BioLooVitalis is a biopharmaceutical firm headquartered in Singapore Renowned for its pioneering work in the fie d of human therapeutics. BioLooVitalis places a strong emphasis on addressing critical healthcare concerns particularly in the domains of cardiovascular diseases, oncology bone health, and inflammation BioLooVitalis has demonstrated its commitment to data security and integrity by maintaining an effective information security management system (ISMS) based on ISO/IEC 77001 for the past two years. After noticing an increase m failed login attempts over several weeks. bioLooVitalis IT security learn reviewed log data, correlated it with user behavior patterns, and mapped it against known attach vectors to determine potential causes. Based on their findings, they prepared a technical report detailing the nature of the anomalies and submitted it to the compliance function. The compliance team then summarized the findings and presented them to the executive management during the quarterly ISMS performance review. To proactively track system behavior following the spike n failed login attempts. BioLooVitalis ' s IT security team configured a dashboard showing real time login activity. system response times, and end point availability across departments. This helped the team quickly detect abnormal behavior without waiting formal reporting cycles. Following The implementation of the real time access control dashboard BioLooVitalis internal audit team assessed whether the new processes and tools effectively reduced unauthorized access attempts and met both technical and policy-based requirements. Lastly, the internal auditors collected system-generated access logs, reviewed user access reports, and conducted interviews with IT personnel. These data sources helped them verify whether the new controls were functioning as intended and aligned with internal ISMS objectives.
Based on The scenario above, answer the following question.
What aspect of the internal audit was addressed by BioLooVital s? Refer to scenario 8

• A. Evaluation of ISMS measurement review
• B. Evaluation of effectiveness and efficiency of processes and controls
• C. Evaluation of effectiveness and efficiency of ISMS life cycle

An organization has justified the exclusion of control 5.18 Access rights of ISO/IEC 27001 in the Statement of Applicability (SoA) as follows: " An access control reader is already installed at the main entrance of the building. " Which statement is correct '

• A. The justification for the exclusion of a control is not required to be included in the SoA
• B. The justification is not acceptable because it does not indicate that it has been selected based on the risk assessment results
• C. The justification is not acceptable, because it does not reflect the purpose of control 5.18

What is the main difference between an audit program and an audit plan?

• A. An audit program outlines policies, procedures, or requirements for reference in audit evidence comparison, while an audit plan provides an overarching framework for a series of audits with specific timelines and purposes
• B. An audit program outlines the overarching framework for a series of audits with specific timelines and purposes, while an audit plan outlines the activities and arrangements for a particular audit
• C. An audit program outlines the activities and arrangements for a particular audit, while an audit plan provides an overarching framework for a series of audits with specific timelines and purposes

NeuroTrustMed is a leading medical technology company based in Seoul, South Korea. The company specializes in developing AI-assisted neuroimaging solutions used in early diagnosis and treatment planning for neurological disorders. As a data-intensive company handling sensitive patient health records and medical research data, NeuroTrustMed places a strong emphasis on cybersecurity and regulatory compliance. The company has maintained an ISO/IEC 27001-certified ISMS for the past three years. It continuously reviews and improves its ISMS to address emerging threats, support innovation in medical diagnostics, and maintain stakeholder trust. As part of its commitment to continual improvement, NeuroTrustMed actively tracks potential nonconformities, performs root-cause analyses, implements corrective and preventive actions, and ensures all changes are documented and aligned with the company's strategic objectives. When a new data protection regulation came into effect affecting cross-regional data handling, the information security team conducted a gap assessment between current policies and the new regulation. Then, it updated relevant documentation and processes to meet compliance. Following these revisions, NeuroTrustMed updated the ISMS documentation and added a new entry in the improvement register. The register, maintained in the form of a structured spreadsheet, included a unique change number, a description of the update, and a high-priority classification due to legal compliance, the dates of initiation and completion, and the sign-off by the information security manager. Around the same period, during a scheduled management review, the information security team also identified a pattern of onboarding errors. While these had not resulted in any data breaches, they posed a risk of unauthorized access. In response, the onboarding procedure was revised and an automated verification step was added to ensure accuracy before access is granted. To understand the underlying cause, the team collected data on the provisioning process. They analyzed process logs, interviewed onboarding staff, and traced access errors back to a misconfigured step in the HR-to-IT handover workflow. The team validated this finding through test cases before implementing any changes. Once confirmed, the information security team documented the nonconformity in the ISMS log. The documentation included a description of the issue, impacted systems, affected users, and a brief risk assessment of potential consequences related to access management. Based on the scenario above, answer the following question.
Refer to scenario 10, is the composition of the certification decision committee acceptable?

• A. Yes, as persons that make the decision for certification are different from those who carried out the audit.
• B. No, the committee should have included only members from the audit team and no other experts that were not part of the audit
• C. No, the committee must include one member from the audit team and other individuals working for the certification body

Scenario 5: Bytes iS a dynamic and innovative Company specializing in the design, manufacturing. and distribution Of hardware and software, with a focus On providing comprehensive network and supporting services. It is headquartered in the vibrant tech hub of Lagos, Nigeria. It has a diverse and dedicated team, boasting a workforce of over 800 employees who are passionate about delivering cutting-edge solutions to their Clients. Given the nati-jte Of its business. Bytes frequently handles sensitive data both internally and When collaborating With Clients and partners.
Recognizing the Challenges inherent in securely sharing data with clients. partners, and within its own internal operations. Bytes has implemented robust information security measures, They utilize a defined risk assessment process, which enables them to assess and address potential threats and information security risks.
This process ensures compliance with ISOflEC 27001 requirements, a critical aspect of Bytes ' operations.
Initially. Bytes identified both external and internal issues that are relevant to its purpose and that impact its ability to achieve the intended information security management System Outcomes, External issues beyond the company ' S control include factors Such as social and Cultural dynamics, political. legal.
normative, and regulatory environments, financial and macroeconomic conditions. technological developments, natural factors, and competitive pressures. Internal issues, which are within the organization ' s control, encompass aspects like the company ' s culture. its policies, objectives, and strategies; govetnance structures.
roles, and responsibilities: adopted standards and guidelines; contractual relationships that influence processes within the ISMS scope: processes and procedures resources and knowledge capabilities; physical infrastructure information systems. information flows. and decisiorwnaking processes; as well as the results of previous audits and risk assessments. Bytes also focused on identifying the interested parties relevant to the ISMS understanding their requirements, and determining which Of those requirements will be addressed by the ISMS In pursuing a secure digital environment, Bytes leverages the latest technology, utilizing automated vulnerability scanning tools to identify known vulnerable services in their ICT systems. This proactive approach ensures that potential weaknesses are swiftly addressed. bolstering their overall information security posture.
In their comprehensive approach to information security, Bytes has identified and assessed various risks. During this process, despite implementing the security controls, Bytes ' expert team identified unacceptable residual risks, and the team Currently faces uncertainty regarding which specific options to for addressing these identified and unacceptable residual risks.
Based on scenario 5, certain residual risks were defined as unacceptable. Which risk treatment options should Bytes consider?

• A. Bytes should terminate the affected projects immediately
• B. Bytes should suspend all operations until risks are fully eliminated
• C. Bytes should identify alternative risk treatment options