What risk treatment option has Company A Implemented If it has decided not to collect information from users so that It is not necessary to implement information security controls?

• A. Risk retention
• B. Risk avoidance
• C. Risk modification

The application used by an organization has a complicated user interface. What does the complicated user interface represent in this case?

• A. An intrinsic vulnerability, since it is a characteristic of the asset
• B. A type of threat, since it may result in an unwanted incident
• C. An extrinsic vulnerability, since it is fin external factor that impacts the asset

Scenario 10: ProEBank
ProEBank, an Austrian financial institution, implemented an ISMS and prepared for ISO/IEC 27001 certification. During planning, the company identified a conflict of interest with one auditor, who had previously worked with their main competitor. ProEBank refused to undergo the audit until a new audit team was assigned. The certification body acknowledged the issue and replaced the team.
ProEBank is an Austrian financial institution known for its comprehensive range of banking services.
Headquartered in Vienna, it leaverages the city ' s advanced technological and financial ecosystem To enhance its security posture, ProEBank has implementied an information security management system (ISMS) based on the ISO/IEC 27001. After a year of having the ISMS in place, the company decided to apply for a certification audit to obtain certification against ISO/IEC 27001.
To prepare for the audit, the company first informed its employees for the audit and organized training sessions to prepare them. It also prepared documented information in advance, so that the documents would be ready when external auditors asked to review them Additionally, it determined which of its employees have the knowledge to help the external auditors understand and evaluate the processes.
During the planning phase for the audit, ProEBank reviewed the list of assigned auditors provided by the certification body. Upon reviewing the list, ProEBank identified a potential conflict of interest with one of the auditors, who had previously worked for ProEBank ' s mein competitor in the banking industry To ensure the integrity of the audit process. ProEBank refused to undergo the audit until a completely new audit team was assigned. In response, the certification body acknowledged the conflict of interest and made the necessary adjustments to ensure the impartiality of the audit team After the resolution of this issue, the audit team assessed whether the ISMS met both the standard ' s requirements and the company ' s objectives. During this process, the audit team focused on reviewing documented information.
Three weeks later, the team conducted an on-site visit to the auditee's location where they aimed to evaluate whether the ISMS conformed to the requirements of ISO/IEC 27001. was effectively implemented, and enabled the auditee to reach its information security objectives. After the on-site visit the team prepared the audit conclusions and notified the auditee that some minor nonconformities had been detected The audit team leader then issued a recommendation for certification.
After receiving the recommendation from the audit team leader, the certification body established a committee to make the decision for certification. The committee included one member from the audit team and two other experts working for the certification body.
Question:
Is ProEBank ' s decision to require a new audit team due to a perceived conflict of interest acceptable?

• A. No - they should have requested only the replacement of the auditor
• B. Yes - the auditee is allowed to refuse to undergo the audit until a new audit team is established
• C. No - the auditee does not have the right to reject the auditors selected by the certification body

Which option below should be addressed in an information security policy?

• A. Actions to be performed after an information security incident
• B. The complexity of information security processes and their interactions
• C. Legal and regulatory obligations imposed upon the organization