最も有効な ISOIEC20000LI 試験参考書

Based on scenario 7. what else should Texas H&H Inc. do when responding to the incident?

• A. Communicate the updated Information security policy only to the top management of the company
• B. Record and document the incident which serves as input for future corrective actions
• C. Decide to stop using cloud services in order to eliminate the risk of similar incidents happening in the future

How can Invalid Electric's ensure that Us employees are prepared for the audit?

• A. By allowing the employees to observe the technologies used
• B. By showing the employees the internal audit reports so they can anticipate the questions asked by the auditor
• C. By conducting practice Interviews with the employees

If an organization wants to monitor operations in real time and notify users about deviations, which type of dashboard should be used?

• A. Operational dashboard
• B. Tactical dashboard
• C. Strategic dashboard

Scenario 4: TradeB. a commercial bank that has just entered the market, accepts deposits from its clients and offers basic financial services and loans for investments. TradeB has decided to implement an information security management system (ISMS) based on ISO/IEC 27001 Having no experience of a management
[^system implementation, TradeB's top management contracted two experts to direct and manage the ISMS implementation project.
First, the project team analyzed the 93 controls of ISO/IEC 27001 Annex A and listed only the security controls deemed applicable to the company and their objectives Based on this analysis, they drafted the Statement of Applicability. Afterward, they conducted a risk assessment, during which they identified assets, such as hardware, software, and networks, as well as threats and vulnerabilities, assessed potential consequences and likelihood, and determined the level of risks based on three nonnumerical categories (low, medium, and high). They evaluated the risks based on the risk evaluation criteria and decided to treat only the high risk category They also decided to focus primarily on the unauthorized use of administrator rights and system interruptions due to several hardware failures by establishing a new version of the access control policy, implementing controls to manage and control user access, and implementing a control for ICT readiness for business continuity Lastly, they drafted a risk assessment report, in which they wrote that if after the implementation of these security controls the level of risk is below the acceptable level, the risks will be accepted Based on scenario 4, the fact that TradeB defined the level of risk based on three nonnumerical categories indicates that;

• A. The level of risk will be evaluated against qualitative criteria
• B. The level of risk will be evaluated using quantitative analysis
• C. The level of risk will be defined using a formula

Employees of the Finance Department did not fully understand the awareness sessions. What should TradeB do to avoid similar situations in the future? Refer to scenario 6.

• A. Consider self-studies as the type of activities needed to address the competence gaps
• B. Extend the duration of the training and awareness session
• C. Adjust awareness sessions to the target audience based on the activities they perform within the company