MENU
To verify conformity to control 8.15 Logging of ISO/IEC 27001 Annex A, the audit team verified a sample of server logs to determine if they can be edited or deleted. Which audit procedure was used?
Suggested Answer: A
Get Premium ISO-IEC-27001-Lead-Auditor Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
The audit procedure used here is 'analysis.' The audit team analyzed server logs to verify if they can be edited or deleted, focusing on evaluating the logs' properties and the controls over their manipulation to ensure they comply with ISO/IEC 27001 requirements.
36 comments · newest first
JE
Jessenia
10 months ago
I agree, Analysis makes the most sense here.
ST
Starr
11 months ago
Wait, can server logs really be edited? That’s surprising!
CH
Chery
11 months ago
Observation seems unlikely for this one.
FE
Felicidad
11 months ago
I think it’s Sampling, though.
OL
Ollie
11 months ago
Definitely sounds like they used Analysis.
TH
Theodora
12 months ago
I recall something about "Sampling" being used in similar scenarios, but I can't shake the feeling that "Analysis" fits better for this specific case.
DE
Devora
12 months ago
I feel like "Observation" could be relevant too, but it seems more like they are checking the logs directly, which might lean towards "Analysis."
JA
Jaime
12 months ago
I'm not entirely sure, but I remember a practice question where we had to choose between "Sampling" and "Observation." This feels more like "Sampling" to me.
BE
Bethanie
1 year ago
I think the audit procedure used here might be "Analysis," since they are looking closely at the logs to see if they can be altered.
HO
Hortencia
1 year ago
Okay, I've got this. The audit team was checking the integrity of the server logs, so the correct audit procedure would be analysis to verify the logs can't be edited or deleted.
AL
Alfreda
1 year ago
I'm a bit confused by this question. The options don't seem to directly match the details provided. I'll have to think it through carefully before answering.
BL
Blondell
1 year ago
Hmm, I'm not totally sure about this one. The question talks about verifying if the logs can be edited or deleted, so maybe observation would be the right audit procedure to check that?
RO
Rocco
1 year ago
This question seems straightforward. I think the audit procedure used was sampling, since the question mentions the audit team verified a "sample" of server logs.
JO
Jodi
1 year ago
Hmm, I'm not totally sure about this one. I think it might be interval, but I'm not 100% confident. I'll have to think it through carefully.
VI
Viola
2 years ago
If I was an auditor, I'd want to make sure I have a good sample size to draw conclusions. B) Sampling is the way to go.
LI
Lizbeth
2 years ago
Haha, I bet the auditors had a blast watching paint dry on those servers. C) Observation is the way to go!
CL
Clorinda
2 years ago
Haha, yeah, watching paint dry on servers sounds like a thrilling time for auditors.
JU
Justine
2 years ago
I agree, it's important to make sure they can't be tampered with.
ST
Stacey
2 years ago
Observation is definitely the best way to verify those server logs.
LE
Leeann
2 years ago
I'm not sure, but I think Observation could also be used to verify the server logs.
KR
Krissy
2 years ago
I agree with Audrie, Sampling makes sense to verify conformity to control 8.15 Logging.
BE
Beth
2 years ago
A) Analysis could work, but I'm not sure it's specific enough to the logging control. B) Sampling makes the most sense to me.
VI
Vicky
2 years ago
C) Observation seems like the logical choice here. The audit team would need to actually watch the servers to see if the logs can be edited or deleted.
DA
Dannie
2 years ago
I agree, it's important to physically observe the servers to ensure the logs are secure.
EL
Eliseo
2 years ago
Yes, observation is the best way to verify if the logs are tamper-proof.
SK
Skye
2 years ago
The audit team would need to actually watch the servers to see if the logs can be edited or deleted.
VI
Viola
2 years ago
Observation seems like the logical choice here.
DE
Dell
2 years ago
That makes sense, they need to see it in action to verify compliance.
CA
Carmela
2 years ago
Yes, the audit team would need to physically watch the servers.
MI
Millie
2 years ago
Observation seems like the logical choice here.
AU
Audrie
2 years ago
I think the audit procedure used was Sampling.
DU
Dulce
2 years ago
I think the correct answer is B) Sampling. It's the most effective way to verify a control like logging that applies to a large number of servers.
LO
Loreta
2 years ago
Observation could also be useful, but it may not provide a comprehensive view of the effectiveness of the control.
SH
Sharita
2 years ago
It's a practical approach to ensure compliance with control requirements without spending excessive time and resources.
EU
Eun
2 years ago
Sampling allows us to check a representative sample of logs without having to go through each one individually.
DE
Delsie
2 years ago
I agree, B) Sampling is the best way to verify a control like logging on multiple servers.