Confidently Practice Online with Free ISO-IEC-27001-Lead-Implementer Exam Cram

Scenario 2: Beauty is a cosmetics company that has recently switched to an e-commerce model, leaving the

traditional retail. The top management has decided to build their own custom platform in-house and outsource

the payment process to an external provider operating online payments systems that support online money

transfers.

Due to this transformation of the business model, a number of security controls were implemented based on

the identified threats and vulnerabilities associated to critical assets. To protect customers' information.

Beauty's employees had to sign a confidentiality agreement. In addition, the company reviewed all user access

rights so that only authorized personnel can have access to sensitive files and drafted a new segregation of

duties chart.

However, the transition was difficult for the IT team, who had to deal with a security incident not long after

transitioning to the e commerce model. After investigating the incident, the team concluded that due to the outof-date anti-malware software, an attacker gamed access to their files and exposed customers' information,

including their names and home addresses.

The IT team decided to stop using the old anti-malware software and install a new one which would

automatically remove malicious code in case of similar incidents. The new software was installed in every

workstation within the company. After installing the new software, the team updated it with the latest

malware definitions and enabled the automatic update feature to keep it up to date at all times. Additionally,

they established an authentication process that requires a user identification and password when accessing

sensitive information. In addition, Beauty conducted a number of information security awareness sessions for the IT team and other

employees that have access to confidential information in order to raise awareness on the importance of

system and network security.

Based on the scenario above, answer the following question:

According to scenario 2, Solena decided to issue a press release in which its representatives denied the attack.

What does this situation present?

Scenario 2: Beauty is a cosmetics company that has recently switched to an e-commerce model, leaving the traditional retail. The top management has decided to build their own custom platform in-house and outsource the payment process to an external provider operating online payments systems that support online money transfers. Due to this transformation of the business model, a number of security controls were implemented based on the identified threats and vulnerabilities associated to critical assets. To protect customers' information. Beauty's employees had to sign a confidentiality agreement. In addition, the company reviewed all user access rights so that only authorized personnel can have access to sensitive files and drafted a new segregation of duties chart.However, the transition was difficult for the IT team, who had to deal with a security incident not long after transitioning to the e commerce model. After investigating the incident, the team concluded that due to the out-of-date anti-malware software, an attacker gamed access to their files and exposed customers' information, including their names and home addresses. The IT team decided to stop using the old anti-malware software and install a new one which would automatically remove malicious code in case of similar incidents. The new software was installed in every workstation within the company. After installing the new software, the team updated it with the latest malware definitions and enabled the automatic update feature to keep it up to date at all times. Additionally, they established an authentication process that requires a user identification and password when accessing sensitive information. In addition, Beauty conducted a number of information security awareness sessions for the IT team and other employees that have access to confidential information in order to raise awareness on the importance of system and network security. Based on scenario 2, Beauty should have implemented (1)_____________________________ to detect (2)_________________________.

A non-human threat for computer systems is a flood. In which situation is a flood always a relevant threat? 

Scenario 1: HealthGenic is a pediatric clinic that monitors the health and growth of individuals from infancy

to early adulthood using a web-based medical software. The software is also used to schedule appointments,

create customized medical reports, store patients' data and medical history, and communicate with all the

[^involved parties, including parents, other physicians, and the medical laboratory staff.

Last month, HealthGenic experienced a number of service interruptions due to the increased number of users

accessing the software Another issue the company faced while using the software was the complicated user

interface, which the untrained personnel found challenging to use.

The top management of HealthGenic immediately informed the company that had developed the software

about the issue. The software company fixed the issue; however, in the process of doing so, it modified some

files that comprised sensitive information related to HealthGenic's patients. The modifications that were made

resulted in incomplete and incorrect medical reports and, more importantly, invaded the patients' privacy.

Based on the scenario above, answer the following question:

According to scenario 1, which of the following controls implemented by Antiques is a detective and

administrative control?

How does the Statement of Applicability (SoA) contribute to the certification audit process?