Get real ISOIEC20000LI exam questions for better preparation

The application used by an organization has a complicated user interface. What does the complicated user interface represent in this case?

• A. An intrinsic vulnerability, since it is a characteristic of the asset
• B. A type of threat, since it may result in an unwanted incident
• C. An extrinsic vulnerability, since it is fin external factor that impacts the asset

Upon the risk assessment outcomes. Socket Inc. decided to:
* Require the use of passwords with at least 12 characters containing uppercase and lowercase letters, symbols, and numbers
* Require the change of passwords at least once every 60 days
* Keep backup copies of files on IT-provided network drives
* Assign users to a separate network when they have access to cloud storage files storing customers' personal data.
Based on the scenario above, answer the following question:
Which of the following options indicate that Socket Inc. used risk modification to treat risks?

• A. Conducting a risk assessment before deciding to use third-party services
• B. Storing customers' personal data in a cloud-based storage
• C. Requiring the change of passwords at least once every 60 days

Scenario 9: OpenTech provides IT and communications services. It helps data communication enterprises and network operators become multi-service providers During an internal audit, its internal auditor, Tim, has identified nonconformities related to the monitoring procedures He identified and evaluated several system Invulnerabilities.
Tim found out that user IDs for systems and services that process sensitive information have been reused and the access control policy has not been followed After analyzing the root causes of this nonconformity, the ISMS project manager developed a list of possible actions to resolve thenonconformity. Then, the ISMS project manager analyzed the list and selected the activities that would allow the elimination of the root cause and the prevention of a similar situation in the future. These activities were included in an action plan The action plan, approved by the top management, was written as follows:
A new version of the access control policy will be established and new restrictions will be created to ensure that network access is effectively managed and monitored by the Information and Communication Technology (ICT) Department The approved action plan was implemented and all actions described in the plan were documented.
Based on scenario 9, OpenTech has taken all the actions needed, except____________.

• A. Permanent corrections
• B. Preventive actions
• C. Corrective actions

The purpose of control 5.9 inventory of Information and other associated assets of ISO/IEC 27001 is to identify organization's information and other associated assets in order to preserve their information security and assign ownership. Which of the following actions docs NOT fulfill this purpose?

• A. Conducting regular reviews of identified information and other associated assets
• B. Assigning the responsibility for appropriately classifying and protecting information and other associated assets to the asset owners
• C. Establishing rules to control physical and logical access to Information and other associated assets

According to scenario 9, TroNlcon SPEC aimed to eliminate the causes of adverse events By focusing on:

• A. Correcting information security Incidents rather than preventing them
• B. Preventing information security incidents rather than correcting them
• C. Detecting information security incidents rather than correcting them