Valid ISO-IEC-27035-Lead-Incident-Manager Dumps shared by ExamDiscuss.com for Helping Passing ISO-IEC-27035-Lead-Incident-Manager Exam! ExamDiscuss.com now offer the newest ISO-IEC-27035-Lead-Incident-Manager exam dumps, the ExamDiscuss.com ISO-IEC-27035-Lead-Incident-Manager exam questions have been updated and answers have been corrected get the newest ExamDiscuss.com ISO-IEC-27035-Lead-Incident-Manager dumps with Test Engine here:
Scenario 7: Located in central London, Konzolo has become a standout innovator in the cryptocurrency field. The company faced challenges monitoring the security of its own and third-party systems. An incident involving server downtime exposed vulnerabilities in a third-party service provider's security posture, leading to unauthorized access. In response, Konzolo launched a thorough vulnerability scan of its cryptographic wallet software and uncovered critical weaknesses due to outdated encryption algorithms. Noah, the IT manager, documented and communicated the findings. Paulina was brought in to lead a forensic investigation, provide actionable insights, and help enhance the company's overall incident response strategy based on ISO/IEC 27035 standards. Based on the scenario above, answer the following question: Which of the following steps for effective security monitoring did Konzolo NOT adhere to?
Correct Answer: C
Comprehensive and Detailed Explanation From Exact Extract: ISO/IEC 27035-1:2016 and ISO/IEC 27035-2:2016 emphasize the importance of monitoring not only internal systems but also third-party or outsourced services. Clause 7.3.2 of ISO/IEC 27035-2 specifically recommends that organizations establish mechanisms for the continuous monitoring of service providers and outsourced systems, particularly when such services process or store sensitive information. In the scenario, Konzolo suffered an incident due to a failure by a third-party service provider to uphold security controls. This indicates that Konzolo had insufficient or no effective monitoring of outsourced services in place, which directly contributed to the breach and system downtime. On the other hand: Option A is incorrect because Konzolo did conduct a vulnerability scan, identifying and addressing cryptographic weaknesses. Option B is also incorrect, as Paulina conducted forensic and behavioral analysis (both manual and automated) as part of the investigation process. Reference Extracts: ISO/IEC 27035-2:2016, Clause 7.3.2: "Monitoring should not be limited to internal infrastructure but should include third-party and outsourced services to ensure that they are operating within defined security parameters." ISO/IEC 27002:2022, Control 5.23: "Information security should be addressed in agreements with third parties." Correct answer: C -