Which situation described in scenario 7 Indicates that Texas H&H Inc. implemented a detective control?

• A. Texas H&H Inc. integrated the incident management policy in Its information security policy
• B. Texas H&H Inc. hired an expert to conduct a forensic analysis
• C. Texas H&H Inc. tested its system for malicious activity and checked cloud based email settings

Scenario 1: HealthGenic is a pediatric clinic that monitors the health and growth of individuals from infancy to early adulthood using a web-based medical software. The software is also used to schedule appointments, create customized medical reports, store patients' data and medical history, and communicate with all the
[^involved parties, including parents, other physicians, and the medical laboratory staff.
Last month, HealthGenic experienced a number of service interruptions due to the increased number of users accessing the software Another issue the company faced while using the software was the complicated user interface, which the untrained personnel found challenging to use.
The top management of HealthGenic immediately informed the company that had developed the software about the issue. The software company fixed the issue; however, in the process of doing so, it modified some files that comprised sensitive information related to HealthGenic's patients. The modifications that were made resulted in incomplete and incorrect medical reports and, more importantly, invaded the patients' privacy.
Based on the scenario above, answer the following question:
According to scenario 1. to detect (1)____________________________, Antiques should have implemented (2)

• A. (1) Patches. (2) an access control software
• B. (1) Intrusions on networks. (?) an intrusion detection system
• C. (1) Technical vulnerabilities. (2) network intrusions

Scenario 9: OpenTech provides IT and communications services. It helps data communication enterprises and network operators become multi-service providers During an internal audit, its internal auditor, Tim, has identified nonconformities related to the monitoring procedures He identified and evaluated several system Invulnerabilities.
Tim found out that user IDs for systems and services that process sensitive information have been reused and the access control policy has not been followed After analyzing the root causes of this nonconformity, the ISMS project manager developed a list of possible actions to resolve the nonconformity. Then, the ISMS project manager analyzed the list and selected the activities that would allow the elimination of the root cause and the prevention of a similar situation in the future. These activities were included in an action plan The action plan, approved by the top management, was written as follows:
A new version of the access control policy will be established and new restrictions will be created to ensure that network access is effectively managed and monitored by the Information and Communication Technology (ICT) Department The approved action plan was implemented and all actions described in the plan were documented.
Based on scenario 9. did the ISMS project manager complete the corrective action process appropriately?

• A. Yes, the corrective action process should include the identification of the nonconformity, situation analysis, and implementation of corrective actions
• B. No, the corrective action process should also include the review of the implementation of the selected actions
• C. No, the corrective action did not address the root cause of the nonconformity

Scenario 1: HealthGenic is a pediatric clinic that monitors the health and growth of individuals from infancy to early adulthood using a web-based medical software. The software is also used to schedule appointments, create customized medical reports, store patients' data and medical history, and communicate with all the involved parties, including parents, other physicians, and the medical laboratory staff.
Last month, HealthGenic experienced a number of service interruptions due to the increased number of users accessing the software Another issue the company faced while using the software was the complicated user interface, which the untrained personnel found challenging to use.
The top management of HealthGenic immediately informed the company that had developed the software about the issue. The software company fixed the issue; however, in the process of doing so, it modified some files that comprised sensitive information related to HealthGenic's patients. The modifications that were made resulted in incomplete and incorrect medical reports and, more importantly, invaded the patients' privacy.
Based on the scenario above, answer the following question:
According to scenario 1, which of the following controls implemented by Antiques is a detective and administrative control?

• A. Review of the information security policy
• B. Enable the automatic update feature of the new software
• C. Review of all user access rights

Based on scenario 9. the top management decided to accept the risk related to a nonconformity to control 5.17 Authentication informal ion. is this acceptable?

• A. Acceptable, as the company properly informed the internal audit that they decided to accept the risk
• B. Acceptable, the company analyzed the implementation costs and accepted the risk
• C. Unacceptable, the company should have provided justification for accepting the risks and documented it