PECB ISO-IEC-27001-Lead-Auditor Exam With Confidence Using Practice Dumps

Comprehensive and Detailed In-Depth Explanation:

C. Correct Answer:

The classification-based security approach aligns with ISO/IEC 27001:2022 Annex A Control A.5.12 (Classification of Information).

The organization is applying a security control in accordance with the classification policy, ensuring conformity to information security best practices.

A. Incorrect:

Nonconformity occurs when a process does not comply with ISO/IEC 27001 requirements. However, in this case, the classification system is correctly implemented.

B. Incorrect:

Anomaly refers to unexpected deviations in operations, but this is an intentional implementation.

Relevant Standard Reference:

ISO/IEC 27001:2022 Annex A Control A.5.12 (Information Classification Policy)

Comprehensive and Detailed In-Depth Explanation:

A. Preventive Control – Correct Answer. Access control software is designed to prevent unauthorized access by enforcing authentication and authorization mechanisms. This aligns with ISO/IEC 27001:2022 Annex A Control A.5.18 (Access Rights).

B. Detective controls identify and log unauthorized access attempts, but do not prevent them.

C. Corrective controls take action after a security event has occurred.

Comprehensive and Detailed In-Depth Explanation:

B. Correct Answer:

Audit plans must remain flexible to adapt to unforeseen findings and risks.

ISO 19011:2018 specifies that audit planning should allow dynamic adjustments.

A. Incorrect:

Audit procedures are part of execution, not planning.

C. Incorrect:

The audit team, not top management, prepares the audit plan.

Relevant Standard Reference:

ISO 19011:2018 Clause 5.4 (Audit Planning Flexibility)