ISO-IEC-27001-LEAD-AUDITOR practice question 31 of 35

You are carrying out your first third-party ISMS surveillance audit as an Audit Team Leader. You are presently in the auditee's data centre with…

You are carrying out your first third-party ISMS surveillance audit as an Audit Team Leader. You are presently in the auditee's data centre with another member of your audit team. Your colleague seems unsure as to the difference between an information security event and an information security incident. You attempt to explain the difference by providing examples. Which three of the following scenarios can be defined as information security incidents?

Answer options

A: The organisation's malware protection software prevents a virus

B: A hard drive is used after its recommended replacement date

C: The organisation receives a phishing email

D: An employee fails to clear their desk at the end of their shift

E: A contractor who has not been paid deletes top management ICT accounts Correct answer

F: An unhappy employee changes payroll records without permission Correct answer

G: The organisation fails a third-party penetration test

H: The organisation's marketing data is copied by hackers and sold to a competitor Correct answer

Correct Answer:

E. A contractor who has not been paid deletes top management ICT accounts; F. An unhappy employee changes payroll records without permission; H. The organisation's marketing data is copied by hackers and sold to a competitor

Explanation

These three scenarios represent actual security incidents where unauthorized actions resulted in real compromise or harm. Option E involves malicious deletion of critical accounts causing business disruption. Option F represents unauthorized data modification compromising integrity. Option H is a data breach where confidential information was stolen and sold, directly impacting the organization's competitive position and security.

Why Incorrect

A. Control worked successfully; no compromise occurred.
B. Risk condition, not an actual security event.
C. Potential threat received but no compromise resulted.
D. Policy violation without actual security compromise.
G. Controlled testing revealing vulnerabilities, not malicious activity.

References

- ISO/IEC 27000:2018

Section 3.31 and 3.32 (Definitions of information security event and incident)

- ISO/IEC 27001:2013

Annex A.16.1 (Management of information security incidents and improvements)

- ISO/IEC 27035-1:2016

Section 5.2 (Information security incident management principles)

- NIST SP 800-61 Rev. 2

Section 2.1 (Computer Security Incident Handling Guide - Incident definitions)

- ISO/IEC 27002:2013

Section 16.1.1 (Responsibilities and procedures for incident management)

Keep practicing

Take the free ISO-IEC-27001-LEAD-AUDITOR practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test