[2025年12月17日] 365日無料更新ISO-IEC-27035-Lead-Incident-Manager知能問題集をゲット
ベスト品質のPECB ISO-IEC-27035-Lead-Incident-Manager試験問題
質問 # 12
When does the information security incident management plan come into effect?
- A. After a security audit is completed
- B. When a security vulnerability is reported
- C. When a new security policy is drafted
正解：B
解説：
Comprehensive and Detailed Explanation From Exact Extract:
According to ISO/IEC 27035-1 and 27035-2, the incident management plan is activated upon the detection or reporting of a security event, particularly when a vulnerability, threat, or compromise has been identified. The plan ensures structured response and accountability from the very first signs of a potential incident.
Clause 6.4.2 in ISO/IEC 27035-2 explains that incident response activities-including logging, categorization, assessment, and escalation-should begin as soon as a security incident or vulnerability is reported. This proactive trigger allows early containment and mitigation.
Security audits and policy drafts (Options A and B) are part of preventive or governance mechanisms, not operational triggers for activating the plan.
Reference Extracts:
ISO/IEC 27035-2:2016, Clause 6.4.2: "The incident management plan should be activated once a security incident or significant vulnerability is identified and reported." Clause 5.1: "Detection and reporting are the initial steps in triggering the formal incident management lifecycle." Correct answer: C
質問 # 13
Which of the following is NOT an example of technical control?
- A. Implementing a policy for regular password changes
- B. Installing a firewall to protect the network
- C. Implementing surveillance cameras
正解：A
解説：
Comprehensive and Detailed Explanation From Exact Extract:
According to ISO/IEC 27002:2022 (and earlier versions), information security controls can be broadly categorized into three types: technical (also called logical), physical, and administrative (or organizational) controls.
Technical controls (also known as logical controls) involve the use of software and hardware to protect assets.
Examples include:
Firewalls
Intrusion detection systems
Encryption
Access control mechanisms
Physical controls are designed to prevent physical access to IT systems and include things such as:
Surveillance cameras
Security guards
Biometric access systems
Administrative controls, also called management or procedural controls, include the policies, procedures, and guidelines that govern the organization's security practices. These include:
Security awareness training
Acceptable use policies
Password policies
Option A, "Implementing a policy for regular password changes," is an administrative control, not a technical one. It dictates user behavior through rules and policy enforcement, but does not technically enforce the change itself unless paired with technical enforcement (like system settings).
Option B, surveillance cameras, are physical controls, and option C, installing a firewall, is a classic example of a technical control.
Reference Extracts:
ISO/IEC 27002:2022, Clause 5.1 - "Information security controls can be administrative (policy-based), technical, or physical depending on their form and implementation." NIST SP 800-53, Control Families - Differentiates between management, operational, and technical controls.
Therefore, the correct answer is A: Implementing a policy for regular password changes.
-
質問 # 14
What is the primary function of a single type of IRT?
- A. Enhancing the reliability of incident response activities
- B. Monitoring targets from remote locations
- C. Managing incidents within a specified organization
正解：C
解説：
Comprehensive and Detailed Explanation From Exact Extract:
A single-type Incident Response Team (IRT), as defined in ISO/IEC 27035-1:2016, is responsible for managing and coordinating incident response within a specific organization or business unit. Its scope typically covers the entire lifecycle of incident handling-preparation, detection, containment, response, recovery, and lessons learned-focused solely on the needs of that particular entity.
This contrasts with a coordinating or multi-party IRT, which may support multiple organizations or coordinate between units. While Option A is a byproduct of a well-functioning IRT, it is not its core function.
Option B (monitoring) may fall under a SOC, but not the primary function of a single IRT.
Reference Extracts:
ISO/IEC 27035-1:2016, Clause 6.5.1: "An organization may establish a single IRT responsible for handling all incidents affecting the organization." ISO/IEC 27035-2:2016, Clause 6.2.3: "Single IRTs typically manage incidents internally and directly support the organization's response processes." Correct answer: C
-
質問 # 15
Scenario 1: RoLawyers is a prominent legal firm based in Guadalajara, Mexico. It specializes in a wide range of legal services tailored to meet the diverse needs of its clients. Committed to excellence and integrity, RoLawyers has a reputation for providing legal representation and consultancy to individuals, businesses, and organizations across various sectors.
Recognizing the critical importance of information security in today's digital landscape, RoLawyers has embarked on a journey to enhance its information security measures. This company is implementing an information security incident management system aligned with ISO/IEC 27035-1 and ISO/IEC 27035-2 guidelines. This initiative aims to strengthen RoLawyers' protections against possible cyber threats by implementing a structured incident response process to provide guidance on establishing and maintaining a competent incident response team.
After transitioning its database from physical to online infrastructure to facilitate seamless information sharing among its branches, RoLawyers encountered a significant security incident. A malicious attack targeted the online database, overloading it with traffic and causing a system crash, making it impossible for employees to access it for several hours.
In response to this critical incident, RoLawyers quickly implemented new measures to mitigate the risk of future occurrences. These measures included the deployment of a robust intrusion detection system (IDS) designed to proactively identify and alert the IT security team of potential intrusions or suspicious activities across the network infrastructure. This approach empowers RoLawyers to respond quickly to security threats, minimizing the impact on their operations and ensuring the continuity of its legal services.
By being proactive about information security and incident management, RoLawyers shows its dedication to protecting sensitive data, keeping client information confidential, and earning the trust of its stakeholders.
Using the latest practices and technologies, RoLawyers stays ahead in legal innovation and is ready to handle cybersecurity threats with resilience and careful attention.
According to scenario 1, what information security incident did RoLawyers face?
- A. Denial-of-service attack
- B. Malware attack
- C. Man-in-the-middle attack
正解：A
解説：
Comprehensive and Detailed Explanation From Exact Extract:
According to ISO/IEC 27035-1:2016, an information security incident is any event that compromises the confidentiality, integrity, or availability of information. In this scenario, RoLawyers experienced an attack where their online database was overloaded with excessive traffic, resulting in a system crash. This incident made it impossible for employees to access the database for several hours.
This type of event is characteristic of a Denial-of-Service (DoS) attack. ISO/IEC 27035-1 Annex B provides examples of typical incidents, and one example includes "network-based attacks, including denial-of-service attacks." A DoS attack typically aims to make a service or resource unavailable to its intended users by overwhelming it with traffic.
There is no indication in the scenario that the attackers were intercepting communications (as would be seen in a Man-in-the-Middle attack) or installing malware to damage or steal data. The nature of the attack- excess traffic causing a crash-clearly aligns with the definition of a DoS attack.
Reference Extracts:
ISO/IEC 27035-1:2016, Clause B.2.1 (Examples of incident types): "Denial-of-service (DoS) attacks cause disruption or degradation of services." ISO/IEC 27035-1:2016, Clause 4.1: "An incident can result from deliberate attacks such as DoS, malicious code, or unauthorized access." Therefore, the incident faced by RoLawyers was a Denial-of-Service attack.
-
質問 # 16
Which document provides guidelines for planning and preparing for incident response and for learning lessons from the incident response process?
- A. ISO/IEC 27035-1
- B. ISO/IEC 27037
- C. ISO/IEC 27035-2
正解：C
解説：
Comprehensive and Detailed Explanation From Exact Extract:
ISO/IEC 27035-2:2016 is titled "Information security incident management - Part 2: Guidelines to plan and prepare for incident response." This document provides detailed guidance on establishing an incident response capability, planning for incident response, and implementing effective response actions. It also emphasizes the importance of post-incident analysis and lessons learned to improve future incident handling.
Key activities covered in ISO/IEC 27035-2 include:
* Planning and preparing for incident handling (e.g., policy development, roles and responsibilities)
* Establishing and training the incident response team (IRT)
* Developing communication strategies and escalation procedures
* Conducting root cause analysis and collecting lessons learned
* Applying improvements to prevent recurrence
By contrast:
* ISO/IEC 27035-1 provides high-level principles of incident management (Part 1: Principles).
* ISO/IEC 27037 relates to the handling of digital evidence and is focused more on forensic practices than incident response preparation.
Reference Extracts:
* ISO/IEC 27035-2:2016, Introduction: "This part provides guidance on the planning and preparation necessary for effective incident response and for learning lessons from incidents."
* ISO/IEC 27035-2:2016, Clause 6.5: "Lessons learned and reporting can help improve future incident response and provide input to risk assessments and control improvements."
質問 # 17
Scenario 5: Located in Istanbul. Turkey. Alura Hospital is a leading medical institution specializing in advanced eye surgery and vision care. Renowned for its modern facilities, cutting edge technology, and highly skilled staff, Alura Hospital is committed to delivering exceptional patient care. Additionally, Alura Hospital has implemented the ISO/IEC 27035 standards to enhance its information security incident management practices.
At Alura Hospital, the information security incident management plan is a critical component of safeguarding patient data and maintaining the integrity of its medical services This comprehensive plan includes instructions for handling vulnerabilities discovered during incident management According to this plan, when new vulnerabilities are discovered, Mehmet is appointed as the incident handler and is authorized to patch the vulnerabilities without assessing their potential impact on the current incident, prioritizing patient data security above all else Recognizing the importance of a structured approach to incident management. Alura Hospital has established four teams dedicated to various aspects of incident response The planning team focuses on implementing security processes and communicating with external organizations The monitoring team is responsible for security patches, upgrades, and security policy implementation The analysis team adjusts risk priorities and manages vulnerability reports, while the test and evaluation team organizes and performs incident response tests to ensure preparedness During an incident management training session, staff members at Alura Hospital were provided with clear roles and responsibilities. However, a technician expressed uncertainty about their role during a data integrity incident as the manager assigned them a role unrelated to their expertise. This decision was made to ensure that all staff members possess versatile skills and are prepared to handle various scenarios effectively.
Additionally. Alura Hospital realized it needed to communicate better with stakeholders during security incidents. The hospital discovered it was not adequately informing stakeholders and that relevant information must be provided using formats, language, and media that meet their needs. This would enable them to participate fully in the incident response process and stay informed about potential risks and mitigation strategies.
Also, the hospital has experienced frequent network performance issues affecting critical hospital systems and increased sophisticated cyber attacks designed to bypass traditional security measures. So, it has deployed an external firewall. This action is intended to strengthen the hospital s network security by helping detect threats that have already breached the perimeter defenses. The firewall's implementation is a part of the hospital's broader strategy to maintain a robust and secure IT infrastructure, which is crucial for protecting sensitive patient data and ensuring the reliability of critical hospital systems. Alura Hospital remains committed to integrating state-of-the-art technology solutions to uphold the highest patient care and data security standards.
Based on scenario 5, the responsibilities of which team in Alura Hospital were NOT defined correctly?
- A. The monitoring team
- B. The planning team
- C. The analysis team
正解：B
解説：
Comprehensive and Detailed Explanation:
ISO/IEC 27035-2:2016 clearly outlines functional responsibilities for various roles in the incident management structure. The issue in the scenario lies in the description of the planning team.
The planning team, per ISO guidance, should focus on policy development, incident readiness planning, role assignments, and maintaining readiness through simulations and updates-not on communicating with external parties (which typically falls under the remit of the communications or coordination function within the incident response team).
Monitoring and analysis team responsibilities-such as applying patches, managing risk priorities, and analyzing vulnerabilities-are accurately described.
Reference:
ISO/IEC 27035-2:2016, Clause 5.2.3 - "The planning function should be responsible for developing and maintaining the plan, identifying resource needs, and ensuring team training." Correct answer: A
-
質問 # 18
Which of the following statements regarding the principles for digital evidence gathering is correct?
- A. Relevance means that the DEFR should be able to describe the procedures followed and justify the decision to acquire each item based on its value to the investigation
- B. Reliability implies that all processes used in handling digital evidence should be unique and not necessarily reproducible
- C. Sufficiency means that only a minimal amount of material should be gathered to avoid unnecessary auditing and justification efforts
正解：A
解説：
Comprehensive and Detailed Explanation From Exact Extract:
Digital evidence gathering, as outlined in ISO/IEC 27037 and referenced in ISO/IEC 27035-2, must adhere to several core principles-reliability, sufficiency, relevance, and integrity. Relevance, in particular, means that the Digital Evidence First Responder (DEFR) must ensure that any item collected has direct or potential bearing on the investigation.
Relevance also requires:
Clear justification for why an item was acquired
Ability to trace the decision-making process
Alignment with investigation objectives
Option A misrepresents "sufficiency," which does not mean minimal collection but rather collecting enough evidence to support conclusions without overburdening the investigation. Option B contradicts the principle of reliability, which requires that processes be standardized and reproducible.
Reference:
ISO/IEC 27037:2012, Clause 6.2.2.4: "Relevance is determined by the value of the digital evidence in addressing the objectives of the investigation." ISO/IEC 27035-2:2016 references this standard in Clause 7.4.4 regarding forensic evidence handling.
Correct answer: C
-
質問 # 19
Scenario 4: ORingo is a company based in Krakow, Poland, specializing in developing and distributing electronic products for health monitoring and heart rate measurement applications. With a strong emphasis on innovation and technological advancement, ORingo has established itself as a trusted provider of high-quality, reliable devices that enhance the well being and healthcare capabilities of individuals and healthcare professionals alike.
As part of its commitment to maintaining the highest standards of information security, ORingo has established an information security incident management process This process aims to ensure that any potential threats are swiftly identified, assessed, and addressed to protect systems and information. However, despite these measures, an incident response team member at ORingo recently detected a suspicious state in their systems operational data, leading to the decision to shut down the company-wide system until the anomaly could be thoroughly investigated Upon detecting the threat, the company promptly established an incident response team to respond to the incident effectively. The team's responsibilities encompassed identifying root causes, uncovering hidden vulnerabilities, and implementing timely resolutions to mitigate the impact of the incident on ORingo's operations and customer trust.
In response to the threat detected across its cloud environments. ORingo employed a sophisticated security tool that broadened the scope of incident detection and mitigation This tool covers network traffic, doud environments, and potential attack vectors beyond traditional endpoints, enabling ORingo to proactively defend against evolving cybersecurity threats During a routine check, the IT manager at ORingo discovered that multiple employees lacked awareness of proper procedures following the detection of a phishing email. In response, immediate training sessions on information security policies and incident response were scheduled for all employees, emphasizing the importance of vigilance and adherence to established protocols in safeguarding ORingo's sensitive data and assets.
As part of the training initiative. ORingo conducted a simulated phishing attack exercise to assess employee response and knowledge. However, an employee inadvertently informed an external partner about the 'attack'' during the exercise, highlighting the importance of ongoing education and reinforcement of security awareness principles within the organization.
Through its proactive approach to incident management and commitment to fostering a culture of security awareness and readiness. ORingo reaffirms its dedication to safeguarding the integrity and confidentiality of its electronic products and ensuring the trust and confidence of its customers and stakeholders worldwide.
Based on scenario 4, are the responsibilities of the incident response team (IRT) established according to the ISO/IEC 27035-2 guidelines?
- A. Yes, IRT's responsibilities include identifying root causes, discovering hidden vulnerabilities, and resolving incidents quickly to minimize their impact
- B. No, the responsibilities of IRT also include assessing events and declaring incidents
- C. No, the responsibilities of IRT do not include resolving incidents
正解：B
解説：
Comprehensive and Detailed Explanation:
ISO/IEC 27035-2:2016 outlines comprehensive responsibilities for an incident response team, which include not just response and mitigation but also:
Assessing and classifying reported events
Determining if they qualify as incidents
Coordinating containment, eradication, and recovery actions
Conducting root cause analysis and lessons learned
While the scenario highlights the team's strengths in root cause analysis and resolution, it omits one key responsibility: the proper assessment and classification of the anomaly before response. This makes option C the most accurate.
Reference:
ISO/IEC 27035-2:2016, Clause 5.2.2 - "The IRT should assess events, determine whether they are incidents, and take appropriate actions." Therefore, the correct answer is C.
-
質問 # 20
What is the primary objective of an awareness program?
- A. Introducing new security technology to the IT department
- B. Reinforcing or modifying behavior and attitudes toward security
- C. Enhancing the efficiency of the company's IT infrastructure
正解：B
解説：
Comprehensive and Detailed Explanation From Exact Extract:
The core purpose of a security awareness program, as outlined in ISO/IEC 27035 and ISO/IEC 27001, is to influence behavior and attitudes toward security, making staff more conscious of threats and their responsibilities in preventing incidents. An effective awareness program helps reduce human errors, enhances response readiness, and builds a security-conscious culture.
ISO/IEC 27035-2:2016 clearly differentiates awareness from training. While training focuses on skills and procedures, awareness is about shaping the mindset, ensuring that employees understand the importance of security in their daily tasks.
Option A (technology introduction) and option C (IT efficiency) are not primary goals of awareness programs.
Reference Extracts:
ISO/IEC 27035-2:2016, Clause 7.3.1: "The objective of awareness activities is to change behavior and enhance understanding of security threats and how to prevent them." ISO/IEC 27001:2022, Control 6.3 and Annex A: "Personnel should be made aware of the importance of information security and their responsibilities in supporting it." Correct answer: B
-
質問 # 21
How should vulnerabilities lacking corresponding threats be handled?
- A. They may not require controls but should be analyzed and monitored for changes
- B. They still require controls and should be promptly addressed
- C. They should be disregarded as they pose no risk
正解：A
解説：
Comprehensive and Detailed Explanation From Exact Extract:
According to ISO/IEC 27005:2018 (which supports ISO/IEC 27035 in risk management and threat assessment processes), vulnerabilities that are not currently associated with known threats do not necessarily need immediate remediation or technical control measures. However, they cannot be ignored entirely either.
Such vulnerabilities may not pose an active risk at the present time, but that can change quickly if a new threat emerges that can exploit them. Therefore, these vulnerabilities should be documented, assessed in context, and monitored over time. This process ensures that if the threat landscape evolves, the organization can respond proactively.
The standard emphasizes a risk-based approach, which includes:
* Analyzing vulnerabilities in relation to assets and threat likelihood
* Monitoring the environment for changes that may introduce new threats
* Avoiding unnecessary or unjustified resource expenditure on low-risk issues Option A is incorrect because it suggests addressing all vulnerabilities without considering risk context.
Option B is risky and contradicts ISO best practices, which emphasize continuous risk monitoring.
Reference Extracts:
* ISO/IEC 27005:2018, Clause 8.2.2: "Vulnerabilities without known threats may not require treatment immediately but should be monitored regularly."
* ISO/IEC 27001:2022, Annex A, Control A.8.8 - "Management of technical vulnerabilities should be risk- based and responsive to changes." Therefore, the correct answer is C: They may not require controls but should be analyzed and monitored for changes.
-
質問 # 22
According to scenario 4, what is the next action ORingo should take to prevent escalation when conducting exercises?
- A. Proceed with the exercise as planned, considering this as a part of the learning process
- B. Wait until the exercise is completed to clarify the situation with all parties involved
- C. Inform all participants and external entities involved that this was a simulated scenario and not a real threat immediately
正解：C
解説：
Comprehensive and Detailed Explanation:
According to ISO/IEC 27035-2:2016, incident response exercises (including simulations such as phishing campaigns) must be carefully controlled to avoid confusion, escalation, or reputational damage. If an exercise is misunderstood by employees or external parties, it could lead to unintended consequences including external escalation, customer concern, or media involvement.
The best practice is to ensure that all involved-especially external stakeholders-are informed as soon as possible if they are exposed to simulated elements. Transparency ensures the organization maintains trust and mitigates potential fallout. This is part of effective communication during planned exercises.
Reference:
ISO/IEC 27035-2:2016, Clause 7.5 - "Exercises should be clearly identified, controlled, and followed by communication plans that inform affected parties of their simulated nature." Correct answer: C
-
質問 # 23
Who is responsible for providing threat intelligence and supporting the lead investigator within an incident response team?
- A. Team leader
- B. IT support staff
- C. Analysts and researchers
正解：C
解説：
Comprehensive and Detailed Explanation From Exact Extract:
In an Incident Response Team (IRT), analysts and researchers are responsible for threat intelligence, data analysis, malware investigation, and providing in-depth technical insights. Their work directly supports the lead investigator by identifying root causes, attack vectors, indicators of compromise (IOCs), and evaluating threat actor tactics.
According to ISO/IEC 27035-2:2016, these roles are part of the broader support functions within an IRT and are crucial for technical depth and timely resolution of incidents.
Option A (IT support staff) may provide infrastructure-level assistance but typically lacks threat analysis capabilities. Option C (team leader) oversees coordination and communication but is not the primary intelligence resource.
Reference Extracts:
ISO/IEC 27035-2:2016, Clause 7.2.3: "Support roles may include malware analysts, forensic experts, and threat intelligence researchers." ENISA CSIRT Training Guide: "Analysts contribute to ongoing investigations by identifying attack patterns and supporting mitigation decisions." Correct answer: B
-
質問 # 24
Scenario 3: L&K Associates is a graphic design firm headquartered in Johannesburg, South Africa. It specializes in providing innovative and creative design solutions to clients across various industries. With offices in multiple parts of the country, they effectively serve clients, delivering design solutions that meet their unique needs and preferences.
In its commitment to maintaining information security, L&K Associates is implementing an information security incident management process guided by ISO/IEC 27035-1 and ISO/IEC 27035-2. Leona, the designated leader overseeing the implementation of the incident management process, customized the scope of incident management to align with the organization's unique requirements. This involved specifying the IT systems, services, and personnel involved in the incident management process while excluding potential incident sources beyond those directly related to IT systems and services.
Based on the scenario above, answer the following question:
Is the incident management scope correctly determined at L&K Associates?
- A. No, the incident management scope is overly restrictive, excluding potential incident sources beyond those directly related to IT systems and services
- B. No, the incident management scope is too broad, encompassing all IT systems regardless of relevance
- C. Yes, the incident management scope is customized to align with the organization's unique needs
正解：C
解説：
Comprehensive and Detailed Explanation From Exact Extract:
ISO/IEC 27035-1:2016 encourages organizations to define the scope of incident management based on their own risk environment, business model, and available resources. This scope should be tailored to focus on the systems, services, and personnel that are most critical and relevant to the organization's operations.
In this scenario, Leona appropriately aligned the scope with L&K Associates' specific IT infrastructure and business processes, deliberately including relevant IT systems and associated personnel while excluding unrelated sources. This customization is consistent with best practices and ensures that the incident management process remains focused, efficient, and manageable.
ISO/IEC 27035-2, Clause 4.2, emphasizes that "the scope of incident management should be defined in a way that it supports the organization's objectives and risk environment." Therefore, the correct answer is A: Yes, the incident management scope is customized to align with the organization's unique needs.
-
質問 # 25
What is the purpose of incident categorization within the incident management lifecycle?
- A. To automatically assign incidents to technicians
- B. To sort incidents based on the disrupted IT or business domain
- C. To determine the priority of incidents
正解：B
解説：
Comprehensive and Detailed Explanation From Exact Extract:
According to ISO/IEC 27035-1:2016 and ISO/IEC 27035-2:2016, incident categorization is a vital step in the incident management lifecycle. Its primary purpose is to sort and group incidents based on specific criteria so that appropriate actions and escalation paths can be taken.
One of the core objectives of categorization is to sort incidents by the domain or system affected - whether it' s a database, email system, network, or physical server. This enables organizations to assign incidents to relevant subject matter experts and apply the right procedures, based on the affected business function or IT component.
While categorization can influence prioritization (option A), the main intent is classification based on nature and domain. Automatic technician assignment (option B) may be supported by some service management platforms but is not the foundational purpose of incident categorization under ISO 27035.
Reference Extracts:
ISO/IEC 27035-1:2016, Clause 6.1.2 - "Categorization should identify the domain or component affected to enable appropriate response and escalation." ISO/IEC 27035-2:2016, Clause 7.3 - "Incidents should be categorized based on the type of disruption they cause and the business or technical domain they impact." Therefore, the correct answer is C: To sort incidents based on the disrupted IT or business domain.
-
質問 # 26
What can documenting recovery options and associated data loss/recovery timeframes assist with during incident response?
- A. Making informed decisions about containment and recovery
- B. Minimizing the impact on system performance
- C. Accelerating the incident response process
正解：A
解説：
Comprehensive and Detailed Explanation From Exact Extract:
Documenting recovery options and estimating recovery time objectives (RTOs) and data loss tolerances (Recovery Point Objectives - RPOs) is a crucial planning activity that supports decision-making during the containment and recovery phases. ISO/IEC 27035-2:2016, Clause 6.4.6 emphasizes that such documentation allows teams to:
Evaluate trade-offs between containment scope and data loss
Determine acceptable downtime for critical services
Select the most appropriate recovery strategy based on business impact
This documentation supports strategic thinking rather than rushed action, reducing the likelihood of costly decisions. It does not necessarily accelerate the process (Option C), nor is it designed to optimize performance (Option A).
Reference:
ISO/IEC 27035-2:2016, Clause 6.4.6: "Recovery planning should consider documented recovery procedures, acceptable data loss, and system downtime to support business continuity." Correct answer: B
質問 # 27
What is a key activity in the response phase of information security incident management?
- A. Restoring systems to normal operation
- B. Logging all activities, results, and related decisions for later analysis
- C. Ensuring the change control regime covers information security incident tracking
正解：B
解説：
Comprehensive and Detailed Explanation From Exact Extract:
During the response phase, one of the most critical activities-according to ISO/IEC 27035-1 and 27035-2- is the documentation of actions, decisions, and results. Clause 6.4.6 of ISO/IEC 27035-1 emphasizes that all activities must be logged to support post-incident analysis, audit trails, and lessons learned. This ensures that:
Accountability is maintained
Decisions can be reviewed
Investigations are legally sound (especially in regulated environments) While restoring systems (Option C) typically occurs in the recovery phase, logging activities and outcomes is essential during the actual response. Change control processes (Option B) are supporting functions but are not core to the immediate response phase.
Reference:
ISO/IEC 27035-1:2016, Clause 6.4.6: "All incident response actions and decisions should be recorded to enable traceability and facilitate future improvement." Correct answer: A
-
質問 # 28
Scenario 8: Moneda Vivo, headquartered in Kuala Lumpur. Malaysia, is a distinguished name in the banking sector. It is renowned for its innovative approach to digital banking and unwavering commitment to information security. Moneda Vivo stands out by offering various banking services designed to meet the needs of its clients. Central to its operations is an information security incident management process that adheres to the recommendations of ISO/IEC 27035-1 and 27035-2.
Recently. Moneda Vivo experienced a phishing attack aimed at its employees Despite the bank's swift identification and containment of the attack, the incident led to temporary service outages and data access issues, underscoring the need for improved resilience The response team compiled a detailed review of the attack, offering valuable insights into the techniques and entry points used and identifying areas for enhancing their preparedness.
Shortly after the attack, the bank strengthened its defense by implementing a continuous review process to ensure its incident management procedures and systems remain effective and appropriate While monitoring the incident management process, a trend became apparent. The mean time between similar incidents decreased after a few occurrences; however, Moneda Vivo strategically ignored the trend and continued with regular operations This decision was rooted in a deep confidence in its existing security measures and incident management protocols, which had proven effective in quick detection and resolution of issues Moneda Vivo's commitment to transparency and continual improvement is exemplified by its utilization of a comprehensive dashboard. This tool provides real time insights into the progress of its information security incident management, helping control operational activities and ensure that processes stay within the targets of productivity, quality, and efficiency. However, securing its digital banking platform proved challenging.
Following a recent upgrade, which included a user interface change to its digital banking platform and a software update, Moneda Vivo recognized the need to immediately review its incident management process for accuracy and completeness. The top management postponed the review due to financial and time constraints.
Based on scenario 8, Moneda Vivo has recently upgraded its digital banking platform. In line with the continual improvement process, Moneda Vivo has decided to review the information security incident management process for accuracy immediately after the software update. Is this recommended?
- A. Yes, the incident management process should be reviewed after any minor software update
- B. No, the incident management process should be evaluated after a significant technological overhaul to ensure the system is up-to-date
- C. No, the incident management process should be reviewed when the bank's annual audit is conducted
正解：B
解説：
Comprehensive and Detailed Explanation From Exact Extract:
According to ISO/IEC 27035-1:2016, Clause 7.1 and ISO/IEC 27035-2:2016, Clause 7.3.3, it is advised to review and revise the information security incident management process following major organizational or technical changes. These changes include upgrades, system overhauls, and structural IT shifts. While minor updates may not necessitate a full review, significant technological updates, such as those affecting core digital banking platforms, should trigger immediate evaluation to ensure continued relevance and effectiveness of incident response strategies.
In the scenario, Moneda Vivo recognized the need for a review but delayed it, which could pose risks. Option C accurately reflects ISO guidance.
Reference:
ISO/IEC 27035-1:2016 Clause 7.1: "Reviews should be performed after major changes or after information security incidents." ISO/IEC 27035-2:2016 Clause 7.3.3 Correct answer: C
-
質問 # 29
Scenario 4: ORingo is a company based in Krakow, Poland, specializing in developing and distributing electronic products for health monitoring and heart rate measurement applications. With a strong emphasis on innovation and technological advancement, ORingo has established itself as a trusted provider of high-quality, reliable devices that enhance the well being and healthcare capabilities of individuals and healthcare professionals alike.
As part of its commitment to maintaining the highest standards of information security, ORingo has established an information security incident management process This process aims to ensure that any potential threats are swiftly identified, assessed, and addressed to protect systems and information. However, despite these measures, an incident response team member at ORingo recently detected a suspicious state in their systems operational data, leading to the decision to shut down the company-wide system until the anomaly could be thoroughly investigated Upon detecting the threat, the company promptly established an incident response team to respond to the incident effectively. The team's responsibilities encompassed identifying root causes, uncovering hidden vulnerabilities, and implementing timely resolutions to mitigate the impact of the incident on ORingo's operations and customer trust.
In response to the threat detected across its cloud environments. ORingo employed a sophisticated security tool that broadened the scope of incident detection and mitigation This tool covers network traffic, doud environments, and potential attack vectors beyond traditional endpoints, enabling ORingo to proactively defend against evolving cybersecurity threats During a routine check, the IT manager at ORingo discovered that multiple employees lacked awareness of proper procedures following the detection of a phishing email. In response, immediate training sessions on information security policies and incident response were scheduled for all employees, emphasizing the importance of vigilance and adherence to established protocols in safeguarding ORingo's sensitive data and assets.
As part of the training initiative. ORingo conducted a simulated phishing attack exercise to assess employee response and knowledge. However, an employee inadvertently informed an external partner about the 'attack'' during the exercise, highlighting the importance of ongoing education and reinforcement of security awareness principles within the organization.
Through its proactive approach to incident management and commitment to fostering a culture of security awareness and readiness. ORingo reaffirms its dedication to safeguarding the integrity and confidentiality of its electronic products and ensuring the trust and confidence of its customers and stakeholders worldwide.
According to scenario 4, in response to a detected threat across its cloud environments, which tool did ORingo utilize to extend its threat detection and response capabilities beyond traditional endpoints?
- A. XDR
- B. SIEM
- C. IPS
正解：A
解説：
Comprehensive and Detailed Explanation:
XDR (Extended Detection and Response) is a security solution that integrates and correlates data across multiple domains including endpoints, networks, cloud workloads, and more. In the scenario, the tool is described as capable of covering network traffic, cloud environments, and beyond-characteristics that align directly with the capabilities of XDR.
IPS (Intrusion Prevention System) focuses narrowly on network perimeter security.
SIEM (Security Information and Event Management) is primarily focused on log aggregation and analysis rather than real-time detection and automated response across multiple layers.
Reference:
NIST SP 800-207 and modern security frameworks define XDR as a centralized detection and response platform with cross-domain visibility.
Therefore, the correct answer is A: XDR
-
質問 # 30
Scenario 6: EastCyber has established itself as a premier cyber security company that offers threat detection, vulnerability assessment, and penetration testing tailored to protect organizations from emerging cyber threats. The company effectively utilizes ISO/IEC 27035*1 and 27035-2 standards, enhancing its capability to manage information security incidents.
EastCyber appointed an information security management team led by Mike Despite limited resources, Mike and the team implemented advanced monitoring protocols to ensure that every device within the company's purview is under constant surveillance This monitoring approach is crucial for covering everything thoroughly, enabling the information security and cyber management team to proactively detect and respond to any sign of unauthorized access, modifications, or malicious activity within its systems and networks.
In addition, they focused on establishing an advanced network traffic monitoring system This system carefully monitors network activity, quickly spotting and alerting the security team to unauthorized actions This vigilance is pivotal in maintaining the integrity of EastCyber's digital infrastructure and ensuring the confidentiality, availability, and integrity of the data it protects.
Furthermore, the team focused on documentation management. They meticulously crafted a procedure to ensure thorough documentation of information security events. Based on this procedure, the company would document only the events that escalate into high-severity incidents and the subsequent actions. This documentation strategy streamlines the incident management process, enabling the team to allocate resources more effectively and focus on incidents that pose the greatest threat.
A recent incident involving unauthorized access to company phones highlighted the critical nature of incident management. Nate, the incident coordinator, quickly prepared an exhaustive incident report. His report detailed an analysis of the situation, identifying the problem and its cause. However, it became evident that assessing the seriousness and the urgency of a response was inadvertently overlooked.
In response to the incident, EastCyber addressed the exploited vulnerabilities. This action started the eradication phase, aimed at systematically eliminating the elements of the incident. This approach addresses the immediate concerns and strengthens EastCyber's defenses against similar threats in the future.
Scenario 6: EastCyber has established itself as a premier cybersecurity company that offers threat detection, vulnerability assessment, and penetration testing tailored to protect organizations from emerging cyber threats. The company effectively utilizes ISO/IEC 27035-1 and 27035-2 standards, enhancing its capability to manage information security incidents.
EastCyber appointed an information security management team led by Mike. Despite limited resources, Mike and the team implemented advanced monitoring protocols to ensure that every device within the company's purview is under constant surveillance. This monitoring approach is crucial for covering everything thoroughly, enabling the information security and cyber management team to proactively detect and respond to any sign of unauthorized access, modifications, or malicious activity within its systems and networks.
Based on the scenario above, answer the following question:
While implementing monitoring protocols, Mike ensured that every device within the company's purview was under constant surveillance. Is this a recommended practice?
- A. Yes. Mike defined the objective of network monitoring correctly
- B. No, Mike should have focused on new devices, as they are more likely to have undetected vulnerabilities
- C. No, Mike should have focused on the essential components to reduce the clutter and noise in the data collected
正解：A
解説：
Comprehensive and Detailed Explanation From Exact Extract:
According to ISO/IEC 27035-2:2016, Clause 7.3.2, implementing continuous monitoring across all critical assets and endpoints is a key component of proactive incident detection. Organizations are encouraged to establish real-time detection mechanisms that allow prompt identification of unauthorized or abnormal behavior.
Mike's approach-ensuring all systems are under constant surveillance-is consistent with this recommendation. Comprehensive monitoring allows the early identification of security events that may otherwise go unnoticed, especially in environments where advanced persistent threats (APTs) or insider threats are concerns.
While focusing only on new devices or limiting monitoring to certain components may reduce noise, it creates gaps in coverage and increases the risk of missed threats.
Reference:
ISO/IEC 27035-2:2016, Clause 7.3.2: "Monitoring systems and activities should be established and maintained to detect deviations that may indicate a security incident." ISO/IEC 27001:2022, Control A.5.28: "Monitoring systems should cover all devices that process or store sensitive information." Correct answer: A
-
質問 # 31
Scenario 3: L&K Associates is a graphic design firm headquartered in Johannesburg, South Africa. It specializes in providing innovative and creative design solutions to clients across various industries. With offices in multiple parts of the country, they effectively serve clients, delivering design solutions that meet their unique needs and preferences.
In its commitment to maintaining information security, L&K Associates is implementing an information security incident management process guided by ISO/IEC 27035-1 and ISO/IEC 27035-2. Leona, the designated leader overseeing the implementation of the incident management process, customized the scope of incident management to align with the organization's unique requirements. This involved specifying the IT systems, services, and personnel involved in the incident management process while excluding potential incident sources beyond those directly related to IT systems and services.
In scenario 3, which technique did L&K Associates use for its risk analysis process?
- A. Quantitative risk analysis
- B. Qualitative risk analysis
- C. Semi-quantitative risk analysis
正解：A
解説：
Comprehensive and Detailed Explanation From Exact Extract:
In the scenario, Leona used a methodology that estimates "practical values for consequences and their probabilities," which clearly points to a quantitative risk analysis approach.
Quantitative risk analysis, as defined in ISO/IEC 27005:2018, involves assigning numerical values (e.g., monetary impact, frequency rates) to both the probability and consequence of risks. This allows for risk prioritization based on actual or estimated figures, enabling data-driven decisions on mitigation strategies.
Qualitative analysis uses descriptive categories (e.g., high/medium/low), and semi-quantitative methods mix ranking scales with partial numeric estimations - neither of which are described in this scenario.
Reference:
ISO/IEC 27005:2018, Clause 8.3.3: "Quantitative risk analysis estimates the probability and impact of risk using numerical values to derive a risk level." Therefore, the correct answer is C: Quantitative risk analysis.
-
質問 # 32
Scenario 4: ORingo is a company based in Krakow, Poland, specializing in developing and distributing electronic products for health monitoring and heart rate measurement applications. With a strong emphasis on innovation and technological advancement, ORingo has established itself as a trusted provider of high-quality, reliable devices that enhance the well being and healthcare capabilities of individuals and healthcare professionals alike.
As part of its commitment to maintaining the highest standards of information security, ORingo has established an information security incident management process This process aims to ensure that any potential threats are swiftly identified, assessed, and addressed to protect systems and information. However, despite these measures, an incident response team member at ORingo recently detected a suspicious state in their systems operational data, leading to the decision to shut down the company-wide system until the anomaly could be thoroughly investigated Upon detecting the threat, the company promptly established an incident response team to respond to the incident effectively. The team's responsibilities encompassed identifying root causes, uncovering hidden vulnerabilities, and implementing timely resolutions to mitigate the impact of the incident on ORingo's operations and customer trust.
In response to the threat detected across its cloud environments. ORingo employed a sophisticated security tool that broadened the scope of incident detection and mitigation This tool covers network traffic, doud environments, and potential attack vectors beyond traditional endpoints, enabling ORingo to proactively defend against evolving cybersecurity threats During a routine check, the IT manager at ORingo discovered that multiple employees lacked awareness of proper procedures following the detection of a phishing email. In response, immediate training sessions on information security policies and incident response were scheduled for all employees, emphasizing the importance of vigilance and adherence to established protocols in safeguarding ORingo's sensitive data and assets.
As part of the training initiative. ORingo conducted a simulated phishing attack exercise to assess employee response and knowledge. However, an employee inadvertently informed an external partner about the 'attack'' during the exercise, highlighting the importance of ongoing education and reinforcement of security awareness principles within the organization.
Through its proactive approach to incident management and commitment to fostering a culture of security awareness and readiness. ORingo reaffirms its dedication to safeguarding the integrity and confidentiality of its electronic products and ensuring the trust and confidence of its customers and stakeholders worldwide.
In scenario 4, during a routine check, the IT manager discovered that multiple employees were unaware of the proper procedures following the detection of a phishing email and scheduled immediate training for all employees on information security policies and incident response. Is this recommended?
- A. No, providing training is unnecessary; the employees' ignorance of proper procedures regarding phishing emails is a minor issue
- B. Yes, it is recommended that immediate training on these topics be provided to ensure employees know how to respond correctly to phishing emails
- C. No, the IT manager should handle the incident without involving other employees
正解：B
解説：
Comprehensive and Detailed Explanation:
Phishing is one of the most common entry points for cybersecurity incidents. ISO/IEC 27035 and ISO/IEC
27002 both recommend security awareness training as a key preventive control. When users do not understand proper response procedures, the risk of successful attacks increases significantly.
Providing immediate training, especially following the identification of a knowledge gap, is considered best practice. This aligns with ISO/IEC 27001:2022 Annex A.6.3 and A.5.36, which emphasize the need for education and continuous awareness on security topics, including how to handle phishing attempts.
Reference:
ISO/IEC 27035-1:2016, Clause 6.1 - "Preparation includes awareness training to reduce the likelihood and impact of incidents." ISO/IEC 27002:2022, Control A.6.3 - "Personnel should receive appropriate awareness education and training to carry out their information security responsibilities." Therefore, the correct answer is A.
質問 # 33
Scenario 6: EastCyber has established itself as a premier cyber security company that offers threat detection, vulnerability assessment, and penetration testing tailored to protect organizations from emerging cyber threats. The company effectively utilizes ISO/IEC 27035*1 and 27035-2 standards, enhancing its capability to manage information security incidents.
EastCyber appointed an information security management team led by Mike Despite limited resources, Mike and the team implemented advanced monitoring protocols to ensure that every device within the company's purview is under constant surveillance This monitoring approach is crucial for covering everything thoroughly, enabling the information security and cyber management team to proactively detect and respond to any sign of unauthorized access, modifications, or malicious activity within its systems and networks.
In addition, they focused on establishing an advanced network traffic monitoring system This system carefully monitors network activity, quickly spotting and alerting the security team to unauthorized actions This vigilance is pivotal in maintaining the integrity of EastCyber's digital infrastructure and ensuring the confidentiality, availability, and integrity of the data it protects.
Furthermore, the team focused on documentation management. They meticulously crafted a procedure to ensure thorough documentation of information security events. Based on this procedure, the company would document only the events that escalate into high-severity incidents and the subsequent actions. This documentation strategy streamlines the incident management process, enabling the team to allocate resources more effectively and focus on incidents that pose the greatest threat.
A recent incident involving unauthorized access to company phones highlighted the critical nature of incident management. Nate, the incident coordinator, quickly prepared an exhaustive incident report. His report detailed an analysis of the situation, identifying the problem and its cause. However, it became evident that assessing the seriousness and the urgency of a response was inadvertently overlooked.
In response to the incident, EastCyber addressed the exploited vulnerabilities. This action started the eradication phase, aimed at systematically eliminating the elements of the incident. This approach addresses the immediate concerns and strengthens EastCyber's defenses against similar threats in the future.
According to scenario 6, Nate compiled a detailed incident report that analyzed the problem and its cause but did not evaluate the incident's severity and response urgency. Does this align with the ISO/IEC 27035-1 guidelines?
- A. No, Nate overlooked the necessity of assessing the seriousness and the urgency of the response
- B. No, as the report did not include a comprehensive list of all employees who accessed the system within
24 hours before the incident - C. Yes. Nate included all the elements required by ISO/IEC 27035-1
正解：A
解説：
Comprehensive and Detailed Explanation From Exact Extract:
ISO/IEC 27035-1:2016 emphasizes that part of the incident handling process-particularly during assessment and documentation-must include evaluation of both the seriousness (severity) and urgency (criticality) of the incident.
Clause 6.4.2 requires that an incident's potential impact and required response timelines be assessed promptly to determine appropriate action. Nate's omission of this evaluation, despite creating a technically sound report, means that the organization could misjudge the incident's risk, delay appropriate response, or fail to meet notification obligations.
Option A is incorrect because ISO/IEC 27035 explicitly lists impact and urgency as required analysis elements. Option C, while possibly helpful in forensic analysis, is not a required component per the standard.
Reference:
ISO/IEC 27035-1:2016, Clause 6.4.2: "Assess the impact, severity, and urgency of the incident to determine the necessary response and escalation procedures." Clause 6.5.4: "An incident report should include an evaluation of incident criticality to inform decision- making." Correct answer: B Each includes the correct answer, detailed justification, and citation from ISO/IEC 27035 standards.
-
質問 # 34
......
PECB ISO-IEC-27035-Lead-Incident-Manager 認定試験の出題範囲：
| トピック | 出題範囲 |
|---|---|
| トピック 1 |
|
| トピック 2 |
|
| トピック 3 |
|
PECB試験練習テスト問題で高得点を目指そう：https://www.goshiken.com/PECB/ISO-IEC-27035-Lead-Incident-Manager-mondaishu.html
検証された材料は決まってこれ！ISO-IEC-27035-Lead-Incident-Manager：https://drive.google.com/open?id=1lzbCrNVFSFbF3riUCp1aIYMHzrwNiKzM