ISO-IEC-27001-Lead-Implementer Exam Dumps - PECB Certified ISO/IEC 27001 : 2022 Lead Implementer exam

Based on his tasks, Bob is part of the incident response team (IRT) of InfoSec. According to ISO/IEC 27035-2:2023, the IRT is a team of appropriately skilled and trusted members of an organization that responds to and resolves incidents in a coordinated way1. One of the tasks of the IRT is to conduct an evaluation of the nature of an unexpected event, including the details on how the event happened and what or whom it might affect1. This is consistent with Bob’s responsibility of ensuring that a thorough evaluation of the nature of an unexpected event is conducted. Therefore, Bob belongs to the incident response team.

ISO/IEC 27035-2:2023 (en), Information technology — Information security incident management — Part 2: Guidelines to plan and prepare for incident response1

Response to Information Security Incidents | ISMS.online2

The correct and verified answer to Question 294 is B. Identification and description, based directly on the scenario and the requirements of ISO/IEC 27001:2022 Clause 7.5 – Documented information.

The scenario states that during documentation, Infralink ensured traceability by including:

Document titles

Creation or update dates

Author names

Unique reference numbers

These elements map exactly to the documented information requirements in Clause 7.5.2, which specifies how ISMS documentation must be identified and described.

ISO/IEC 27001:2022 Clause 7.5.2 a) states that documented information shall be appropriately identified and described, including:

“a title, date, author, or reference number.”

This clause is explicitly reflected in the scenario wording, leaving no ambiguity that identification and description were the aspects ensured.

The other options can be clearly ruled out:

Option A (Format and media) relates to Clause 7.5.2 b), which concerns whether documents are electronic, paper-based, language used, or software format. The scenario does not mention document formats or media.

Option C (Review and approval scheduling) relates to Clause 7.5.2 c) and 7.5.3, which address approval for suitability and control of changes. The scenario does not describe review cycles, approval authorities, or version approval workflows.

By ensuring clear identification attributes, Infralink supports traceability, accountability, auditability, and version control, which are critical for ISMS effectiveness and certification readiness.

ISO/IEC 27701 is the international standard that extends ISO/IEC 27001 and ISO/IEC 27002 for privacy information management. It specifies the requirements and provides guidance for establishing, implementing, maintaining, and continually improving a Privacy Information Management System (PIMS).

"ISO/IEC 27701:2019 — Security techniques — Extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy information management — Requirements and guidelines."

— ISO/IEC 27701:2019, Foreword

The correct and verified answer is B. Technological, because the identified risk—unrestricted write access to production source code and development tools—must be managed through technical enforcement mechanisms, not solely by people or organizational measures.

The scenario describes a failure to restrict access to critical production systems, allowing a junior developer to modify source code without authorization. This is a classic access control and privilege management issue that requires technological controls such as role-based access control (RBAC), privileged access management, repository permissions, and segregation of environments.

ISO/IEC 27001:2022 Annex A categorizes controls into organizational, people, physical, and technological groups. The controls relevant to this scenario fall squarely under technological controls, including:

A.8.2 – Privileged access rightsRequires restriction and management of elevated access to prevent unauthorized or excessive privileges.

A.8.3 – Information access restrictionEnsures access to information and systems is limited in accordance with business requirements.

A.8.4 – Access to source codeExplicitly requires that access to source code is restricted, controlled, and monitored.

A.8.32 – Change managementEnsures that changes to production systems are authorized, tested, and approved.

While people controls (such as training or awareness) and organizational controls (such as policies) are supportive, they are insufficient on their own. Without technical enforcement, policies cannot prevent unauthorized access in practice.

ISO/IEC 27001:2022 emphasizes defense-in-depth, where technological controls enforce rules automatically, reducing reliance on human behavior alone.

According to ISO/IEC 27001:2022, clause 10.2.2, the organization shall define and apply an information security incident management process that includes the following activities:

reporting information security events and weaknesses;

assessing information security events and classifying them as information security incidents;

responding to information security incidents according to their classification;

learning from information security incidents, including identifying causes, taking corrective actions and preventive actions, and communicating the results and actions taken;

collecting evidence, where applicable.

The standard does not specify who should perform these activities, as long as they are done in a consistent and effective manner. Therefore, the organization may choose to conduct forensic investigation internally or by using external consultants, depending on its needs, resources, and capabilities. However, the organization should ensure that the external consultants are competent, trustworthy, and comply with the organization’s policies and procedures.

ISO/IEC 27001:2022, Information security, cybersecurity and privacy protection — Information security management systems — Requirements, clause 10.2.2; PECB ISO/IEC 27001 Lead Implementer Course, Module 10: Incident Management.