2025 Latest PECB ISO-IEC-27035-Lead-Incident-Manager Real Exam Dumps PDF
ISO-IEC-27035-Lead-Incident-Manager Exam Dumps, ISO-IEC-27035-Lead-Incident-Manager Practice Test Questions
NEW QUESTION # 33
Scenario 8: Moneda Vivo, headquartered in Kuala Lumpur. Malaysia, is a distinguished name in the banking sector. It is renowned for its innovative approach to digital banking and unwavering commitment to information security. Moneda Vivo stands out by offering various banking services designed to meet the needs of its clients. Central to its operations is an information security incident management process that adheres to the recommendations of ISO/IEC 27035-1 and 27035-2.
Recently. Moneda Vivo experienced a phishing attack aimed at its employees Despite the bank's swift identification and containment of the attack, the incident led to temporary service outages and data access issues, underscoring the need for improved resilience The response team compiled a detailed review of the attack, offering valuable insights into the techniques and entry points used and identifying areas for enhancing their preparedness.
Shortly after the attack, the bank strengthened its defense by implementing a continuous review process to ensure its incident management procedures and systems remain effective and appropriate While monitoring the incident management process, a trend became apparent. The mean time between similar incidents decreased after a few occurrences; however, Moneda Vivo strategically ignored the trend and continued with regular operations This decision was rooted in a deep confidence in its existing security measures and incident management protocols, which had proven effective in quick detection and resolution of issues Moneda Vivo's commitment to transparency and continual improvement is exemplified by its utilization of a comprehensive dashboard. This tool provides real time insights into the progress of its information security incident management, helping control operational activities and ensure that processes stay within the targets of productivity, quality, and efficiency. However, securing its digital banking platform proved challenging.
Following a recent upgrade, which included a user interface change to its digital banking platform and a software update, Moneda Vivo recognized the need to immediately review its incident management process for accuracy and completeness. The top management postponed the review due to financial and time constraints.
Based on scenario 8, Moneda Vivo conducts continuous review of the incident management process to ensure the effectiveness of processes and procedures in place. Is this a good practice to follow?
- A. No, organizations should regularly assess the physical security measures to ensure they align with incident management protocols
- B. Yes, organizations should conduct continuous review of the incident management process to ensure the effectiveness of the processes and procedures in place
- C. No, organizations should conduct quarterly performance reviews of individual employees to ensure they follow incident management protocols
Answer: B
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
ISO/IEC 27035-1:2016 stresses the importance of continual review and improvement of the incident management process. Clause 7.1 specifically advises that organizations regularly evaluate their policies, procedures, and tools to ensure they remain effective in the face of evolving threats and business changes.
Moneda Vivo's continuous review aligns perfectly with this guidance, reinforcing preparedness and adaptability. Options A and C, while related to broader security or HR practices, are not directly aligned with ISO/IEC 27035's core recommendation regarding process review.
Reference:
ISO/IEC 27035-1:2016, Clause 7.1: "The organization should review the effectiveness of the information security incident management process regularly and in response to incidents and significant changes."
NEW QUESTION # 34
What is the primary objective of an awareness program?
- A. Introducing new security technology to the IT department
- B. Reinforcing or modifying behavior and attitudes toward security
- C. Enhancing the efficiency of the company's IT infrastructure
Answer: B
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
The core purpose of a security awareness program, as outlined in ISO/IEC 27035 and ISO/IEC 27001, is to influence behavior and attitudes toward security, making staff more conscious of threats and their responsibilities in preventing incidents. An effective awareness program helps reduce human errors, enhances response readiness, and builds a security-conscious culture.
ISO/IEC 27035-2:2016 clearly differentiates awareness from training. While training focuses on skills and procedures, awareness is about shaping the mindset, ensuring that employees understand the importance of security in their daily tasks.
Option A (technology introduction) and option C (IT efficiency) are not primary goals of awareness programs.
Reference Extracts:
ISO/IEC 27035-2:2016, Clause 7.3.1: "The objective of awareness activities is to change behavior and enhance understanding of security threats and how to prevent them." ISO/IEC 27001:2022, Control 6.3 and Annex A: "Personnel should be made aware of the importance of information security and their responsibilities in supporting it." Correct answer: B
-
NEW QUESTION # 35
Scenario 2: NoSpace, a forward-thinking e-commerce store based in London, is renowned for its diverse products and advanced technology. To enhance its information security, NoSpace implemented an ISMS according to ISO/IEC 27001 to better protect customer data and ensure business continuity. Additionally, the company adopted ISO/IEC 27035-1 and ISO/IEC 27035-2 guidelines. Mark, the incident manager at NoSpace, strategically led the entire implementation. He played a crucial role in aligning the company's ISMS with the requirements specified in ISO/IEC 27001, using ISO/IEC 27035-1 guidelines as the foundation.
During a routine internal audit, a minor anomaly was detected in the data traffic that could potentially indicate a security threat. Mark was immediately notified to assess the situation. Then, Mark and his team immediately escalated the incident to crisis management to handle the potential threat without further assessment. The decision was made to ensure a swift response.
After resolving the situation, Mark decided to update the incident management process. During the initial phase of incident management, Mark recognized the necessity of updating NoSpace's information security policies. This included revising policies related to risk management at the organizational level as well as for specific systems, services, or networks. The second phase of the updated incident management process included the assessment of the information associated with occurrences of information security events and the importance of classifying events and vulnerabilities as information security incidents. During this phase, he also introduced a "count down" process to expedite the evaluation and classification of occurrences, determining whether they should be recognized as information security incidents.
Mark developed a new incident management policy to enhance the organization's resilience and adaptability in handling information security incidents. Starting with a strategic review session with key stakeholders, the team prioritized critical focus areas over less impactful threats, choosing not to include all potential threats in the policy document. This decision was made to keep the policy streamlined and actionable, focusing on the most significant risks identified through a risk assessment. The policy was shaped by integrating feedback from various department heads to ensure it was realistic and enforceable. Training and awareness initiatives were tailored to focus only on critical response roles, optimizing resource allocation and focusing on essential capabilities.
Based on scenario 2, did Mark follow the guidelines of ISO/IEC 27035 series regarding the incident management phases in the updated incident management process?
- A. Yes, all phases of the incident management process were established according to the ISO/IEC 27035-1 guidelines
- B. No, the second phase of the incident management process should include the collection of information associated with the occurrences of information security events
- C. No, the decision on whether to classify events as information security incidents should be assessed before initiating the incident management process
Answer: B
Explanation:
-
Comprehensive and Detailed Explanation From Exact Extract:
ISO/IEC 27035-1:2016 outlines a structured five-phase approach to information security incident management, which includes:
1. Prepare
2. Identify (or detect and report)
3. Assess and Decide
4. Respond
5. Lessons Learned
According to the standard, the "Assess and Decide" phase must include the collection, review, and analysis of information associated with the occurrence of a potential incident. This phase ensures that the organization bases its classification decisions on factual data and contextual analysis, allowing the organization to determine whether the event should be categorized as a formal security incident.
In the scenario, Mark does introduce an accelerated "count down" process to evaluate and classify incidents, which is a commendable improvement in efficiency. However, there is no mention of gathering or documenting the actual event data prior to classification. This oversight fails to fully align with the standard.
Option A is incorrect because not all phases were implemented as defined-specifically, phase 3 ("Assess and Decide") lacks an essential component: the collection of evidence/information from the anomaly or event.
Option C is also incorrect. According to ISO/IEC 27035, assessment and classification take place within the formal incident management process-not before it. The initiation of the process includes the evaluation of whether a security event becomes an incident.
Reference Extracts:
* ISO/IEC 27035-1:2016, Clause 6.2.2: "The assessment and decision process involves analyzing the information associated with reported events to decide whether they should be treated as incidents."
* ISO/IEC 27035-2:2016, Clause 7.3: "This phase includes collecting information from available sources...
such as logs, reports, and alerts, to support classification and response decisions." Therefore, the correct answer is B: No, the second phase of the incident management process should include the collection of information associated with the occurrences of information security events.
NEW QUESTION # 36
Scenario 3: L&K Associates is a graphic design firm headquartered in Johannesburg, South Africa. It specializes in providing innovative and creative design solutions to clients across various industries. With offices in multiple parts of the country, they effectively serve clients, delivering design solutions that meet their unique needs and preferences.
In its commitment to maintaining information security, L&K Associates is implementing an information security incident management process guided by ISO/IEC 27035-1 and ISO/IEC 27035-2. Leona, the designated leader overseeing the implementation of the incident management process, customized the scope of incident management to align with the organization's unique requirements. This involved specifying the IT systems, services, and personnel involved in the incident management process while excluding potential incident sources beyond those directly related to IT systems and services.
In scenario 3, which of the following risk identification approaches was used by L&K Associates?
- A. Event-based approach
- B. Asset-based approach
- C. Both A and B
Answer: C
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
L&K Associates employed two distinct approaches as described in ISO/IEC 27005:2018 and referenced in ISO/IEC 27035-2:
Strategic scenario identification, which involves analyzing sources of risk and their impact on stakeholders and objectives. This is aligned with the event-based approach, which focuses on risk sources and events that may lead to incidents.
Operational scenario identification, which involves a thorough assessment of assets, threats, and vulnerabilities - aligning with the asset-based approach, where the focus is on critical assets and the threats that may exploit their weaknesses.
ISO/IEC 27005:2018, Clause 8.2.2, identifies multiple methods for risk identification, including:
Asset-based approach
Event-based (or threat-based) approach
Vulnerability-centered approach
In this scenario, both the asset- and event-based methods were clearly applied by Leona, which is encouraged in ISO risk management practices to provide a holistic view of risk.
Therefore, the correct answer is C: Both A and B.
NEW QUESTION # 37
How is the impact of an information security event assessed?
- A. By identifying the assets affected by the event
- B. By evaluating the effect on the confidentiality, integrity, and availability of information
- C. By determining if the event is an information security incident
Answer: B
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
The impact of an information security event is assessed by evaluating how the event affects the CIA triad- Confidentiality, Integrity, and Availability-of information assets. This fundamental concept underpins all ISO/IEC 27000-series standards, including ISO/IEC 27035.
ISO/IEC 27035-1:2016, Clause 6.2.3 explicitly states that an event's severity and urgency are to be assessed by evaluating its actual or potential impact on the organization's information security objectives, namely:
Confidentiality: Protection from unauthorized disclosure
Integrity: Protection from unauthorized modification
Availability: Assurance of timely and reliable access
This approach ensures consistent and risk-based decision-making during incident assessment. Options A and B are important steps, but they are part of the broader process; they do not directly measure impact.
Reference:
ISO/IEC 27035-1:2016, Clause 6.2.3: "The impact should be assessed based on the effect on confidentiality, integrity, and availability of the information assets affected." Correct answer: C
-
NEW QUESTION # 38
What determines the frequency of reviewing an organization's information security incident management strategy?
- A. The frequency of audits conducted by external agencies
- B. The nature, scale, and complexity of the organization
- C. The number of employees in the organization
Answer: B
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
ISO/IEC 27035-1:2016 Clause 7.1 explicitly states that the frequency and depth of reviewing the incident management strategy should be based on the organization's size, complexity, and threat environment. Larger or more complex environments may require more frequent reviews to remain agile and responsive.
Audit schedules (Option C) may influence timing, but they do not dictate the necessary frequency for strategic reviews. The number of employees (Option A) alone is not a sufficient factor.
Reference:
ISO/IEC 27035-1:2016 Clause 7.1: "The frequency and scope of reviews should be determined by the nature, scale, and complexity of the organization." Correct answer: B
-
NEW QUESTION # 39
What is the purpose of incident categorization within the incident management lifecycle?
- A. To determine the priority of incidents
- B. To automatically assign incidents to technicians
- C. To sort incidents based on the disrupted IT or business domain
Answer: C
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
According to ISO/IEC 27035-1:2016 and ISO/IEC 27035-2:2016, incident categorization is a vital step in the incident management lifecycle. Its primary purpose is to sort and group incidents based on specific criteria so that appropriate actions and escalation paths can be taken.
One of the core objectives of categorization is to sort incidents by the domain or system affected - whether it' s a database, email system, network, or physical server. This enables organizations to assign incidents to relevant subject matter experts and apply the right procedures, based on the affected business function or IT component.
While categorization can influence prioritization (option A), the main intent is classification based on nature and domain. Automatic technician assignment (option B) may be supported by some service management platforms but is not the foundational purpose of incident categorization under ISO 27035.
Reference Extracts:
ISO/IEC 27035-1:2016, Clause 6.1.2 - "Categorization should identify the domain or component affected to enable appropriate response and escalation." ISO/IEC 27035-2:2016, Clause 7.3 - "Incidents should be categorized based on the type of disruption they cause and the business or technical domain they impact." Therefore, the correct answer is C: To sort incidents based on the disrupted IT or business domain.
-
NEW QUESTION # 40
What is the primary function of a single type of IRT?
- A. Monitoring targets from remote locations
- B. Enhancing the reliability of incident response activities
- C. Managing incidents within a specified organization
Answer: C
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
A single-type Incident Response Team (IRT), as defined in ISO/IEC 27035-1:2016, is responsible for managing and coordinating incident response within a specific organization or business unit. Its scope typically covers the entire lifecycle of incident handling-preparation, detection, containment, response, recovery, and lessons learned-focused solely on the needs of that particular entity.
This contrasts with a coordinating or multi-party IRT, which may support multiple organizations or coordinate between units. While Option A is a byproduct of a well-functioning IRT, it is not its core function.
Option B (monitoring) may fall under a SOC, but not the primary function of a single IRT.
Reference Extracts:
ISO/IEC 27035-1:2016, Clause 6.5.1: "An organization may establish a single IRT responsible for handling all incidents affecting the organization." ISO/IEC 27035-2:2016, Clause 6.2.3: "Single IRTs typically manage incidents internally and directly support the organization's response processes." Correct answer: C
-
NEW QUESTION # 41
Scenario 1: RoLawyers is a prominent legal firm based in Guadalajara, Mexico. It specializes in a wide range of legal services tailored to meet the diverse needs of its clients. Committed to excellence and integrity, RoLawyers has a reputation for providing legal representation and consultancy to individuals, businesses, and organizations across various sectors.
Recognizing the critical importance of information security in today's digital landscape, RoLawyers has embarked on a journey to enhance its information security measures. This company is implementing an information security incident management system aligned with ISO/IEC 27035-1 and ISO/IEC 27035-2 guidelines. This initiative aims to strengthen RoLawyers' protections against possible cyber threats by implementing a structured incident response process to provide guidance on establishing and maintaining a competent incident response team.
After transitioning its database from physical to online infrastructure to facilitate seamless information sharing among its branches, RoLawyers encountered a significant security incident. A malicious attack targeted the online database, overloading it with traffic and causing a system crash, making it impossible for employees to access it for several hours.
In response to this critical incident, RoLawyers quickly implemented new measures to mitigate the risk of future occurrences. These measures included the deployment of a robust intrusion detection system (IDS) designed to proactively identify and alert the IT security team of potential intrusions or suspicious activities across the network infrastructure. This approach empowers RoLawyers to respond quickly to security threats, minimizing the impact on their operations and ensuring the continuity of its legal services.
By being proactive about information security and incident management, RoLawyers shows its dedication to protecting sensitive data, keeping client information confidential, and earning the trust of its stakeholders.
Using the latest practices and technologies, RoLawyers stays ahead in legal innovation and is ready to handle cybersecurity threats with resilience and careful attention.
Based on the scenario above, answer the following question:
Considering its industry and services, is the guidance provided in ISO/IEC 27035-1 applicable for RoLawyers?
- A. No, it is specific to organizations in the information security industry
- B. Yes, it applies to all organizations, regardless of their size, type, or nature
- C. No, it is specific to organizations providing incident management services
Answer: B
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
ISO/IEC 27035-1:2016 is titled "Information security incident management - Part 1: Principles of incident management". This standard provides a comprehensive framework for establishing, implementing, operating, monitoring, reviewing, maintaining, and improving incident management within an organization.
The scope of ISO/IEC 27035-1 is explicitly broad and designed to be applicable to all organizations, regardless of their size, type, or nature, as stated in the standard's introduction and scope sections. The principles laid out in the document are intended to be flexible and scalable so that organizations from any sector can adopt and implement incident management processes suitable to their specific context.
The document clearly emphasizes that information security incidents can impact any organization that processes, stores, or transmits information digitally - including law firms like RoLawyers. The guidance addresses the creation of an incident response capability to detect, respond, and recover from information security incidents effectively.
Furthermore, the standard stresses that incident management is a vital part of maintaining information security resilience, minimizing damage, and protecting the confidentiality, integrity, and availability of information assets, which is crucial for organizations handling sensitive data, such as legal firms.
Hence, ISO/IEC 27035-1 is not limited to IT or information security service providers alone; instead, it supports any organization's need to manage information security incidents systematically. RoLawyers, given its reliance on digital data and the critical nature of its information, can and should apply the standard's principles to safeguard its assets and clients.
Reference Extracts from ISO/IEC 27035-1:2016:
* Scope (Section 1): "The principles provided in this document are intended to be applicable to all organizations, irrespective of type, size or nature."
* Introduction (Section 0.1): "Effective incident management helps organizations to reduce the consequences of incidents and limit the damage caused to information and information systems."
* General (Section 4): "This document provides guidance for establishing, implementing, operating, monitoring, reviewing, maintaining and improving incident management processes within an organization." Thus, based on ISO/IEC 27035-1, the guidance is fully applicable to RoLawyers, aligning with their objective to improve information security and incident management practices.
NEW QUESTION # 42
Scenario 5: Located in Istanbul. Turkey. Alura Hospital is a leading medical institution specializing in advanced eye surgery and vision care. Renowned for its modern facilities, cutting edge technology, and highly skilled staff, Alura Hospital is committed to delivering exceptional patient care. Additionally, Alura Hospital has implemented the ISO/IEC 27035 standards to enhance its information security incident management practices.
At Alura Hospital, the information security incident management plan is a critical component of safeguarding patient data and maintaining the integrity of its medical services This comprehensive plan includes instructions for handling vulnerabilities discovered during incident management According to this plan, when new vulnerabilities are discovered, Mehmet is appointed as the incident handler and is authorized to patch the vulnerabilities without assessing their potential impact on the current incident, prioritizing patient data security above all else Recognizing the importance of a structured approach to incident management. Alura Hospital has established four teams dedicated to various aspects of incident response The planning team focuses on implementing security processes and communicating with external organizations The monitoring team is responsible for security patches, upgrades, and security policy implementation The analysis team adjusts risk priorities and manages vulnerability reports, while the test and evaluation team organizes and performs incident response tests to ensure preparedness During an incident management training session, staff members at Alura Hospital were provided with clear roles and responsibilities. However, a technician expressed uncertainty about their role during a data integrity incident as the manager assigned them a role unrelated to their expertise. This decision was made to ensure that all staff members possess versatile skills and are prepared to handle various scenarios effectively.
Additionally. Alura Hospital realized it needed to communicate better with stakeholders during security incidents. The hospital discovered it was not adequately informing stakeholders and that relevant information must be provided using formats, language, and media that meet their needs. This would enable them to participate fully in the incident response process and stay informed about potential risks and mitigation strategies.
Also, the hospital has experienced frequent network performance issues affecting critical hospital systems and increased sophisticated cyber attacks designed to bypass traditional security measures. So, it has deployed an external firewall. This action is intended to strengthen the hospital s network security by helping detect threats that have already breached the perimeter defenses. The firewall's implementation is a part of the hospital's broader strategy to maintain a robust and secure IT infrastructure, which is crucial for protecting sensitive patient data and ensuring the reliability of critical hospital systems. Alura Hospital remains committed to integrating state-of-the-art technology solutions to uphold the highest patient care and data security standards.
Based on scenario 5, the responsibilities of which team in Alura Hospital were NOT defined correctly?
- A. The analysis team
- B. The monitoring team
- C. The planning team
Answer: C
Explanation:
Comprehensive and Detailed Explanation:
ISO/IEC 27035-2:2016 clearly outlines functional responsibilities for various roles in the incident management structure. The issue in the scenario lies in the description of the planning team.
The planning team, per ISO guidance, should focus on policy development, incident readiness planning, role assignments, and maintaining readiness through simulations and updates-not on communicating with external parties (which typically falls under the remit of the communications or coordination function within the incident response team).
Monitoring and analysis team responsibilities-such as applying patches, managing risk priorities, and analyzing vulnerabilities-are accurately described.
Reference:
ISO/IEC 27035-2:2016, Clause 5.2.3 - "The planning function should be responsible for developing and maintaining the plan, identifying resource needs, and ensuring team training." Correct answer: A
-
NEW QUESTION # 43
According to ISO/IEC 27035-2, how should an organization plan the development of the incident response team capabilities?
- A. By focusing only on internal capabilities
- B. By discontinuing any capabilities that have not been used recently
- C. By considering how often certain capabilities were needed in the past
Answer: C
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
ISO/IEC 27035-2:2016 recommends that organizations should assess the necessary capabilities of the Incident Response Team (IRT) based on risk exposure and the frequency of past incidents requiring specific skills or tools. This ensures a balanced and realistic approach to resource allocation while preparing for probable future events.
Section 7.2.1 of ISO/IEC 27035-2 outlines that capability planning should consider:
Lessons learned from prior incidents
Incident history and trends
Anticipated threat landscape
Option A is incorrect because relying solely on internal capabilities may leave organizations vulnerable when specialized expertise is required. Option C contradicts ISO guidance because a lack of recent use does not mean a capability is no longer critical; it may still be required during high-impact, low-frequency incidents.
Reference:
ISO/IEC 27035-2:2016, Clause 7.2.1: "Incident response capabilities should be planned and developed based on the history of incidents, business requirements, and likely future needs." Correct answer: B
-
NEW QUESTION # 44
Which action is NOT involved in the process of improving controls in incident management?
- A. Implementing new or updated controls
- B. Updating the incident management policy
- C. Documenting risk assessment results
Answer: C
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
Improving controls in incident management is a proactive activity focused on directly adjusting and strengthening existing defenses. As per ISO/IEC 27035-2:2016, Clause 7.4, this process typically involves identifying deficiencies, updating or implementing new technical or procedural controls, and revising policies.
While risk assessments inform control decisions, simply documenting their results does not constitute direct improvement of controls. Hence, Option A is not part of the control improvement process itself.
Reference:
ISO/IEC 27035-2:2016 Clause 7.4: "Actions to improve controls include analyzing causes of incidents and updating procedures and policies accordingly." Correct answer: A
-
NEW QUESTION # 45
Scenario 8: Moneda Vivo, headquartered in Kuala Lumpur. Malaysia, is a distinguished name in the banking sector. It is renowned for its innovative approach to digital banking and unwavering commitment to information security. Moneda Vivo stands out by offering various banking services designed to meet the needs of its clients. Central to its operations is an information security incident management process that adheres to the recommendations of ISO/IEC 27035-1 and 27035-2.
Recently. Moneda Vivo experienced a phishing attack aimed at its employees Despite the bank's swift identification and containment of the attack, the incident led to temporary service outages and data access issues, underscoring the need for improved resilience The response team compiled a detailed review of the attack, offering valuable insights into the techniques and entry points used and identifying areas for enhancing their preparedness.
Shortly after the attack, the bank strengthened its defense by implementing a continuous review process to ensure its incident management procedures and systems remain effective and appropriate While monitoring the incident management process, a trend became apparent. The mean time between similar incidents decreased after a few occurrences; however, Moneda Vivo strategically ignored the trend and continued with regular operations This decision was rooted in a deep confidence in its existing security measures and incident management protocols, which had proven effective in quick detection and resolution of issues Moneda Vivo's commitment to transparency and continual improvement is exemplified by its utilization of a comprehensive dashboard. This tool provides real time insights into the progress of its information security incident management, helping control operational activities and ensure that processes stay within the targets of productivity, quality, and efficiency. However, securing its digital banking platform proved challenging.
Following a recent upgrade, which included a user interface change to its digital banking platform and a software update, Moneda Vivo recognized the need to immediately review its incident management process for accuracy and completeness. The top management postponed the review due to financial and time constraints.
Scenario 8: Moneda Vivo, headquartered in Kuala Lumpur, Malaysia, is a distinguished name in the banking sector. It recently experienced a phishing attack, prompting the response team to conduct a detailed review.
The incident underscored the need for resilience and continuous improvement.
What is the primary goal of the information Moneda Vivo's incident report team gathered from the incident?
- A. To showcase the effectiveness of existing security protocols to stakeholders
- B. To document the incident for legal compliance purposes
- C. To learn from the incident and improve future security measures
Answer: C
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
The core purpose of incident reporting, as outlined in ISO/IEC 27035-1:2016 (Clause 6.4.7), is to learn from the incident in order to improve future preparedness, resilience, and effectiveness. Lessons learned from an incident should feed into policy, process, and technical improvements. The scenario highlights how Moneda Vivo's team analyzed the phishing attack to understand entry points and weaknesses, directly aligning with this principle.
While legal compliance (Option B) and showcasing security (Option A) may be secondary benefits, the primary objective is always organizational learning and resilience enhancement.
Reference:
ISO/IEC 27035-1:2016, Clause 6.4.7: "The lessons learned phase involves identifying improvements to the information security incident management process and to other relevant processes and controls." Correct answer: C
-
NEW QUESTION # 46
Scenario 8: Moneda Vivo, headquartered in Kuala Lumpur. Malaysia, is a distinguished name in the banking sector. It is renowned for its innovative approach to digital banking and unwavering commitment to information security. Moneda Vivo stands out by offering various banking services designed to meet the needs of its clients. Central to its operations is an information security incident management process that adheres to the recommendations of ISO/IEC 27035-1 and 27035-2.
Recently. Moneda Vivo experienced a phishing attack aimed at its employees Despite the bank's swift identification and containment of the attack, the incident led to temporary service outages and data access issues, underscoring the need for improved resilience The response team compiled a detailed review of the attack, offering valuable insights into the techniques and entry points used and identifying areas for enhancing their preparedness.
Shortly after the attack, the bank strengthened its defense by implementing a continuous review process to ensure its incident management procedures and systems remain effective and appropriate While monitoring the incident management process, a trend became apparent. The mean time between similar incidents decreased after a few occurrences; however, Moneda Vivo strategically ignored the trend and continued with regular operations This decision was rooted in a deep confidence in its existing security measures and incident management protocols, which had proven effective in quick detection and resolution of issues Moneda Vivo's commitment to transparency and continual improvement is exemplified by its utilization of a comprehensive dashboard. This tool provides real time insights into the progress of its information security incident management, helping control operational activities and ensure that processes stay within the targets of productivity, quality, and efficiency. However, securing its digital banking platform proved challenging.
Following a recent upgrade, which included a user interface change to its digital banking platform and a software update, Moneda Vivo recognized the need to immediately review its incident management process for accuracy and completeness. The top management postponed the review due to financial and time constraints.
According to scenario 8, which reporting dashboard did Moneda Vivo use?
- A. Operational
- B. Strategic
- C. Tactical
Answer: A
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
The scenario mentions that Moneda Vivo uses a dashboard that offers "real-time insights into the progress of its information security incident management, helping control operational activities and ensure that processes stay within the targets of productivity, quality, and efficiency." These characteristics are aligned with an operational dashboard. According to ISO/IEC 27035-2 and related best practices, operational dashboards track day-to-day activities, monitor KPIs related to incident management, and help frontline teams manage incidents in real time.
Strategic dashboards (Option A) are used by executives for long-term decision-making, while tactical dashboards (Option C) are used for mid-term planning and departmental coordination.
Reference:
ISO/IEC 27035-2:2016, Clause 7.4.6: "Dashboards can support monitoring of incident management activities at operational and tactical levels." Correct answer: B
-
NEW QUESTION # 47
How should vulnerabilities lacking corresponding threats be handled?
- A. They should be disregarded as they pose no risk
- B. They may not require controls but should be analyzed and monitored for changes
- C. They still require controls and should be promptly addressed
Answer: B
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
According to ISO/IEC 27005:2018 (which supports ISO/IEC 27035 in risk management and threat assessment processes), vulnerabilities that are not currently associated with known threats do not necessarily need immediate remediation or technical control measures. However, they cannot be ignored entirely either.
Such vulnerabilities may not pose an active risk at the present time, but that can change quickly if a new threat emerges that can exploit them. Therefore, these vulnerabilities should be documented, assessed in context, and monitored over time. This process ensures that if the threat landscape evolves, the organization can respond proactively.
The standard emphasizes a risk-based approach, which includes:
* Analyzing vulnerabilities in relation to assets and threat likelihood
* Monitoring the environment for changes that may introduce new threats
* Avoiding unnecessary or unjustified resource expenditure on low-risk issues Option A is incorrect because it suggests addressing all vulnerabilities without considering risk context.
Option B is risky and contradicts ISO best practices, which emphasize continuous risk monitoring.
Reference Extracts:
* ISO/IEC 27005:2018, Clause 8.2.2: "Vulnerabilities without known threats may not require treatment immediately but should be monitored regularly."
* ISO/IEC 27001:2022, Annex A, Control A.8.8 - "Management of technical vulnerabilities should be risk- based and responsive to changes." Therefore, the correct answer is C: They may not require controls but should be analyzed and monitored for changes.
-
NEW QUESTION # 48
According to scenario 4, what is the next action ORingo should take to prevent escalation when conducting exercises?
- A. Wait until the exercise is completed to clarify the situation with all parties involved
- B. Inform all participants and external entities involved that this was a simulated scenario and not a real threat immediately
- C. Proceed with the exercise as planned, considering this as a part of the learning process
Answer: B
Explanation:
Comprehensive and Detailed Explanation:
According to ISO/IEC 27035-2:2016, incident response exercises (including simulations such as phishing campaigns) must be carefully controlled to avoid confusion, escalation, or reputational damage. If an exercise is misunderstood by employees or external parties, it could lead to unintended consequences including external escalation, customer concern, or media involvement.
The best practice is to ensure that all involved-especially external stakeholders-are informed as soon as possible if they are exposed to simulated elements. Transparency ensures the organization maintains trust and mitigates potential fallout. This is part of effective communication during planned exercises.
Reference:
ISO/IEC 27035-2:2016, Clause 7.5 - "Exercises should be clearly identified, controlled, and followed by communication plans that inform affected parties of their simulated nature." Correct answer: C
-
NEW QUESTION # 49
Scenario 7: Located in central London, Konzolo has become a standout innovator in the cryptocurrency field.
By introducing its unique cryptocurrency, Konzolo has contributed to the variety of digital currencies and prioritized enhancing the security and reliability of its offerings.
Konzolo aimed to enhance its systems but faced challenges in monitoring the security of its own and third- party systems. These issues became especially evident during an incident that caused several hours of server downtime This downtime was primarily caused by a third-party service provider that failed to uphold strong security measures, allowing unauthorized access.
In response to this critical situation, Konzolo strengthened its information security infrastructure. The company initiated a comprehensive vulnerability scan of its cryptographic wallet software, a cornerstone of its digital currency offerings The scan revealed a critical vulnerability due to the software using outdated encryption algorithms that are susceptible to decryption by modern methods that posed a significant risk of asset exposure Noah, the IT manager, played a central role in this discovery With careful attention to detail, he documented the vulnerability and communicated the findings to the incident response team and management.
Acknowledging the need for expertise in navigating the complexities of information security incident management. Konzolo welcomed Paulina to the team. After addressing the vulnerability and updating the cryptographic algorithms, they recognized the importance of conducting a thorough investigation to prevent future vulnerabilities. This marked the stage for Paulina s crucial involvement. She performed a detailed forensic analysis of the incident, employing automated and manual methods during the collection phase. Her analysis provided crucial insights into the security breach, enabling Konzolo to understand the depth of the vulnerability and the actions required to mitigate it.
Paulina also played a crucial role in the reporting phase, as her comprehensive approach extended beyond analysis. By defining clear and actionable steps for future prevention and response, she contributed significantly to developing a resilient information security incident management system based on ISO/IEC
27035-1 and 27035-2 guidelines. This strategic initiative marked a significant milestone in Konzolo's quest to strengthen its defenses against cyber threats According to scenario 7, what type of incident has occurred at Konzolo?
- A. Critical severity incident
- B. High severity incident
- C. Medium severity incident
Answer: B
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
Severity classification of an incident under ISO/IEC 27035-2:2016 is determined by factors such as potential data exposure, business disruption, and impact on critical services. In this scenario, the server downtime caused by a third-party breach and a vulnerability in cryptographic wallet software-capable of leading to asset exposure-signifies serious business and operational risks.
Although the vulnerability was critical, no actual asset theft or breach was confirmed. Therefore, while serious, the incident does not reach the "critical" threshold (which would typically involve data exfiltration, irreversible loss, or public impact). The appropriate classification is "High Severity." Reference:
* ISO/IEC 27035-2:2016, Clause 6.3.1: "Severity is determined by the actual or potential impact on business operations, data, reputation, and legal obligations."
* Annex A (Example Severity Levels): "High-severity incidents involve confirmed vulnerabilities with significant potential for impact, such as financial loss or regulatory violations." Correct answer: B
-
NEW QUESTION # 50
What role does the incident coordinator play during the response phase?
- A. Coordinating the activities of IRTs and monitoring response time
- B. Assessing if the event is a potential or confirmed security incident
- C. Initiating the response actions immediately
Answer: A
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
The incident coordinator plays a vital managerial and operational role in guiding and synchronizing the efforts of Incident Response Teams (IRTs). ISO/IEC 27035-2:2016, Clause 7.2.2 describes the role as one that involves coordination of resources, communication, and oversight to ensure that all phases of the response are executed according to procedure and within acceptable timelines.
Responsibilities include:
Assigning roles and responsibilities
Overseeing containment, eradication, and recovery efforts
Communicating with stakeholders
Tracking incident metrics and resolution progress
Initiating the response (Option B) is typically a decision taken collectively or by senior management or the IMT after classification. Assessing the nature of an event (Option C) falls under the detection and classification phase, not the coordinator's primary role during response.
Reference:
ISO/IEC 27035-2:2016, Clause 7.2.2: "The incident coordinator is responsible for leading and coordinating the incident response process, ensuring timely and efficient execution." Correct answer: A
-
NEW QUESTION # 51
Scenario 2: NoSpace, a forward-thinking e-commerce store based in London, is renowned for its diverse products and advanced technology. To enhance its information security, NoSpace implemented an ISMS according to ISO/IEC 27001 to better protect customer data and ensure business continuity. Additionally, the company adopted ISO/IEC 27035-1 and ISO/IEC 27035-2 guidelines. Mark, the incident manager at NoSpace, strategically led the entire implementation. He played a crucial role in aligning the company's ISMS with the requirements specified in ISO/IEC 27001, using ISO/IEC 27035-1 guidelines as the foundation.
During a routine internal audit, a minor anomaly was detected in the data traffic that could potentially indicate a security threat. Mark was immediately notified to assess the situation. Then, Mark and his team immediately escalated the incident to crisis management to handle the potential threat without further assessment. The decision was made to ensure a swift response.
After resolving the situation, Mark decided to update the incident management process. During the initial phase of incident management, Mark recognized the necessity of updating NoSpace's information security policies. This included revising policies related to risk management at the organizational level as well as for specific systems, services, or networks. The second phase of the updated incident management process included the assessment of the information associated with occurrences of information security events and the importance of classifying events and vulnerabilities as information security incidents. During this phase, he also introduced a 'count down' process to expedite the evaluation and classification of occurrences, determining whether they should be recognized as information security incidents.
Mark developed a new incident management policy to enhance the organization's resilience and adaptability in handling information security incidents. Starting with a strategic review session with key stakeholders, the team prioritized critical focus areas over less impactful threats, choosing not to include all potential threats in the policy document. This decision was made to keep the policy streamlined and actionable, focusing on the most significant risks identified through a risk assessment. The policy was shaped by integrating feedback from various department heads to ensure it was realistic and enforceable. Training and awareness initiatives were tailored to focus only on critical response roles, optimizing resource allocation and focusing on essential capabilities.
Based on scenario 2, was Mark's information security incident management policy appropriately developed?
- A. No, he should have outlined any awareness and training initiatives within the organization that are related to incident management
- B. Yes, the information security incident management policy was appropriately developed
- C. No, the purpose of the information security incident management policy was not appropriately defined, as it failed to address all potential threats
Answer: B
Explanation:
-
Comprehensive and Detailed Explanation From Exact Extract:
Yes, Mark's approach to developing NoSpace's information security incident management policy was aligned with the structured guidelines outlined in ISO/IEC 27035-1 and ISO/IEC 27035-2. These standards emphasize the importance of establishing an effective and realistic policy framework that supports the identification, management, and learning from information security incidents.
ISO/IEC 27035-1:2016, Clause 6.1, outlines the core components of the "Prepare" phase of the incident management lifecycle. A well-developed incident management policy should:
* Define the purpose, scope, and applicability of the policy
* Focus on critical assets and threats identified through a formal risk assessment
* Be shaped by stakeholder input
* Be realistic, enforceable, and capable of being integrated across departments
* Include training and awareness tailored to relevant personnel
In this scenario, Mark held a strategic session with stakeholders, ensured the policy was risk-based, and tailored training initiatives to critical roles only - which aligns precisely with ISO guidance on optimizing resource allocation and ensuring enforceability.
Option A is incorrect because the scenario clearly states that Mark implemented training and awareness initiatives tailored to critical response roles, which meets ISO/IEC 27035-1 expectations.
Option B is incorrect because ISO/IEC 27035-1 emphasizes prioritization of high-risk threats rather than attempting to address all potential threats equally. A focused and actionable policy that targets the most significant risks is more practical and aligns with international best practices.
Reference Extracts:
* ISO/IEC 27035-1:2016, Clause 6.1: "The preparation phase should include the definition of incident management policy, development of procedures, and awareness/training initiatives."
* ISO/IEC 27035-2:2016, Clause 5.1: "The policy should be concise, focused on relevant threats, and shaped by organizational structure and risk appetite."
* ISO/IEC 27001:2022, Annex A.5.25 & A.5.27: "Clear roles, responsibilities, and awareness should be assigned and supported through training."
Therefore, the correct answer is: C. Yes, the information security incident management policy was appropriately developed.
NEW QUESTION # 52
What is the purpose of incident identification in the incident response process?
- A. To conduct a preliminary assessment of the incident
- B. To collect all data related to the incident, including information from affected systems, network logs, user accounts, and any other relevant sources
- C. To recognize incidents through various methods like intrusion detection systems and employee reports
Answer: C
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
Incident identification is the first operational step in the incident response process. It involves detecting unusual or suspicious activity and recognizing whether it constitutes an information security incident. ISO
/IEC 27035-1:2016 describes various sources of detection, such as:
Security monitoring tools (e.g., IDS/IPS)
User reports or helpdesk notifications
Automated alerts from applications or infrastructure
The goal at this stage is not to collect detailed forensic data or conduct deep analysis, but rather to determine whether the activity warrants classification as a potential incident and to escalate accordingly.
Reference:
ISO/IEC 27035-1:2016, Clause 6.2.1: "Incident identification involves recognizing the occurrence of an event that could be an information security incident." Correct answer: C
-
NEW QUESTION # 53
Scenario 8: Moneda Vivo, headquartered in Kuala Lumpur. Malaysia, is a distinguished name in the banking sector. It is renowned for its innovative approach to digital banking and unwavering commitment to information security. Moneda Vivo stands out by offering various banking services designed to meet the needs of its clients. Central to its operations is an information security incident management process that adheres to the recommendations of ISO/IEC 27035-1 and 27035-2.
Recently. Moneda Vivo experienced a phishing attack aimed at its employees Despite the bank's swift identification and containment of the attack, the incident led to temporary service outages and data access issues, underscoring the need for improved resilience The response team compiled a detailed review of the attack, offering valuable insights into the techniques and entry points used and identifying areas for enhancing their preparedness.
Shortly after the attack, the bank strengthened its defense by implementing a continuous review process to ensure its incident management procedures and systems remain effective and appropriate While monitoring the incident management process, a trend became apparent. The mean time between similar incidents decreased after a few occurrences; however, Moneda Vivo strategically ignored the trend and continued with regular operations This decision was rooted in a deep confidence in its existing security measures and incident management protocols, which had proven effective in quick detection and resolution of issues Moneda Vivo's commitment to transparency and continual improvement is exemplified by its utilization of a comprehensive dashboard. This tool provides real time insights into the progress of its information security incident management, helping control operational activities and ensure that processes stay within the targets of productivity, quality, and efficiency. However, securing its digital banking platform proved challenging.
Following a recent upgrade, which included a user interface change to its digital banking platform and a software update, Moneda Vivo recognized the need to immediately review its incident management process for accuracy and completeness. The top management postponed the review due to financial and time constraints.
Based on scenario 8, Moneda Vivo has recently upgraded its digital banking platform. In line with the continual improvement process, Moneda Vivo has decided to review the information security incident management process for accuracy immediately after the software update. Is this recommended?
- A. No, the incident management process should be evaluated after a significant technological overhaul to ensure the system is up-to-date
- B. Yes, the incident management process should be reviewed after any minor software update
- C. No, the incident management process should be reviewed when the bank's annual audit is conducted
Answer: A
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
According to ISO/IEC 27035-1:2016, Clause 7.1 and ISO/IEC 27035-2:2016, Clause 7.3.3, it is advised to review and revise the information security incident management process following major organizational or technical changes. These changes include upgrades, system overhauls, and structural IT shifts. While minor updates may not necessitate a full review, significant technological updates, such as those affecting core digital banking platforms, should trigger immediate evaluation to ensure continued relevance and effectiveness of incident response strategies.
In the scenario, Moneda Vivo recognized the need for a review but delayed it, which could pose risks. Option C accurately reflects ISO guidance.
Reference:
ISO/IEC 27035-1:2016 Clause 7.1: "Reviews should be performed after major changes or after information security incidents." ISO/IEC 27035-2:2016 Clause 7.3.3 Correct answer: C
-
NEW QUESTION # 54
Scenario 4: ORingo is a company based in Krakow, Poland, specializing in developing and distributing electronic products for health monitoring and heart rate measurement applications. With a strong emphasis on innovation and technological advancement, ORingo has established itself as a trusted provider of high-quality, reliable devices that enhance the well being and healthcare capabilities of individuals and healthcare professionals alike.
As part of its commitment to maintaining the highest standards of information security, ORingo has established an information security incident management process This process aims to ensure that any potential threats are swiftly identified, assessed, and addressed to protect systems and information. However, despite these measures, an incident response team member at ORingo recently detected a suspicious state in their systems operational data, leading to the decision to shut down the company-wide system until the anomaly could be thoroughly investigated Upon detecting the threat, the company promptly established an incident response team to respond to the incident effectively. The team's responsibilities encompassed identifying root causes, uncovering hidden vulnerabilities, and implementing timely resolutions to mitigate the impact of the incident on ORingo's operations and customer trust.
In response to the threat detected across its cloud environments. ORingo employed a sophisticated security tool that broadened the scope of incident detection and mitigation This tool covers network traffic, doud environments, and potential attack vectors beyond traditional endpoints, enabling ORingo to proactively defend against evolving cybersecurity threats During a routine check, the IT manager at ORingo discovered that multiple employees lacked awareness of proper procedures following the detection of a phishing email. In response, immediate training sessions on information security policies and incident response were scheduled for all employees, emphasizing the importance of vigilance and adherence to established protocols in safeguarding ORingo's sensitive data and assets.
As part of the training initiative. ORingo conducted a simulated phishing attack exercise to assess employee response and knowledge. However, an employee inadvertently informed an external partner about the 'attack'' during the exercise, highlighting the importance of ongoing education and reinforcement of security awareness principles within the organization.
Through its proactive approach to incident management and commitment to fostering a culture of security awareness and readiness. ORingo reaffirms its dedication to safeguarding the integrity and confidentiality of its electronic products and ensuring the trust and confidence of its customers and stakeholders worldwide.
Based on the scenario above, answer the following question:
After identifying a suspicious state in ORingo's system, a member of the IRT initiated a company-wide system shutdown until the anomaly was investigated. Is this acceptable?
- A. No, the IRT should have determined the facts that enable detection of the event occurrence
- B. No, the IRT should have immediately informed all employees about the potential data breach
- C. Yes, the correct action is to initiate a company-wide system shutdown until the anomaly is investigated
Answer: A
Explanation:
Comprehensive and Detailed Explanation:
According to ISO/IEC 27035-1:2016, particularly in Clause 6.2.2 (Assess and Decide), the organization must first assess the reported event to determine whether it qualifies as a security incident before implementing disruptive responses such as a full system shutdown.
Initiating a shutdown without first determining the cause, impact, or whether it's a confirmed incident can lead to unnecessary operational disruption and loss of services. The proper approach is to collect evidence, analyze system behavior, and make informed decisions based on risk level and confirmed facts.
Option B best reflects the required approach: The IRT should first determine the facts that enable detection and validation of the event's occurrence and impact before initiating drastic action like shutting down critical systems.
Reference:
ISO/IEC 27035-1:2016, Clause 6.2.2 - "An analysis should be conducted to determine whether the event should be treated as an information security incident." Clause 6.2.3 - "Response should be proportionate to the impact and type of the incident." Therefore, the correct answer is B.
-
NEW QUESTION # 55
......
PECB ISO-IEC-27035-Lead-Incident-Manager Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
PDF (New 2025) Actual PECB ISO-IEC-27035-Lead-Incident-Manager Exam Questions: https://www.examcost.com/ISO-IEC-27035-Lead-Incident-Manager-practice-exam.html
Dumps Moneyack Guarantee - ISO-IEC-27035-Lead-Incident-Manager Dumps UpTo 90% Off: https://drive.google.com/open?id=17K7XvjmbtwBEwXsHnmRmnfhPJKG8UHrh
