ISO-IEC-27001-LEAD-IMPLEMENTER practice question 6 of 35

Scenario 2: Beauty is a cosmetics company that has recently switched to an e-commerce model, leaving the traditional retail. The top management has…

Domain Implementing an ISMS based on ISO/IEC 27001

Scenario 2: Beauty is a cosmetics company that has recently switched to an e-commerce model, leaving the traditional retail. The top management has decided to build their own custom platform in-house and outsource the payment process to an external provider operating online payments systems that support online money transfers. Due to this transformation of the business model, a number of security controls were implemented based on the identified threats and vulnerabilities associated to critical assets. To protect customers' information. Beauty's employees had to sign a confidentiality agreement. In addition, the company reviewed all user access rights so that only authorized personnel can have access to sensitive files and drafted a new segregation of duties chart. However, the transition was difficult for the IT team, who had to deal with a security incident not long after transitioning to the e commerce model. After investigating the incident, the team concluded that due to the out-of-date anti-malware software, an attacker gamed access to their files and exposed customers' information, including their names and home addresses. The IT team decided to stop using the old anti-malware software and install a new one which would automatically remove malicious code in case of similar incidents. The new software was installed in every workstation within the company. After installing the new software, the team updated it with the latest malware definitions and enabled the automatic update feature to keep it up to date at all times. Additionally, they established an authentication process that requires a user identification and password when accessing sensitive information. In addition, Beauty conducted a number of information security awareness sessions for the IT team and other employees that have access to confidential information in order to raise awareness on the importance of system and network security. According to scenario 2. Beauty has reviewed all user access rights. What type of control is this?

Answer options

A: Detective and administrative Correct answer

B: Corrective and managerial

C: Legal and technical

Correct Answer:

A. Detective and administrative

Explanation

Reviewing user access rights is a classic example of an administrative control because it is a formal, documented process or procedure mandated by management policy. It relies on people to execute the review according to established rules. Simultaneously, it functions as a detective control. The primary purpose of the review is to detect or identify inappropriate, excessive, or outdated access permissions that could lead to a security violation. By examining existing rights against the principle of least privilege and current job roles, the organization can find and flag discrepancies. Therefore, it is both administrative in nature and detective in function.

Why Incorrect

B. Corrective and managerial: This is incorrect because the review itself does not fix a security incident that has already occurred; it is not a corrective action.
C. Legal and technical: This is incorrect because the review process is procedural and human-driven (administrative), not an automated system function (technical) or a legal mandate itself.

References

1. PECB. (2022). ISO/IEC 27001 Lead Implementer Training Course Material. In the module "Selection of controls," control types are defined. Administrative controls are described as policies, procedures, and standards. Detective controls are defined as measures that detect security events. An access rights review is a procedure (administrative) used to detect inappropriate access (detective).

2. ISO/IEC 27002:2022, Information security, cybersecurity and privacy protection — Information security controls. Control 5.18, "Review of user access rights," specifies that "access rights of users should be reviewed at regular intervals." The implementation guidance involves establishing a formal review process (an administrative control) to identify and remove inappropriate access (a detective function).

3. Calder, A., & Watkins, S. G. (2019). IT Governance: An International Guide to Data Security and ISO 27001/ISO 27002 (7th ed.). Kogan Page. Chapter 13, "Choosing Controls," categorizes controls by function and implementation type. It classifies procedural controls like regular reviews as administrative and controls that identify policy violations, such as access right reviews, as detective. (See section on "Types of control").

Keep practicing

Take the free ISO-IEC-27001-LEAD-IMPLEMENTER practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test