PECB ISO-IEC-27001-Lead-Implementer Exam With Confidence Using Practice Dumps

According to ISO/IEC 27001:2022, information security controls are measures that are implemented to protect the confidentiality, integrity, and availability of information assets1. Controls can be preventive, detective, or corrective, depending on their purpose and nature2. Preventive controls aim to prevent or deter the occurrence of a security incident or reduce its likelihood. Detective controls aim to detect or discover the occurrence of a security incident or its symptoms. Corrective controls aim to correct or restore the normal state of an asset or a process after a security incident or mitigate its impact2.

In this scenario, Socket Inc. implemented several security controls to prevent information security incidents from recurring, such as:

Segregation of networks: This is a preventive and technical control that involves separating different parts of a network into smaller segments, using devices such as routers, firewalls, or VPNs, to limit the access and communication between them3. This can enhance the security and performance of the network, as well as reduce the administrative efforts and costs3.

Privileged access rights: This is a preventive and administrative control that involves granting access to information assets or systems only to authorized personnel who have a legitimate need to access them, based on their roles and responsibilities4. This can reduce the risk of unauthorized access, misuse, or modification of information assets or systems4.

Cryptographic controls: This is a preventive and technical control that involves the use of cryptography, which is the science of protecting information by transforming it into an unreadable format, to protect the confidentiality, integrity, and authenticity of information assets or systems. This can prevent unauthorized access, modification, or disclosure of information assets or systems.

Information security threat management: This is a preventive and administrative control that involves the identification, analysis, and response to information security threats, which are any incidents that could negatively affect the confidentiality, integrity, or availability of information assets or systems. This can help the organization to anticipate, prevent, or mitigate the impact of information security threats.

Information security integration into project management: This is a preventive and administrative control that involves the incorporation of information security requirements and controls into the planning, execution, and closure of projects, which are temporary endeavors undertaken to create a unique product, service, or result. This can ensure that information security risks and opportunities are identified and addressed throughout the project life cycle.

However, information backup is not a preventive control, but a corrective control. Information backup is a corrective and technical control that involves the creation and maintenance of copies of information assets or systems, using dedicated software and utilities, to ensure that they can be recovered in case of data loss, corruption, accidental deletion, or cyber incidents. This can help the organization to restore the normal state of information assets or systems after a security incident or mitigate its impact. Therefore, information backup does not prevent information security incidents from recurring, but rather helps the organization to recover from them.

ISO/IEC 17021-1:2015 (which sets out the requirements for bodies providing audit and certification of management systems, referenced in ISO/IEC 27001 certification practices) clearly states that the certification body must consider all relevant information when making a certification decision. This includes audit findings and other information, such as public information that may affect the decision, as long as it is relevant and objective.

Relevant Extract:

ISO/IEC 17021-1:2015, Clause 9.5.1 states:

“The certification body shall make decisions regarding granting, maintaining, renewing, extending, reducing, suspending or withdrawing certification based on an evaluation of audit findings and conclusions and any other relevant information (e.g., public information, complaints, etc.).”

ISO/IEC 27001:2022 Implementation Guidance supports this:

“Certification bodies may use other relevant information, such as publicly available data, to ensure the integrity and accuracy of the certification process.”

The certification decision should not be based solely on audit findings (B is incorrect) nor exclusively on auditor opinion (A is incorrect), but must include any relevant information—this may include public records, regulatory notices, and complaints that can impact certification status.

An intrusion detection system (IDS) is a device or software application that monitors network activities, looking for malicious behaviors or policy violations, and reports their findings to a management station. An IDS can help an organization to detect intrusions on networks, which are unauthorized attempts to access, manipulate, or harm network resources or data. In the scenario, Beauty should have implemented an IDS to detect intrusions on networks, such as the one that exposed customers’ information due to the out-of-date anti-malware software. An IDS could have alerted the IT team about the suspicious network activity and helped them to respond faster and more effectively. Therefore, the correct answer is C.