PECB ISO-IEC-27035-Lead-Incident-Manager Exam Dumps - Actual Questions Answers

Comprehensive and Detailed Explanation:

According to ISO/IEC 27035-1:2016 and ISO/IEC 27001:2022, when defining the scope of an information security incident management system, organizations must consider all forms of information—whether digital or physical—that are relevant to the business. Incidents can affect hardcopy (e.g., paper-based records) and electronic data (e.g., emails, files), so both must be included in the scope assessment.

—

Comprehensive and Detailed Explanation From Exact Extract:

Yes, Mark’s approach to developing NoSpace’s information security incident management policy was aligned with the structured guidelines outlined in ISO/IEC 27035-1 and ISO/IEC 27035-2. These standards emphasize the importance of establishing an effective and realistic policy framework that supports the identification, management, and learning from information security incidents.

ISO/IEC 27035-1:2016, Clause 6.1, outlines the core components of the “Prepare” phase of the incident management lifecycle. A well-developed incident management policy should:

* Define the purpose, scope, and applicability of the policy

* Focus on critical assets and threats identified through a formal risk assessment

* Be shaped by stakeholder input

* Be realistic, enforceable, and capable of being integrated across departments

* Include training and awareness tailored to relevant personnel

In this scenario, Mark held a strategic session with stakeholders, ensured the policy was risk-based, and tailored training initiatives to critical roles only — which aligns precisely with ISO guidance on optimizing resource allocation and ensuring enforceability.

Option A is incorrect because the scenario clearly states that Mark implemented training and awareness initiatives tailored to critical response roles, which meets ISO/IEC 27035-1 expectations.

Option B is incorrect because ISO/IEC 27035-1 emphasizes prioritization of high-risk threats rather than attempting to address all potential threats equally. A focused and actionable policy that targets the most significant risks is more practical and aligns with international best practices.

Reference Extracts:

* ISO/IEC 27035-1:2016, Clause 6.1: “The preparation phase should include the definition of incident management policy, development of procedures, and awareness/training initiatives.”

* ISO/IEC 27035-2:2016, Clause 5.1: “The policy should be concise, focused on relevant threats, and shaped by organizational structure and risk appetite.”

* ISO/IEC 27001:2022, Annex A.5.25 & A.5.27: “Clear roles, responsibilities, and awareness should be assigned and supported through training.”

Therefore, the correct answer is: C. Yes, the information security incident management policy was appropriately developed.

—

Let me know when you’re ready for QUESTION NO: 16.

—

Comprehensive and Detailed Explanation From Exact Extract:

ISO/IEC 27035-1:2016 and ISO/IEC 27035-2:2016 emphasize the importance of monitoring not only internal systems but also third-party or outsourced services. Clause 7.3.2 of ISO/IEC 27035-2 specifically recommends that organizations establish mechanisms for the continuous monitoring of service providers and outsourced systems, particularly when such services process or store sensitive information.

In the scenario, Konzolo suffered an incident due to a failure by a third-party service provider to uphold security controls. This indicates that Konzolo had insufficient or no effective monitoring of outsourced services in place, which directly contributed to the breach and system downtime.

On the other hand:

Option A is incorrect because Konzolo did conduct a vulnerability scan, identifying and addressing cryptographic weaknesses.

Option B is also incorrect, as Paulina conducted forensic and behavioral analysis (both manual and automated) as part of the investigation process.

Reference Extracts:

ISO/IEC 27035-2:2016, Clause 7.3.2: “Monitoring should not be limited to internal infrastructure but should include third-party and outsourced services to ensure that they are operating within defined security parameters.”

ISO/IEC 27002:2022, Control 5.23: “Information security should be addressed in agreements with third parties.”

Correct answer: C

—