ISO-IEC-27001-LEAD-IMPLEMENTER practice question 11 of 35

Scenario 1: NobleFind is an online retailer specializing in high-end, custom-design furniture. The company offers a wide range of handcrafted pieces…

Full set: 290 questions

Domain Implementing an ISMS based on ISO/IEC 27001

Scenario 1: NobleFind is an online retailer specializing in high-end, custom-design furniture. The company offers a wide range of handcrafted pieces tailored to meet the needs of residential and commercial clients. NobleFind also provides expert design consultation services. Despite NobleFind's efforts to keep its online shop platform secure, the company faced persistent issues, including a recent data breach. These ongoing challenges disrupted normal operations and underscored the need for enhanced security measures. The designated IT team quickly responded to resolve the problem. To address these issues, NobleFind decided to implement an Information Security Management System (ISMS) based on ISO/IEC 27001 to improve security, protect customer data, and ensure the stability of its services. In addition to its commitment to information security, NobleFind focuses on maintaining the accuracy and completeness of its product dat a. This is ensured by carefully managing version control, checking information regularly, enforcing strict access policies, and implementing backup procedures. Moreover, product details and customer designs are accessible only to authorized individuals, with security measures such as multi-factor authentication and data access policies. NobleFind has implemented an incident investigation process within its ISMS, as part of its comprehensive approach to information security. Additionally, it has established record retention policies to ensure that online information about each product and client information remains readily accessible and usable on demand for authorized entities. NobleFind established an information security policy offering clear guidelines for safeguarding historical data. It also insisted that personnel sign confidentiality agreements and were committed to recruiting only qualified individuals. Additionally, NobleFind implemented measures for monitoring the resources used by its systems, reviewing user access rights, and conducting a thorough analysis of audit logs to swiftly identify and address any security anomalies. With its ISMS in place, NobleFind maintains and safeguards documented information, encompassing a wide range of data, records, and specifications. This documented information is vital to its operations, ensuring the security and integrity of customer data, historical records, and financial information. According to scenario 1, which detective control did NobleFind implement?
Answer options
A: Enforcing strict access policies
B: Conducting a thorough analysis of audit logs Correct answer
C: Implementing an incident investigation process
D: Implementing backup procedures
Correct Answer:
B. Conducting a thorough analysis of audit logs
Explanation

Detective controls are designed to find and identify security incidents or anomalies after they have occurred. According to the scenario, NobleFind implemented measures for "conducting a thorough analysis of audit logs to swiftly identify and address any security anomalies." This action directly aligns with the purpose of a detective control, which is to monitor systems and analyze data (like logs) to detect potential security breaches or policy violations that have already happened or are in progress.

Why Incorrect

A. Enforcing strict access policies is a preventive control, as its primary function is to stop unauthorized access from occurring in the first place.
C. Implementing an incident investigation process is a corrective control, as it is initiated after an incident has been detected to respond, recover, and learn from it.
D. Implementing backup procedures is a corrective control, as its purpose is to restore data and services to a normal state following a data loss incident.

References

1. ISO/IEC 27002:2022, Information security, cybersecurity and privacy protection — Information security controls, Control 8.16 Monitoring activities. The purpose of this control is "to detect anomalous behaviour and, if appropriate, respond to information security events." The guidance explicitly mentions the collection and analysis of logs from systems as a key part of this detective activity.

2. PECB. (2022). ISO/IEC 27001 Lead Implementor Training Course Material. In the module covering the selection and implementation of controls (typically Day 3), security controls are categorized by their function. Log analysis and monitoring are consistently classified as detective controls, intended to identify incidents, whereas access control is preventive, and incident response and backups are corrective.

3. Calder, A., & Watkins, S. G. (2019). IT Governance: An International Guide to Data Security and ISO 27001/ISO 27002 (7th ed.). Kogan Page Publishers. Chapter 13, "Information security controls," discusses the classification of controls. It explains that detective controls (e.g., intrusion detection, audit trails) are used to discover incidents, while preventive controls (e.g., access control) aim to stop them, and corrective controls (e.g., backups, incident response) are used to fix them.

Keep practicing

Take the free ISO-IEC-27001-LEAD-IMPLEMENTER practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test

More questions

Other ISO-IEC-27001-LEAD-IMPLEMENTER practice questions

Scroll to Top