Question 1

In establishing an ISMS, which principle most directly addresses the ongoing monitoring and adjustment of security controls based on performance and changing threat landscape?

Options :

A : Continual Improvement

B : Risk-Based Thinking

C : Management Responsibility

D : Process Approach

Answer: A

Question 2

Inherent risks identification, associated with ISMS asset valuation, plays a crucial role in determining information security controls. Which statement MOST accurately reflects the impact of accurately identifying inherent risks on the ISMS?

Options :

A : It primarily helps in selecting the most cost-effective security controls, regardless of the potential impact on data confidentiality.

B : It facilitates the development of a comprehensive risk treatment plan, enabling the organization to prioritize and address vulnerabilities based on their potential impact and likelihood.

C : It allows the organization to completely eliminate all potential information security threats, ensuring a secure environment.

D : It mainly focuses on ensuring compliance with legal requirements, regardless of the actual risks the organization faces.

Answer: B

Question 3

Suppose a company 'SecureTech' holds ISO/IEC 27001 certification. During a surveillance audit, the auditor discovers several minor nonconformities relating to asset management. SecureTech promptly corrects these nonconformities and provides evidence to the auditor. What is the MOST appropriate auditor's response regarding the nonconformities?

Options :

A : Recommend immediate suspension of SecureTech's ISO/IEC 27001 certification due to the observed nonconformities.

B : Record the corrections as positive findings and disregard the initial nonconformities entirely.

C : Accept the corrective actions as evidence of commitment to ISMS maintenance and allow the certification to continue without further action.

D : Accept the corrective actions and record the nonconformities as closed, while potentially increasing the scope or frequency of future audits based on the number and nature of the findings.

Answer: D

Question 4

Following audit confirmation, what principle is MOST directly threatened when the auditee's department head, who is also a personal friend of the Lead Auditor, is responsible for providing all documentation and coordinating all interviews for that department's processes?

Options :

A : Fair Presentation

B : Due Professional Care

C : Integrity

D : Independence

Answer: D

Question 5

Suppose a lead auditor observes that a minor nonconformity, initially raised during the audit, has been addressed by the auditee with documented corrective action verified as effective during the closing meeting. However, the evidence was submitted just before the meeting started. What is the MOST appropriate action for the lead auditor?

Options :

A : Immediately close the nonconformity and proceed with a recommendation for certification.

B : Document the closure of the nonconformity in the audit report and recommend certification, highlighting the last-minute evidence submission.

C : Insist on scheduling a follow-up audit to independently verify the corrective actionâ€™s long-term effectiveness before recommending certification.

D : Note the closure and recommend certification but stipulate that the next surveillance audit must specifically focus on the sustained effectiveness of this corrective action.

Answer: D

Confidently Practice Online with Free ISO-CLA-22 Exam Cram

Buying Options: