Pass ISO-IEC-27001-Lead-Auditor Exam with Updated ISO-IEC-27001-Lead-Auditor Exam Dumps PDF 2024
ISO-IEC-27001-Lead-Auditor Exam Dumps - Free Demo & 365 Day Updates
NEW QUESTION # 15
You are a certification body auditor, conducting a surveillance audit to ISO/IEC 27001:2022 of a data centre operated by a client who provides hosting services for ICT facilities.
You and your guide are currently in one of the private suites that the client rents out to customers. Access to each suite is controlled using a combination lock. CCTV is also installed in every suite.
Within each suite are three data cabinets in which the client can locate mission-critical servers and other items of networking equipment such as switches and routers.
You notice that whilst two of the cabinets in your suite are locked, the third is unlocked. You ask the guide why. They reply "This is because the client is currently swapping out a hard drive unit. Their technician is currently on a lunch break".
What three actions should you undertake next?
- A. With the permission of the guide, speak to the customer to confirm that they are in the process of swapping out a drive.
- B. Raise a nonconformity against control 7.2 'physical entry' as the area where the client's equipment is located is not protected.
- C. Raise a nonconformity against control 7.4 'physical security monitoring' as the private suite is not being continuously monitored for unauthorised physical access.
- D. Do nothing, the room appears adequately protected so it is unlikely that a security incident has taken place.
- E. When the technician returns from lunch, reprimand them for leaving the cabinet open.
- F. Raise a nonconformity against control 5.16 'identity management' as it may not be possible to identify who left the cabinet unlocked.
- G. Raise an opportunity for improvement suggesting cabinet doors are locked whenever clients leave their suites, even if they intend to return within a short time.
- H. Review the CCTV records to ensure that only the client has accessed the cabinet since it was last confirmed as locked.
Answer: A,G,H
Explanation:
Leaving the cabinet unlocked while the technician is on a lunch break exposes the client's equipment and data to potential physical security risks, such as theft, damage, or tampering. This is a violation of the ISO/IEC
27001:2022 requirements for physical entry (control 7.2) and physical security monitoring (control 7.4), which aim to prevent unauthorized access to information processing facilities and assets. Therefore, the appropriate actions for the auditor are:
* Raise an opportunity for improvement (OFI) suggesting that the cabinet doors are locked whenever clients leave their suites, even if they intend to return within a short time. This would enhance the security of the client's equipment and data, and reduce the likelihood of security incidents.
* Review the CCTV records to ensure that only the client has accessed the cabinet since it was last confirmed as locked. This would verify the integrity and availability of the client's equipment and data, and identify any possible unauthorized access or interference.
* With the permission of the guide, speak to the customer to confirm that they are in the process of swapping out a drive. This would validate the reason for leaving the cabinet unlocked, and assess the impact and risk of the activity on the client's information security.
References: =
* ISO/IEC 27001:2022, clause 7.2, Physical entry
* ISO/IEC 27001:2022, clause 7.4, Physical security monitoring
* PECB Candidate Handbook ISO 27001 Lead Auditor, page 19, Audit Process
* PECB Candidate Handbook ISO 27001 Lead Auditor, page 21, Audit Findings
NEW QUESTION # 16
You are the lead auditor of the courier company SpeeDelivery. You have carried out a risk analysis and now want to determine your risk strategy. You decide to take measures for the large risks but not for the small risks.
What is this risk strategy called?
- A. Risk bearing
- B. Risk neutral
- C. Risk avoidance
- D. Risk skipping
Answer: A
Explanation:
The risk strategy that involves taking measures for the large risks but not for the small risks is called risk bearing. Risk bearing is a strategy that accepts the existence of risks and their potential consequences without implementing any specific controls to reduce them. Risk bearing is usually applied to risks that have low likelihood and low impact, or when the cost of controls outweighs the benefits. Risk bearing implies that the organization has enough resources and resilience to cope with the risks if they materialize. ISO/IEC 27001:2022 defines risk acceptance as "decision to accept risk" (see clause 3.4). Reference: [CQI & IRCA Certified ISO/IEC 27001:2022 Lead Auditor Training Course], ISO/IEC 27001:2022 Information technology - Security techniques - Information security management systems - Requirements, [What is Risk Bearing?]
NEW QUESTION # 17
The following are the guidelines to protect your password, except:
- A. For easy recall, use the same password for company and personal accounts
- B. Do not share passwords with anyone
- C. Change a temporary password on first log-on
- D. Don't use the same password for various company system security access
Answer: A,B
Explanation:
Explanation
The following are guidelines to protect your password, except for easy recall use the same password for company and personal accounts; do not share passwords with anyone. Using the same password for company and personal accounts is not a guideline to protect your password, as it increases the risk of compromising your password if one of your accounts is hacked or breached. You should use different and unique passwords for each account, and change them regularly. Sharing passwords with anyone is not a guideline to protect your password, as it reduces the security and accountability of your password. You should keep your password confidential and never disclose it to anyone, even if they claim to be authorized or trustworthy. Don't use the same password for various company system security access is a guideline to protect your password, as it prevents unauthorized access or misuse of your password if one of the systems is compromised or breached.
You should use different and complex passwords for each system, and follow the password policies and standards of the organization. Change a temporary password on first log-on is a guideline to protect your password, as it prevents unauthorized access or misuse of your password if the temporary password is intercepted or leaked. You should change the temporary password to a personal and secure password as soon as possible, and avoid using default or predictable passwords. References: : CQI & IRCA ISO 27001:2022 Lead Auditor Course Handbook, page 43. : [ISO/IEC 27001 LEAD AUDITOR - PECB], page 15.
NEW QUESTION # 18
You are an experienced ISMS audit team leader. During the conducting of a third-party surveillance audit, you decide to test your auditee's knowledge of ISO/IEC 27001's risk management requirements.
You ask her a series of questions to which the answer is either 'that is true' or 'that is false'. Which four of the following should she answer 'that is true'?
- A. The initial phase in an organisation's risk management process should be information security risk assessment
- B. The organisation must produce a risk treatment plan for every business risk identified
- C. Risk identification is used to determine the severity of an information security risk
- D. Risk assessments should be undertaken following significant changes
- E. The organisation must operate a risk treatment process to eliminate it's information security risks
- F. ISO/IEC 27001 provides an outline approach for the management of risk
- G. Risks assessments should be undertaken at monthly intervals
- H. The results of risk assessments must be maintained
Answer: B,D,F,H
Explanation:
Explanation
The following four statements are true according to ISO/IEC 27001's risk management requirements: 12
* The results of risk assessments must be maintained. This is true because clause 8.2.3 of ISO/IEC
27001:2022 requires the organisation to retain documented information of the information security risk assessment process and the results12
* ISO/IEC 27001 provides an outline approach for the management of risk. This is true because clause
6.1.2 of ISO/IEC 27001:2022 specifies the general steps for the information security risk management process, which include establishing the risk criteria, assessing the risks, treating the risks, and monitoring and reviewing the risks12
* The organisation must produce a risk treatment plan for every business risk identified. This is true because clause 6.1.3 of ISO/IEC 27001:2022 requires the organisation to produce a risk treatment plan that defines the actions to be taken to address the unacceptable risks, the responsibilities, the expected dates, and the resources required12
* Risk assessments should be undertaken following significant changes. This is true because clause 8.2.4 of ISO/IEC 27001:2022 requires the organisation to review and update the risk assessment at planned intervals or when significant changes occur12 The following four statements are false according to ISO/IEC 27001's risk management requirements:
* Risk identification is used to determine the severity of an information security risk. This is false because risk identification is used to identify the assets, threats, vulnerabilities, and existing controls that are relevant to the information security risk management process. The severity of an information security risk is determined by the risk analysis, which evaluates the likelihood and impact of the risk scenarios12
* The organisation must operate a risk treatment process to eliminate its information security risks. This is false because the organisation can choose from four options to treat its information security risks: avoid, transfer, mitigate, or accept. The organisation does not have to eliminate all its information security risks, but only those that are unacceptable according to its risk criteria12
* The initial phase in an organisation's risk management process should be information security risk assessment. This is false because the initial phase in an organisation's risk management process should be establishing the risk management framework, which includes defining the risk management policy, objectives, scope, roles, responsibilities, and criteria. The information security risk assessment is the second phase in the risk management process12
* Risks assessments should be undertaken at monthly intervals. This is false because there is no fixed frequency for conducting risk assessments in ISO/IEC 27001. The organisation should determine the appropriate intervals for reviewing and updating the risk assessment based on its risk appetite, risk profile, and operational context12 References:
1: ISO/IEC 27001:2022 Lead Auditor (Information Security Management Systems) Course by CQI and IRCA Certified Training 1 2: ISO/IEC 27001 Lead Auditor Training Course by PECB 2
NEW QUESTION # 19
A well-executed risk analysis provides a great deal of useful information. A risk analysis has four main objectives.
What is not one of the four main objectives of a risk analysis?
- A. Determining relevant vulnerabilities and threats
- B. Establishing a balance between the costs of an incident and the costs of a security measure
- C. Implementing counter measures
- D. Identifying assets and their value
Answer: C
NEW QUESTION # 20
You are an experienced ISMS audit team leader who is currently conducting a third party initial certification audit of a new client, using ISO/IEC 27001:2022 as your criteria.
It is the afternoon of the second day of a 2-day audit, and you are just about to start writing your audit report.
So far no nonconformities have been identified and you and your team have been impressed with both the site and the organisation's ISMS.
At this point, a member of your team approaches you and tells you that she has been unable to complete her assessment of leadership and commitment as she has spent too long reviewing the planning of changes.
Which one of the following actions will you take in response to this information?
- A. Given there have been no nonconformities identified and the overall impression of the organisation has been a good one, record a positive recommendation for certification in the audit report.
- B. Review the audit plan and client availabilities to determine whether there is any opportunity for another member of your team to pick up this task before the closing meeting.
- C. Contact the individual managing the audit programme and seek their permission to record a positive recommendation in the audit report.
- D. Suggest to the client that if they are prepared to upgrade your return flight to first class you will audit leadership and commitment in your own time tomorrow.
- E. Advise the auditee and audit client that it is not possible to make a positive recommendation at this point.
- F. Contact your head office and await their further instructions of how to proceed.
- G. Advise the auditee that the certification audit will need to be terminated and rescheduled.
- H. Apologise to the client and tell them you will return at a later date to review leadership and commitment.
Answer: E
Explanation:
Leadership and commitment is a key requirement of ISO/IEC 27001:2022, as it establishes the top management's role and responsibility in establishing, implementing, maintaining, and continually improving the ISMS. Without assessing this aspect, the audit team cannot conclude that the ISMS is effective and conforms to the standard. Therefore, the audit team leader should advise the auditee and audit client that it is not possible to make a positive recommendation at this point, and explain the reason and the implications. The audit team leader should also consult with the certification body and the audit programme manager on the next steps, such as extending the audit duration, conducting a follow-up audit, or issuing a conditional certification, depending on the certification body's policy and the audit client's agreement. References: = ISO/IEC 27001:2022, clause 5, Leadership PECB Candidate Handbook ISO 27001 Lead Auditor, page 19, Audit Process PECB Candidate Handbook ISO 27001 Lead Auditor, page 22, Audit Report PECB Candidate Handbook ISO 27001 Lead Auditor, page 23, Audit Conclusion and Recommendation
NEW QUESTION # 21
You ask the IT Manager why the organisation still uses the mobile app while personal data encryption and pseudonymisation tests failed. Also, whether the Service Manager is authorised to approve the test.
The IT Manager explains the test results should be approved by him according to the software security management procedure. The reason why the encryption and pseudonymisation functions failed is that these functions heavily slowed down the system and service performance. An extra 150% of resources are needed to cover this. The Service Manager agreed that access control is good enough and acceptable. That's why the Service Manager signed the approval.
You are preparing the audit findings. Select the correct option.
- A. There is a nonconformity (NC). The organisation and developer perform security tests that fail.
(Relevant to clause 8.1, control A.8.29) - B. There is NO nonconformity (NC). The Service Manager makes a good decision to continue the service.
(Relevant to clause 8.1, control A.8.30) - C. There is a nonconformity (NC). The organisation and developer do not perform acceptance tests.
(Relevant to clause 8.1, control A.8.29) - D. There is a nonconformity (NC). The Service Manager does not comply with the software security management procedure. (Relevant to clause 8.1, control A.8.30)
Answer: D
Explanation:
According to ISO 27001:2022 Annex A Control 8.30, the organisation shall ensure that externally provided processes, products or services that are relevant to the information security management system are controlled. This includes developing and entering into licensing agreements that cover code ownership and intellectual property rights, and implementing appropriate contractual requirements related to secure design and coding in accordance with Annex A 8.25 and 8.2912 In this case, the organisation and the developer have performed security tests that failed, which indicates that the secure design and coding requirements of Annex A 8.29 were not met. The IT Manager explains that the encryption and pseudonymisation functions failed because they slowed down the system and service performance, and that an extra 150% of resources are needed to cover this. However, this does not justify the acceptance of the test results by the Service Manager, who is not authorised to approve the test according to the software security management procedure. The Service Manager should have consulted with the IT Manager, who is the owner of the process, and followed the procedure for handling nonconformities and corrective actions. The Service Manager's decision to continue the service based on access control alone exposes the organisation to the risk of compromising the confidentiality, integrity, and availability of personal data processed by the mobile app. Therefore, there is a nonconformity (NC) with clause 8.1, control A.8.30.
References:
1: ISO/IEC 27001:2022 Lead Auditor (Information Security Management Systems) Course by CQI and IRCA Certified Training 1 2: ISO/IEC 27001 Lead Auditor Training Course by PECB 2
NEW QUESTION # 22
You are an experienced ISMS audit team leader guiding an auditor in training. She asks you about the grading of nonconformities in audit reports. You decide to test her knowledge by asking her which four of the following statements are true.
- A. The action taken to address major nonconformities is typically more substantial than the action taken to address minor nonconformities
- B. Major nonconformities may be subject to on-site follow up
- C. The grading of nonconformities must be explained to the auditee at the opening meeting
- D. The auditee is always responsible for determining the criteria for grading nonconformities
- E. Nonconformities must be graded only using the terms 'major' or 'minor'
- F. Very minor nonconformities should be re-graded as opportunities for improvement
- G. Several minor nonconformities can be grouped into a major nonconformity
- H. Nonconformities may be graded to indicate their significance
Answer: A,B,G,H
Explanation:
Explanation
The four statements that are true are:
*Major nonconformities may be subject to on-site follow up
*The action taken to address major nonconformities is typically more substantial than the action taken to address minor nonconformities
*Several minor nonconformities can be grouped into a major nonconformity
*Nonconformities may be graded to indicate their significance
According to ISO 19011:2018, a nonconformity is the non-fulfilment of a requirement1. Nonconformities may be graded to indicate their significance, based on the criteria established by the audit programme or the audit client2. The grading of nonconformities may use different terms or levels, such as major, minor, critical, etc., depending on the nature and context of the audit3. However, some common definitions of major and minor nonconformities are:
*A major nonconformity is a nonconformity that affects the ability of the management system to achieve its intended results, or that represents a significant breakdown of the management system4. Major nonconformities may require immediate corrective action and on-site follow up by the auditor to verify their closure5.
*A minor nonconformity is a nonconformity that does not affect the ability of the management system to achieve its intended results, or that represents an isolated lapse of the management system4. Minor nonconformities may require corrective action within a specified time frame and off-site verification by the auditor to confirm their closure5.
The action taken to address nonconformities depends on the severity and impact of the nonconformity, and the risk of recurrence or escalation. Typically, the action taken to address major nonconformities is more substantial than the action taken to address minor nonconformities, as it may involve identifying and eliminating the root cause of the problem, implementing preventive measures, and monitoring the effectiveness of the solution.
Several minor nonconformities can be grouped into a major nonconformity if they are related to the same requirement, process, or area, and if they indicate a systemic failure or a significant risk to the management system. The auditor should use professional judgment and evidence-based approach to decide whether to group or report nonconformities individually.
The other statements are false, based on the guidance of ISO 19011:2018. For example:
*Option B is false, because nonconformities can be graded using different terms or levels, depending on the criteria established by the audit programme or the audit client2. The terms 'major' and 'minor' are not mandatory or universal, but rather examples of possible grading levels3.
*Option D is false, because very minor nonconformities should not be re-graded as opportunities for improvement, but rather reported as nonconformities, as they still represent a non-fulfilment of a requirement1. An opportunity for improvement is a suggestion for enhancing the performance or effectiveness of the management system, but it is not a nonconformity or a requirement.
*Option F is false, because the grading of nonconformities does not have to be explained to the auditee at the opening meeting, but rather at the closing meeting, where the audit findings and conclusions are presented and discussed. The opening meeting is intended to provide an overview of the audit objectives, scope, criteria, and methods, and to confirm the audit arrangements and logistics.
*Option G is false, because the auditee is not always responsible for determining the criteria for grading nonconformities, but rather the audit programme or the audit client, in consultation with the auditee and other relevant parties2. The auditee is responsible for taking corrective action to address the nonconformities, and for providing evidence of their completion and effectiveness.
References: 1: ISO 19011:2018, 3.13; 2: ISO 19011:2018, 6.6.2; 3: ISO 19011:2018, 6.6.3; 4: ISO Audit Findings :Non-conformance - AUVA Certification1; 5: Annex III: Nonconformity grading - FSSC2; : ISO
27001 Certification - Major vs. Minor Nonconformities - Advisera3; : GUIDANCE FOR ADDRESSING AND CLEARING NONCONFORMITIES - SADCAS4; : ISO 19011:2018, 6.2; : ISO 19011:2018, 3.14; :
ISO 19011:2018, 6.7; : ISO 19011:2018, 6.4; : ISO 19011:2018, 6.7.2; : ISO 19011:2018; : ISO 19011:2018; :
ISO 19011:2018; : ISO 19011:2018; : ISO 19011:2018; : [ISO 19011:2018]; : [ISO 19011:2018]; : [ISO
19011:2018]; : [ISO 19011:2018]; : [ISO 19011:2018]; : [ISO 19011:2018]; : [ISO 19011:2018]
NEW QUESTION # 23
Select the word that best completes the sentence:
Answer:
Explanation:
Explanation:
The word that best completes the sentence is "demonstrate". According to ISO/IEC 27001:2022, Clause 7.5, the organization shall retain documented information as evidence of the performance of the processes and the conformity of the products and services with the requirements1. The purpose of retaining documented information is to demonstrate conformity with the requirements of the management system standard, not to maintain, audit, or certify it. References: 1: ISO/IEC 27001:2022, Information technology - Security techniques - Information security management systems - Requirements, Clause 7.5
NEW QUESTION # 24
Select the words that best complete the sentence below to describe audit resources:
Answer:
Explanation:
Explanation
According to ISO 19011:2018, clause 5.3, the person responsible for managing the audit programme should determine the resources necessary for the audit programme, such as the audit team members, the budget, the time, the tools, etc. The audit resources should be sufficient and appropriate to ensure the quality and effectiveness of the audit programme and the audit results. The audit resources include the following elements12:
Essential resources: These are the resources that are required to conduct the audit programme and the individual audits, such as the audit documents, the audit methods, the audit tools, the audit schedule, the audit budget, etc. The essential resources should be identified and allocated based on the audit objectives, scope, and criteria, and the availability and cooperation of the auditee. The essential resources should also be reviewed and updated as necessary to reflect any changes or deviations in the audit programme or the individual audits.
Competent personnel: These are the audit team members who have the appropriate knowledge, skills, and experience to conduct the audit effectively and efficiently, and to provide credible and reliable audit results and recommendations. The competent personnel should include the audit team leader, the auditors, and any technical experts or observers who support the audit team. The competent personnel should be selected and appointed based on the audit objectives, scope, and criteria, and the specific competence requirements for the audit programme and the individual audits. The competent personnel should also be independent and impartial, and avoid any conflicts of interest or self-interest that may affect the audit results or the audit decisions.
References:
ISO 19011:2018 - Guidelines for auditing management systems, clause 5.3 PECB Candidate Handbook ISO 27001 Lead Auditor, page 19
NEW QUESTION # 25
The following options are key actions involved in a first-party audit. Order the stages to show the sequence in which the actions should take place.
Answer:
Explanation:
NEW QUESTION # 26 
Answer:
Explanation:
Explanation
An audit finding is the result of the evaluation of the collected audit evidence against audit criteria.
NEW QUESTION # 27
Auditor competence is a combination of knowledge and skills. Which two of the following activities are predominately related to "knowledge"?
- A. Understanding how to identify findings
- B. Determining how to seek evidence from the auditee
- C. Designing a checklist
- D. Communicate with the auditee
- E. Follow an audit trail deviating from the prepared checklist
- F. Determining what evidence to gather
Answer: C,F
Explanation:
Knowledge is the understanding of facts, concepts, principles, theories and practices related to a specific subject or discipline. Skills are the ability to apply knowledge and use know-how to complete tasks and solve problems. According to ISO 19011:2018, the knowledge and skills of an auditor include the following:
* Knowledge of audit principles, procedures and methods
* Knowledge of management system standards and reference documents
* Knowledge of the organization's context, scope, processes and objectives
* Knowledge of relevant legal, regulatory and contractual requirements
* Knowledge of applicable industry, sector or technical disciplines
* Knowledge of risk management and risk-based thinking
* Skill in collecting and verifying information
* Skill in evaluating conformity and effectiveness of management systems
* Skill in reporting and communicating audit results
* Skill in managing audit activities and teams
Based on this, the activities that are predominately related to knowledge are designing a checklist and determining what evidence to gather, as they require the auditor to understand the audit criteria, scope, objectives and methods, as well as the organization's context, processes and risks. The other activities are more related to skills, as they involve applying knowledge and using know-how to perform tasks and solve problems during the audit.
References:
* ISO 19011:2018, Guidelines for auditing management systems, clauses 7.2.1, 7.2.2 and 7.2.3
* PECB Candidate Handbook - ISO 27001 Lead Auditor, pages 9-10 and 16-17
* ISO 9001 Auditing Practices Group Guidance on: Auditing Competence, pages 2-3 and 8
NEW QUESTION # 28
Which two of the following options are an advantage of using a sampling plan for the audit?
- A. Overrules the auditor's instincts
- B. Use of the plan for consecutive audits
- C. Reduces the audit duration
- D. Implements the audit plan efficiently
- E. Gives confidence in the audit results
- F. Prevents conflict within the audit team
Answer: C,E
Explanation:
A sampling plan for the audit is a method of selecting a representative subset of the audit evidence to evaluate the conformity of the ISMS1. The advantages of using a sampling plan are:
* It reduces the audit duration by focusing on the most relevant and significant aspects of the ISMS2.
* It gives confidence in the audit results by ensuring that the sample is sufficient, reliable, and unbiased3.
References: 1: ISMS Auditing Guideline - ISO27000, page 9; 2: Internal Audit Plan - ISO Templates and Documents Download; 3: A Step-by-Step Guide to Conducting an ISO 27001 Internal Audit, Step 4; : ISMS Auditing Guideline - ISO27000; : Internal Audit Plan - ISO Templates and Documents Download; : A Step-by-Step Guide to Conducting an ISO 27001 Internal Audit
NEW QUESTION # 29 
Answer:
Explanation:
Explanation
An audit finding is the result of the evaluation of the collected audit evidence against audit criteria.
NEW QUESTION # 30
A well-executed risk analysis provides a great deal of useful information. A risk analysis has four main objectives.
What is not one of the four main objectives of a risk analysis?
- A. Determining relevant vulnerabilities and threats
- B. Establishing a balance between the costs of an incident and the costs of a security measure
- C. Implementing counter measures
- D. Identifying assets and their value
Answer: C
Explanation:
Implementing countermeasures is not one of the four main objectives of a risk analysis. A risk analysis is a systematic process that involves identifying, assessing, and evaluating potential risks to understand their likelihood and impact. Its objective is to develop strategies to manage or mitigate those risks effectively. The four main objectives of a risk analysis are:
Identifying assets and their value: This involves determining what are the information assets that need to be protected and how valuable they are for the organization.
Determining relevant vulnerabilities and threats: This involves identifying what are the weaknesses or flaws in the information assets or systems that could be exploited by malicious actors or events and what are the sources or causes of those potential attacks or incidents.
Establishing a balance between the costs of an incident and the costs of a security measure: This involves estimating what are the potential consequences or impacts of a risk occurrence in terms of financial, operational, reputational, or legal losses and comparing them with what are the costs or benefits of implementing a security measure to prevent or reduce that risk.
Providing a basis for risk treatment decisions: This involves prioritizing the risks based on their likelihood and impact and selecting the most appropriate risk treatment options such as avoiding, transferring, reducing, or accepting the risk.
Implementing countermeasures is not an objective but an outcome of a risk analysis. Countermeasures are specific actions or controls that are designed to prevent or mitigate a risk occurrence or impact. Countermeasures are selected based on the results of a risk analysis and aligned with the organization's risk appetite and objectives. Therefore, the correct answer is B. Reference: [ISO/IEC 27005:2018], clauses 6-9; Risk Analysis - What Is It, Benefits, Example, Methods - WallStreetMojo.
NEW QUESTION # 31
......
ISO-IEC-27001-Lead-Auditor Dumps - Pass Your Certification Exam: https://freecert.test4sure.com/ISO-IEC-27001-Lead-Auditor-exam-materials.html