MENU
Which situation presented in scenario 8 is not in compliance with ISO/IEC 27001 requirements?
Suggested Answer: A
Get Premium ISO-IEC-27001-Lead-Implementer Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
40 comments · newest first
DO
Donette
10 months ago
Totally agree, B is not following ISO standards!
CA
Carrol
11 months ago
C is definitely a problem, too much access for one person.
GR
Gracia
11 months ago
Wait, two years for an audit? That seems too long!
VA
Valentin
11 months ago
I think B is the issue, audits should be more frequent.
MO
Mozell
11 months ago
Option A is compliant, Emma's role is fine.
EM
Emilio
12 months ago
I'm a bit confused about the specifics of the roles in option A; I thought operational roles had to be clearly defined, but I can't recall the details.
JA
James
12 months ago
I feel like option C raises some red flags about access control, which is a big part of ISO/IEC 27001 compliance.
CA
Carri
12 months ago
I remember a practice question about audit timelines, and I think option B could be problematic if audits are supposed to be more frequent.
TH
Thad
1 year ago
I think option A might be okay since operational roles are often part of the management system, but I'm not entirely sure.
IN
Ines
1 year ago
Ah, I see. I think option A is the correct answer. Having an operational role in the management system could compromise the independence and objectivity of the ISMS.
ST
Stefania
1 year ago
I'm pretty confident that the answer is B. The standard requires regular audits, and waiting two years seems too long to me.
EV
Evangelina
1 year ago
I'm a bit confused on this one. I'll need to re-read the scenario and the answer choices a few times to make sure I understand the requirements properly.
TA
Tambra
1 year ago
Okay, let's see. I think it might be option C, since having unrestricted access to all offices and documentation could be a security risk and violate the principle of least privilege.
SH
Sharen
1 year ago
Hmm, this one seems tricky. I'll need to carefully review the ISO/IEC 27001 requirements to determine which situation is not in compliance.
GL
Gladis
1 year ago
Hmm, this seems straightforward. I think the engineer needs to match the survey to a "normal client" since that's the typical type of client they would encounter.
LE
Letha
2 years ago
I hope the correct answer isn't 'All of the above' - that would be a real ISO/IEC 27001 plot twist!
EL
Elke
2 years ago
I agree, 'All of the above' would be a nightmare!
MA
Maryanne
2 years ago
Option C: Not conducting regular security training for employees.
GA
Gayla
2 years ago
Option B: Allowing unauthorized access to the server room.
BE
Belen
2 years ago
Option A: Storing sensitive data on unencrypted devices.
QU
Quentin
2 years ago
This question is like a game of ISO/IEC 27001 'Where's Waldo?' - gotta find that non-compliant situation!
LE
Leota
2 years ago
C) Emma had access to all offices and documentation of HealthGenic. Yikes! That's like giving the keys to the kingdom to a random employee. Not very secure.
LA
Latricia
2 years ago
B) The recodification audit Is planned to be conducted two years after HealthGenic implemented the ISMS. Ah, I see. ISO/IEC 27001 requires more frequent audits.
MA
Maira
2 years ago
A) Emma has an operational role in the HealthGenic's management system. Hmm, I don't see any issues with that. Operational roles are common in ISMS.
AR
Arlette
2 years ago
Yes, access control is crucial for maintaining compliance.
FL
Flo
2 years ago
That's a clear violation of ISO/IEC 27001 requirements.
FL
Fletcher
2 years ago
But in scenario 8, Emma also has access to sensitive information without proper authorization.
YO
Yolando
2 years ago
I agree, having an operational role in ISMS is normal.
DO
Dong
2 years ago
C) Emma had access to all offices and documentation of HealthGenic. That's a big no-no. Access should be limited based on the principle of least privilege.
IS
Isabella
2 years ago
Emma having access to everything at HealthGenic is definitely not in compliance with ISO/IEC 27001 requirements.
LO
Lonna
2 years ago
Having access to all offices and documentation is a big security risk.
ST
Stevie
2 years ago
Access should definitely be limited based on the principle of least privilege.
MA
Madelyn
2 years ago
But what about the recodification audit being planned two years later? Isn't that also a violation of ISO/IEC 27001 requirements?
AL
Alex
2 years ago
B) The recodification audit Is planned to be conducted two years after HealthGenic implemented the ISMS. This doesn't sound right. Shouldn't it be conducted more frequently?
MA
Marge
2 years ago
HealthGenic may need to review their audit schedule to ensure they are meeting ISO/IEC 27001 requirements.
TE
Terina
2 years ago
It's important to regularly assess and update the ISMS to maintain compliance with the standard.
JE
Jeanice
2 years ago
Maybe HealthGenic should consider conducting the audit annually to stay in line with ISO/IEC 27001 requirements.
TE
Tess
2 years ago
I agree, the recodification audit should be conducted more frequently to ensure compliance.
LE
Leatha
2 years ago
I agree with Lavera, that goes against the principle of least privilege.
LA
Lavera
2 years ago
I think the situation with Emma having access to all offices and documentation is not in compliance.