ISO 27001 ; 2022

Which three of the following phrases would apply to “do” in relation to the Plan-Do-Check-Act cycle for a business process?

• Training staff

• Providing ICT assets

• Identifying risks

• Retaining documentation

• Organising changes

Which two of the following statements are true?

• Excluding any requirements specified in clauses 4 to 10 is not acceptable when an organisation claims conformity to ISO/IEC 27001

• Excluding any controls specified in Annex A with justification is not acceptable when an organisation claims conformity to ISO/IEC 27001

• Excluding any controls specified in Annex A with justification is acceptable when an organisation claims conformity to ISO/IEC 27001

• Excluding any requirements specified in clauses 4 to 10 is acceptable when an organisation claims conformity to ISO/IEC 27001

Audit methods can be either with or without interaction with individuals representing the auditee.

Which six of the following methods are without interaction?

• Sampling (e.g. products).
  Observing work performed via live video streaming

• Analysing findings
  Preparing checklists

• Reviewing documents provided in advance of the audit
  Checking legal compliance with local authorities

• Conducting interviews
  Conducting a visit on site

• Completing checklists with auditee participation

Which three of the following phrases are ‘criteria’ in relation to an audit?

• Complete the audit on time

• Management policy

• International Standard

• Regulatory requirements

• Confirm the scope of the management system

Which three of the following phrases would apply to ‘audit scope’ in relation to an audit?

• Audit boundaries

• Achievable results

• Audit boundaries

• Ability to meet regulatory requirements

Which three of the following phrases are ‘criteria’ in relation to an audit?

• Management policy

• Confirm the scope of the management system

• Identify opportunities for improvement

• International Standard

• Regulatory requirements

Which three of the following phrases would apply to ‘audit scope’ in relation to an audit?

• Processes audited
  Audit boundaries

• Ability to meet regulatory requirements
  Regulatory requirements

• Achievable results
  Assessing conformity

• Assessing conformity
  Documented outcomes

Which three options describe a disadvantage of using a checklist?

• Noting down evidence details

• Ensuring the audit plan is implemented

• Not varying from the checklist when necessary

• Restricting interviews to nominated parties

• Using the same checklist for every audit without review

During an opening meeting of a Stage 2 audit, the Managing Director of the client organisation invites the audit team to view a new company video lasting 45 minutes.

Whichthreeof the following responses should the audit team leadernotmake?

• Advise the Managing Director that the audit team agrees to his request

• State that the audit team leader will stay behind after the opening meeting to view the video on behalf of the team

• State that the audit team will make a decision on the viewing at a later time

• Suggest that the first five minutes of the video could be viewed to provide a flavour of its content

• Invite the Managing Director to the auditors’ hotel for a viewing that evening

Invite the Managing Director to the auditors’ hotel for a viewing that evening

• Overrules the auditor’s instincts

• Might miss key issues

• Implements the audit plan efficiently

• Use of the plan for consecutive audits without review

• Provides an accurate understanding of the ISMS