Exam ISO-IEC-27001-Lead-Implementer Topic 5 Question 87 Discussion
Actual exam question for PECB's ISO-IEC-27001-Lead-Implementer exam
Question #: 87
Topic #: 5
Question #: 87
Topic #: 5
Infralink is a medium-sized IT consultancy firm headquartered in Dublin, Ireland. It specializes in secure cloud infrastructure, software integration, and data analytics, serving a diverse client base in the healthcare, financial services, and legal sectors, including hospitals, insurance providers, and law firms. To safeguard sensitive client data and support business continuity, Infralink has implemented an information security management system (ISMS) aligned with the requirements of ISO/IEC 27001.
In developing its security architecture, the company adopted services to support centralized user identification and shared authentication mechanisms across its departments. These services also governed the creation and management of credentials within the company. Additionally, Infralink deployed solutions to protect sensitive data in transit and at rest, maintaining confidentiality and integrity across its systems.
In preparation for implementing information security controls, the company ensured the availability of necessary resources, personnel competence, and structured planning. It conducted a cost-benefit analysis, scheduled implementation phases, and prepared documentation and activity checklists for each phase. The intended outcomes were clearly defined to align security controls with business objectives.
Infralink started by implementing several controls from Annex A of ISO/IEC 27001. These included regulating physical and logical access to information and assets in accordance with business and information security requirements, managing the identity life cycle, and establishing procedures for providing, reviewing, modifying, and revoking access rights. However, controls related to the secure allocation and management of authentication information, as well as the establishment of rules or agreements for secure information transfer, have not yet been implemented. During the documentation process, the company ensured that all ISMS- related documents supported traceability by including titles, creation or update dates, author names, and unique reference numbers. Based on the scenario above, answer the following question.
According to scenario 3. what aspects did Infralink ensure when documenting ISMS information?
In developing its security architecture, the company adopted services to support centralized user identification and shared authentication mechanisms across its departments. These services also governed the creation and management of credentials within the company. Additionally, Infralink deployed solutions to protect sensitive data in transit and at rest, maintaining confidentiality and integrity across its systems.
In preparation for implementing information security controls, the company ensured the availability of necessary resources, personnel competence, and structured planning. It conducted a cost-benefit analysis, scheduled implementation phases, and prepared documentation and activity checklists for each phase. The intended outcomes were clearly defined to align security controls with business objectives.
Infralink started by implementing several controls from Annex A of ISO/IEC 27001. These included regulating physical and logical access to information and assets in accordance with business and information security requirements, managing the identity life cycle, and establishing procedures for providing, reviewing, modifying, and revoking access rights. However, controls related to the secure allocation and management of authentication information, as well as the establishment of rules or agreements for secure information transfer, have not yet been implemented. During the documentation process, the company ensured that all ISMS- related documents supported traceability by including titles, creation or update dates, author names, and unique reference numbers. Based on the scenario above, answer the following question.
According to scenario 3. what aspects did Infralink ensure when documenting ISMS information?
Suggested Answer: B Vote an answer
The correct and verified answer to Question 294 is B. Identification and description, based directly on the scenario and the requirements of ISO/IEC 27001:2022 Clause 7.5 - Documented information.
The scenario states that during documentation, Infralink ensured traceability by including:
* Document titles
* Creation or update dates
* Author names
* Unique reference numbers
These elements map exactly to the documented information requirements in Clause 7.5.2, which specifies how ISMS documentation must be identified and described.
ISO/IEC 27001:2022 Clause 7.5.2 a) states that documented information shall be appropriately identified and described, including:
"a title, date, author, or reference number."
This clause is explicitly reflected in the scenario wording, leaving no ambiguity that identification and description were the aspects ensured.
The other options can be clearly ruled out:
* Option A (Format and media) relates to Clause 7.5.2 b), which concerns whether documents are electronic, paper-based, language used, or software format. The scenario does not mention document formats or media.
* Option C (Review and approval scheduling) relates to Clause 7.5.2 c) and 7.5.3, which address approval for suitability and control of changes. The scenario does not describe review cycles, approval authorities, or version approval workflows.
By ensuring clear identification attributes, Infralink supports traceability, accountability, auditability, and version control, which are critical for ISMS effectiveness and certification readiness.
The scenario states that during documentation, Infralink ensured traceability by including:
* Document titles
* Creation or update dates
* Author names
* Unique reference numbers
These elements map exactly to the documented information requirements in Clause 7.5.2, which specifies how ISMS documentation must be identified and described.
ISO/IEC 27001:2022 Clause 7.5.2 a) states that documented information shall be appropriately identified and described, including:
"a title, date, author, or reference number."
This clause is explicitly reflected in the scenario wording, leaving no ambiguity that identification and description were the aspects ensured.
The other options can be clearly ruled out:
* Option A (Format and media) relates to Clause 7.5.2 b), which concerns whether documents are electronic, paper-based, language used, or software format. The scenario does not mention document formats or media.
* Option C (Review and approval scheduling) relates to Clause 7.5.2 c) and 7.5.3, which address approval for suitability and control of changes. The scenario does not describe review cycles, approval authorities, or version approval workflows.
By ensuring clear identification attributes, Infralink supports traceability, accountability, auditability, and version control, which are critical for ISMS effectiveness and certification readiness.
by Baldwin at Jan 15, 2026, 11:20 AM
Contact Us
If you have any question please leave me your email address, we will reply and send email to you in 12 hours.
Our Working Time: ( GMT 0:00-15:00 ) From Monday to Saturday
Support: Contact now
Comments
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
Report Comment
Commenting
You can sign-up / login (it's free).