Free Actual PECB ISO-IEC-27001-Lead-Auditor Exam Questions & Answers

Question 1

You are an experienced ISMS auditor conducting a third-party surveillance audit at an organisation which offers ICT reclamation services. ICT equipment which companies no longer require is processed by the organisation. It is either recommissioned and reused or is securely destroyed.

You notice two servers on a bench in the corner of the room. Both have stickers on them with the server's name, IP address and admin password. You ask the ICT Manager about them, and he tells you they were part of a shipment received yesterday from a regular customer.

Which one action should you take?

AAsk the auditee to remove the labels, then carry on with the audit

BAsk the ICT Manager to record an information security incident and initiate the information security incident management process

CNote the audit finding and check the process for dealing with incoming shipments relating to customer IT security

DRaise a nonconformity against control 5.31 'Legal, staturary, regulatory and contractual requirements'

ERaise a nonconformity against control 8.20 'network security' (networks and network devices shall be secured, managed and controlled to protect information in systems and applications)

FRecord what you have seen in your audit findings, but take no further action

Correct : C

Options Selected by Other Users:

Question 2

You are an experienced ISMS audit team leader. You are currently conducting a third-party surveillance audit of an

international haulage organisation. You have sampled four internal audit reports which state:

Report 1 - Auditor: Mr James.

Over the year the organisation has failed to meet its promised delivery dates on 23 occasions out of 100. This is against a target of '95% of deliveries on time'.

Grading - Minor

Corrective Action due: Within 9 months.

Report 2 - Auditor: Mr James.

Between January and March, it was noted 125 complaints were received about the Service Desk Team. Clients

accused them of being rude and unresponsive.

Grading - Minor

Corrective Action due: Within 12 months.

Report 3 - Auditor: Mr James.

Of the 40 customer orders received last month, 38 were correctly processed. Of the remaining 2, one was missing a

signature and one was missing a date.

Grading -

Corrections due: Within 3 weeks

Report 4 - Auditor: Mr Rogers.

Of the 30 personnel records examined, 26 were found to be fully completed whilst the remaining 4 were all missing

the individual's start date.

Grading -- Major

Corrections due: Within 1 week

Which four of the options demonstrate the concerns you would have about these reports?

AI would be concerned as to whether criteria for grading nonconformities are in existence in this organisation

BI would be concerned as to whether the auditors understand the difference between corrections and corrective actions

CI would be concerned because action taken to address a major nonconformity should always be completed sooner than action taken to address minor nonconformities

DI would be concerned that no grading is recorded for Report 3. This could indicate that the auditor did not complete the report correctly or that they failed to make a determination as to severity

EI would be concerned that the auditors focussed only on information security processes

FI would be concerned that timing for addressing the nonconformities is significantly different in the four reports

GI would have a concern that no nonconformity review was conducted

HI would have a concern that one auditor appeared to be conducting most of the internal audits

Correct : A, B, D, F

PECB ISO-IEC-27001-Lead-Auditor Exam Questions - Navigate Your Path to Success

Sample Questions for PECB ISO-IEC-27001-Lead-Auditor Exam Preparation

Options Selected by Other Users:

Options Selected by Other Users: