ISO 27001 ISMS Lead Implementer Certification (PECB) Practice Test

A fintech start-up is scaling from 90 to 260 employees after a funding round. The CTO wants lightweight controls, the legal team is negotiating enterprise customers, and office seating changes are distracting managers. During the ISMS project planning meeting, the IT team wants to exclude supplier monitoring because the cloud provider has an ISO/IEC 27001 certificate. The lead implementer must recommend the next defensible action before customer due-diligence response. Which option best fits ISO/IEC 27001:2022 implementation practice?

A university research center handles sponsored research data and student records. A grant audit is due in July, two labs use personal cloud storage, and campus parking changes are unrelated noise. During the internal audit planning session, the team proposes implementing all 93 Annex A controls so no auditor can challenge exclusions. The lead implementer must recommend the next defensible action before audit committee update. Which option best fits ISO/IEC 27001:2022 implementation practice?

A manufacturer with unionized plants is connecting production telemetry to a cloud analytics platform. Plant uptime is the loudest concern, the HR system migration is unrelated, and engineering wants to reuse an old OT exception. During the risk assessment workshop, the security team describes missing vendor review clauses as a threat, weak offboarding as a risk, and regulatory fines as a vulnerability. The lead implementer must recommend the next defensible action before go-live approval board. Which option best fits ISO/IEC 27001:2022 implementation practice?

A logistics provider is integrating a recently acquired warehouse management system. The acquisition brought three suppliers, night-shift supervisors use local spreadsheets, and a fleet fuel contract is being renegotiated. During the control implementation review, a newly acquired subsidiary uses different risk scales and wants to keep them until after the certification audit to avoid delaying integration. The lead implementer must recommend the next defensible action before certification readiness gate. Which option best fits ISO/IEC 27001:2022 implementation practice?

A public cloud customer is moving its customer portal from virtual machines to managed containers. Developers want faster releases, the provider has several certifications, and the office lease renewal is unrelated. During the change risk review, a fintech team rates a data integrity risk as low because no personal data would be disclosed, although payment balances could be altered for four hours. The lead implementer must recommend the next defensible action before production release window. Which option best fits ISO/IEC 27001:2022 implementation practice?