PECB ISO/IEC 27032 Lead Cybersecurity Manager Lead-Cybersecurity-Manager Exam Questions

Page: 1 / 14
Total 80 questions
Question 1

Which of the following statements regarding best describes vulnerability assessment?



Answer : C

Vulnerability assessment best describes the process of combining automated testing with expert analysis. This approach helps identify, evaluate, and prioritize vulnerabilities in an organization's systems and networks. Automated tools can quickly scan for known vulnerabilities, while expert analysis can provide context, validate findings, and offer remediation recommendations. This comprehensive method ensures a thorough assessment of security weaknesses. Reference include NIST SP 800-30, which provides guidance on risk assessments, including vulnerability assessments.


Question 2

Which of the following best describes a computer security incident?



Answer : A

A computer security incident is best described as an event where an attacker exploits a vulnerability to command a botnet and launch a distributed denial-of-service (DDoS) attack on a web server. This type of incident involves unauthorized access and malicious activity aimed at disrupting the availability of a web service. Such incidents are typically included in the scope of security incidents because they involve breaches of security policy and pose significant risks to the affected systems. Reference include NIST SP 800-61, which defines and categorizes computer security incidents.


Question 3

Scenario 7: Established in 2005 in Arizona, the US. Hitec is one of The leading online retail companies. It Is especially known for electronic devices, such as televisions, telephones, and laptops. Hitec strives to continually enhance customer satisfaction and optimize its technology platforms and applications. the company's website and mobile application provide a range of features designed to simplify the online shopping experience, including customized product recommendations and a user-friendly search engine. The system enables customers to easily track the progress of their orders made through any of Hitec's platforms, in addition. Hitec employs a comprehensive customer management system to collect and manage customer information, including payment history, order details, and individual preferences.

Recently. Hitec had to deal with a serious cybersecurity incident that resulted in a data breach. Following numerous customer complaints about the malfunctioning of the ordering system. Hitec's engineers initiated an investigation into their network. The investigation unveiled multiple instances of unauthorized access by two distinct attackers. They gamed access sensitive customer information, such as credit card numbers and login credentials. Instead of promptly sharing information about the detected threats with other companies in the cybersecurity alliance and asking for help, Hitec chose to rely solely on its own detection and response capabilities. After resolving the incident, the company publicly acknowledged falling victim to a data breach. However, it refrained from disclosing specific details regarding the impact it had on its customers

Two weeks after the cyberattack, another retail company, Buyent, made an announcement regarding their successful prevention of a similar data breach unlike Hitec. Buyent took a transparent approach by providing detailed insights into the attacker's methods and the step-by-step procedures they employed to mitigate the attack. As both companies were part of the same cybersecurity alliance, Buyent willingly shared the requested information in accordance with their established information sharing and coordination framework, ensuring that any personal data shared was processed in a manner that prevented direct attribution to specific data subjects. This Involved utilizing additional information, which was kepi separately and secured through technical and organizational measures.

To ensure secure transmission. Buyent sent links that required a password for access, protecting the encrypted files sent to Hitec These files included comprehensive guidelines and approaches adopted hy Buyent to effectively detect and respond to cybersecurity events.

Upon careful analysis of the provided Information. Hitec concluded that their previous attack was primarily attributed to weaknesses in their detection capabilities in response. Hitec made strategic changes to their procedures. They implemented the utilization of Darknet as a technical approach to detect suspicious and malicious network activities. Furthermore, Hitec established a new security policy which required regular network and system testing By implementing these controls. Hilec aimed to strengthen Us ability to identify system vulnerabilities and threats, thereby boosting the overall cybersecurity defense.

Lastly, Hitec decided to contract a training provider to conduct cybersecurity training for its employees. They agreed to provide a training session that covered essential cybersecurity practices applicable to all staff, regardless of their roles within the company As the agreed upon training date approached, the training provider requested the necessary documentation from Hitec. Including the cybersecurity policy and specific examples related to the practices or guidelines employed by the company. After Hitec did not deliver the requested resources, the training provider refused to conduct the training session.

Based on the scenario above, answer the following question:

What data protection technique did Buyem employ to safeguard personal data while sharing Information with Hitec regarding the cyberattack Refer to scenario 7.



Answer : A

In the scenario, Buyent safeguarded personal data by sharing information in a manner that prevented direct attribution to specific data subjects. This technique is known as pseudonymization, where personal data is processed in such a way that it cannot be attributed to a specific individual without the use of additional information. Pseudonymization helps protect privacy while still allowing data to be useful for analysis and processing. This approach is recommended by regulations such as the GDPR and ISO/IEC 27018 for the protection of personal data in cloud environments.


Question 4

What is the significance of incident prevention as a principle of IRBC?



Answer : B

The significance of incident prevention as a principle of IRBC is that it helps organizations maintain the desired levels of systems availability. By preventing incidents, organizations can avoid disruptions to their operations and ensure that critical systems remain available and functional. This proactive approach to incident management is essential for maintaining business continuity and minimizing downtime. Reference include ISO/IEC 27031, which outlines the importance of preventive measures in ICT readiness for business continuity.


Question 5

What is an advantage of properly implementing a security operations center (SOC) within an organization?



Answer : C

Properly implementing a Security Operations Center (SOC) within an organization has the advantage of facilitating continuous monitoring and analysis of the organization's activities, leading to enhanced security incident detection. The SOC acts as a central hub for monitoring, detecting, and responding to security threats in real-time, which is crucial for maintaining the security of an organization's systems and data. This continuous vigilance helps in early detection and rapid response to incidents, thereby reducing potential damage. Reference include NIST SP 800-61, which provides guidelines for establishing and maintaining effective incident response capabilities, including the role of a SOC.


Question 6

An organization operating in the food industry has recently discovered that its warehouses, which store large amounts of valuable products, are unprotected and lacks proper surveillance, thus, presenting a vulnerability that con be exploited. Which of the following threats is typically associated with the identified vulnerability?



Answer : C

In the scenario provided, the organization operating in the food industry has warehouses storing large amounts of valuable products that are unprotected and lack proper surveillance. This presents a clear vulnerability that can be exploited. The most likely threat associated with this vulnerability is theft.

Theft involves the unauthorized taking of physical goods, and in the context of unprotected warehouses, it becomes a significant risk. Proper surveillance and physical security measures are critical controls to prevent such incidents. Without these, the organization's assets are at risk of being stolen, leading to significant financial losses and operational disruptions.


ISO/IEC 27002:2013 - Provides guidelines for organizational information security standards and information security management practices, including the selection, implementation, and management of controls. It addresses physical and environmental security, which includes securing areas that house critical or valuable assets.

NIST SP 800-53 - Recommends security controls for federal information systems and organizations. It includes controls for physical and environmental protection (PE), which cover measures to safeguard physical locations and prevent unauthorized physical access.

Question 7

Scenario 3: EsteeMed is a cardiovascular institute located in Orlando. Florida H Is known for tis exceptional cardiovascular and thoracic services and offers a range of advanced procedures, including vascular surgery, heart valve surgery, arrhythmia and ablation, and lead extraction. With a dedicated team of over 30 cardiologists and cardiovascular surgeons, supported by more than IUU specialized nurses and technicians, EsteeMed Is driven by a noble mission to save lives Every year. it provides its services to over 50,000 patients from across the globe.

As Its reputation continued to grow. EsteeMed recognized the importance of protecting Its critical assets. It Identified these assets and implemented the necessary measures to ensure their security Employing a widely adopted approach to Information security governance. EsteeMed established an organizational structure that connects the cybersecurity team with the information security sector under the IT Department.

Soon after these changes, there was an incident where an unauthorized employee transferred highly restricted patient data to the cloud The Incident was detected by Tony, the IT specialist. As no specific guidelines were in place to address such unlikely scenarios, Tony promptly reported the incident to his colleagues and, together. they alerted the board of managers Following that, the management of EsteeMed arranged a meeting with their cloud provider to address the situation.

During the meeting, the representatives of the cloud provider assured the management of the EsteeMed that the situation will be managed effectively The cloud provider considered the existing security measures sufficient to ensure the confidentiality, Integrity, and availability of the transferred data Additionally, they proposed a premium cloud security package that could offer enhanced protection for assets of this nature. Subsequently, EsteeMed's management conducted an internal meeting following the discussion with the cloud provider.

After thorough discussions, the management determined that the associated costs of implementing further security measures outweigh the potential risks at the present lime Therefore, they decided to accept the actual risk level for the time being. The likelihood of a similar incident occurring in the future was considered low. Furthermore, the cloud provider had already implemented robust security protocols.

To ensure effective risk management. EsteeMed had documented and reported its risk management process and outcomes through appropriate mechanisms, it recognized that decisions about the creation, retention, and handling of documented information should consider various factors. These factors include aspects such as the intended use of the Information. Its sensitivity, and the external and internal context in which It operates.

Lastly. EsteeMed identified and recorded its assets in an inventory to ensure their protection. The inventory contained detailed information such as the type of assets, their size, location, owner, and backup information.

Based on the scenario above, answer the following question:

What did EsteeMed's approach 10 protecting its critical assets Include after the incident occurred' Refer to scenario 3



Answer : C

After the incident where an unauthorized employee transferred highly restricted patient data to the cloud, EsteeMed focused on ensuring the security of virtual assets in cyberspace. The scenario indicates that the response to the incident involved discussions with the cloud provider about the security measures in place and the potential adoption of a premium cloud security package. This highlights EsteeMed's approach to protecting their critical assets by focusing on the cybersecurity measures necessary to safeguard their virtual assets stored and managed in the cloud.


ISO/IEC 27017:2015 - Provides guidelines for information security controls applicable to the provision and use of cloud services by providing additional implementation guidance for relevant controls specified in ISO/IEC 27002.

NIST SP 800-144 - Guidelines on Security and Privacy in Public Cloud Computing which emphasize the importance of protecting virtual assets in the cloud environment.

Page:    1 / 14   
Total 80 questions