PECB ISO-IEC-27001-Lead-Auditor Exam - Topic 3 Question 63 Discussion

Actual exam question for PECB's ISO-IEC-27001-Lead-Auditor exam

Question #: 63
Topic #: 3

[All ISO-IEC-27001-Lead-Auditor Questions]

Which is an example of a qualitative evidence?

AThe documented results of an intrusion-detection test from an information security expert from an external organization

BA defined sample analysis of nonconformity reports drafted by the audited organization from the time their ISMS was implemented

CAn interview with the information security personnel to validate if the information security process complies with the standard requirements

Show Suggested Answer

Suggested Answer: C

Qualitative evidence in an audit typically involves observations, interviews, and reviews that provide insights into the processes and compliance through subjective but informed assessments. An interview with information security personnel to validate compliance with the standard requirements is an example of qualitative evidence, where the quality and effectiveness of processes are assessed based on expert judgments rather than measurable metrics.

by Jamika at Jan 05, 2026, 05:16 AM

Limited Time Offer

25%

Off

Get Premium ISO-IEC-27001-Lead-Auditor Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Dean

15 days ago

B is interesting, but it’s more quantitative. C feels right for qualitative.

upvoted 0 times

...

Stevie

20 days ago

A seems more factual, but I feel C captures the essence.

upvoted 0 times

...

Malinda

25 days ago

Agreed, C shows real experiences and opinions.

upvoted 0 times

...

Fernanda

1 month ago

I think C is the best choice. Interviews provide deep insights.

upvoted 0 times

...

Candida

1 month ago

A is interesting, but it’s more quantitative, right?

upvoted 0 times

...

Luisa

1 month ago

Totally agree with C being the right choice!

upvoted 0 times

...

Twana

2 months ago

Wait, how is C not just an interview? Seems odd.

upvoted 0 times

...

Mitzie

2 months ago

I think B is more qualitative, though.

upvoted 0 times

...

Coral

2 months ago

C is definitely qualitative evidence.

upvoted 0 times

...

Viva

2 months ago

C is the clear choice here. Interviews are where the real juicy details come out.

upvoted 0 times

...

Jenelle

2 months ago

Haha, who needs qualitative data when you can just crunch the numbers? I'm going with A!

upvoted 0 times

...

Sharika

2 months ago

C is the way to go. Interviews are a great way to get that qualitative insight.

upvoted 0 times

...

Jospeh

3 months ago

I'd go with C. Interviews give you a more in-depth, subjective understanding of the process.

upvoted 0 times

...

Raina

3 months ago

Definitely C. Interviews provide qualitative data that can't be captured in numerical form.

upvoted 0 times

...

Myra

3 months ago

C) An interview with the information security personnel to validate if the information security process complies with the standard requirements.

upvoted 0 times

...

Tommy

4 months ago

I’m confused because I thought both B and C could fit, but I guess C is more about personal insights, right?

upvoted 0 times

...

Mireya

4 months ago

I'm not entirely sure, but I think qualitative evidence focuses on opinions and experiences, which makes me lean towards option C.

upvoted 0 times

...

Ressie

4 months ago

I remember practicing a question like this, and I feel like the nonconformity reports could also be considered qualitative since they analyze issues.

upvoted 0 times

...

Ailene

4 months ago

I think qualitative evidence is more about subjective data, so maybe the interview with the security personnel?

upvoted 0 times

...

Angelyn

4 months ago

For this type of question, I'd recommend focusing on the key characteristics of qualitative evidence, like direct observations, interviews, and reviews of documentation. That should help me identify the best example from the options provided.

upvoted 0 times

...

Katlyn

4 months ago

Hmm, I'm a bit confused on the difference between qualitative and quantitative evidence. I'll need to review my notes to make sure I understand the distinction before answering this.

upvoted 0 times

...

Devora

5 months ago

The intrusion-detection test results seem more like quantitative evidence to me, since they involve documented metrics and measurements. I'd go with the interview as the best qualitative example.

upvoted 0 times

...

Thurman

5 months ago

I'm not sure about this one. The sample analysis of nonconformity reports seems like it could also be considered qualitative evidence since it's based on reviewing documentation.

upvoted 0 times

...

Sherita

5 months ago

I think the interview with the information security personnel would be a good example of qualitative evidence. It provides direct feedback and insights from the people involved in the process.

upvoted 0 times

...