[Q37-Q55] Use the best ways of preparing for ISO-IEC-27035-Lead-Incident-Manager Exam Dumps with TestKingFree PECB ISO-IEC-27035-Lead-Incident-Manager PDF Dumps [2026]

Q37. Who should have access to training materials on information security incident management?

Only personnel involved in technical roles

Only internal interested parties

All personnel, including new employees, third-party users, and contractors

Q38. What roles do business managers play in relation to the Incident Management Team (IMT) and Incident Response Teams (IRTs)?

Developing policies and procedures for managing internal employees found engaging in unauthorized or illegal computer activities

Guiding on liability and compliance issues to the IMT and IRT and advise on which incidents constitute mandatory data breach notifications

Understanding how the IMT and IRTs support business processes and define authority over business systems

Q39. Which of the following is NOT an example of technical control?

Implementing a policy for regular password changes

Implementing surveillance cameras

Installing a firewall to protect the network

Q40. Scenario 6: EastCyber has established itself as a premier cyber security company that offers threat detection, vulnerability assessment, and penetration testing tailored to protect organizations from emerging cyber threats. The company effectively utilizes ISO/IEC 27035-1 and 27035-2 standards, enhancing its capability to manage information security incidents.
EastCyber appointed an information security management team led by Mike. Despite limited resources, Mike and the team implemented advanced monitoring protocols to ensure that every device within the company’s purview is under constant surveillance. This monitoring approach is crucial for covering everything thoroughly, enabling the information security and cyber management team to proactively detect and respond to any sign of unauthorized access, modifications, or malicious activity within its systems and networks.
A recent incident involving unauthorized access to company phones highlighted the critical nature of incident management. Nate, the incident coordinator, quickly prepared an exhaustive incident report. His report detailed an analysis of the situation, identifying the problem and its cause. In response to the incident, EastCyber addressed the exploited vulnerabilities. This action started the eradication phase, aimed at systematically eliminating the elements of the incident.
Based on scenario 6, answer the following:
EastCyber decided to address vulnerabilities exploited during an incident as part of the eradication phase, to eradicate the elements of the incident. Is this approach acceptable?

Addressing vulnerabilities exploited during an incident is appropriate during the eradication phase

No, vulnerabilities exploited during an incident should be addressed during the containment phase

No, vulnerabilities exploited during an incident should be addressed during the recovery phase

Q41. Based on ISO/IEC 27035-2, which of the following is an example of evaluation activities used to evaluate the effectiveness of the incident management team?

Conducting information security testing, particularly vulnerability assessment

Analyzing the lessons learned once an information security incident has been handled and closed

Evaluating the capabilities and services once they become operational

Q42. Scenario 8: Moneda Vivo, headquartered in Kuala Lumpur. Malaysia, is a distinguished name in the banking sector. It is renowned for its innovative approach to digital banking and unwavering commitment to information security. Moneda Vivo stands out by offering various banking services designed to meet the needs of its clients. Central to its operations is an information security incident management process that adheres to the recommendations of ISO/IEC 27035-1 and 27035-2.
Recently. Moneda Vivo experienced a phishing attack aimed at its employees Despite the bank’s swift identification and containment of the attack, the incident led to temporary service outages and data access issues, underscoring the need for improved resilience The response team compiled a detailed review of the attack, offering valuable insights into the techniques and entry points used and identifying areas for enhancing their preparedness.
Shortly after the attack, the bank strengthened its defense by implementing a continuous review process to ensure its incident management procedures and systems remain effective and appropriate While monitoring the incident management process, a trend became apparent. The mean time between similar incidents decreased after a few occurrences; however, Moneda Vivo strategically ignored the trend and continued with regular operations This decision was rooted in a deep confidence in its existing security measures and incident management protocols, which had proven effective in quick detection and resolution of issues Moneda Vivo’s commitment to transparency and continual improvement is exemplified by its utilization of a comprehensive dashboard. This tool provides real time insights into the progress of its information security incident management, helping control operational activities and ensure that processes stay within the targets of productivity, quality, and efficiency. However, securing its digital banking platform proved challenging.
Following a recent upgrade, which included a user interface change to its digital banking platform and a software update, Moneda Vivo recognized the need to immediately review its incident management process for accuracy and completeness. The top management postponed the review due to financial and time constraints.
Scenario 8: Moneda Vivo, headquartered in Kuala Lumpur, Malaysia, is a distinguished name in the banking sector. It recently experienced a phishing attack, prompting the response team to conduct a detailed review.
The incident underscored the need for resilience and continuous improvement.
What is the primary goal of the information Moneda Vivo’s incident report team gathered from the incident?

To showcase the effectiveness of existing security protocols to stakeholders

To document the incident for legal compliance purposes

To learn from the incident and improve future security measures

Q43. Which element should an organization consider when identifying the scope of their information security incident management?

Hardcopy information

Electronic information

Both A and B

Q44. Scenario 1: RoLawyers is a prominent legal firm based in Guadalajara, Mexico. It specializes in a wide range of legal services tailored to meet the diverse needs of its clients. Committed to excellence and integrity, RoLawyers has a reputation for providing legal representation and consultancy to individuals, businesses, and organizations across various sectors.
Recognizing the critical importance of information security in today’s digital landscape, RoLawyers has embarked on a journey to enhance its information security measures. This company is implementing an information security incident management system aligned with ISO/IEC 27035-1 and ISO/IEC 27035-2 guidelines. This initiative aims to strengthen RoLawyers’ protections against possible cyber threats by implementing a structured incident response process to provide guidance on establishing and maintaining a competent incident response team.
After transitioning its database from physical to online infrastructure to facilitate seamless information sharing among its branches, RoLawyers encountered a significant security incident. A malicious attack targeted the online database, overloading it with traffic and causing a system crash, making it impossible for employees to access it for several hours.
In response to this critical incident, RoLawyers quickly implemented new measures to mitigate the risk of future occurrences. These measures included the deployment of a robust intrusion detection system (IDS) designed to proactively identify and alert the IT security team of potential intrusions or suspicious activities across the network infrastructure. This approach empowers RoLawyers to respond quickly to security threats, minimizing the impact on their operations and ensuring the continuity of its legal services.
By being proactive about information security and incident management, RoLawyers shows its dedication to protecting sensitive data, keeping client information confidential, and earning the trust of its stakeholders.
Using the latest practices and technologies, RoLawyers stays ahead in legal innovation and is ready to handle cybersecurity threats with resilience and careful attention.
Based on scenario 1, which security control has RoLawyers implemented?

Preventive controls

Detective controls

Corrective controls

Q45. Which method is used to examine a group of hosts or a network known for vulnerable services?

Security testing and evaluation

Automated vulnerability scanning tool

Penetration testing

Q46. Scenario 8: Moneda Vivo, headquartered in Kuala Lumpur. Malaysia, is a distinguished name in the banking sector. It is renowned for its innovative approach to digital banking and unwavering commitment to information security. Moneda Vivo stands out by offering various banking services designed to meet the needs of its clients. Central to its operations is an information security incident management process that adheres to the recommendations of ISO/IEC 27035-1 and 27035-2.
Recently. Moneda Vivo experienced a phishing attack aimed at its employees Despite the bank’s swift identification and containment of the attack, the incident led to temporary service outages and data access issues, underscoring the need for improved resilience The response team compiled a detailed review of the attack, offering valuable insights into the techniques and entry points used and identifying areas for enhancing their preparedness.
Shortly after the attack, the bank strengthened its defense by implementing a continuous review process to ensure its incident management procedures and systems remain effective and appropriate While monitoring the incident management process, a trend became apparent. The mean time between similar incidents decreased after a few occurrences; however, Moneda Vivo strategically ignored the trend and continued with regular operations This decision was rooted in a deep confidence in its existing security measures and incident management protocols, which had proven effective in quick detection and resolution of issues Moneda Vivo’s commitment to transparency and continual improvement is exemplified by its utilization of a comprehensive dashboard. This tool provides real time insights into the progress of its information security incident management, helping control operational activities and ensure that processes stay within the targets of productivity, quality, and efficiency. However, securing its digital banking platform proved challenging.
Following a recent upgrade, which included a user interface change to its digital banking platform and a software update, Moneda Vivo recognized the need to immediately review its incident management process for accuracy and completeness. The top management postponed the review due to financial and time constraints.
Based on scenario 8, Moneda Vivo has recently upgraded its digital banking platform. In line with the continual improvement process, Moneda Vivo has decided to review the information security incident management process for accuracy immediately after the software update. Is this recommended?

Yes, the incident management process should be reviewed after any minor software update

No, the incident management process should be reviewed when the bank’s annual audit is conducted

No, the incident management process should be evaluated after a significant technological overhaul to ensure the system is up-to-date

Q47. When does the information security incident management plan come into effect?

After a security audit is completed

When a new security policy is drafted

When a security vulnerability is reported

Q48. How should vulnerabilities lacking corresponding threats be handled?

They still require controls and should be promptly addressed

They should be disregarded as they pose no risk

They may not require controls but should be analyzed and monitored for changes

Q49. How is the impact of an information security event assessed?

By determining if the event is an information security incident

By identifying the assets affected by the event

By evaluating the effect on the confidentiality, integrity, and availability of information

Q50. Scenario 3: L&K Associates is a graphic design firm headquartered in Johannesburg, South Africa. It specializes in providing innovative and creative design solutions to clients across various industries. With offices in multiple parts of the country, they effectively serve clients, delivering design solutions that meet their unique needs and preferences.
In its commitment to maintaining information security, L&K Associates is implementing an information security incident management process guided by ISO/IEC 27035-1 and ISO/IEC 27035-2. Leona, the designated leader overseeing the implementation of the incident management process, customized the scope of incident management to align with the organization’s unique requirements. This involved specifying the IT systems, services, and personnel involved in the incident management process while excluding potential incident sources beyond those directly related to IT systems and services.
According to scenario 3, Leona decided to initially include only the elements provided in Clause 4.3 of ISO
/IEC 27035-2, Information security incident management policy content, in the incident management policy.
Is this acceptable?

Yes, because Leona has conducted a thorough risk assessment to identify potential gaps in the incident management policy beyond the scope of clause 4.3 of ISO/IEC 27035-2

Yes, because as a minimum, the policy must cover the elements provided in clause 4.3 of ISO/IEC
27035-2

No, clause 4.3 of ISO/IEC 27035-2 does not cover elements for an effective incident management policy

Q51. Which document provides guidelines for planning and preparing for incident response and for learning lessons from the incident response process?

ISO/IEC 27035-1

ISO/IEC 27035-2

ISO/IEC 27037

Q52. What does the Incident Cause Analysis Method (ICAM) promote?

A disciplined approach to incident analysis by emphasizing five key areas: people, environment, equipment, procedures, and the organization

An emphasis on evaluating and reporting the financial impact of incidents on the organization

The analysis of incidents through the creation of a detailed timeline of events leading up to the incident

Q53. What is the primary function of a single type of IRT?

Enhancing the reliability of incident response activities

Monitoring targets from remote locations

Managing incidents within a specified organization

Q54. Scenario 8: Moneda Vivo, headquartered in Kuala Lumpur. Malaysia, is a distinguished name in the banking sector. It is renowned for its innovative approach to digital banking and unwavering commitment to information security. Moneda Vivo stands out by offering various banking services designed to meet the needs of its clients. Central to its operations is an information security incident management process that adheres to the recommendations of ISO/IEC 27035-1 and 27035-2.
Recently. Moneda Vivo experienced a phishing attack aimed at its employees Despite the bank’s swift identification and containment of the attack, the incident led to temporary service outages and data access issues, underscoring the need for improved resilience The response team compiled a detailed review of the attack, offering valuable insights into the techniques and entry points used and identifying areas for enhancing their preparedness.
Shortly after the attack, the bank strengthened its defense by implementing a continuous review process to ensure its incident management procedures and systems remain effective and appropriate While monitoring the incident management process, a trend became apparent. The mean time between similar incidents decreased after a few occurrences; however, Moneda Vivo strategically ignored the trend and continued with regular operations This decision was rooted in a deep confidence in its existing security measures and incident management protocols, which had proven effective in quick detection and resolution of issues Moneda Vivo’s commitment to transparency and continual improvement is exemplified by its utilization of a comprehensive dashboard. This tool provides real time insights into the progress of its information security incident management, helping control operational activities and ensure that processes stay within the targets of productivity, quality, and efficiency. However, securing its digital banking platform proved challenging.
Following a recent upgrade, which included a user interface change to its digital banking platform and a software update, Moneda Vivo recognized the need to immediately review its incident management process for accuracy and completeness. The top management postponed the review due to financial and time constraints.
Based on scenario 8, Moneda Vivo ignored the trend and continued regular operations when the mean time between the same types of incidents decreased after a few occurrences. Is this acceptable?

When the mean time between the same types of incidents decreases after a few occurrences, it shows that the incidents are becoming less significant

No, when the mean time between the same types of incidents decreases, a study should be necessary to confirm that the incidents are unrelated

No, when the mean time between the same types of incidents decreases, a study should be conducted to discover why

Q55. Scenario 3: L&K Associates is a graphic design firm headquartered in Johannesburg, South Africa. It specializes in providing innovative and creative design solutions to clients across various industries. With offices in multiple parts of the country, they effectively serve clients, delivering design solutions that meet their unique needs and preferences.
In its commitment to maintaining information security, L&K Associates is implementing an information security incident management process guided by ISO/IEC 27035-1 and ISO/IEC 27035-2. Leona, the designated leader overseeing the implementation of the incident management process, customized the scope of incident management to align with the organization’s unique requirements. This involved specifying the IT systems, services, and personnel involved in the incident management process while excluding potential incident sources beyond those directly related to IT systems and services.
Based on the scenario above, answer the following question:
Is the incident management scope correctly determined at L&K Associates?

Yes, the incident management scope is customized to align with the organization’s unique needs

No, the incident management scope is too broad, encompassing all IT systems regardless of relevance

No, the incident management scope is overly restrictive, excluding potential incident sources beyond those directly related to IT systems and services