confidentiality, as they are not directly involved in the audit process or the information security management system of B. Sharing the findings with B's Information Security Manager or other relevant managers in B would be appropriate, as they are part of the auditee organization and responsible for the implementation and improvement of the ISMS. Sharing the findings with A's supplier evaluation team or B's certification body would also be acceptable, as they have a legitimate need to know the audit results for the purpose of supplier selection or certification, respectively. References: 1: PECB Candidate Handbook - ISO
27001 Lead Auditor, pages 7-8.
NEW QUESTION # 218
哪一項不是 HR 在招募前的要求？
- A. 必須接受資訊安全意識訓練。
- B. 必須成功通過背景調查
- C. 接受背景驗證
- D. 申請人必須完成就業前文件要求
Answer: A
Explanation:
According to ISO/IEC 27001:2022, clause 7.2.2, the organization shall ensure that all persons who have access to information are aware of the information security policy and their contribution to the effectiveness of the ISMS, including the benefits of improved information security performance2. Therefore, awareness training on information security is a requirement for all persons, not just new hires. Reference: ISO/IEC 27001:2022 Lead Auditor (Information Security Management Systems) | CQI | IRCA
NEW QUESTION # 219
您正在一家提供醫療保健服務的住宅療養院進行 ISMS 審核。審核計畫的下一步是驗證資訊安全事件管理流程。 IT 安全經理介紹了資訊安全事件管理程序，並解釋該流程基於 ISO/IEC 27035-1:2016。
您查看該文件並注意到一條聲明「任何資訊安全弱點、事件和事故應在識別後 1 小時內報告給聯絡人 (PoC)」。在訪問員工時，您發現大家對「弱點、事件、事件」意義的理解有差異。
您從事件追蹤系統中抽取過去 6 個月的事件報告記錄樣本，總結結果如下表所示。
您想進一步調查其他領域以收集更多審計證據。選擇兩個不會出現在您的審核追蹤中的選項。
- A. 透過訪問更多員工了解他們對報告流程的理解來收集更多證據。
（與控制措施 A.6.8 相關） - B. 收集更多有關組織如何確定事件恢復時間的證據。 （與控制措施 A.5.27 相關）
- C. 收集更多有關醫療保健監測服務要求的證據。 （與第4.2條相關）
- D. 收集更多有關事件恢復程序的證據。 （與控制措施 A.5.26 相關）
- E. 收集有關人力資源經理如何以及何時支付贖金以解鎖個人行動資料（即信用卡和銀行轉帳）的更多證據。 （與控制措施 A.5.26 相關）
- F. 收集更多關於公司如何以及何時支付贖金以解鎖公司手機和資料（即信用卡和銀行轉帳）的證據。 （與控制措施 A.5.26 相關）
- G. 收集更多證據，說明組織如何確定事件發生後無需採取進一步行動。 （與控制措施 A.5.26 相關）
Answer: C,F
Explanation:
According to ISO/IEC 27001:2022, which specifies the requirements for establishing, implementing, maintaining and continually improving an information security management system (ISMS), clause 4.2 requires an organization to determine the needs and expectations of interested parties that are relevant to its ISMS1. This includes identifying the legal, regulatory, contractual and other requirements that apply to its information security activities1. Therefore, collecting more evidence on what the service requirements of healthcare monitoring are may not be relevant to verifying the information security incident management process, as it is not directly related to the audit objective or criteria. This option will not be in the audit trail.
NEW QUESTION # 220
情境 5：Data Grid Inc. 是一家知名公司，為整個資訊科技基礎設施提供安全服務。它提供網路安全軟體，包括端點安全、防火牆和防毒軟體。二十年來，Data Grid Inc. 透過先進的產品和服務幫助多家公司保護其網路安全。 Data Grid Inc. 在資訊和網路安全領域享有盛譽，決定獲得 ISO/IEC 27001 認證，以更好地保護其內部和客戶資產並獲得競爭優勢。
Data Grid Inc. 任命了審計團隊，該團隊同意審計任務的條款。此外，Data Grid Inc.明確了審核範圍，明確了審核標準，並建議在五天內結束審核。由於Data Grid Inc.員工人數眾多，流程複雜，審計小組拒絕了Data Grid Inc.在五天內進行審計的提議。 Data Grid Inc.堅稱他們計劃在五天內完成審核，因此雙方同意在規定的時間內進行審核。審計小組遵循基於風險的審計方法。
為了獲得主要業務流程和控制的概述，審計團隊存取了流程描述和組織圖表。他們無法對 IT 風險和控制進行更深入的分析，因為他們對 IT 基礎架構和應用程式的存取受到限制。然而，審計小組表示，Data Grid Inc. 的 ISMS 出現重大缺陷的風險很低，因為該公司的大部分流程都是自動化的。因此，他們透過詢問 Data Grid Inc. 的代表以下問題來評估 ISMS 整體上符合標準要求：
*如何定義和指派 IT 和 IT 控制的職責？
*Data Grid Inc. 如何評估控制措施是否達到了預期效果？
*Data Grid Inc. 採取了哪些控制措施來保護操作環境和資料免受惡意軟體的侵害？
*是否實施了與防火牆相關的控制？
Data Grid Inc. 的代表提供了充分且適當的證據來解決所有這些問題。
審計組長起草審計結論並向Data Grid Inc. 的最高管理階層報告。
儘管審核員推薦Data Grid Inc.進行認證，但Data Grid Inc.與認證機構之間在審核目標方面產生了誤解。 Data Grid Inc. 表示，儘管審計目標包括確定潛在改進的領域，但審計團隊並未提供此類資訊。
根據該場景，回答以下問題：
Data Grid Inc. 對以下所有行為負責，但以下情況除外：
- A. 指定審核標準
- B. 定義審核範圍
- C. 任命審核團隊
Answer: C
Explanation:
In the context of ISO/IEC 27001 audits, the audit team is appointed by the certification body, not by the organization being audited. Data Grid Inc. is responsible for specifying the audit criteria and defining the audit scope, but not for appointing the audit team.
References: ISO 19011:2018, Guidelines for auditing management systems
NEW QUESTION # 221
您正在一家提供醫療保健服務的住宅療養院 (ABC) 進行 ISMS 審核。審核計劃的下一步是驗證 ABC 醫療保健行動應用程式開發、支援和生命週期流程的資訊安全性。在審核過程中，您了解到該組織將行動應用程式開發外包給了一家擁有CMMI Level 5、ITSM（ISO/IEC 20000-1）、BCMS（ISO
22301）和
通過 ISMS (ISO/IEC 27001) 認證。
IT經理介紹了軟體安全管理流程，並將流程總結如下：
行動應用程式開發至少應採用「設計安全」和「預設安全」原則。
應具備以下個人資料保護安全功能：
存取控制。
個人資料加密，即高階加密標準（AES）演算法，金鑰長度：256位元；個人資料假名化。
已檢查漏洞，無安全後門
您採樣最新的行動應用測試報告，詳細資訊如下：
IT經理解釋說，根據軟體安全管理程序，測試結果應由他批准。加密和假名功能失敗的原因是這些功能嚴重降低了系統和服務效能。需要額外 150% 的資源來滿足這一點。服務經理同意存取控制足夠好並且可以接受。這就是服務經理簽署批准書的原因。
您正在準備審計結果。選擇正確的選項。
- A. 存在不合格項 (NC)。服務管理員不遵守軟體安全管理程序。 （與第 8.1 條相關，控制措施 A.8.30）
- B. 存在不合格項 (NC)。組織和開發人員不執行驗收測試。
（與第 8.1 條相關，控制措施 A.8.29） - C. 存在不合格項 (NC)。組織和開發人員執行的安全測試失敗。
（與第 8.1 條相關，控制措施 A.8.29） - D. 不存在不合格項 (NC)。服務經理做出了繼續提供服務的正確決定。
（與第 8.1 條相關，控制措施 A.8.30）
Answer: A
NEW QUESTION # 222
下列哪兩個短語適用於與業務流程的計劃-實施-檢查-行動週期相關的「行動」？
- A. 審核流程
- B. 實現改進
- C. 重設目標
- D. 驗證訓練
- E. 測量目標
- F. 計劃變更
Answer: B,C
Explanation:
The Act phase of the PDCA cycle is where the organisation takes actions to improve its processes and performance based on the results of the Check phase. This may involve resetting objectives to make them more realistic, achievable or challenging, or implementing changes to address the root causes of problems and achieve the desired outcomes. The Act phase is also where the organisation monitors the effects of the actions taken and evaluates their effectiveness and efficiency. The Act phase is important because it enables the organisation to learn from its experience and continually improve its ISMS. References: What is 'Plan, Do, Check, Act'? A framework for continuous improvement, PDCA in ISO27001 - Free guide to learn | Dr. Erdal Ozkaya, PECB Candidate Handbook ISO 27001 Lead Auditor (page 12)
NEW QUESTION # 223
在與管理認證機構審核計畫的個人進行討論時，客戶組織的管理系統代表會要求指定特定審核員來進行認證審核。選擇以下選項中的兩個來了解管理審核計劃的個人應如何應對。
- A. 建議請求認證機構管理層允許該請求
- B. 表明他的請求將被考慮，但可能不會被接受
- C. 通知管理系統代表他的請求可以被接受
- D. 建議管理系統代表選擇其他認證機構
- E. 告知管理系統代表，審核團隊的選擇是審核專案經理需要根據可用資源做出的決定
Answer: B,E
Explanation:
According to ISO/IEC 17021-1, which specifies the requirements for bodies providing audit and certification of management systems, a certification body should ensure that its auditors are competent, impartial, and independent from the auditee organization2. Therefore, if a Management System Representative of a client organization asks for a specific auditor for the certification audit, the individual(s) managing the audit programme should respond in a way that does not compromise these principles or create any conflict of interest or undue influence2. Two possible ways to respond are to state that his request will be considered but may not be taken up, as there may be other factors that affect the auditor selection process; or to advise him that the audit team selection is a decision that the audit programme manager needs to make based on the resources available, such as auditor availability, competence, location, etc2. The other options are not suitable ways to respond in this situation. For example, advising him that his request can be accepted may raise doubts about the objectivity and credibility of the auditor and the certification body; suggesting that he chooses another certification body may imply that his request is unreasonable or unethical; and suggesting asking the certification body management to permit his request may suggest that there is room for negotiation or manipulation in auditor selection2. References: ISO/IEC 17021-1:2015 - Conformity assessment - Requirements for bodies providing audit and certification of management systems - Part 1: Requirements
NEW QUESTION # 224
在第三方認證審核中，保密性是審核計畫中的一個問題。選擇正確說明審計中保密功能的兩個選項
- A. 保密是審計行為的原則之一
- B. 審核團隊中的觀察員無法存取任何機密資訊
- C. 由於審核員始終有導遊陪同，因此不會對受審核方的敏感資訊造成風險
- D. 審核員在使用攝影機或錄音設備之前應獲得受審核方的許可
- E. 審計資訊可用於審計人員提升個人能力
- F. 監理要求迫使審核員在審核中保密
Answer: A,D
Explanation:
Confidentiality is one of the principles of audit conduct that auditors should adhere to when performing audits. Confidentiality means that auditors should exercise discretion in the use and protection of information acquired in the course of their duties3. Auditors should respect the intellectual property rights of the auditee and other parties involved in the audit, and should not disclose any information that is sensitive, proprietary, or confidential without prior approval from the auditee or other authorized parties3. Auditors should also obtain the auditee's permission before using a camera or recording equipment during an audit, as these devices may capture confidential information or infringe on the privacy of individuals3. Therefore, these two options correctly state the function of confidentiality in an audit. The other options are either incorrect or irrelevant to confidentiality. For example, auditors are not forced by regulatory requirements to maintain confidentiality in an audit, but rather by ethical obligations and contractual agreements3. Observers in an audit team can access confidential information if they have signed a confidentiality agreement and have been authorized by the auditee3. Audit information can be used for improving personal competence by the auditor only if it does not compromise confidentiality or conflict with other interests3. As an auditor is always accompanied by a guide, there is still a risk to the auditee's sensitive information if the guide is not trustworthy or authorized to access such information3. Reference: ISO 19011:2018 - Guidelines for auditing management systems
NEW QUESTION # 225
您正在一家提供醫療保健服務的住宅療養院執行 ISMS 審核，並審查軟體程式碼管理 (SCM) 系統。您在 SCM 上總共發現了 10 個使用者帳戶。
您確認其中一位用戶 Scott 已辭職 9 個月
前。 SCM 系統管理員確認 Scott 最後一次檢出原始碼是在 1 個月前。他正在安全區域使用本機網路的授權桌面之一。
您檢查用戶註銷程序，其中規定“經理必須確保在辭職批准後立即從相關ICT系統和/或設備註銷用戶帳戶和授權。”用戶Scott沒有註銷記錄。
IT 安全經理解釋說，Scott 辭職後每個月仍然會回到辦公室，提供原始碼維護的支援。這就是為什麼他在 SCM 上的帳戶仍然存在。
您想進一步調查其他領域以收集更多審計證據。選擇三個不是有效審計追蹤的選項。
- A. 從新僱傭關係下人力資源部門進行的 Scott 背景核查中收集更多證據。 （與控制 A.6.1 相關）
- B. 收集更多有關 Scott 如何存取安全區域的證據。 （與控制 A.8.4 相關）
- C. 收集更多證據來證明 Scott 辭職的原因以及他的重新任職是否存在利益衝突。 （與控制措施 A.5.3 相關）
- D. 收集更多證據，了解 Scott 保存他查看的原始程式碼的位置以及如何保護它。
（與控制 A.8.4 相關） - E. 收集更多有關組織如何支付 Scott 原始碼維護支援服務費用的證據。 （與控制 A.6.2 相關）
- F. 收集更多關於如何管理 Scott 從全職工作到兼職工作的轉變的證據（與控制措施 A.6.5 相關）
- G. 收集更多關於如何定期審查存取控制以維護安全的證據（與控制措施 A.5.35 相關）
- H. 收集更多有關 Scott 如何存取員工的桌面和本地網路的證據。 （與控制 A.5.15 相關）
Answer: C,E,F
Explanation:
The options B, D, and G are not valid audit trails because they are not directly related to the ISMS requirements or the audit criteria. They are more relevant to the human resource management or the contractual arrangements of the organization, which are outside the scope of the ISMS audit. The other options are valid audit trails because they can provide evidence of how the organization implements and maintains the ISMS controls related to access control, secure areas, and information security aspects of business continuity management. References:
* PECB Candidate Handbook ISO/IEC 27001 Lead Auditor, page 16, section 4.2.1
* ISO/IEC 27001:2013, clauses A.5.3, A.5.15, A.5.35, A.6.1, A.6.2, A.6.5, A.8.4, A.17.1
* ISO 19011:2018, clause 6.2.2
NEW QUESTION # 226
選出最能完成下面句子的單字來描述第三方審核計畫。
要使用最佳單字完成句子，請按一下要完成的空白部分，使其以紅色突出顯示，然後從下面的選項中按一下適用的文字。或者，您可以將該選項拖曳到適當的空白部分。
Answer:
Explanation:
Explanation:
The words that best complete the sentence are assess and recommendation. The sentence would read as follows:
"An audit plan is a statement of the intent of the audit team to assess all areas of the company with a view to determining a recommendation for certification approval." Explanation: According to the web search results from my predefined tool, a third-party audit plan is a document that describes the scope, objectives, criteria, and methodology of an external audit conducted by an independent certification body to verify the conformity of an organization's ISMS with the ISO 27001 standard12. The audit plan also includes the audit schedule, the audit team, the audit locations, and the audit deliverables23. One of the main deliverables of a third-party audit is the audit report, which summarizes the audit findings, the audit conclusions, and the audit recommendation34. The audit recommendation is the opinion of the audit team on whether the organization's ISMS meets the certification requirements and whether the certification should be granted, maintained, suspended, or withdrawn45.
Therefore, the purpose of the audit plan is to state the intention of the audit team to assess all areas of the company, meaning to evaluate the performance and effectiveness of the ISMS, and to determine a recommendation for certification approval, meaning to provide a judgment on the certification status of the ISMS. The other words in the options, such as verdict, permit, report, inspect, and question, do not accurately reflect the meaning of the audit plan. A verdict is a formal decision made by a judge or a jury, not by an audit team. A permit is a legal authorization to do something, not a certification of conformity. A report is a document that presents the audit results, not the audit intention. An inspection is a visual examination of something, not a comprehensive assessment of an ISMS. A question is a request for information, not a determination of a recommendation.
NEW QUESTION # 227
以下是資訊安全的目的，但以下情況除外：
- A. 最大化投資回報
- B. 確保業務連續性
- C. 增加企業資產
- D. 最小化業務風險
Answer: C
Explanation:
The following are purposes of information security, except increasing business assets. Increasing business assets is not a purpose of information security, as it is not directly related to protecting information and systems from threats and risks. Information security may contribute to increasing business assets by enhancing customer trust, reputation, compliance, and efficiency, but it is not its primary goal. Ensuring business continuity is a purpose of information security, as it aims to prevent or minimize disruptions or losses caused by incidents affecting information and systems. Minimizing business risk is a purpose of information security, as it aims to identify and reduce threats and vulnerabilities that may compromise information and systems. Maximizing return on investment is a purpose of information security, as it aims to optimize the costs and benefits of implementing and maintaining information security controls and measures. References: : CQI & IRCA ISO 27001:2022 Lead Auditor Course Handbook, page 23. : [ISO/IEC
27001 Brochures | PECB], page 4.
NEW QUESTION # 228
您是一位經驗豐富的 ISMS 審核團隊領導，為審核員提供培訓指導。
受訓的審核員似乎對 ISO 27001:2022 中能力的解釋感到困惑，並且正在尋求您的澄清，以確保他的理解是正確的。他列出了一系列小情景，並詢問您將其中哪一個歸因於缺乏能力。選擇四個正確選項。
- A. 一位最近從 IT 網路團隊調到軟體開發團隊的員工不知道在出貨前需要填寫產品發佈表格
- B. 一位經驗豐富的接待員允許她認識的承包商在沒有門禁卡的情況下進入資料中心
- C. 資料中心操作員因急於執行另一項任務而無意中將備份磁帶放入了錯誤的磁碟機中
- D. 高階經理人無法協助組織的資訊安全事件復原流程，因為她沒有接受過所需的培訓
- E. IT 技術人員因未閱讀提供的說明而未能正確配置新型號的伺服器
- F. 新啟動者無法開啟閉路電視監控，因為他們沒有被告知如何執行此操作
- G. 一位高級程式設計師沒有檢查他們的編碼是否有錯誤，因為他們去看醫生遲到了
- H. 系統管理員因收到錯誤指令而刪除了兩個真實帳戶以及五個冗餘帳戶
Answer: A,D,E,F
Explanation:
These four scenarios are examples of a lack of competence, which is defined as the ability to apply the knowledge and skills needed to perform a work role or a task effectively and efficiently12. Competence in ISO 27001:2022 is determined by the organisation's needs and expectations, and it is based on the relevant education, training, or experience of the people involved in the ISMS34. The organisation is required to ensure that all the people who affect the performance of the ISMS are competent, and to provide them with the necessary training and awareness to fulfil their roles and responsibilities35. The four scenarios indicate that the people involved either lack the knowledge or skills to perform their tasks, or have not received the appropriate training or guidance to do so. The other scenarios are not related to competence, but to other factors such as negligence, error, or policy violation.
NEW QUESTION # 229
下列哪一項是組織環境的定義？
- A. 可能影響組織制定和實現其目標的方法的內部和外部問題的組合
- B. 對可能影響組織實現其目標的願望的內部和外部問題的控制
- C. 協調可能對組織的成功產生正面或負面影響的內部和外部問題
- D. 可能影響組織制定和實現其目標的方法的內部和外部問題的複雜性
Answer: A
Explanation:
The context of the organisation is the business environment in which the organisation operates and defines its information security management system (ISMS). It includes the internal and external factors and conditions that can influence the organisation's information security objectives, strategies, and policies. The context of the organisation helps the organisation to identify the scope, boundaries, and requirements of the ISMS, as well as the interested parties and their expectations. The context of the organisation is determined by considering both internal and external issues, such as the organisational structure, culture, values, mission, vision, objectives, strategies, resources, capabilities, processes, activities, products, services, markets, customers, competitors, suppliers, partners, regulators, laws, regulations, standards, guidelines, best practices, risks, opportunities, threats, vulnerabilities, etc. Reference: ISO 27001:2022 Clause 4 Context of the organization, ISO 27001 Requirement 4.1 - Understanding the Context of the Organisation, ISO 27001 context of the organization - How to define it - Advisera
NEW QUESTION # 230
選出最能完成句子的單字：
Answer:
Explanation:
Explanation:
The word that best completes the sentence is "demonstrate". According to ISO/IEC 27001:2022, Clause 7.5, the organization shall retain documented information as evidence of the performance of the processes and the conformity of the products and services with the requirements1. The purpose of retaining documented information is to demonstrate conformity with the requirements of the management system standard, not to maintain, audit, or certify it. References: 1: ISO/IEC 27001:2022, Information technology - Security techniques - Information security management systems - Requirements, Clause 7.5
NEW QUESTION # 231
您是經驗豐富的審核團隊領導，指導審核員進行培訓。
您的團隊目前正在對代表外部客戶儲存資料的組織進行第三方監督審核。接受培訓的審核員的任務是審查適用性聲明 (SoA) 中列出的並在現場實施的組織控制措施。
從以下內容中選擇您希望接受培訓的審核員審查的四項控制措施。
- A. 電源線和資料線如何進入建築物
- B. 供應商協定中如何解決資訊安全問題
- C. 資訊資產清單的開發與維護
- D. 在組織內部以及向其他組織傳輸訊息的規則
- E. 現場閉路電視和門禁系統的運行
- F. 組織的業務連續性安排
- G. 保密與保密協議
- H. 進出裝載區的通道
Answer: B,C,D,G
Explanation:
According to the PECB Candidate Handbook for ISO/IEC 27001 Lead Auditor, the auditor in training should review the organisational controls that are related to the information security policy, the roles and responsibilities, the information classification, the information exchange, the supplier relationships, and the information asset management1. These controls are aligned with the ISO/IEC 27001 requirements for clauses
5, 7, 8.2, 8.3, and 8.42. The other controls (A, D, G, and H) are more relevant to the physical and environmental security, the communications security, or the business continuity management, which are not part of the organisational controls3. References: 1: PECB Candidate Handbook for ISO/IEC 27001 Lead Auditor, page 42, section 5.2.32: ISO/IEC 27001:2022, clauses 5, 7, 8.2, 8.3, and 8.43: ISO/IEC 27001:2022, clauses 8.1, 8.5, and 8.6.
NEW QUESTION # 232
情境 6：Sinvestment 是一家提供家庭保險、商業保險和人壽保險的保險公司。該公司成立於北卡羅來納州，但最近在其他地區進行了擴張，包括歐洲和非洲。
Sinvestment 致力於遵守適用於其行業的法律法規，並防止任何資訊安全事件。他們實施了基於 ISO/IEC 27001 的 ISMS 並申請了 ISO/IEC 27001 認證。
認證機構指派兩名審核員進行審核。與Sinvestment簽訂保密協議後。他們開始了審計活動。首先，他們審查了標準要求的文件，包括 ISMS 範圍聲明、資訊安全政策和內部稽核報告。審查過程並不容易，因為儘管 Sinvestment 表示他們已製定文件程序，但並非所有文件都具有相同的格式。
隨後，審計小組對Sinvestment的高階主管進行了多次訪談，以了解他們在ISMS實施中的作用。第一階段審計的所有活動都是遠端進行的，除了根據 Sinvestment 的要求在現場進行的文件資訊審查之外。
在此階段，審計人員發現沒有與資訊安全培訓和意識計劃相關的文件。被問及時，Sinvestment代表表示，公司已為所有員工提供資訊安全培訓課程。第一階段審計讓審計團隊對 Sinvestment 的營運和 ISMS 有了整體了解。
第二階段審核在第一階段審核三週後進行。審計小組觀察到，行銷部門（未包含在審計範圍內）沒有適當的程序來控制員工的存取權限。由於控制員工的存取權限是ISO/IEC 27001的要求之一，並且已包含在公司的資訊安全政策中，因此該問題包含在審計報告中。此外，在第二階段審計中，審計小組觀察到Sinvestment沒有記錄使用者活動日誌。
該公司的程序規定“記錄用戶活動的日誌應保留並定期審查”，但該公司沒有提供任何執行該程序的證據。
在所有審核活動中，審核員透過觀察、訪談、文件化資訊審查、分析和技術驗證來收集資訊和證據。對第一階段和第二階段的所有審核結果進行了分析，審核小組決定發布積極的認證建議。
根據場景 6，行銷部門員工沒有遵守存取控制策略。
在這種情況下哪個選項是正確的？
- A. 行銷部不屬於審核範圍，因此該問題僅應傳達給Sinvestment代表
- B. Sinvestment 未控制員工的存取權限，這存在潛在的資訊安全風險，應作為重大不合格項進行報告
- C. 員工的存取權限控制包含在Sinvestment的資訊安全政策中，因此該問題必須傳達給Sinvestment的代表並包含在審計報告中
Answer: C
Explanation:
Even though the marketing department was not included in the audit scope, the issue of employees' access rights control must be communicated to Sinvestment's representatives and included in the audit report because it is part of Sinvestment's information security policy. It reflects on the overall adherence to the ISMS requirements.
NEW QUESTION # 233
您是一位審核小組組長，剛完成了對行動電信供應商的第三方審核。您正在準備審計報告，並即將完成標題為「保密」的部分。
您團隊中受訓的審核員會詢問您是否在任何情況下可以將機密報告發佈給第三方。
以下哪四個答案是錯的？
- A. 如果第三方已獲得我們揭露報告的法律通知，那麼我們必須這樣做。在所有此類情況下，我們都會向審核客戶以及受審核方（如適用）提供建議
- B. 分包審核員被視為保密方面的第三方，因此通常受保密協議的約束
- C. 審核機構僱用的任何審核員都可以存取審核報告
- D. 我們的保密義務並不是永遠持續的。作為認證機構，我們可以決定將報告保密多久。此後，第三方可以透過提出主題存取請求來存取它們
- E. 在任何情況下都不能將報告發佈給第三方。機密意味著機密，洩漏該文件將構成違反信任
- F. 雖然我們建議客戶該報告是保密的，但如果我們認為合理，我們可以決定將其發佈給第三方。我們總是事後告訴客戶
- G. 報告可以發佈給第三方，但必須經過審計客戶的明確事先批准
- H. 起始立場始終是第三方沒有自動存取審核報告的權利
Answer: B,C,D,F
Explanation:
The audit report is a confidential document that contains sensitive information about the auditee's ISMS and its performance. The audit team has a duty to protect the confidentiality of the audit report and only disclose it to authorized parties, such as the audit client, the certification body, and the accreditation body. Therefore, the following responses are false:
A: The audit team cannot decide to release the report to third parties without the consent of the audit client, as this would breach the confidentiality agreement and the audit code of conduct. The audit team should always inform the audit client before disclosing the report to any third party, and obtain their explicit, prior approval.
F: Not every auditor employed by the auditing organization can access the audit report, as this would violate the principle of need-to-know. Only auditors who are involved in the audit process, such as the audit team leader, the audit team members, the audit programme manager, and the certification decision maker, can access the audit report. Other auditors who are not related to the audit have no legitimate reason to access the report, and should be prevented from doing so by appropriate security measures.
G: The duty of confidentiality does not expire after a certain period of time, as this would compromise the trust and integrity of the audit process. The audit report remains confidential indefinitely, unless there is a legal or contractual obligation to disclose it, or the audit client agrees to release it. Third parties cannot access the audit report by making a subject access request, as this would infringe the privacy and data protection rights of the audit client and the auditee.
H: Subcontracted auditors are not considered to be third parties regarding confidentiality, as they are part of the audit team and have a contractual relationship with the auditing organization. Subcontracted auditors are typically bound by the same confidentiality agreement and audit code of conduct as the employed auditors, and have the same rights and responsibilities to access and protect the audit report.
Reference:
ISO/IEC 27001:2022, clause 9.2, Internal audit
ISO/IEC 27006:2015, clause 7.2.3, Confidentiality
PECB Candidate Handbook ISO 27001 Lead Auditor, page 22, Audit Report
PECB Candidate Handbook ISO 27001 Lead Auditor, page 24, Audit Code of Conduct
NEW QUESTION # 234
ISMS (1)----------------幫助確定 (2)----------------,
- A. 問題 (1) 管理評審，(2) 持續改善的機會
- B. (1) 持續改進，(2) 矯正措施的有效性
- C. (1) 內部審計，(2) ISMS 範圍
Answer: A
Explanation:
Management review is a crucial component of an ISMS that helps determine opportunities for continual improvement. Through management review, an organization assesses the performance and effectiveness of its ISMS, including reviewing opportunities for improvements and the need for changes to the ISMS, including the security policy and security objectives.
References: ISO/IEC 27001:2013 Standard, Clause 9.3 (Management Review)
NEW QUESTION # 235
......
Latest PECB ISO-IEC-27001-Lead-Auditor-CN Practice Test Questions: https://passleader.passsureexam.com/ISO-IEC-27001-Lead-Auditor-CN-pass4sure-exam-dumps.html