Why should the security testing processes be defined and implemented in the development life cycle?

• A. To protect the production environment and data from compromise by development and test activities
• B. To Identify organizational assets and define appropriate protection responsibilities
• C. To validate if information security requirements are met when applications are deployed to the production environment

According to ISO/IEC 270G1. why shall organizations document nonconformities?

• A. To provide evidence of regulations set by external sources that need to be followed by the organization
• B. To provide evidence of the requirements set by internal audit after reviewing their audit reports
• C. To provide evidence of the results of the corrective actions and the nature of the nonconformities

Based on scenario 8. how does the HealthGenic's negligence affect the ISMS certificate?

• A. HealthGenic will be able to renew the ISMS certificate, as they did not detect any information security incident in the past two years
• B. HealthGenic might not be able to renew the ISMS certificate, as the internal audit lasted longer than planned
• C. HealthGenic might not be able to renew the ISMS certificate, as it has not conducted management reviews at planned intervals

Based on scenario 7. what else should Texas H&H Inc. do when responding to the incident?

• A. Communicate the updated Information security policy only to the top management of the company
• B. Decide to stop using cloud services in order to eliminate the risk of similar incidents happening in the future
• C. Record and document the incident which serves as input for future corrective actions

Scenario 8: SunDee is an American biopharmaceutical company, headquartered in California, the US. It specializes in developing novel human therapeutics, with a focus on cardiovascular diseases, oncology, bone health, and inflammation. The company has had an information security management system (ISMS) based on SO/IEC 27001 in place for the past two years. However, it has not monitored or measured the performance and effectiveness of its ISMS and conducted management reviews regularly Just before the recertification audit, the company decided to conduct an internal audit. It also asked most of their staff to compile the written individual reports of the past two years for their departments. This left the Production Department with less than the optimum workforce, which decreased the company's stock.
Tessa was SunDee's internal auditor. With multiple reports written by 50 different employees, the internal audit process took much longer than planned, was very inconsistent, and had no qualitative measures whatsoever Tessa concluded that SunDee must evaluate the performance of the ISMS adequately. She defined SunDee's negligence of ISMS performance evaluation as a major nonconformity, so she wrote a nonconformity report including the description of the nonconformity, the audit findings, and recommendations. Additionally, Tessa created a new plan which would enable SunDee to resolve these issues and presented it to the top management Based on scenario 8. does SunDee comply with ISO/IEC 27001 requirements regarding the monitoring and measurement process?

• A. No, because even though the standard does not imply when such a process should be performed, the company must have a monitoring and measurement process in place
• B. Yes, because the standard requires that the monitoring and measurement phase be conducted every two years
• C. Yes. because the standard does not Indicate when the monitoring and measurement phase should be performed