Authentic PECB Certification Exam ISO-IEC-27035-Lead-Incident-Manager Questions Answers

Comprehensive and Detailed Explanation From Exact Extract:

According to ISO/IEC 27035-2:2016, one of the technical requirements to support effective incident management is the capability to rapidly detect, collect, and process information about security events, incidents, and vulnerabilities. Timely acquisition of this data allows the organization to assess threats, determine the scope of incidents, and execute response measures quickly.

Clause 7.4.1 emphasizes the need for adequate tools and infrastructure to support the detection and acquisition of information security events and vulnerability reports. The collected data becomes the foundation for risk assessment, root cause analysis, and corrective action planning.

Option A (public disclosure of contact details) might be relevant for CERT/CSIRT public coordination but is not a core requirement in technical incident response. Option B (immediate deletion of reports) is contrary to best practices, as incident reports are critical for audits, compliance, and continuous improvement.

Reference Extracts:

ISO/IEC 27035-2:2016, Clause 7.4.1: “Organizations should ensure that technical means are in place to allow quick acquisition and analysis of information related to events, incidents, and vulnerabilities.”

Correct answer: C

—

Comprehensive and Detailed Explanation From Exact Extract:

ISO/IEC 27035-2:2016 is titled “Information security incident management — Part 2: Guidelines to plan and prepare for incident response.” This document provides detailed guidance on establishing an incident response capability, planning for incident response, and implementing effective response actions. It also emphasizes the importance of post-incident analysis and lessons learned to improve future incident handling.

Key activities covered in ISO/IEC 27035-2 include:

* Planning and preparing for incident handling (e.g., policy development, roles and responsibilities)

* Establishing and training the incident response team (IRT)

* Developing communication strategies and escalation procedures

* Conducting root cause analysis and collecting lessons learned

* Applying improvements to prevent recurrence

By contrast:

* ISO/IEC 27035-1 provides high-level principles of incident management (Part 1: Principles).

* ISO/IEC 27037 relates to the handling of digital evidence and is focused more on forensic practices than incident response preparation.

Reference Extracts:

* ISO/IEC 27035-2:2016, Introduction: “This part provides guidance on the planning and preparation necessary for effective incident response and for learning lessons from incidents.”

* ISO/IEC 27035-2:2016, Clause 6.5: “Lessons learned and reporting can help improve future incident response and provide input to risk assessments and control improvements.”

Comprehensive and Detailed Explanation From Exact Extract:

ISO/IEC 27035-1:2016 Clause 7.1 explicitly states that the frequency and depth of reviewing the incident management strategy should be based on the organization’s size, complexity, and threat environment. Larger or more complex environments may require more frequent reviews to remain agile and responsive.

Audit schedules (Option C) may influence timing, but they do not dictate the necessary frequency for strategic reviews. The number of employees (Option A) alone is not a sufficient factor.