PECB ISO-IEC-27001-Lead-Auditor Exam - Topic 3 Question 63 Discussion

Actual exam question for PECB's ISO-IEC-27001-Lead-Auditor exam

Question #: 63
Topic #: 3

[All ISO-IEC-27001-Lead-Auditor Questions]

Which is an example of a qualitative evidence?

AThe documented results of an intrusion-detection test from an information security expert from an external organization

BA defined sample analysis of nonconformity reports drafted by the audited organization from the time their ISMS was implemented

CAn interview with the information security personnel to validate if the information security process complies with the standard requirements

Show Suggested Answer

Suggested Answer: C

Qualitative evidence in an audit typically involves observations, interviews, and reviews that provide insights into the processes and compliance through subjective but informed assessments. An interview with information security personnel to validate compliance with the standard requirements is an example of qualitative evidence, where the quality and effectiveness of processes are assessed based on expert judgments rather than measurable metrics.

by Jamika at Jan 05, 2026, 05:16 AM

Limited Time Offer

25%

Off

Get Premium ISO-IEC-27001-Lead-Auditor Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Jospeh

3 days ago

I'd go with C. Interviews give you a more in-depth, subjective understanding of the process.

upvoted 0 times

...

Raina

8 days ago

Definitely C. Interviews provide qualitative data that can't be captured in numerical form.

upvoted 0 times

...

Myra

13 days ago

C) An interview with the information security personnel to validate if the information security process complies with the standard requirements.

upvoted 0 times

...

Tommy

18 days ago

I’m confused because I thought both B and C could fit, but I guess C is more about personal insights, right?

upvoted 0 times

...

Mireya

24 days ago

I'm not entirely sure, but I think qualitative evidence focuses on opinions and experiences, which makes me lean towards option C.

upvoted 0 times

...

Ressie

29 days ago

I remember practicing a question like this, and I feel like the nonconformity reports could also be considered qualitative since they analyze issues.

upvoted 0 times

...

Ailene

1 month ago

I think qualitative evidence is more about subjective data, so maybe the interview with the security personnel?

upvoted 0 times

...

Angelyn

1 month ago

For this type of question, I'd recommend focusing on the key characteristics of qualitative evidence, like direct observations, interviews, and reviews of documentation. That should help me identify the best example from the options provided.

upvoted 0 times

...

Katlyn

1 month ago

Hmm, I'm a bit confused on the difference between qualitative and quantitative evidence. I'll need to review my notes to make sure I understand the distinction before answering this.

upvoted 0 times

...

Devora

2 months ago

The intrusion-detection test results seem more like quantitative evidence to me, since they involve documented metrics and measurements. I'd go with the interview as the best qualitative example.

upvoted 0 times

...

Thurman

2 months ago

I'm not sure about this one. The sample analysis of nonconformity reports seems like it could also be considered qualitative evidence since it's based on reviewing documentation.

upvoted 0 times

...

Sherita

2 months ago

I think the interview with the information security personnel would be a good example of qualitative evidence. It provides direct feedback and insights from the people involved in the process.

upvoted 0 times

...