ISO-IEC-27001 Lead Auditor PECB Certification Exam Guides

1. What is the difference between a restricted and confidential document?

2. CEO sends a mail giving his views on the status of the company and the company’s future strategy and the CEO's vision and the employee's part in it. The mail should be classified as

3. You see a blue color sticker on certain physical assets.

What does this signify?

4. Integrity of data means

5. You have a hard copy of a customer design document that you want to dispose off.

What would you do

6. You receive the following mail from the IT support team: Dear User,Starting next week, we will be deleting all inactive email accounts in order to create spaceshare the below details in order to continue using your account. In case of no response,

Name:

Email ID:

Password:

DOB:

Kindly contact the webmail team for any further support. Thanks for your attention.

Which of the following is the best response?

7. The following are definitions of Information, except:

8. In the event of an Information security incident, system users' roles and responsibilities are to be observed, except:

9. What is the standard definition of ISMS?

10. Information or data that are classified as ______ do not require labeling.

11. A property of Information that has the ability to prove occurrence of a claimed event.

12. Stages of Information

13. A decent visitor is roaming around without visitor's ID. As an employee you should do the following, except:

14. Which of the following is not a type of Information Security attack?

15. The following are purposes of Information Security, except:

16. The following are the guidelines to protect your password, except:

17. Phishing is what type of Information Security Incident?

18. Information Security is a matter of building and maintaining ________.

19. All are prohibited in acceptable use of information assets, except:

20. In acceptable use of Information Assets, which is the best practice?

21. CMM stands for?

22. Which is not a requirement of HR prior to hiring?

23. Who are allowed to access highly confidential files?

24. Which is the glue that ties the triad together

25. Implement plan on a test basis - this comes under which section of PDCA

26. What is we do in ACT - From PDCA cycle

27. -------------------------is an asset like other important business assets has value to an organization and consequently needs to be protected.

28. Below is Purpose of "Integrity", which is one of the Basic Components of Information Security

29. Which one of the following options best describes the main purpose of a Stage 1 third-party audit?

30. Which two of the following statements are true?

31. DRAG DROP

Select the words that best complete the sentence:

To complete the sentence with the word(s) click on the blank section you want to complete so that it is highlighted in red, and then click on the application text from the options below. Alternatively, you may drag and drop the option to the appropriate blank section.

32. DRAG DROP

Select a word from the following options that best completes the sentence:

To complete the sentence with the word(s) click on the blank section you want to complete so that it is highlighted in red, and then click on the application text from the options below. Alternatively, you may drag and drop the option to the appropriate blank section.

33. Which two activities align with the “Check’’ stage of the Plan-Do-Check-Act cycle when applied to the process of managing an internal audit program as described in ISO 19011?

34. DRAG DROP

Please match the roles to the following descriptions:





To complete the table click on the blank section you want to complete so that it is highlighted in red, and then click on the applicable test from the options below. Alternatively, you may drag and drop each option to the appropriate blank section.

35. Which two of the following are examples of audit methods that 'do' involve human interaction?

36. In the context of a third-party certification audit, confidentiality is an issue in an audit programme.

Select two options which correctly state the function of confidentiality in an audit

37. DRAG DROP

Select the words that best complete the sentence:

To complete the sentence with the best word(s), click on the blank section you want to complete so that it is highlighted in red, and then click on the applicable text from the options below. Alternatively, you may drag and drop the option to the appropriate blank section.

38. Which three of the following phrases are objectives' in relation to an audit?

39. Which six of the following actions are the individual(s) managing the audit programme responsible

for?

40. Which three of the following work documents are not required for audit planning by an auditor conducting a certification audit?

41. Which three of the following options are an advantage of using a sampling plan for the audit?

42. After completing Stage 1 and in preparation for a Stage 2 initial certification audit, the auditee informs the audit team leader that they wish to extend the audit scope to include two additional sites that have recently been acquired by the organisation.

Considering this information, what action would you expect the audit team leader to take?

43. DRAG DROP

In regard to generating an audit finding, select the words that best complete the following sentence.

To complete the sentence with the best word(s), click on the blank section you want to complete so that it Is highlighted in red, and then click on the applicable text from the options below. Alternatively, you may drag and drop the option to the appropriate blank section.

44. During discussions with the individual(s) managing the audit programme of a certification body, the Management System Representative of the client organisation asks for a specific auditor for the certification audit. Select two of the following options for how the individual(s) managing the audit programme should respond.

45. During an opening meeting of a Stage 2 audit, the Managing Director of the client organisation invites the audit team to view a new company video lasting 45 minutes.

Which two of the following responses should the audit team leader make?

46. DRAG DROP

You are an experienced ISMS audit team leader, talking to an Auditor in training who has been assigned to your audit team. You want to ensure that they understand the importance of the Check stage of the Plan-Do-Check-Act cycle in respect of the operation of the information security management system.

You do this by asking him to select the words that best complete the sentence:

To complete the sentence with the best word(s), click on the blank section you want to complete so that it is highlighted in red, and then click on the applicable text from the options below. Alternatively, you may drag and drop the option to the appropriate blank section.

47. You are an ISMS auditor conducting a third-party surveillance audit of a telecom's provider. You are in the equipment staging room where network switches are pre-programmed before being despatched to clients. You note that recently there has been a significant increase in the number of switches failing their initial configuration test and being returned for reprogramming.

You ask the Chief Tester why and she says, 'It's a result of the recent ISMS upgrade'. Before the upgrade each technician had their own hard copy work instructions. Now, the eight members of my team have to share two laptops to access the clients' configuration instructions online. These delays put pressure on the technicians, resulting in more mistakes being made'.

Based solely on the information above, which clause of ISO to raise a nonconformity against' Select one.

48. During a third-party certification audit you are presented with a list of issues by an auditee.

Which four of the following constitute 'external' issues in the context of a management system to ISO/IEC 27001:2022?

49. You are performing an ISMS audit at a residential nursing home that provides healthcare services. The next step in your audit plan is to verify the information security incident management process. The IT Security Manager presents the information security incident management procedure and explains that the process is based on ISO/IEC 27035-1:2016.

You review the document and notice a statement "any information security weakness, event, and incident should be reported to the Point of Contact (PoC) within 1 hour after identification". When interviewing staff, you found that there were differences in the understanding of the meaning of "weakness, event, and incident".

You sample incident report records from the event tracking system for the last 6 months with summarized results in the following table.





You would like to further investigate other areas to collect more audit evidence. Select two options that will not be in your audit trail.

50. You are an experienced audit team leader guiding an auditor in training,

Your team is currently conducting a third-party surveillance audit of an organisation that stores data on behalf of external clients. The auditor in training has been tasked with reviewing the TECHNOLOGICAL controls listed in the Statement of Applicability (SoA) and implemented at the site. Select four controls from the following that would you expect the auditor in training to review.

51. You are preparing the audit findings. Select two options that are correct.

52. You are an experienced ISMS auditor, currently providing support to an ISMS auditor in training who is carrying out her first initial certification audit. She asks you what she should be verifying when auditing an organisation's Information Security objectives. You ask her what she has included in her audit checklist and she provides the following replies.

Which three of these responses would you cause you concern in relation to conformity with ISO/IEC 27001:2022?

53. You are carrying out your first third-party ISMS surveillance audit as an Audit Team Leader. You are presently in the auditee's data centre with another member of your audit team.

Your colleague seems unsure as to the difference between an information security event and an information security incident. You attempt to explain the difference by providing examples.

Which three of the following scenarios can be defined as information security incidents?

54. You are performing an ISMS audit at a nursing home where residents always wear an electronic wristband for monitoring their location, heartbeat, and blood pressure. The wristband automatically uploads this data to a cloud server for healthcare monitoring and analysis by staff.

You now wish to verify that the information security policy and objectives have been established by top management. You are sampling the mobile device policy and identify a security objective of this policy is "to ensure the security of teleworking and use of mobile devices" The policy states the following controls will be applied in order to achieve this.

Personal mobile devices are prohibited from connecting to the nursing home network, processing, and storing residents' data.

The company's mobile devices within the ISMS scope shall be registered in the asset register. The company's mobile devices shall implement or enable physical protection, i.e., pin-code protected screen lock/unlock, facial or fingerprint to unlock the device.

The company's mobile devices shall have a regular backup.

To verify that the mobile device policy and objectives are implemented and effective, select three options for your audit trail.

55. The data center at which you work is currently seeking ISO/IEC27001:2022 certification. In preparation for your initial certification visit a number of internal audits have been carried out by a colleague working at another data centre within your Group. They secured their ISO/IEC 27001:2022 certificate earlier in the year.

You have just qualified as an Internal ISMS auditor and your manager has asked you to review the audit process and audit findings as a final check before the external Certrfication Body arrives.

Which six of the following would cause you concern in respect of conformity to ISO/IEC 27001:2022 requirements?

56. You are conducting a third-party surveillance audit when another member of the audit team approaches you seeking clarification. They have been asked to assess the organisation's application of control 5.7 - Threat Intelligence. They are aware that this is one of the new controls introduced in the 2022 edition of ISO/IEC 27001, and they want to make sure they audit the control correctly. They have prepared a checklist to assist them with their audit and want you to confirm that their planned activities are aligned with the control's requirements.

Which three of the following options represent valid audit trails?

57. You are performing an ISMS audit at a residential nursing home that provides healthcare services. The next step in your audit plan is to verify the information security of the business continuity management process. During the audit, you learned that the organisation activated one of the business continuity plans (BCPs) to make sure the nursing service continued during the recent pandemic. You ask Service Manager to explain how the organisation manages information security during the business continuity management process.

The Service Manager presents the nursing service continuity plan for a pandemic and summarises the process as follows:

Stop the admission of any NEW residents.

70% of administration staff and 30% of medical staff will work from home.

Regular staff self-testing including submitting a negative test report 1 day BEFORE they come to the office.

Install ABC's healthcare mobile app, tracking their footprint and presenting a GREEN Health Status QR-Code for checking on the spot.

You ask the Service Manager how to prevent non-relevant family members or interested parties from accessing residents' personal data when staff work from home. The Service Manager cannot answer and suggests the n" Security Manager should help with that.

You would like to further investigate other areas to collect more audit evidence Select three options that will be in your audit trail.

58. You are carrying out your first third-party ISMS surveillance audit as an Audit Team Leader. You are presently in the auditee's data centre with another member of your audit team.

You are currently in a large room that is subdivided into several smaller rooms, each of which has a numeric combination lock and swipe card reader on the door. You notice two external contractors using a swipe card and combination number provided by the centre's reception desk to gain access to a client's suite to carry out authorised electrical repairs.

You go to reception and ask to see the door access record for the client's suite. This indicates only one card was swiped. You ask the receptionist and they reply, "yes it's a common problem. We ask everyone to swipe their cards but with contractors especially, one tends to swipe and the rest simply 'tailgate' their way in" but we know who they are from the reception sign-in.

Based on the scenario above which one of the following actions would you now take?

A. Take no action. Irrespective of any recommendations, contractors will always act in this way

B. Raise a nonconformity against control A.5.20 'addressing information security in supplier relationships' as information security requirements have not been agreed upon with the supplier

C. Raise a nonconformity against control A.7.6 'working in secure areas' as security measures for working in secure areas have not been defined

D. Determine whether any additional effective arrangements are in place to verify individual access to secure areas e.g. CCTV

E. Raise an opportunity for improvement that contractors must be accompanied at all times when accessing secure facilities

F. Raise an opportunity for improvement to have a large sign in reception reminding everyone requiring access must use their swipe card at all times

G. Raise a nonconformity against control A.7.2 'physical entry' as a secure area is not adequately protected

H. Tell the organisation they must write to their contractors, reminding them of the need to use access cards appropriately

59. DRAG DROP

You are an experienced ISMS audit team leader providing instruction to an auditor in training. They are unclear in their understanding of risk processes and ask you to provide them with an example of each of the processes detailed below.

Match each of the descriptions provided to one of the following risk management processes.

To complete the table click on the blank section you want to complete so that it is highlighted in red, and then click on the applicable text from the options below. Alternatively, you may drag and drop each option to the appropriate blank section.

60. You are performing an ISMS initial certification audit at a residential nursing home that provides healthcare services. The next step in your audit plan is to conduct the closing meeting.

During the final audit team meeting, as an audit team leader, you agree to report 2 minor nonconformities and 1 opportunity for improvement as below:





Select one option of the recommendation to the audit programme manager you are going to advise to the auditee at the closing meeting.

61. You are an ISMS audit team leader tasked with conducting a follow-up audit at a client's data centre. Following two days on-site you conclude that of the original 12 minor and 1 major nonconformities that prompted the follow-up audit, only 1 minor nonconformity still remains outstanding. Select four options for the actions you could take.

62. You are an experienced ISMS audit team leader guiding an auditor in training. Your team has just completed a third-party surveillance audit of a mobile telecom provider. The auditor in training asks you how you intend to prepare for the Closing meeting.

Which four of the following are appropriate responses?

63. You are an experienced ISMS audit team leader guiding an auditor in training. You are testing her understanding of follow-up audits by asking her a series of questions to which the answer is either "true* or 'false'.

Which four of the following questions should the answer be true"'

64. DRAG DROP

As the ISMS audit team leader, you are conducting a second-party audit of an international logistics company on behalf of an online retailer. During the audit, one of your team members reports a nonconformity relating to control 5.18 (Access rights) of Appendix A of ISO/IEC 27001:2022. She found evidence that removing the server access protocols of 20 people who left in the last 3 months took up to 1 week whereas the policy required removing access within 24 hours of their departure.

Complete the sentence with the best word(s), dick on the blank section you want to complete so that it is highlighted in red, and then click on the applicable text from the options below. Alternatively, you may drag and drop the option to the appropriate blank section.

65. You are conducting an ISMS audit in the despatch department of an international logistics organisation that provides shipping services to large organisations including local hospitals and government offices. Parcels typically contain pharmaceutical products, biological samples, and documents such as passports and driving licences. You note that the company records show a very large number of returned items with causes including mis-addressed labels and, in 15% of company cases, two or more labels for different addresses for the one package. You are interviewing the Shipping Manager (SM).

You: Are items checked before being dispatched?

SH: Any obviously damaged items are removed by the duty staff before being dispatched, but the small profit margin makes it uneconomic to implement a formal checking process. You: What action is taken when items are returned?

SM: Most of these contracts are relatively low value, therefore it has been decided that it is easier and more convenient to simply reprint the label and re-send individual parcels than it is to implement an investigation.

You raise a nonconformity. Referencing the scenario, which six of the following Appendix A controls would you expect the auditee to have implemented when you conduct the follow-up audit?

66. You are conducting an ISMS audit in the despatch department of an international logistics organisation that provides shipping services to large organisations including local hospitals and government offices. Parcels typically contain pharmaceutical products, biological samples, and documents such as passports and driving licences. You note that the company records show a very large number of returned items with causes including misaddressed labels and, in 15% of cases, two or more labels for different addresses for the one package. You are interviewing the Shipping Manager (SM).

You: Are items checked before being dispatched?

SM: Any obviously damaged items are removed by the duty staff before being dispatched, but the small profit margin makes it uneconomic to implement a formal checking process.

You: What action is taken when items are returned?

SM: Most of these contracts are relatively low value, therefore it has been decided that it is easier and more convenient to simply reprint the label and re-send individual parcels than it is to implement an investigation.

You raise a nonconformity against ISO 27001:2022 based on the lack of control of the labelling process.

At the closing meeting, the Shipping Manager issues an apology to you that his comments may have been misunderstood. He says that he did not realise that there is a background IT process that automatically checks that the right label goes onto the right parcel otherwise the parcel is ejected at labelling. He asks that you withdraw your nonconformity.

Select three options of the correct responses that you as the audit team leader would make to the request of the Shipping Manager.

A. Advise the Shipping Manager that his request will be included in the audit report

B. Advise management that the new information provided will be discussed when the auditors have more time

C. Inform the Shipping Manager that the nonconformity is minor and should be quickly corrected

D. Ask the audit team members to state what they think should happen

E. Inform him of your understanding and withdraw the nonconformity

F. Thank the Shipping Manager for his honesty but advise that withdrawing the nonconformity is not the right way to proceed

G. Advise the Shipping Manager that the nonconformity must stand since the evidence obtained for it was dear

H. Indicate that the nonconformity is evidence of a deeper system failure that needs to be rectified

67. Which two of the following statements are true?

68. DRAG DROP

The following options are key actions involved in a first-party audit.

Order the stages to show the sequence in which the actions should take place.

69. Which two of the following phrases would apply to "plan" in relation to the Plan-Do-Check-Act cycle for a business process?

70. Which two of the following phrases are 'objectives' in relation to a first-party audit?

71. DRAG DROP

Match the correct responsibility with each participant of a second-party audit:

72. Which one of the following options describes the main purpose of a Stage 1 audit?

73. Objectives, criteria, and scope are critical features of a third-party ISMS audit.

Which two issues are audit objectives?

74. Which two of the following are examples of audit methods that 'do not' involve human interaction?

75. Select two options that describe an advantage of using a checklist.

76. Which one of the following statements best describes the purpose of conducting a document review?

77. DRAG DROP

78. During a Stage 1 audit opening meeting, the Management System Representative (MSR) asks to extend the audit scope to include a new site overseas which they have expanded into since the certification application was made.

Select two options for how the auditor should respond.

A. Advise the MSR that an extension of the scope may be incorporated but will have to go through

established procedures

B. Advise the MSR that the audit scope has been determined based on their initial application so the audit has to proceed as planned

C. Suggest that the MSR cancels the audit contract and reapplies for the new situation

D. Determine whether the Management System covers the processes at the new site and, if so, proceed with the audit

E. Advise the MSR that, within the existing scope, the new work area can be included without any problem

F. Confirm that the auditor will advise the auditee that the audit scope will be revised to include the new work area

79. You have to carry out a third-party virtual audit.

Which two of the following issues would you need to inform the auditee about before you start conducting the audit?

80. DRAG DROP

You have just completed a scheduled information security audit of your organisation when the IT Manager approaches you and asks for your assistance in the revision of the company's risk management process.

He is attempting to update the current documentation to make it easier for other managers to understand, however, it is clear from your discussion he is confusing several key terms.

You ask him to match each of the descriptions with the appropriate risk term.

What should the correct answers be?

81. You ask the IT Manager why the organisation still uses the mobile app while personal data encryption and pseudonymisation tests failed. Also, whether the Service Manager is authorised to approve the test.

The IT Manager explains the test results should be approved by him according to the software security management procedure. The reason why the encryption and pseudonymisation functions failed is that these functions heavily slowed down the system and service performance. An extra 150% of resources are needed to cover this. The Service Manager agreed that access control is good enough and acceptable. That's why the Service Manager signed the approval. You are preparing the audit findings. Select the correct option.

82. You ask the IT Manager why the organisation still uses the mobile app while personal data encryption and pseudonymization tests failed. Also, whether the Service Manager is authorized to approve the test.

The IT Manager explains the test results should be approved by him according to the software security management procedure. The reason why the encryption and pseudonymization functions failed is that these functions heavily slowed down the system and service performance. An extra 150% of resources are needed to cover this. The Service Manager agreed that access control is good enough and acceptable. That's why the Service Manager signed the approval.

You sample one of the medical staff's mobile and found that ABC's healthcare mobile app, version 1.01 is installed. You found that version 1.01 has no test record.

The IT Manager explains that because of frequent ransomware attacks, the outsourced mobile app development company gave a free minor update on the tested software, performed an emergency release of the updated software, and gave a verbal guarantee that there will be no impact on any security functions. Based on his 20 years of information security experience, there is no need to re-test.

You are preparing the audit findings Select two options that are correct.

83. During a third-party certification audit, you are presented with a list of issues by an auditee.

Which four of the following constitute 'internal' issues in the context of a management system to ISO 27001:2022?

84. You are an experienced ISMS audit team leader. During the conducting of a third-party surveillance audit, you decide to test your auditee's knowledge of ISO/IEC 27001's risk management requirements.

You ask her a series of questions to which the answer is either 'that is true' or 'that is false'.

Which four of the following should she answer 'that is true'?

85. You are performing an ISMS audit at a residential nursing home called ABC that provides healthcare services. You find all nursing home residents wear an electronic wristband for monitoring their location, heartbeat, and blood pressure always. You learned that the electronic wristband automatically uploads all data to the artificial intelligence (AI) cloud server for healthcare monitoring and analysis by healthcare staff.

To verify the scope of ISMS, you interview the management system representative (MSR) who explains that the ISMS scope covers an outsourced data center.

Select three options for the audit evidence you need to find to verify the scope of the ISMS.

86. You are an experienced ISMS audit team leader providing guidance to an ISMS auditor in training. They have been asked to carry out an assessment of external providers and have prepared a checklist containing the following activities. They have asked you to review their checklist to confirm that the actions they are proposing are appropriate.

The audit they have been invited to participate in is a third-party surveillance audit of a data centre. The data centre agent is part of a wider telecommunication group. Each data centre within the group operates its own ISMS and holds its own certificate.

Select three options that relate to ISO/IEC 27001:2022's requirements regarding external providers.

A. I will check the other data centres are treated as external providers, even though they are part of the same telecommunication group

B. I will ensure external providers have a documented process in place to notify the organisation of any risks arising from the use of its products or services

C. I will ensure that the organisation has a reserve external provider for each process it has identified as critical to preservation of the confidentiality, integrity and accessibility of its information

D. I will limit my audit activity to externally provided processes as there is no need to audit externally provided products of services

E. I will ensure the organization is regularly monitoring, reviewing and evaluating external provider performance

F. I will ensure the organization is has determined the need to communicate with external providers regarding the ISMS

G. I will ensure that top management have assigned roles and responsibilities for those providing external ISMS processes as well as internal ISMS processes

H. I will ensure that the organisation ranks its external providers and allocates the majority of its work to those providers who are rated the highest

87. You are an experienced ISMS auditor conducting a third-party surveillance audit at an organisation which offers ICT reclamation services. ICT equipment which companies no longer require is processed by the organisation. It Is either recommissioned and reused or is securely destroyed. You notice two servers on a bench in the corner of the room. Both have stickers on item with the server's name, IP address and admin password. You ask the ICT Manager about them, and he tells you they were part of a shipment received yesterday from a regular customer.

Which one action should you take?

A. Ask the ICT Manager to record an information security incident and initiate the information security incident management process

B. Note the audit finding and check the process for dealing with incoming shipments relating to customer IT security

C. Record what you have seen in your audit findings, but take no further action

D. Raise a nonconformity against control 5.31 Legal, staturary, regulatory and contractual requirements'

E. Raise a nonconformity against control 8.20 'network security’ (networks and network devices shall be secured, managed and controlled to protect information in systems and applications)

F. Ask the auditee to remove the labels, then carry on with the audit

88. DRAG DROP

You are an experienced ISMS audit team leader. An auditor in training has approached you to ask you to clarify the different types of audits she may be required to undertake. Match the following audit types to the descriptions.

To complete the table click on the blank section you want to complete so that It is highlighted In fed, and then click on the applicable text from the options below. Alternatively, you may drag and drop each option to the appropriate blank section.

89. You are performing an ISMS audit at a residential nursing home railed ABC that provides healthcare services. The next step in your audit plan is to verify the effectiveness of the continual improvement process. During the audit, you learned most of the residents' family members (90%) receive WeCare medical device promotional advertisements through email and SMS once a week via ABC's healthcare mobile app. All of them do not agree on the use of the collected personal data (or marketing or any other purposes than nursing and medical care on the signed service agreement with ABC. They have very strong reason to believe that ABC is leaking residents' and family members' personal information to a non-relevant third party and they have filed complaints.

The Service Manager says that all these complaints have been treated as nonconformities, and the corrective actions have been planned and implemented according to the Nonconformity and Corrective management procedure. The corrective action involved stopping working with WeCare the medical device manufacturer immediately and asking them to delete all personal data received as well as sending an apology email to all residents and their family members. You are preparing the audit findings. Select one option of the correct finding.

90. You are an ISMS audit team leader who has been assigned by your certification body to carry out a follow-up audit of a client. You are preparing your audit plan for this audit.

Which two of the following statements are true?

91. During a follow-up audit, you notice that a nonconformity identified for completion before the follow-up audit is still outstanding.

Which four of the following actions should you take?

A. Report the failure to address the corrective action for the outstanding nonconformity to the organisation's top management

B. Immediately raise an nonconformity as the date for completion has been exceeded

C. If the delay is justified agree on a revised date for clearing the nonconformity with the auditee/audit client

D. Contact the individuals) managing the audit programme to seek their advice as to how to proceed

E. Decide whether the delay in addressing the nonconformity is justified

F. Cancel the follow-up audit and return when an assurance has been received that the

nonconformity has been cleared

G. Note the nonconformity is still outstanding and follow audit trails to determine why H. If the delay is unjustified advise the auditee /audit client and agree on remedial action

92. You are performing an ISO 27001 ISMS surveillance audit at a residential nursing home, ABC Healthcare Services. ABC uses a healthcare mobile app designed and maintained by a supplier, WeCare, to monitor residents' well-being. During the audit, you learn that 90% erf the residents' family members regularly receive medical device advertisements from WeCare, by email and SMS once a week. The service agreement between ABC and WeCare prohibits the supplier from using residents' personal data. ABC has received many complaints from residents and their family members.

The Service Manager says that the complaints were investigated as an information security incident which found that they were justified. Corrective actions have been planned and implemented according to the nonconformity and corrective action management procedure.

You write a nonconformity "ABC failed to comply with information security control A.5.34 (Privacy and protection of PII) relating to the personal data of residents' and their family members. A supplier, WeCare, used residents' personal information to send advertisements to family members"

Select three options of the corrections and corrective actions listed that you would expect ABC to make in response to the nonconformity

93. Which one of the following options is the definition of an interested party?