Lead_Auditor: PECB.Lead_Auditor.ExamTopics.2026-01-09.31q.vcex

You are an experienced audit team leader conducting a third-party surveillance audit of an organization that designs websites for its clients. You are currently reviewing the organization’s Statement of Applicability.

Based on the requirements of ISO/IEC 27001, which two of the following observations about the Statement of Applicability are true? (Choose two.)

The Statement of Applicability must be reviewed at Management Review
The Statement of Applicability must be reviewed at least annualy
Justification is only required for any controls that the organization chooses to exclude
The Statement of Applicability is owned and amended by the organization’s top management
A Statement of Applicability must be produced by organizations seeking ISO/IEC 27001 conformity
Justification for both the inclusion and exclusion of Annex A controls in the Statement of Applicability is required

Correct answer: A, E

You are an experienced ISMS audit team leader. You are providing an introduction to ISO/IEC 27001:2022 to a class of Quality Management System Auditors who are seeking to retrain to enable them to carry out information security management system audits.

You ask them which of the following characteristics of information does an information security management system seek to preserve?

Which three answers should they provide? (Choose three.)

Importance
Completeness
Accessibility
Integrity
Availability
Confidentiality
Efficiency
Clarity

Correct answer: B, D, F

Scenario: Clinic, founded in the 1990s, is a medical device company that specializes in treatments for heart-related conditions and complex surgical interventions. Based in Europe, it serves both patients and healthcare professionals. Clinic collects patient data to tailor treatments, monitor outcomes, and improve device functionality. To enhance data security and build trust, Clinic is implementing an information security management system (ISMS) based on ISO/IEC 27001. This initiative demonstrates Clinic's commitment to securely managing sensitive patient information and its proprietary technologies.

Clinic established the scope of its ISMS by solely considering internal issues, interfaces and dependencies between activities conducted internally and those outsourced to other organizations, and the expectations of interested parties. This scope was carefully documented and made accessible. In defining its ISMS, Clinic chose to focus specifically on key processes within critical departments such as Research and Development, Patient Data Management, and Customer Support.

Despite initial challenges. Clinic remained committed to its ISMS implementation, tailoring security controls to its unique needs. The project team excluded certain Annex A controls from ISO/IEC 27001, incorporating additional sector-specific controls to enhance security. The project team meticulously evaluated the applicability of these controls against internal and external factors, culminating in developing a comprehensive Statement of Applicability (SoA) detailing the rationale behind control selection and implementation.

As preparations for certification progressed, Brian, appointed as the team leader for the project team, adopted a self-directed risk assessment methodology to identify and evaluate the company, strategic issues, and security practices. This proactive approach ensured that Clinic's risk assessment aligned with its objectives and missions.

Based on scenario, the Clinic decided that the ISMS would cover only key processes and departments. Is this acceptable?

Yes, but the decision to exclude other processes and departments must be justified
Yes, organizations may limit the scope of the ISMS, but they cannot request a certification audit if the ISMS scope does not include all processes and departments
No, Clinic must include all processes and departments in the scope, regardless of their importance or relevance to the ISMS

Correct answer: A

Scenario: Northstorm is an online retail shop offering unique vintage and modern accessories. It initially entered a small market but gradually grew thanks to the development of the overall e-commerce landscape. Northstorm works exclusively on line and ensures efficient payment processing, inventory management, marketing tools, and shipment orders. It uses prioritized ordering to receive, restock, and ship its most popular products.

Northstorm has traditionally managed its IT operations by hosting its website and maintaining full control over its infrastructure, including hardware, software, and data administration. However, this approach hindered its growth due to the lack of responsive infrastructure. Seeking to enhance its e-commerce and payment systems, Northstorm opted to expand its in-house data centers, completing the expansion in two phases over three months. Initially, the company upgraded its core servers, point-of-sale, ordering, billing, database, and backup systems. The second phase involved improving mail, payment, and network functionalities. Additionally, during this phase, Northstorm adopted an international standard for personal identifiable information (PII) controllers and PII processors regarding PII processing to ensure its data handling practices were secure and compliant with global regulations.

Despite the expansion, Northstorm's upgraded data centers failed to meet its evolving business demands. This inadequacy led to several new challenges, including issues with order prioritization. Customers reported not receiving priority orders, and the company struggled with responsiveness. This was largely due to the main server's inability to process orders from YouDecide, an application designed to prioritize orders and simulate customer interactions. The application, reliant on advanced algorithms, was incompatible with the new operating system (OS) installed during the upgrade.

Faced with urgent compatibility issues, Northstorm quickly patched the application without proper validation, leading to the installation of a compromised version. This security lapse resulted in the main server being affected and the company's website going offline for a week. Recognizing the need for a more reliable solution, the company decided to outsource its website hosting to an e-commerce provider. The company signed a confidentiality agreement concerning product ownership and conducted a thorough review of user access rights to enhance security before transitioning.

According to scenario, Northstorm reviewed users' access rights. What is the type and function of this security control?

Detective and administrative
Corrective and managerial
Legal and technical

Correct answer: A

You are an experienced ISMS audit team leader guiding an auditor in training. You are testing her understanding of follow-up audits by asking her a series of questions to which the answer is either 'true' or 'false'.

Which two of the following questions should the answer be 'true'? (Choose two.)

A follow-up audit is required in all instances where nonconformities have been identified
A follow-up audit is required only in instances where a major nonconformity has been identified
A follow-up audit may be carried out where nonconformities are major
The outcome of a follow-up audit could change an original major nonconformity into a minor nonconformity
The outcomes of a follow-up audit should be reported to the audit team leader who carried out the original audit
The outcomes of a follow-up audit should be reported to the individual managing the audit programme and the audit client

Correct answer: C, D

You are performing an ISMS audit at a residential nursing home called ABC that provides healthcare services. The next step in your audit plan is to verity the information security of ABC's healthcare mobile app development, support, and lifecycle process. During the audit, you learned the organization outsourced the mobile app development to a professional software development organization with CMMI Level 5, ITSM (ISO/IEC 20000-1), BCMS (ISO 22301) and ISMS (ISO/IEC 27001) certified.

The IT Manager presents the software security management procedure and summarises the process as follows:

The mobile app development shall adopt "security-by-design" and "security-by-default" principles, as a minimum. The following security functions for personal data protection shall be available:

Access control.

Personal data encryption, i.e., Advanced Encryption Standard (AES) algorithm, key lengths: 256 bits; and

Personal data pseudonymization.

Vulnerability checked and no security backdoor

You sample the latest Mobile App Test report - Reference ID: 0098, details as follows:

You would like to investigate other areas further to collect more audit evidence. Select three options that will not be in your audit trail. (Choose three.)

Collect more evidence by downloading and testing the mobile app on your phone. (Relevant to control A.8.1)
Collect more evidence to determine the number of users of ABC's healthcare mobile app. (Relevant to clause 4.2)
Collect more evidence on how much residents' family members pay to install ABC's healthcare mobile app. (Relevant to clause 4.2)
Collect more evidence on how the developer trains its product support personnel. (Relevant to clause 7.2)
Collect more evidence on how the organization manages information security in the selection of an external service provider. (Relevant to control A.5.19)
Collect more evidence on how the organization performs testing of personal data handling. (Relevant to control A.5.34)
Collect more evidence on the organization's business continuity policy. (Relevant to control A.5.30)
Collect more evidence to verify the developer's CMMI Level 5, ITSM (ISO/IEC 20000-1), BCMS (ISO 22301) and ISMS (ISO/IEC 27001) certification. (Relevant to control A.5.21)

Correct answer: A, C, G

The data center at which you work is currently seeking ISO/IEC 27001:2022 certification. In preparation for your initial certification visit, several internal audits have been carried out by a colleague working at another data center within your Group. They secured their own ISO/IEC 27001:2022 certificate earlier in the year.

You have just qualified as an Internal ISMS auditor and your manager has asked you to review the audit process and audit findings as a final check before the external Certification Body arrives.

Which four of the following would cause you concern in respect of conformity to ISO/IEC 27001:2022 requirements? (Choose four.)

Although the scope for each internal audit has been defined, there are no audit criteria defined for the audits carried out to date.
Audit reports are not held in hardcopy (i.e. on paper). They are only stored as *.PDF documents on the organization's intranet.
The audit process states the results of audits will be made available to 'relevant' managers, not top management.
The audit programme does not reference audit methods or audit responsibilities.
The audit programme does not take into account the relative importance of information security processes.
The audit programme does not take into account the results of previous audits.
The audit programme has not been signed as 'approved' by Top Management.
The audit programme shows management reviews taking place at irregular intervals during the year.

Correct answer: A, D, E, F

Select two of the following options that are the responsibility of a legal technical expert on the audit team during a certification audit. (Choose two.)

Advising on legal checkpoints for the audit team
Criticizing the organization's legal compliance issues
Debating complex legal points with the auditee
Evaluating the auditee's legal knowledge
Meeting the organization's legal representative
Verifying the legal status of the organization

Correct answer: A, F

Auditor competence is a combination of knowledge and skills. Which two of the following activities are predominately related to "knowledge"? (Choose two.)

Communicate with the auditee
Designing a checklist
Determining how to seek evidence from the auditee
Determining what evidence to gather
Follow an audit trail deviating from the prepared checklist
Understanding how to identify findings

Correct answer: B, D

The purpose of a management system is to?

Dictate the performance of an organization.
Improve the performance of an organization.
Manage the performance of an organization.
Monitor the performance of an organization.

Correct answer: C

Scenario: Techmanic is a Belgian company founded in 1995 and currently operating in Brussels. It provides IT consultancy, software design, and hardware/software services, including deployment and maintenance. The company serves sectors like public services, finance, telecom, energy, healthcare, and education. As a customer-centered company, it prioritizes strong client relationships and leading security practices.

Techmanic has been ISO/IEC 27001 certified for a year and regards this certification with pride. During the certification audit, the auditor found some inconsistencies in its ISMS implementation. Since the observed situations did not affect the capability of its ISMS to achieve the intended results, Techmanic was certified after auditors followed up on the root cause analysis and corrective actions remotely. During that year, the company added hosting to its list of services and requested to expand its certification scope to include that area. The auditor in charge approved the request and notified Techmanic that the extension audit would be conducted during the surveillance audit.

Techmanic underwent a surveillance audit to verify its ISMS's continued effectiveness and compliance with ISO/IEC 27001. The surveillance audit aimed to ensure that Techmanic's security practices, including the recent addition of hosting services, aligned seamlessly with the rigorous requirements of the certification.

The auditor strategically utilized the findings from previous surveillance audit reports in the recertification activity with the purpose of replacing the need for additional recertification audits, specifically in the IT consultancy sector. Recognizing the value of continual improvement and learning from past assessments, Techmanic implemented a practice of reviewing previous surveillance audit reports. This proactive approach not only facilitated identifying and resolving potential nonconformities but also aimed to streamline the recertification process in the IT consultancy sector.

During the surveillance audit, several nonconformities were found. The ISMS continued to fulfill the ISO/IEC 27001's requirements, but Techmanic failed to resolve the nonconformities related to the hosting services, as reported by its internal auditor. In addition, the internal audit report had several inconsistencies, which questioned the independence of the internal auditor during the audit of hosting services. Based on this, the extension certification was not granted. As a result, Techmanic requested a transfer to another certification body. In the meantime, the company released a statement to its clients stating that the ISO/IEC 27001 certification covers the IT services, as well as the hosting services.

What action should be taken regarding Techmanic's certification? Refer to scenario.

Suspend the certification because they used the certification out of its scope
Withdraw the certification because they failed to resolve nonconformities related to the hosting services
Transfer the certification because they were not granted the extension certification

Correct answer: B

Vendor:	PECB
Exam Code:	Lead_Auditor
Exam Name:	Lead Auditor
Date:	Jan 09, 2026
File Size:	252 KB
Downloads:	3

Download Lead Auditor.Lead_Auditor.ExamTopics.2026-01-09.31q.vcex

How to open VCEX files?

Demo Questions

Question 1

Question 2

Question 3

Question 4

Question 5

Question 6

Question 7

Question 8

Question 9

Question 10

Question 11

ProfExam at a 20% markdown