Practice ISO-IEC-27035-Lead-Incident-Manager Questions With Certification guide Q&A from Training Expert Prep4sureGuide
Free PECB ISO-IEC-27035-Lead-Incident-Manager Test Practice Test Questions Exam Dumps
NEW QUESTION # 46
According to scenario 4, what is the next action ORingo should take to prevent escalation when conducting exercises?
- A. Proceed with the exercise as planned, considering this as a part of the learning process
- B. Inform all participants and external entities involved that this was a simulated scenario and not a real threat immediately
- C. Wait until the exercise is completed to clarify the situation with all parties involved
Answer: B
Explanation:
Comprehensive and Detailed Explanation:
According to ISO/IEC 27035-2:2016, incident response exercises (including simulations such as phishing campaigns) must be carefully controlled to avoid confusion, escalation, or reputational damage. If an exercise is misunderstood by employees or external parties, it could lead to unintended consequences including external escalation, customer concern, or media involvement.
The best practice is to ensure that all involved-especially external stakeholders-are informed as soon as possible if they are exposed to simulated elements. Transparency ensures the organization maintains trust and mitigates potential fallout. This is part of effective communication during planned exercises.
Reference:
ISO/IEC 27035-2:2016, Clause 7.5 - "Exercises should be clearly identified, controlled, and followed by communication plans that inform affected parties of their simulated nature." Correct answer: C
-
NEW QUESTION # 47
What is a crucial element for the effectiveness of structured information security incident management?
- A. Awareness and participation of all organization personnel
- B. Outsourcing incident management to third-party vendors
- C. Technical expertise alone
Answer: A
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
While technical expertise is essential, ISO/IEC 27035 emphasizes that structured incident management must be supported by the awareness and active participation of all personnel across the organization. Effective incident response is not confined to technical teams; human factors-such as early detection, proper escalation, and policy adherence-require engagement from users, management, and third-party stakeholders.
Clause 6.3 of ISO/IEC 27035-1:2016 specifically highlights that staff awareness is critical. Personnel should understand their role in reporting suspicious activity, following defined procedures, and participating in readiness exercises.
Outsourcing (Option C) may support capacity, but it is not a substitute for internal preparedness, awareness, and governance.
Reference Extracts:
ISO/IEC 27035-1:2016, Clause 6.3: "All staff should be aware of their responsibilities in reporting and managing information security incidents." ISO/IEC 27001:2022, Control 6.3 and A.6.3.1: "Information security responsibilities must be communicated to and accepted by all personnel." Correct answer: B
-
NEW QUESTION # 48
What roles do business managers play in relation to the Incident Management Team (IMT) and Incident Response Teams (IRTs)?
- A. Guiding on liability and compliance issues to the IMT and IRT and advise on which incidents constitute mandatory data breach notifications
- B. Understanding how the IMT and IRTs support business processes and define authority over business systems
- C. Developing policies and procedures for managing internal employees found engaging in unauthorized or illegal computer activities
Answer: B
Explanation:
-
Comprehensive and Detailed Explanation From Exact Extract:
According to ISO/IEC 27035-1:2016 and ISO/IEC 27035-2:2016, business managers have a vital governance and operational oversight role in relation to information security incident response. Their main function is to ensure that incident management activities align with the organization's business processes and risk management strategies.
Clause 7.2.1 of ISO/IEC 27035-2 highlights that business managers are responsible for ensuring that the incident response teams (IRTs) understand business priorities, and that response activities reflect the criticality of affected systems and services. Business managers also help define the operational boundaries and authority of IMTs and IRTs when incidents impact key business systems. Their involvement ensures that decisions made during response efforts support overall organizational resilience and legal compliance.
Option A is more aligned with human resources or legal/compliance functions, not core business manager responsibilities. Option B relates more closely to legal counsel or data privacy officers who are tasked with interpreting laws and regulations concerning breach notifications and liability.
Reference Extracts:
ISO/IEC 27035-2:2016, Clause 7.2.1: "Business managers are responsible for ensuring the coordination between business requirements and incident response activities, and for defining authority over the systems under their management." Clause 6.1.1: "Incident response activities must be aligned with business continuity plans and critical asset protection priorities." Therefore, the correct and most comprehensive answer is: C - Understanding how the IMT and IRTs support business processes and define authority over business systems.
-
NEW QUESTION # 49
Scenario 6: EastCyber has established itself as a premier cyber security company that offers threat detection, vulnerability assessment, and penetration testing tailored to protect organizations from emerging cyber threats. The company effectively utilizes ISO/IEC 27035-1 and 27035-2 standards, enhancing its capability to manage information security incidents.
EastCyber appointed an information security management team led by Mike. Despite limited resources, Mike and the team implemented advanced monitoring protocols to ensure that every device within the company's purview is under constant surveillance. This monitoring approach is crucial for covering everything thoroughly, enabling the information security and cyber management team to proactively detect and respond to any sign of unauthorized access, modifications, or malicious activity within its systems and networks.
A recent incident involving unauthorized access to company phones highlighted the critical nature of incident management. Nate, the incident coordinator, quickly prepared an exhaustive incident report. His report detailed an analysis of the situation, identifying the problem and its cause. In response to the incident, EastCyber addressed the exploited vulnerabilities. This action started the eradication phase, aimed at systematically eliminating the elements of the incident.
Based on scenario 6, answer the following:
EastCyber decided to address vulnerabilities exploited during an incident as part of the eradication phase, to eradicate the elements of the incident. Is this approach acceptable?
- A. No, vulnerabilities exploited during an incident should be addressed during the recovery phase
- B. Addressing vulnerabilities exploited during an incident is appropriate during the eradication phase
- C. No, vulnerabilities exploited during an incident should be addressed during the containment phase
Answer: B
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
According to ISO/IEC 27035-1:2016 and ISO/IEC 27035-2:2016, the eradication phase of incident management is defined as the stage in which the causes and components of the incident-such as malware, unauthorized access points, or system vulnerabilities-are completely removed or neutralized.
Clause 6.4.5 of ISO/IEC 27035-2 clearly outlines that the eradication phase includes actions to eliminate the root causes of incidents, which may include fixing exploited vulnerabilities and removing malicious code.
This ensures that the underlying issues that allowed the incident to occur are effectively resolved, reducing the risk of recurrence.
While containment aims to limit the damage and prevent the spread of an incident, it is not intended for remediation of vulnerabilities. Similarly, the recovery phase focuses on restoring services and returning systems to normal operations after the threat has been eradicated.
Reference Extracts:
ISO/IEC 27035-2:2016, Clause 6.4.5: "The eradication phase includes removing the root cause of the incident (e.g., patching vulnerabilities, deleting malware, and closing open ports)." Clause 6.4.3: "Containment is primarily focused on limiting the scope and impact, not resolving root causes." Correct answer: A
NEW QUESTION # 50
Scenario 7: Located in central London, Konzolo has become a standout innovator in the cryptocurrency field.
By introducing its unique cryptocurrency, Konzolo has contributed to the variety of digital currencies and prioritized enhancing the security and reliability of its offerings.
Konzolo aimed to enhance its systems but faced challenges in monitoring the security of its own and third- party systems. These issues became especially evident during an incident that caused several hours of server downtime This downtime was primarily caused by a third-party service provider that failed to uphold strong security measures, allowing unauthorized access.
In response to this critical situation, Konzolo strengthened its information security infrastructure. The company initiated a comprehensive vulnerability scan of its cryptographic wallet software, a cornerstone of its digital currency offerings The scan revealed a critical vulnerability due to the software using outdated encryption algorithms that are susceptible to decryption by modern methods that posed a significant risk of asset exposure Noah, the IT manager, played a central role in this discovery With careful attention to detail, he documented the vulnerability and communicated the findings to the incident response team and management.
Acknowledging the need for expertise in navigating the complexities of information security incident management. Konzolo welcomed Paulina to the team. After addressing the vulnerability and updating the cryptographic algorithms, they recognized the importance of conducting a thorough investigation to prevent future vulnerabilities. This marked the stage for Paulina s crucial involvement. She performed a detailed forensic analysis of the incident, employing automated and manual methods during the collection phase. Her analysis provided crucial insights into the security breach, enabling Konzolo to understand the depth of the vulnerability and the actions required to mitigate it.
Paulina also played a crucial role in the reporting phase, as her comprehensive approach extended beyond analysis. By defining clear and actionable steps for future prevention and response, she contributed significantly to developing a resilient information security incident management system based on ISO/IEC
27035-1 and 27035-2 guidelines. This strategic initiative marked a significant milestone in Konzolo's quest to strengthen its defenses against cyber threats Based on scenario 7, a vulnerability scan at Konzolo revealed a critical vulnerability in the cryptographic wallet software that could lead to asset exposure. Noah, the IT manager, documented the event and communicated it to the incident response team and management. Is this acceptable?
- A. No, he should have postponed the documentation process until a full investigation is completed
- B. No, he should have waited for confirmation of an actual asset exposure before documenting and communicating the vulnerability
- C. Yes, he should document the event and communicate it to the incident response team and management
Answer: C
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
According to ISO/IEC 27035-1:2016, an information security event should be documented and communicated as soon as it is identified-particularly if it has the potential to escalate into an incident. Timely documentation and escalation enable the organization to take immediate and coordinated actions, which are essential to managing risk effectively.
Clause 6.2.1 of ISO/IEC 27035-1 states that events, even before confirmation as incidents, must be logged and assessed to determine appropriate response measures. Waiting until after a breach occurs or delaying documentation may violate both internal policies and regulatory requirements, especially in high-risk domains like cryptocurrency.
Therefore, Noah's actions align fully with the recommended practices outlined in ISO/IEC 27035.
Reference:
* ISO/IEC 27035-1:2016, Clause 6.2.1: "All identified information security events should be recorded and communicated to ensure appropriate assessment and response."
* Clause 6.2.2: "Early communication and documentation are crucial to managing potential incidents effectively." Correct answer: C
-
NEW QUESTION # 51
Scenario 3: L&K Associates is a graphic design firm headquartered in Johannesburg, South Africa. It specializes in providing innovative and creative design solutions to clients across various industries. With offices in multiple parts of the country, they effectively serve clients, delivering design solutions that meet their unique needs and preferences.
In its commitment to maintaining information security, L&K Associates is implementing an information security incident management process guided by ISO/IEC 27035-1 and ISO/IEC 27035-2. Leona, the designated leader overseeing the implementation of the incident management process, customized the scope of incident management to align with the organization's unique requirements. This involved specifying the IT systems, services, and personnel involved in the incident management process while excluding potential incident sources beyond those directly related to IT systems and services.
Based on scenario 3, did Leona follow all the ISO/IEC 27035-1 guidelines when communicating the information security incident management policy to interested parties?
- A. Yes, she effectively communicated the outcomes of incidents and strategies to minimize recurrence, meeting the necessary communication requirements
- B. No, she should also communicate how often the information security incident policies are updated and revised
- C. No, she should also communicate the incident reporting procedures and specify the appropriate contact for further information
Answer: C
Explanation:
Comprehensive and Detailed Explanation:
According to ISO/IEC 27035-1:2016, effective communication of the incident management policy must include not only policy content, roles, and responsibilities but also specific procedural aspects-such as how to report an incident and who to contact. This ensures that all stakeholders clearly understand their responsibilities in the event of an incident and know how to respond.
In the scenario, Leona communicated the outcomes of incidents, mitigation strategies, personnel obligations, and policy content. However, she did not include the incident reporting procedures or contact points, which are essential components of incident communication as per ISO guidelines.
Reference:
ISO/IEC 27035-1:2016, Clause 6.1: "Communication of the incident management policy should include reporting channels, escalation contacts, and policy revision frequency." Therefore, the correct answer is B.
-
NEW QUESTION # 52
Scenario 5: Located in Istanbul, Turkey, Alura Hospital is a leading medical institution specializing in advanced eye surgery and vision care. Renowned for its modern facilities, cutting-edge technology, and highly skilled staff, Alura Hospital is committed to delivering exceptional patient care. Additionally, Alura Hospital has implemented the ISO/IEC 27035 standards to enhance its information security incident management practices.
At Alura Hospital, the information security incident management plan is a critical component of safeguarding patient data and maintaining the integrity of its medical services. This comprehensive plan includes instructions for handling vulnerabilities discovered during incident management. According to this plan, when new vulnerabilities are discovered, Mehmet is appointed as the incident handler and is authorized to patch the vulnerabilities without assessing their potential impact on the current incident, prioritizing patient data security above all else.
Recognizing the importance of a structured approach to incident management, Alura Hospital has established four teams dedicated to various aspects of incident response. The planning team focuses on implementing security processes and communicating with external organizations. The monitoring team is responsible for security patches, upgrades, and security policy implementation. The analysis team adjusts risk priorities and manages vulnerability reports, while the test and evaluation team organizes and performs incident response tests to ensure preparedness.
During an incident management training session, staff members at Alura Hospital were provided with clear roles and responsibilities. However, a technician expressed uncertainty about their role during a data integrity incident, as the manager assigned them a role unrelated to their expertise. This decision was made to ensure that all staff members possess versatile skills and are prepared to handle various scenarios effectively.
Additionally, Alura Hospital realized it needed to communicate better with stakeholders during security incidents. The hospital discovered it was not adequately informing stakeholders and that relevant information must be provided using formats, language, and media that meet their needs. This would enable them to participate fully in the incident response process and stay informed about potential risks and mitigation strategies.
Also, the hospital has experienced frequent network performance issues affecting critical hospital systems and increased sophisticated cyberattacks designed to bypass traditional security measures. So, it has deployed an external firewall. This action is intended to strengthen the hospital's network security by helping detect threats that have already breached the perimeter defenses. The firewall's implementation is a part of the hospital's broader strategy to maintain a robust and secure IT infrastructure, which is crucial for protecting sensitive patient data and ensuring the reliability of critical hospital systems. Alura Hospital remains committed to integrating state-of-the-art technology solutions to uphold the highest patient care and data security standards.
Based on scenario 5, the hospital decided to deploy an external firewall to detect threats that have already breached the perimeter defenses in response to frequent network performance issues affecting critical hospital systems. Is this recommended?
- A. Deploying an external firewall to detect threats that have already breached the perimeter defenses
- B. No, they should have implemented a cloud-based antivirus solution instead of deploying an external firewall
- C. No, they should have deployed an intrusion detection system to identify and alert the incident response team of the breach
Answer: A
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
ISO/IEC 27035-2:2016 (Information Security Incident Management - Part 2: Guidelines to Plan and Prepare for Incident Response) provides specific guidance on implementing protective technologies that enhance detection, prevention, and response to information security incidents. Among the recommendations, deploying firewalls, intrusion detection systems (IDS), intrusion prevention systems (IPS), and other layered security mechanisms are considered essential practices in ensuring network and system resilience.
In this case, Alura Hospital experienced repeated network performance issues and targeted cyberattacks. Their decision to deploy an external firewall is appropriate and aligns with best practices outlined in ISO/IEC
27035-2, especially for a healthcare institution handling sensitive patient data. External firewalls act as a network barrier that not only prevents unauthorized access but also helps monitor and detect anomalies or threats that may have already breached traditional perimeter defenses. This is particularly important in environments where traditional safeguards are being bypassed by sophisticated attackers.
While intrusion detection systems (option C) are also important, the scenario mentions that the firewall is being used as part of a broader layered defense system and is meant to detect already-breached threats. Cloud- based antivirus solutions (option B) are not a substitute for firewalls in terms of network protection and would not adequately address the complex, targeted threats that Alura is facing.
Reference Extracts from ISO/IEC 27035-2:2016:
Clause 7.3.2: "Organizations should implement network and system security controls such as firewalls, IDS
/IPS, and anti-malware tools to monitor and restrict unauthorized access." Annex B (Example Preparatory Activities): "Firewalls are vital components in detecting and preventing unauthorized traffic, especially when placed at external network perimeters." Thus, deploying an external firewall in this context is a recommended and justified security measure. The correct answer is: A.
-
NEW QUESTION # 53
Scenario 2: NoSpace, a forward-thinking e-commerce store based in London, is renowned for its diverse products and advanced technology. To enhance its information security, NoSpace implemented an ISMS according to ISO/IEC 27001 to better protect customer data and ensure business continuity. Additionally, the company adopted ISO/IEC 27035-1 and ISO/IEC 27035-2 guidelines. Mark, the incident manager at NoSpace, strategically led the entire implementation. He played a crucial role in aligning the company's ISMS with the requirements specified in ISO/IEC 27001, using ISO/IEC 27035-1 guidelines as the foundation.
During a routine internal audit a minor anomaly was detected in the data traffic that could potentially indicate a security threat. Mark was immediately notified to assess the situation. Then, Mark and his team immediately escalated the incident to crisis management to handle the potential threat without further assessment. The decision was made to ensure a swift response.
After resolving the situation, Mark decided to update the incident management process. During the initial phase of incident management, Mark recognized the necessity of updating NoSpace's information security policies. This included revising policies related to risk management at the organizational level as well as for specific systems, services, or networks. The second phase of the updated incident management process included the assessment of the information associated with occurrences of information security events and the importance of classifying events and vulnerabilities as information security incidents. During this phase, he also introduced a 'count down' process to expedite the evaluation and classification of occurrences, determining whether they should be recognized as information security incidents.
Mark developed a new incident management policy to enhance the organization's resilience and adaptability in handling information security incidents. Starting with a strategic review session with key stakeholders, the team prioritized critical focus areas over less impactful threats, choosing not to include all potential threats in the policy document. This decision was made to keep the policy streamlined and actionable, focusing on the most significant risks identified through a risk assessment. The policy was shaped by integrating feedback from various department heads to ensure it was realistic and enforceable. Training and awareness initiatives were tailored to focus only on critical response roles, optimizing resource allocation and focusing on essential capabilities.
Based on scenario 2, NoSpace used the ISO/IEC 27035-1 guidelines to meet the ISMS requirements specified in ISO/IEC 27001. Is this acceptable?
- A. No, ISO/IEC 27035-1 is designed for incident management and response and does not address the broader scope of ISMS requirements specified in ISO/IEC 27001
- B. No, guidelines provided in ISO/IEC 27035-1 do not apply to ISMS requirements specified in ISO/IEC
27001 - C. Yes, another objective associated with ISO/IEC 27035-1 is to provide guidance on meeting the ISMS requirements specified in ISO/IEC 27001
Answer: C
Explanation:
-
Comprehensive and Detailed Explanation From Exact Extract:
Yes, the use of ISO/IEC 27035-1 to support compliance with ISO/IEC 27001 ISMS requirements is fully acceptable and encouraged. ISO/IEC 27035-1:2016 is explicitly designed to support organizations in establishing and maintaining effective information security incident management processes. These processes are a crucial component of a well-functioning Information Security Management System (ISMS), which is governed by ISO/IEC 27001.
Clause 6.1.3 and Clause A.16.1 of ISO/IEC 27001:2022 (formerly 2013) require that organizations establish and respond to information security incidents, including detection, response, and learning from such events.
ISO/IEC 27035-1 directly supports these controls by providing specific guidance on how to identify, manage, and learn from information security incidents in a structured and repeatable way.
Moreover, ISO/IEC 27035-1 is referenced by ISO/IEC 27001 Annex A (specifically A.5.24 to A.5.27 and A.
5.31 in the 2022 version), supporting requirements related to incident management, monitoring, and improvement. The ISO 27035 series acts as a detailed implementation guide for these controls, helping organizations meet both the management and operational requirements of the ISMS.
Therefore, Mark's decision to use ISO/IEC 27035-1 guidelines to align and enhance the incident management aspects of the ISMS is both appropriate and aligned with international best practices.
Reference Extracts:
* ISO/IEC 27035-1:2016, Clause 0.2: "This document also supports the information security requirements defined in ISO/IEC 27001 and provides detailed guidance on incident management activities relevant to an ISMS."
* ISO/IEC 27001:2022, Annex A (A.5.24-A.5.27): "Information security incident management should be based on established processes for detection, response, and learning."
* ISO/IEC 27001:2022, Clause 6.1.3: "Information security risks must be identified and treated as part of the ISMS." Therefore, the correct answer is A: Yes, another objective associated with ISO/IEC 27035-1 is to provide guidance on meeting the ISMS requirements specified in ISO/IEC 27001.
NEW QUESTION # 54
Why is it important to identify all impacted hosts during the eradication phase?
- A. To enhance overall security
- B. To facilitate recovery efforts
- C. To optimize hardware performance
Answer: B
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
During the eradication phase of the information security incident management process, identifying all impacted hosts is essential to ensure that every element affected by the incident is addressed before proceeding to recovery. According to ISO/IEC 27035-2:2016, Clause 6.4.5, the eradication phase involves removing malware, disabling unauthorized access, and remediating vulnerabilities that led to the incident.
Identifying all impacted hosts ensures:
Comprehensive removal of malicious artifacts
Prevention of reinfection or further propagation
A smooth and complete transition into the recovery phase
This directly supports recovery planning because it helps teams understand which systems need to be restored, rebuilt, or validated. Option B (optimizing hardware performance) is not a goal of incident management, and Option C (enhancing overall security) is a long-term objective but not the immediate goal of the eradication phase.
Reference:
ISO/IEC 27035-2:2016, Clause 6.4.5: "During eradication, it is important to identify all affected systems so that root causes and malicious components are removed prior to recovery." Correct answer: A
-
NEW QUESTION # 55
Which action is NOT involved in the process of improving controls in incident management?
- A. Updating the incident management policy
- B. Implementing new or updated controls
- C. Documenting risk assessment results
Answer: C
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
Improving controls in incident management is a proactive activity focused on directly adjusting and strengthening existing defenses. As per ISO/IEC 27035-2:2016, Clause 7.4, this process typically involves identifying deficiencies, updating or implementing new technical or procedural controls, and revising policies.
While risk assessments inform control decisions, simply documenting their results does not constitute direct improvement of controls. Hence, Option A is not part of the control improvement process itself.
Reference:
ISO/IEC 27035-2:2016 Clause 7.4: "Actions to improve controls include analyzing causes of incidents and updating procedures and policies accordingly." Correct answer: A
-
NEW QUESTION # 56
What is the purpose of incident categorization within the incident management lifecycle?
- A. To sort incidents based on the disrupted IT or business domain
- B. To determine the priority of incidents
- C. To automatically assign incidents to technicians
Answer: A
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
According to ISO/IEC 27035-1:2016 and ISO/IEC 27035-2:2016, incident categorization is a vital step in the incident management lifecycle. Its primary purpose is to sort and group incidents based on specific criteria so that appropriate actions and escalation paths can be taken.
One of the core objectives of categorization is to sort incidents by the domain or system affected - whether it' s a database, email system, network, or physical server. This enables organizations to assign incidents to relevant subject matter experts and apply the right procedures, based on the affected business function or IT component.
While categorization can influence prioritization (option A), the main intent is classification based on nature and domain. Automatic technician assignment (option B) may be supported by some service management platforms but is not the foundational purpose of incident categorization under ISO 27035.
Reference Extracts:
ISO/IEC 27035-1:2016, Clause 6.1.2 - "Categorization should identify the domain or component affected to enable appropriate response and escalation." ISO/IEC 27035-2:2016, Clause 7.3 - "Incidents should be categorized based on the type of disruption they cause and the business or technical domain they impact." Therefore, the correct answer is C: To sort incidents based on the disrupted IT or business domain.
-
NEW QUESTION # 57
Scenario 5: Located in Istanbul, Turkey, Alura Hospital is a leading medical institution specializing in advanced eye surgery and vision care. Renowned for its modern facilities, cutting-edge technology, and highly skilled staff, Alura Hospital is committed to delivering exceptional patient care. Additionally, Alura Hospital has implemented the ISO/IEC 27035 standards to enhance its information security incident management practices.
At Alura Hospital, the information security incident management plan is a critical component of safeguarding patient data and maintaining the integrity of its medical services. This comprehensive plan includes instructions for handling vulnerabilities discovered during incident management. According to this plan, when new vulnerabilities are discovered, Mehmet is appointed as the incident handler and is authorized to patch the vulnerabilities without assessing their potential impact on the current incident, prioritizing patient data security above all else.
Recognizing the importance of a structured approach to incident management, Alura Hospital has established four teams dedicated to various aspects of incident response. The planning team focuses on implementing security processes and communicating with external organizations. The monitoring team is responsible for security patches, upgrades, and security policy implementation. The analysis team adjusts risk priorities and manages vulnerability reports, while the test and evaluation team organizes and performs incident response tests to ensure preparedness.
During an incident management training session, staff members at Alura Hospital were provided with clear roles and responsibilities. However, a technician expressed uncertainty about their role during a data integrity incident, as the manager assigned them a role unrelated to their expertise. This decision was made to ensure that all staff members possess versatile skills and are prepared to handle various scenarios effectively.
Additionally, Alura Hospital realized it needed to communicate better with stakeholders during security incidents. The hospital discovered it was not adequately informing stakeholders and that relevant information must be provided using formats, language, and media that meet their needs. This would enable them to participate fully in the incident response process and stay informed about potential risks and mitigation strategies.
Also, the hospital has experienced frequent network performance issues affecting critical hospital systems and increased sophisticated cyberattacks designed to bypass traditional security measures. So, it has deployed an external firewall. This action is intended to strengthen the hospital's network security by helping detect threats that have already breached the perimeter defenses. The firewall's implementation is a part of the hospital's broader strategy to maintain a robust and secure IT infrastructure, which is crucial for protecting sensitive patient data and ensuring the reliability of critical hospital systems. Alura Hospital remains committed to integrating state-of-the-art technology solutions to uphold the highest patient care and data security standards.
According to scenario 5, which of the following principles of efficient communication did Alura Hospital NOT adhere to?
- A. Credibility
- B. Responsiveness
- C. Appropriateness
Answer: C
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
According to ISO/IEC 27035-1:2016 (Information Security Incident Management - Part 1: Principles of Incident Management), one of the core principles of effective communication in incident management is
"appropriateness." This refers to ensuring that the right information is shared with the right stakeholders using the appropriate channels, language, format, and timing. The objective is to guarantee that communication is both understandable and actionable by its recipients.
In the scenario, Alura Hospital recognized that they were not adequately informing stakeholders during security incidents. They identified a gap in providing relevant information using suitable formats, media, or language. This failure points directly to a lack of "appropriateness" in their communication strategy.
According to ISO/IEC 27035-1, Section 6.4 (Communication), it is essential to tailor incident communication to stakeholder needs to ensure informed decision-making and engagement.
The other options-credibility and responsiveness-are not indicated as the failing areas. There is no mention that the information provided lacked credibility or that the hospital failed to respond to incidents or communicate in a timely manner. Rather, the issue lies with the medium, clarity, and stakeholder alignment- hallmarks of appropriateness.
Reference Extracts from ISO/IEC 27035-1:2016:
Clause 6.4: "Communication must be timely, relevant, accurate, and appropriate for the target audience." Clause 7.2.4: "Stakeholders should be informed using formats and channels that they can easily access and understand." Therefore, the principle not adhered to by Alura Hospital is clearly: Appropriateness (C).
-
NEW QUESTION # 58
Who is responsible for providing threat intelligence and supporting the lead investigator within an incident response team?
- A. Team leader
- B. Analysts and researchers
- C. IT support staff
Answer: B
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
In an Incident Response Team (IRT), analysts and researchers are responsible for threat intelligence, data analysis, malware investigation, and providing in-depth technical insights. Their work directly supports the lead investigator by identifying root causes, attack vectors, indicators of compromise (IOCs), and evaluating threat actor tactics.
According to ISO/IEC 27035-2:2016, these roles are part of the broader support functions within an IRT and are crucial for technical depth and timely resolution of incidents.
Option A (IT support staff) may provide infrastructure-level assistance but typically lacks threat analysis capabilities. Option C (team leader) oversees coordination and communication but is not the primary intelligence resource.
Reference Extracts:
ISO/IEC 27035-2:2016, Clause 7.2.3: "Support roles may include malware analysts, forensic experts, and threat intelligence researchers." ENISA CSIRT Training Guide: "Analysts contribute to ongoing investigations by identifying attack patterns and supporting mitigation decisions." Correct answer: B
-
NEW QUESTION # 59
How should vulnerabilities lacking corresponding threats be handled?
- A. They should be disregarded as they pose no risk
- B. They may not require controls but should be analyzed and monitored for changes
- C. They still require controls and should be promptly addressed
Answer: B
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
According to ISO/IEC 27005:2018 (which supports ISO/IEC 27035 in risk management and threat assessment processes), vulnerabilities that are not currently associated with known threats do not necessarily need immediate remediation or technical control measures. However, they cannot be ignored entirely either.
Such vulnerabilities may not pose an active risk at the present time, but that can change quickly if a new threat emerges that can exploit them. Therefore, these vulnerabilities should be documented, assessed in context, and monitored over time. This process ensures that if the threat landscape evolves, the organization can respond proactively.
The standard emphasizes a risk-based approach, which includes:
* Analyzing vulnerabilities in relation to assets and threat likelihood
* Monitoring the environment for changes that may introduce new threats
* Avoiding unnecessary or unjustified resource expenditure on low-risk issues Option A is incorrect because it suggests addressing all vulnerabilities without considering risk context.
Option B is risky and contradicts ISO best practices, which emphasize continuous risk monitoring.
Reference Extracts:
* ISO/IEC 27005:2018, Clause 8.2.2: "Vulnerabilities without known threats may not require treatment immediately but should be monitored regularly."
* ISO/IEC 27001:2022, Annex A, Control A.8.8 - "Management of technical vulnerabilities should be risk- based and responsive to changes." Therefore, the correct answer is C: They may not require controls but should be analyzed and monitored for changes.
-
NEW QUESTION # 60
Why is it important for performance measures to be specific according to the SMART methodology?
- A. To compare them to other data easily
- B. To avoid misconception and ensure clarity
- C. To ensure they are aligned with organizational culture
Answer: B
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
The SMART model (Specific, Measurable, Achievable, Relevant, Time-bound) is outlined in ISO/IEC 27035-
2:2016 for defining and tracking performance metrics in incident response. The "Specific" component ensures that measures are clearly defined and understood by stakeholders to avoid ambiguity.
This clarity is essential for accountability, tracking, and reporting performance accurately, which directly aligns with Option B.
Reference:
ISO/IEC 27035-2:2016 Clause 7.3.2: "Performance indicators should be SMART to ensure they are effective and meaningful." Correct answer: B
-
NEW QUESTION # 61
What determines the frequency of reviewing an organization's information security incident management strategy?
- A. The frequency of audits conducted by external agencies
- B. The number of employees in the organization
- C. The nature, scale, and complexity of the organization
Answer: C
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
ISO/IEC 27035-1:2016 Clause 7.1 explicitly states that the frequency and depth of reviewing the incident management strategy should be based on the organization's size, complexity, and threat environment. Larger or more complex environments may require more frequent reviews to remain agile and responsive.
Audit schedules (Option C) may influence timing, but they do not dictate the necessary frequency for strategic reviews. The number of employees (Option A) alone is not a sufficient factor.
Reference:
ISO/IEC 27035-1:2016 Clause 7.1: "The frequency and scope of reviews should be determined by the nature, scale, and complexity of the organization." Correct answer: B
-
NEW QUESTION # 62
Based on the categorization of information security incidents, incidents such as abuse of rights, denial of actions, and misoperations are categorized as:
- A. Compromise of functions incident
- B. Breach of rule incident
- C. Compromise of information incident
Answer: B
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
ISO/IEC 27035-1 classifies incidents into several categories based on the nature of their impact. Incidents involving the abuse of user rights, denial of authorized activities, or improper system use are considered violations of internal policies or rules. These fall under the category of "Breach of Rule" incidents.
This category emphasizes that while data or functionality may not be directly compromised, internal governance, permissions, or acceptable use policies have been violated. These incidents are crucial to detect as they often indicate insider threats or misconfigured permissions.
Reference:
ISO/IEC 27035-1:2016, Annex A.2.3: "Breach of Rule" incidents include abuse of privileges, unauthorized activities, and actions violating organizational policies.
Correct answer: C
-
NEW QUESTION # 63
Scenario 8: Moneda Vivo, headquartered in Kuala Lumpur. Malaysia, is a distinguished name in the banking sector. It is renowned for its innovative approach to digital banking and unwavering commitment to information security. Moneda Vivo stands out by offering various banking services designed to meet the needs of its clients. Central to its operations is an information security incident management process that adheres to the recommendations of ISO/IEC 27035-1 and 27035-2.
Recently. Moneda Vivo experienced a phishing attack aimed at its employees Despite the bank's swift identification and containment of the attack, the incident led to temporary service outages and data access issues, underscoring the need for improved resilience The response team compiled a detailed review of the attack, offering valuable insights into the techniques and entry points used and identifying areas for enhancing their preparedness.
Shortly after the attack, the bank strengthened its defense by implementing a continuous review process to ensure its incident management procedures and systems remain effective and appropriate While monitoring the incident management process, a trend became apparent. The mean time between similar incidents decreased after a few occurrences; however, Moneda Vivo strategically ignored the trend and continued with regular operations This decision was rooted in a deep confidence in its existing security measures and incident management protocols, which had proven effective in quick detection and resolution of issues Moneda Vivo's commitment to transparency and continual improvement is exemplified by its utilization of a comprehensive dashboard. This tool provides real time insights into the progress of its information security incident management, helping control operational activities and ensure that processes stay within the targets of productivity, quality, and efficiency. However, securing its digital banking platform proved challenging.
Following a recent upgrade, which included a user interface change to its digital banking platform and a software update, Moneda Vivo recognized the need to immediately review its incident management process for accuracy and completeness. The top management postponed the review due to financial and time constraints.
Based on scenario 8, Moneda Vivo has recently upgraded its digital banking platform. In line with the continual improvement process, Moneda Vivo has decided to review the information security incident management process for accuracy immediately after the software update. Is this recommended?
- A. No, the incident management process should be evaluated after a significant technological overhaul to ensure the system is up-to-date
- B. No, the incident management process should be reviewed when the bank's annual audit is conducted
- C. Yes, the incident management process should be reviewed after any minor software update
Answer: A
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
According to ISO/IEC 27035-1:2016, Clause 7.1 and ISO/IEC 27035-2:2016, Clause 7.3.3, it is advised to review and revise the information security incident management process following major organizational or technical changes. These changes include upgrades, system overhauls, and structural IT shifts. While minor updates may not necessitate a full review, significant technological updates, such as those affecting core digital banking platforms, should trigger immediate evaluation to ensure continued relevance and effectiveness of incident response strategies.
In the scenario, Moneda Vivo recognized the need for a review but delayed it, which could pose risks. Option C accurately reflects ISO guidance.
Reference:
ISO/IEC 27035-1:2016 Clause 7.1: "Reviews should be performed after major changes or after information security incidents." ISO/IEC 27035-2:2016 Clause 7.3.3 Correct answer: C
-
NEW QUESTION # 64
Scenario 5: Located in Istanbul. Turkey. Alura Hospital is a leading medical institution specializing in advanced eye surgery and vision care. Renowned for its modern facilities, cutting edge technology, and highly skilled staff, Alura Hospital is committed to delivering exceptional patient care. Additionally, Alura Hospital has implemented the ISO/IEC 27035 standards to enhance its information security incident management practices.
At Alura Hospital, the information security incident management plan is a critical component of safeguarding patient data and maintaining the integrity of its medical services This comprehensive plan includes instructions for handling vulnerabilities discovered during incident management According to this plan, when new vulnerabilities are discovered, Mehmet is appointed as the incident handler and is authorized to patch the vulnerabilities without assessing their potential impact on the current incident, prioritizing patient data security above all else Recognizing the importance of a structured approach to incident management. Alura Hospital has established four teams dedicated to various aspects of incident response The planning team focuses on implementing security processes and communicating with external organizations The monitoring team is responsible for security patches, upgrades, and security policy implementation The analysis team adjusts risk priorities and manages vulnerability reports, while the test and evaluation team organizes and performs incident response tests to ensure preparedness During an incident management training session, staff members at Alura Hospital were provided with clear roles and responsibilities. However, a technician expressed uncertainty about their role during a data integrity incident as the manager assigned them a role unrelated to their expertise. This decision was made to ensure that all staff members possess versatile skills and are prepared to handle various scenarios effectively.
Additionally. Alura Hospital realized it needed to communicate better with stakeholders during security incidents. The hospital discovered it was not adequately informing stakeholders and that relevant information must be provided using formats, language, and media that meet their needs. This would enable them to participate fully in the incident response process and stay informed about potential risks and mitigation strategies.
Also, the hospital has experienced frequent network performance issues affecting critical hospital systems and increased sophisticated cyber attacks designed to bypass traditional security measures. So, it has deployed an external firewall. This action is intended to strengthen the hospital s network security by helping detect threats that have already breached the perimeter defenses. The firewall's implementation is a part of the hospital's broader strategy to maintain a robust and secure IT infrastructure, which is crucial for protecting sensitive patient data and ensuring the reliability of critical hospital systems. Alura Hospital remains committed to integrating state-of-the-art technology solutions to uphold the highest patient care and data security standards.
Based on scenario 5, the responsibilities of which team in Alura Hospital were NOT defined correctly?
- A. The monitoring team
- B. The planning team
- C. The analysis team
Answer: B
Explanation:
Comprehensive and Detailed Explanation:
ISO/IEC 27035-2:2016 clearly outlines functional responsibilities for various roles in the incident management structure. The issue in the scenario lies in the description of the planning team.
The planning team, per ISO guidance, should focus on policy development, incident readiness planning, role assignments, and maintaining readiness through simulations and updates-not on communicating with external parties (which typically falls under the remit of the communications or coordination function within the incident response team).
Monitoring and analysis team responsibilities-such as applying patches, managing risk priorities, and analyzing vulnerabilities-are accurately described.
Reference:
ISO/IEC 27035-2:2016, Clause 5.2.3 - "The planning function should be responsible for developing and maintaining the plan, identifying resource needs, and ensuring team training." Correct answer: A
-
NEW QUESTION # 65
What is the first step in planning the response to information security incidents?
- A. Developing processes that support the response to information security incidents
- B. Defining the response classification
- C. Assigning the response class based on incident information
Answer: B
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
In ISO/IEC 27035-2:2016, the planning phase of incident response starts with establishing a classification system. Response classification is essential to ensure that incidents are assessed and categorized in a consistent manner, allowing appropriate response measures to be applied. This classification forms the foundation for selecting the right procedures, team involvement, and communication protocols.
Assigning a response class (Option A) is a subsequent step that occurs once an incident is analyzed and matched to a pre-defined category. Developing response processes (Option B) is important but comes after the classification model is defined.
Reference Extracts:
ISO/IEC 27035-2:2016, Clause 6.3.2: "The response planning process begins with the classification of potential incidents to determine the required actions and responsibilities." Clause 7.2.2: "Defining response classes helps the organization decide how to handle specific categories of incidents." Correct answer: C
-
NEW QUESTION # 66
Scenario 1: RoLawyers is a prominent legal firm based in Guadalajara, Mexico. It specializes in a wide range of legal services tailored to meet the diverse needs of its clients. Committed to excellence and integrity, RoLawyers has a reputation for providing legal representation and consultancy to individuals, businesses, and organizations across various sectors.
Recognizing the critical importance of information security in today's digital landscape, RoLawyers has embarked on a journey to enhance its information security measures. This company is implementing an information security incident management system aligned with ISO/IEC 27035-1 and ISO/IEC 27035-2 guidelines. This initiative aims to strengthen RoLawyers' protections against possible cyber threats by implementing a structured incident response process to provide guidance on establishing and maintaining a competent incident response team.
After transitioning its database from physical to online infrastructure to facilitate seamless information sharing among its branches, RoLawyers encountered a significant security incident. A malicious attack targeted the online database, overloading it with traffic and causing a system crash, making it impossible for employees to access it for several hours.
In response to this critical incident, RoLawyers quickly implemented new measures to mitigate the risk of future occurrences. These measures included the deployment of a robust intrusion detection system (IDS) designed to proactively identify and alert the IT security team of potential intrusions or suspicious activities across the network infrastructure. This approach empowers RoLawyers to respond quickly to security threats, minimizing the impact on their operations and ensuring the continuity of its legal services.
By being proactive about information security and incident management, RoLawyers shows its dedication to protecting sensitive data, keeping client information confidential, and earning the trust of its stakeholders.
Using the latest practices and technologies, RoLawyers stays ahead in legal innovation and is ready to handle cybersecurity threats with resilience and careful attention.
According to scenario 1, RoLawyers incorporated a structured incident management process to provide guidance on establishing and maintaining a competent incident response team. Is this acceptable?
- A. No, because the implementation of a structured approach helps the RoLawyers to ensure consistency in incident handling across the organization, rather than focusing only on guidance for establishing and maintaining a competent incident response team
- B. No, because the structured incident management process should primarily focus on preventive measures rather than response capabilities
- C. Because the implementation of a structured incident management process helps the company effectively address the need for skilled incident response
Answer: C
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
ISO/IEC 27035-1:2016 and ISO/IEC 27035-2:2016 provide comprehensive guidance on managing information security incidents through a structured incident management process. These documents emphasize the importance of establishing, maintaining, and continually improving an incident response capability, which includes forming a competent incident response team.
The structured incident management process is designed to ensure that organizations can respond effectively and efficiently to incidents, minimizing damage and impact. Specifically, ISO/IEC 27035-2 addresses the practical aspects of incident response, including the formation of an incident response team, their roles, responsibilities, and the need for appropriate skills and training.
The standard explicitly states that a competent incident response team is critical to the incident management lifecycle, which involves preparation, detection and reporting, assessment and decision, responses, and lessons learned. The establishment and maintenance of such a team ensure that the organization is capable of managing incidents with professionalism and consistency.
Furthermore, the structured process helps organizations not only to react to incidents but also to improve resilience through continual learning and process refinement. Preventive measures are part of a broader information security management system (ISMS), but incident management focuses primarily on effective response and recovery, supported by trained personnel.
In the scenario, RoLawyers' approach aligns fully with the ISO/IEC 27035 guidelines. By implementing a structured incident management process and forming a competent incident response team, the firm enhances its ability to deal with threats proactively and respond to incidents efficiently.
Reference Extracts from ISO/IEC 27035-1:2016 and ISO/IEC 27035-2:2016:
* ISO/IEC 27035-1, Section 4.2 (Incident Management Process): "An effective incident management process requires the establishment and maintenance of an incident response capability including a competent incident response team."
* ISO/IEC 27035-2, Section 5.2 (Incident Response Team): "The incident response team should have clearly defined roles and responsibilities and possess the necessary skills and training to manage information security incidents."
* ISO/IEC 27035-2, Introduction: "Incident management activities primarily focus on preparing, detecting, responding, and learning from incidents, rather than solely on prevention." Thus, the correct interpretation confirms that option A is the appropriate answer: implementing a structured incident management process with a competent incident response team is acceptable and strongly recommended.
NEW QUESTION # 67
Scenario 3: L&K Associates is a graphic design firm headquartered in Johannesburg, South Africa. It specializes in providing innovative and creative design solutions to clients across various industries. With offices in multiple parts of the country, they effectively serve clients, delivering design solutions that meet their unique needs and preferences.
In its commitment to maintaining information security, L&K Associates is implementing an information security incident management process guided by ISO/IEC 27035-1 and ISO/IEC 27035-2. Leona, the designated leader overseeing the implementation of the incident management process, customized the scope of incident management to align with the organization's unique requirements. This involved specifying the IT systems, services, and personnel involved in the incident management process while excluding potential incident sources beyond those directly related to IT systems and services.
In scenario 3, which of the following risk identification approaches was used by L&K Associates?
- A. Event-based approach
- B. Asset-based approach
- C. Both A and B
Answer: C
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
L&K Associates employed two distinct approaches as described in ISO/IEC 27005:2018 and referenced in ISO/IEC 27035-2:
Strategic scenario identification, which involves analyzing sources of risk and their impact on stakeholders and objectives. This is aligned with the event-based approach, which focuses on risk sources and events that may lead to incidents.
Operational scenario identification, which involves a thorough assessment of assets, threats, and vulnerabilities - aligning with the asset-based approach, where the focus is on critical assets and the threats that may exploit their weaknesses.
ISO/IEC 27005:2018, Clause 8.2.2, identifies multiple methods for risk identification, including:
Asset-based approach
Event-based (or threat-based) approach
Vulnerability-centered approach
In this scenario, both the asset- and event-based methods were clearly applied by Leona, which is encouraged in ISO risk management practices to provide a holistic view of risk.
Therefore, the correct answer is C: Both A and B.
NEW QUESTION # 68
According to ISO/IEC 27035-2, how should an organization plan the development of the incident response team capabilities?
- A. By discontinuing any capabilities that have not been used recently
- B. By focusing only on internal capabilities
- C. By considering how often certain capabilities were needed in the past
Answer: C
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
ISO/IEC 27035-2:2016 recommends that organizations should assess the necessary capabilities of the Incident Response Team (IRT) based on risk exposure and the frequency of past incidents requiring specific skills or tools. This ensures a balanced and realistic approach to resource allocation while preparing for probable future events.
Section 7.2.1 of ISO/IEC 27035-2 outlines that capability planning should consider:
Lessons learned from prior incidents
Incident history and trends
Anticipated threat landscape
Option A is incorrect because relying solely on internal capabilities may leave organizations vulnerable when specialized expertise is required. Option C contradicts ISO guidance because a lack of recent use does not mean a capability is no longer critical; it may still be required during high-impact, low-frequency incidents.
Reference:
ISO/IEC 27035-2:2016, Clause 7.2.1: "Incident response capabilities should be planned and developed based on the history of incidents, business requirements, and likely future needs." Correct answer: B
-
NEW QUESTION # 69
Which method is used to examine a group of hosts or a network known for vulnerable services?
- A. Automated vulnerability scanning tool
- B. Security testing and evaluation
- C. Penetration testing
Answer: A
Explanation:
Comprehensive and Detailed Explanation:
An automated vulnerability scanning tool is designed specifically to scan systems, hosts, or networks for known vulnerabilities based on a maintained vulnerability database. These tools are efficient for covering large environments quickly and are commonly used in routine security assessments.
Security testing and evaluation (A) is broader and includes manual assessments. Penetration testing (C) simulates real-world attacks but is usually more targeted and time-intensive.
Reference:
ISO/IEC 27002:2022, Control A.5.27: "Automated vulnerability scanning should be used to identify technical vulnerabilities." Correct answer: B
-
NEW QUESTION # 70
......
Prepare Top PECB ISO-IEC-27035-Lead-Incident-Manager Exam Audio Study Guide Practice Questions Edition: https://www.prep4sureguide.com/ISO-IEC-27035-Lead-Incident-Manager-prep4sure-exam-guide.html
Dumps Practice Exam Questions Study Guide for the ISO-IEC-27035-Lead-Incident-Manager Exam: https://drive.google.com/open?id=1huHUeJdHt15e1GnqmNEbCKOdjb6mg9_5