ISO-IEC-27001-LEAD-IMPLEMENTER practice question 1 of 35

Scenario 2: Beauty is a well-established cosmetics company in the beauty industry. The company was founded several decades ago with a passion for…

Full set: 290 questions

Domain Implementing an ISMS based on ISO/IEC 27001

Scenario 2: Beauty is a well-established cosmetics company in the beauty industry. The company was founded several decades ago with a passion for creating high-quality skincare, makeup, and personal care products that enhance natural beauty. Over the years, Beauty has built a strong reputation for its innovative product offerings, commitment to customer satisfaction, and dedication to ethical and sustainable business practices. In response to the rapidly evolving landscape of consumer shopping habits, Beauty transitioned from traditional retail to an e-commerce model. To initiate this strategy, Beauty conducted a comprehensive information security risk assessment, analyzing potential threats and vulnerabilities associated with its new e-commerce venture, aligned with its business strategy and objectives. Concerning the identified risks, the company implemented several information security controls. All employees were required to sign confidentiality agreements to emphasize the importance of protecting sensitive customer dat a. The company thoroughly reviewed user access rights, ensuring only authorized personnel could access sensitive information. In addition, since the company stores valuable products and unique formulas in the warehouse, it installed alarm systems and surveillance cameras with real-time alerts to prevent any potential act of vandalism. After a while, the information security team analyzed the audit logs to monitor and track activities across the newly implemented security controls. Upon investigating and analyzing the audit logs, it was discovered that an attacker had accessed the system due to out-of-date anti-malware software, exposing customers' sensitive information, including names and home addresses. Following this, the IT team replaced the anti-malware software with a new one capable of automatically removing malicious code in case of similar incidents. The new software was installed on all workstations and regularly updated with the latest malware definitions, with an automatic update feature enabled. An authentication process requiring user identification and a password was also implemented to access sensitive information. During the investigation, Maya, the information security manager of Beauty, found that information security responsibilities in job descriptions were not clearly defined, for which the company took immediate action. Recognizing that their e-commerce operations would have a global reach, Beauty diligently researched and complied with the industry's legal, statutory, regulatory, and contractual requirements. It considered international and local regulations, including data privacy laws, consumer protection acts, and global trade agreements. To meet these requirements, Beauty invested in legal counsel and compliance experts who continuously monitored and ensured the company's compliance with legal standards in every market they operated in. Additionally, Beauty conducted multiple information security awareness sessions for the IT team and other employees with access to confidential information, emphasizing the importance of system and network security. Under which category does the vulnerability identified by Maya during the incident fall into?
Answer options
A: Network
B: Site
C: Organization Correct answer
Correct Answer:
C. Organization
Explanation

The vulnerability identified by Maya is that "information security responsibilities in job descriptions were not clearly defined." This is a weakness related to the company's governance, structure, policies, and procedures. In the context of ISO/IEC 27001, vulnerabilities are not limited to technical flaws but also include procedural and administrative weaknesses. A lack of clearly assigned roles and responsibilities is a classic example of an organizational vulnerability, as it originates from management and administrative processes rather than from technical or physical security controls.

Why Incorrect

A. Network: This is incorrect because the identified vulnerability concerns management and human resources processes, not a flaw in network infrastructure, protocols, or configurations.
B. Site: This is incorrect as the vulnerability is unrelated to the physical security of the company's location, such as building access or environmental controls.

References

1. ISO/IEC 27001:2022: Information security, cybersecurity and privacy protection — Information security management systems — Requirements.

Reference: Clause 5.3, "Organizational roles, responsibilities and authorities."

Justification: This clause requires top management to ensure that responsibilities and authorities for information security roles are assigned and communicated. A failure to clearly define these responsibilities, as identified by Maya, constitutes a weakness in the organizational structure mandated by the standard.

2. ISO/IEC 27005:2022: Information security, cybersecurity and privacy protection — Guidance on managing information security risks.

Reference: Section 8.3.3, "Vulnerability identification."

Justification: This standard guides the identification of vulnerabilities, which can be categorized in various ways. A common categorization includes technical, physical, and organizational vulnerabilities. A lack of defined responsibilities falls squarely within the organizational category, which covers weaknesses in processes, procedures, and management structures.

3. Humphreys, E. (2016). Implementing the ISO/IEC 27001:2013 ISMS Standard. Artech House.

Reference: Chapter 5, "Leadership," discussion on Clause 5.3.

Justification: This academic and practitioner text explains that failing to define and communicate security roles and responsibilities is a significant governance gap. Such gaps are treated as organizational vulnerabilities that can undermine the effectiveness of the entire Information Security Management System (ISMS).

Keep practicing

Take the free ISO-IEC-27001-LEAD-IMPLEMENTER practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test

More questions

Other ISO-IEC-27001-LEAD-IMPLEMENTER practice questions

Scroll to Top