Prep and try our ISOIEC20000LI valid and latest training questions & answers

ISO ISOIEC20000LI Exam Overview:

ISO ISOIEC20000LI Exam Syllabus Topics:

ISO Beingcert ISO/IEC 20000 Lead Implementer Sample Questions:

1. A small organization that is implementing an ISMS based on ISO/lEC 27001 has decided to outsource the internal audit function to a third party. Is this acceptable?

A) Yes, outsourcing the internal audit function to a third party is often a better option for small organizations to demonstrate independence and impartiality
B) No, the organizations cannot outsource the internal audit function to a third party because during internal audit, the organization audits its own system
C) No, the outsourcing of the internal audit function may compromise the independence and impartiality of the internal audit team

2. Scenario 8: SunDee is an American biopharmaceutical company, headquartered in California, the US. It specializes in developing novel human therapeutics, with a focus on cardiovascular diseases, oncology, bone health, and inflammation. The company has had an information security management system (ISMS) based on SO/IEC 27001 in place for the past two years. However, it has not monitored or measured the performance and effectiveness of its ISMS and conducted management reviews regularly Just before the recertification audit, the company decided to conduct an internal audit. It also asked most of their staff to compile the written individual reports of the past two years for their departments. This left the Production Department with less than the optimum workforce, which decreased the company's stock.
Tessa was SunDee's internal auditor. With multiple reports written by 50 different employees, the internal audit process took much longer than planned, was very inconsistent, and had no qualitative measures whatsoever Tessa concluded that SunDee must evaluate the performance of the ISMS adequately. She defined SunDee's negligence of ISMS performance evaluation as a major nonconformity, so she wrote a nonconformity report including the description of the nonconformity, the audit findings, and recommendations. Additionally, Tessa created a new plan which would enable SunDee to resolve these issues and presented it to the top management Based on the scenario above, answer the following question:
What caused SunDee's workforce disruption?

A) The voluminous written reports
B) The inconsistency of reports written by different employees
C) The negligence of performance evaluation and monitoring and measurement procedures

3. Based on scenario 9. the top management decided to accept the risk related to a nonconformity to control 5.17 Authentication informal ion. is this acceptable?

A) Unacceptable, the company should have provided justification for accepting the risks and documented it
B) Acceptable, as the company properly informed the internal audit that they decided to accept the risk
C) Acceptable, the company analyzed the implementation costs and accepted the risk

4. An organization uses Platform as a Services (PaaS) to host its cloud-based services As such, the cloud provider manages most off the services to the organization. However, the organization still manages____________________

A) Servers and storage
B) Application and data
C) Operating system and visualization

5. Scenario 9: OpenTech provides IT and communications services. It helps data communication enterprises and network operators become multi-service providers During an internal audit, its internal auditor, Tim, has identified nonconformities related to the monitoring procedures He identified and evaluated several system Invulnerabilities.
Tim found out that user IDs for systems and services that process sensitive information have been reused and the access control policy has not been followed After analyzing the root causes of this nonconformity, the ISMS project manager developed a list of possible actions to resolve the nonconformity. Then, the ISMS project manager analyzed the list and selected the activities that wouldallow the elimination of the root cause and the prevention of a similar situation in the future. These activities were included in an action plan The action plan, approved by the top management, was written as follows:
A new version of the access control policy will be established and new restrictions will be created to ensure that network access is effectively managed and monitored by the Information and Communication Technology (ICT) Department The approved action plan was implemented and all actions described in the plan were documented.
Based on scenario 9. is the action plan for the identified nonconformities sufficient to eliminate the detected nonconformities?

A) No, because the action plan does not address the root cause of the identified nonconformity
B) No, because the action plan does not include a timeframe for implementation
C) Yes, because a separate action plan has been created for the identified nonconformity

Solutions: