Deal of The Day! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions
Mail Us support@pass4success.com
Location US
Mob_nav_barsMENU

PECB ISO-IEC-27001-Lead-Auditor Exam - Topic 1 Question 34 Discussion

Posted by Terina on Apr 29, 2024 at 11:47 AM

The auditor was unable to identify that Company A hid their insecure network architecture. What type of audit risk is this?

Suggested Answer: A, B, E, F

According to ISO/IEC 27001:2022, which specifies the requirements for establishing, implementing, maintaining and continually improving an information security management system (ISMS), clause 4.1 requires an organization to determine external and internal issues that are relevant to its purpose and that affect its ability to achieve the intended outcomes of its ISMS2.External issues are those that originate from outside the organization, such as legal, regulatory, cultural, social, political, economic, natural and competitive factors2.Internal issues are those that originate from within the organization, such as governance, structure, roles and responsibilities, policies, objectives, culture, capabilities, resources and information systems2.Therefore, based on this definition, four examples of external issues in the context of a management system to ISO/IEC 27001:2022 are a rise in interest rates in response to high inflation (which affects the economic environment of the organization), a reduction in grants as a result of a change in government policy (which affects the political and legal environment of the organization), higher labour costs as a result of an aging population (which affects the social and demographic environment of the organization), and inability to source raw materials due to government sanctions (which affects the trade and supply environment of the organization)2. The other options are examples of internal issues, as they originate from within the organization or its activities.For example, poor levels of staff competence as a result of cuts in training expenditure (which affects the capabilities and resources of the organization), increased absenteeism as a result of poor management (which affects the culture and performance of the organization), poor morale as a result of staff holidays being reduced (which affects the motivation and satisfaction of the organization's personnel), and a fall in productivity linked to outdated production equipment (which affects the efficiency and quality of the organization's processes)2.Reference:ISO/IEC 27001:2022 - Information technology -- Security techniques -- Information security management systems -- Requirements


Get Premium ISO-IEC-27001-Lead-Auditor Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test
37 comments · newest first
SE
Selma 10 months ago
Totally agree, it's about detection!
CH
Cherelle 11 months ago
Inherent risk seems off here.
VA
Valentin 11 months ago
Wait, how did the auditor miss that?
KE
Keneth 11 months ago
I think it's more of a control risk.
DA
Darrin 11 months ago
That's definitely a detection risk!
TA
Tammara 12 months ago
I practiced a similar question where the auditor missed a significant fraud. I think that was also about detection risk, so I might go with that here.
LA
Launa 12 months ago
Control risk could be relevant here too, since it relates to the effectiveness of the company's internal controls, but I lean towards detection risk.
EU
Eugene 12 months ago
I remember something about inherent risk being related to the nature of the business, but this seems more about the auditor's oversight.
JU
Julian 1 year ago
I think this might be a detection risk since the auditor failed to identify the issue, but I'm not entirely sure.
ED
Edna 1 year ago
Okay, let me walk through this step-by-step. The auditor failed to identify the issue, so it's not inherent risk. And since it's a control issue, not a detection issue, I think the answer has to be control risk. I feel pretty confident about that.
LY
Lyndia 1 year ago
Hmm, I'm not totally sure about this one. Could it also be detection risk, since the auditor didn't detect the issue? I'll have to think it through carefully.
TE
Terry 1 year ago
This seems like a pretty straightforward audit risk question. I think the answer is Control risk, since the auditor failed to identify the company's insecure network architecture, which is a control issue.
RE
Ressie 1 year ago
Ugh, I'm really struggling with this type of audit risk question. There are so many different types, it's hard to keep them straight. I'll have to review my notes before the exam.
CU
Curtis 1 year ago
Okay, I think I've got this. The question is asking about the physical location of the Planning Optimization service, not the Dynamics 365 instance. Based on my understanding, the service runs in Microsoft's cloud, so the answer is likely option C or D.
LA
Laquita 1 year ago
I'll definitely look into the registry settings for ListOfDDCs. It seems like a common area where misconfigurations can happen.
FI
Fidelia 1 year ago
If the auditor can't even find the network issues, they must be using the 'invisible ink' method of auditing.
IN
India 1 year ago
I'd say this is a clear 'Detection' problem. The auditor must have been using the 'hide and seek' method of auditing.
AN
An 1 year ago
Sounds like a classic case of 'Control' issues. Maybe the auditor needs to take a 'control' alt delete approach to this problem.
DE
Detra 1 year ago
↳ replying to An
Maybe the auditor needs to take a 'control' alt delete approach to this problem.
DE
Delmy 1 year ago
↳ replying to An
C) Detection
YU
Yuki 1 year ago
↳ replying to An
B) Control
LE
Leslee 1 year ago
↳ replying to An
A) Inherent
FR
Francoise 1 year ago
Ah, the classic 'hide and seek' audit technique. Gotta love when the company is playing 'keep away' with their network architecture.
DA
Darrin 1 year ago
↳ replying to Francoise
C) Detection
JE
Jennie 1 year ago
↳ replying to Francoise
B) Control
CR
Crista 1 year ago
↳ replying to Francoise
A) Inherent
AL
Alise 1 year ago
I disagree, I think it's detection risk because the auditor failed to detect the insecure network architecture.
RO
Robt 1 year ago
I agree with Eva, it's definitely inherent risk.
EV
Eva 1 year ago
I think it's inherent risk.
DO
Dorinda 1 year ago
I believe it's detection risk, as the auditor failed to detect the issue.
TA
Tamesha 1 year ago
I agree with Chana, because it's related to the nature of the business.
LE
Lezlie 2 years ago
If the auditor can't even identify the network issues, I'm guessing they need a little more 'detection' in their diet.
SE
Sena 1 year ago
↳ replying to Lezlie
User 4: Maybe they need to improve their detection procedures.
LA
Lavera 1 year ago
↳ replying to Lezlie
User 3: Yeah, the auditor should have caught that during the audit.
YO
Yoko 1 year ago
↳ replying to Lezlie
User 2: That sounds like a detection risk to me.
LO
Lonny 1 year ago
↳ replying to Lezlie
User 1: Looks like Company A is hiding their insecure network architecture.
CH
Chana 2 years ago
I think it's inherent risk.
0/2000 characters

Save Cancel