Discuss PECB ISO-IEC-27001-Lead-Implementer Exam Topic 4 Question 61

HealthGenic is a pediatric clinic that monitors the health and growth of individuals from infancy to early adulthood using a web-based medical software. The software is also used to schedule appointments, create customized medical reports, store patients' data and medical history, and communicate with all the [^involved parties, including parents, other physicians, and the medical laboratory staff.

Last month, HealthGenic experienced a number of service interruptions due to the increased number of users accessing the software Another issue the company faced while using the software was the complicated user interface, which the untrained personnel found challenging to use.

The top management of HealthGenic immediately informed the company that had developed the software about the issue. The software company fixed the issue; however, in the process of doing so, it modified some files that comprised sensitive information related to HealthGenic's patients. The modifications that were made resulted in incomplete and incorrect medical reports and, more importantly, invaded the patients' privacy.

Which situation presented in scenario 8 is not in compliance with ISO/IEC 27001 requirements?

AEmma has an operational role in the HealthGenic's management system

BThe recodification audit Is planned to be conducted two years after HealthGenic implemented the ISMS

CEmma had access to all offices and documentation of HealthGenic

Suggested Answer: A

Get Premium ISO-IEC-27001-Lead-Implementer Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

23 comments · newest first

Laura 10 months ago

Two years for an audit? That seems too long!

Xuan 10 months ago

Not sure if Emma's access is really the issue here.

Regenia 10 months ago

Wait, they modified sensitive patient info? That’s wild!

Odette 10 months ago

I agree, that’s not compliant with ISO standards.

Kristeen 11 months ago

Sounds like a major privacy breach!

Lynna 11 months ago

I think the main compliance issue here is about patient privacy being invaded. That seems like a clear violation of the standards we studied.

Caprice 11 months ago

I feel like the user interface issue could relate to compliance, but I can't recall if it directly ties to ISO/IEC 27001. We had a practice question about user training, though.

Onita 11 months ago

I'm not entirely sure, but I think the timing of the recodification audit could be a problem. Two years seems like a long time after implementing the ISMS.

Jonell 12 months ago

I remember we discussed the importance of access controls in ISO/IEC 27001. I think Emma having access to all offices and documentation might be a compliance issue.

Leslee 12 months ago

This is a tricky one, but I think I've got a good strategy. I'll start by identifying the key information security requirements from ISO/IEC 27001, then carefully match them up to the different issues described in the scenario. The modification of sensitive patient files seems like the most obvious violation, but I'll double-check the other options just to be sure.

Wilson 12 months ago

Hmm, I'm a bit unsure about this one. The scenario covers a lot of different problems with the software and the company's management. I'll need to review the ISO/IEC 27001 requirements closely to determine which specific situation is not in compliance. I don't want to rush into an answer without being confident I've identified the right issue.

Nikita 1 year ago

Okay, I think I've got this. The key issue here is the modification of sensitive patient files by the software company, which resulted in incomplete and incorrect medical reports and invaded patient privacy. That's clearly not in compliance with ISO/IEC 27001 requirements for information security. The other issues, like service interruptions and a complicated user interface, are more operational in nature.

Mitsue 1 year ago

This question seems straightforward, but I want to make sure I understand the key details before answering. The scenario mentions issues with the software, including service interruptions and a complicated user interface. It also mentions that the software company modified sensitive patient files, leading to privacy concerns. I'll need to carefully analyze the ISO/IEC 27001 requirements to determine which of these situations is not in compliance.

Willard 1 year ago

Haha, the 'untrained personnel' struggling with the complicated user interface is a classic scenario. But the privacy breach is definitely the big issue here. C is the answer.

Raymon 1 year ago

Hmm, the software company really messed up by modifying sensitive files. I'm going with C as the non-compliant situation.

Crista 1 year ago

↳ replying to Raymon

I agree, modifying sensitive files is a big problem.

Jamal 1 year ago

Whoa, that's a major breach of patient privacy! Option C has got to be the correct answer here.

Anika 1 year ago

The privacy breach due to the software modifications seems like a clear violation of ISO/IEC 27001 requirements. I'd go with option C on this one.

Timmy 1 year ago

True, both situations could pose risks to the security and confidentiality of the data.

Reita 1 year ago

That could also be a potential compliance issue, as access should be restricted based on roles.

Brock 1 year ago

But what about Emma having access to all offices and documentation?

Timmy 1 year ago

I agree, patient privacy is a critical aspect that should be protected.

Reita 1 year ago

I think the situation with the modified files is not in compliance with ISO/IEC 27001.

PECB ISO-IEC-27001-Lead-Implementer Exam - Topic 4 Question 61 Discussion