Exam Lead Auditor topic 1 question 143 discussion

Actual exam question from PECB's Lead Auditor

Question #: 143
Topic #: 1

You are an experienced audit team leader conducting a third-party surveillance audit of an organization that designs websites for its clients. You are currently reviewing the organization’s Statement of Applicability.

Based on the requirements of ISO/IEC 27001, which two of the following observations about the Statement of Applicability are true? (Choose two.)

A. The Statement of Applicability must be reviewed at Management Review
B. The Statement of Applicability must be reviewed at least annualy
C. Justification is only required for any controls that the organization chooses to exclude
D. The Statement of Applicability is owned and amended by the organization’s top management
E. A Statement of Applicability must be produced by organizations seeking ISO/IEC 27001 conformity
F. Justification for both the inclusion and exclusion of Annex A controls in the Statement of Applicability is required

Show Suggested Answer

Suggested Answer: AE 🗳️

by [deleted] at Oct. 20, 2025, 3:08 a.m.

Comments

Submit Cancel

71b126a

1 week, 5 days ago

Selected Answer: EF

✅ E. Une déclaration d’applicabilité doit être produite par des organismes souhaitant se conformer à la norme ISO/IEC 27001 → Le SoA est obligatoire (clause 6.1.3 d’ISO 27001) et liste les contrôles de l’annexe A, avec leur inclusion/exclusion et justification. ✅ F. L’inclusion et l’exclusion des contrôles de l’annexe A dans l’énoncé d’applicabilité doivent justifier l’inclusion ou l’exclusion des contrôles de l’annexe A → Chaque contrôle doit être justifié, qu’il soit inclus ou exclu, pour démontrer la pertinence par rapport à l’analyse de risques.

upvoted 1 times

...