無料ISO-IEC-27001-Lead-Implementerサンプル問題で100%カバー率のリアル試験問題（更新された82問あります)
今すぐダウンロード！リアルPECB ISO-IEC-27001-Lead-Implementer試験問題集テストエンジン試験問題
PECB ISO-IEC-27001-Lead-Implementer 認定試験の出題範囲：
| トピック | 出題範囲 |
|---|---|
| トピック 1 |
|
| トピック 2 |
|
| トピック 3 |
|
ISO/IEC 27001規格は、情報資産を管理および保護するための世界的に認知されるフレームワークであり、財務情報、知的所有権、機密データなどの機密企業情報をシステマチックに管理し、この情報の機密性、完全性、可用性を確保する方法を提供します。 PECB ISO-IEC-27001-Lead-Implementer認定試験は、この規格に基づくISMSを実装および維持するために必要なスキルと知識を持つ候補者であることを検証します。
質問 # 32
Which statement is an example of risk retention?
- A. An organization has implemented a data loss protection software
- B. An organization terminates work in the construction site during a severe storm
- C. An organization has decided to release the software even though some minor bugs have not been fixed yet
正解：C
質問 # 33
A small organization that is implementing an ISMS based on ISO/lEC 27001 has decided to outsource the internal audit function to a third party. Is this acceptable?
- A. No, the organizations cannot outsource the internal audit function to a third party because during internal audit, the organization audits its own system
- B. No, the outsourcing of the internal audit function may compromise the independence and impartiality of the internal audit team
- C. Yes, outsourcing the internal audit function to a third party is often a better option for small organizations to demonstrate independence and impartiality
正解：C
質問 # 34
Which is a legislative or regulatory act related to information security that can be imposed upon all organizations?
- A. ISO/IEC 27001:2005
- B. Intellectual Property Rights
- C. ISO/IEC 27002:2005
- D. Personal data protection legislation
正解：D
質問 # 35
What is the best way to comply with legislation and regulations for personal data protection?
- A. Appointing the responsibility to someone
- B. Maintaining an incident register
- C. Performing a vulnerability analysis
- D. Performing a threat analysis
正解：A
質問 # 36
A company moves into a new building. A few weeks after the move, a visitor appears unannounced in the office of the director. An investigation shows that visitors passes grant the same access as the passes of the company's staff. Which kind of security measure could have prevented this?
- A. physical security measure
- B. An organizational security measure
- C. A technical security measure
正解：A
質問 # 37
A non-human threat for computer systems is a flood. In which situation is a flood always a relevant threat?
- A. When the computer systems are not insured.
- B. When the organization is located near a river.
- C. If the riskanalysis has not been carried out.
- D. When computer systems are kept in a cellar below ground level.
正解：D
質問 # 38
The identified owner of an asset is always an individual
- A. False
- B. True
正解：A
質問 # 39
What is the next step that Operaze's ISMS implementation team should take after drafting the information security policy? Refer to scenario 5.
- A. Communicate the information security policy to all employees
- B. Obtain top management's approval for the information security policy
- C. Implement the information security policy
正解：B
質問 # 40
What are the data protection principles set out in the GDPR?
- A. Target group, proportionality, transparency, data minimisation
- B. Purpose limitation, pudicity, transparency, data minimisation
- C. Purpose limitation, proportionality, availability, data minimisation
- D. Purpose limitation, proportionality, data minimisation, transparency
正解：D
質問 # 41
Scenario 5: Operaze is a small software development company that develops applications for various companies around the world. Recently, the company conducted a risk assessment to assess the information security risks that could arise from operating in a digital landscape. Using different testing methods, including penetration Resting and code review, the company identified some issues in its ICT systems, including improper user permissions, misconfigured security settings, and insecure network configurations. To resolve these issues and enhance information security, Operaze decided to implement an information security management system (ISMS) based on ISO/IEC 27001.
Considering that Operaze is a small company, the entire IT team was involved in the ISMS implementation project. Initially, the company analyzed the business requirements and the internal and external environment, identified its key processes and activities, and identified and analyzed the interested parties In addition, the top management of Operaze decided to Include most of the company's departments within the ISMS scope. The defined scope included the organizational and physical boundaries. The IT team drafted an information security policy and communicated it to all relevant interested parties In addition, other specific policies were developed to elaborate on security issues and the roles and responsibilities were assigned to all interested parties.
Following that, the HR manager claimed that the paperwork created by ISMS does not justify its value and the implementation of the ISMS should be canceled However, the top management determined that this claim was invalid and organized an awareness session to explain the benefits of the ISMS to all interested parties.
Operaze decided to migrate Its physical servers to their virtual servers on third-party infrastructure. The new cloud computing solution brought additional changes to the company Operaze's top management, on the other hand, aimed to not only implement an effective ISMS but also ensure the smooth running of the ISMS operations. In this situation, Operaze's top management concluded that the services of external experts were required to implement their information security strategies. The IT team, on the other hand, decided to initiate a change in the ISMS scope and implemented the required modifications to the processes of the company.
Based on the scenario above, answer the following question:
What led Operaze to implement the ISMS?
- A. Identification of threats
- B. Identification of assets
- C. Identification of vulnerabilities
正解：C
質問 # 42
What is the greatest risk for an organization ifno information security policy has been defined?
- A. Information security activities are carried out by only a few people.
- B. Too many measures areimplemented.
- C. If everyone works with the same account, it is impossible to find out who worked on what.
- D. It is not possible for an organization to implement information security in a consistent manner.
正解：D
質問 # 43
Which of these reliability aspects is "completeness" a part of?
- A. Availability
- B. Confidentiality
- C. Exclusivity
- D. Integrity
正解：D
質問 # 44
Based on scenario 1. what is a potential impact of the loss of integrity of information in HealthGenic?
- A. Disruption of operations and performance degradation
- B. Service interruptions and complicated user interface
- C. Incomplete and incorrect medical reports
正解：C
質問 # 45
Based on scenario 5. in which category of the interested parties does the MR manager of Operaze belong?
- A. Positively influenced interested parties, because the ISMS will increase the effectiveness and efficiency of the HR Department
- B. Negatively influenced interested parties, because the HR Department will deal with more documentation
- C. Both A and B
正解：C
質問 # 46
What is the difference between training and awareness9 Refer to scenario 6.
- A. Training helps acquire a skill, whereas awareness helps apply it in practice
- B. Training helps transfer a message with the intent of informing, whereas awareness helps change the behavior toward the message
- C. Training helps acquire certain skills, whereas awareness develops certain habits and behaviors.
正解：C
質問 # 47
Which tool is used to identify, analyze, and manage interested parties?
- A. The probability/impact matrix
- B. The likelihood/severity matrix
- C. The power/interest matrix
正解：C
質問 # 48
An organization has implemented a control that enables the company to manage storage media through their life cycle of use. acquisition, transportation and disposal. Which control category does this control belong to?
- A. Technological
- B. Physical
- C. Organizational
正解：A
質問 # 49
'The ISMS covers all departments within Company XYZ that have access to customers' data. The purpose of the ISMS is to ensure the confidentiality, integrity, and availability of customers' data, and ensure compliance with the applicable regulatory requirements regarding information security." What does this statement
^"describe?
- A. The physical boundary of the ISMS scope
- B. The organizational boundaries of the ISMS scope
- C. The information systems boundary of the ISMS scope
正解：B
質問 # 50
An organization has justified the exclusion of control 5.18 Access rights of ISO/IEC 27001 in the Statement of Applicability (SoA) as follows: "An access control reader is already installed at the main entrance of the building." Which statement is correct'
- A. The justification for the exclusion of a control is not required to be included in the SoA
- B. The justification is not acceptable because it does not indicate that it has been selected based on the risk assessment results
- C. The justification is not acceptable, because it does not reflect the purpose of control 5.18
正解：C
質問 # 51
An employee of the organization accidentally deleted customers' data stored in the database. What is the impact of this action?
- A. Information is not available to only authorized users
- B. Information is not accessible when required
- C. Information is modified in transit
正解：B
質問 # 52
What supports the continual improvement of an ISMS?
- A. The update of action plans
- B. The update of eternal audit reports
- C. The update of documented information
正解：C
質問 # 53
Peter works at the company Midwest Insurance. His manager, Linda, asks him to send the terms and conditions for a life insurance policy to Rachel, a client. Who determines the value of the information in the insurance terms and conditions document?
- A. The sender, Peter
- B. The person who drafted the insurance terms and conditions
- C. The recipient, Rachel
- D. The manager, Linda
正解：C
質問 # 54
You have juststarted working at a large organization. You have been asked to sign a code of conduct as well as a contract. What does the organization wish to achieve with this?
- A. A code of conduct prevents a virus outbreak.
- B. A code of conduct helps to prevent the misuse of IT facilities.
- C. A code of conduct gives staff guidance on how to report suspected misuses of IT facilities.
- D. A code of conduct is alegal obligation that organizations have to meet.
正解：B
質問 # 55
......
最新ISO-IEC-27001-Lead-Implementerテスト問題集を試そう！更新されたPECB試験が合格できます：https://jp.fast2test.com/ISO-IEC-27001-Lead-Implementer-premium-file.html
検証済み！ISO-IEC-27001-Lead-Implementer問題集と解答でISO-IEC-27001-Lead-Implementerテストエンジン正確解答付き：https://drive.google.com/open?id=1fjeNIA9ipWHPw5QeQKBJ-RA09eUA1Cp1