Domain 6 Flashcards
Security Assessment and Testing
- Internal audits are the preferred approach when which of the following is true?
A. The organization lacks the organic expertise to conduct them.
B. Regulatory requirements dictate the use of a third-party auditor.
C. The budget for security testing is limited or nonexistent.
D. There is concern over the spillage of proprietary or confidential information.
C. Third-party auditors are almost always fairly expensive, so if the organization’s budget does not support their use, it may be necessary to use internal assets to
conduct the audit.
All of the following are steps in the security audit process except
A. Document the results.
B. Convene a management review.
C. Involve the right business unit leaders.
D. Determine the scope.
B. The management review is not a part of any audit. Instead, this review typically uses the results of one or more audits in order to make strategic decisions.
Which of the following is an advantage of using third-party auditors?
A. They may have knowledge that an organization wouldn’t otherwise be able to leverage.
B. Their cost.
C. The requirement for NDAs and supervision.
D. Their use of automated scanners and reports.
A. Because they perform audits in multiple other organizations, and since their knowledge is constantly refreshed, third-party auditors almost always have knowledge and insights that would otherwise be unavailable to the organization.
Choose the term that describes an audit performed to demonstrate that an organization is complying with its contractual obligations to another organization.
A. Internal audit
B. Third-party audit
C. External audit
D. Compliance audit
C. External audits are used to ensure that contractors are meeting their contractual obligations, so that is the best answer. A compliance audit would
apply to regulatory or industry standards and would almost certainly be a third party audit, which makes answer D a poor fit in most cases
Which of the following is true of a vulnerability assessment?
A. The aim is to identify as many vulnerabilities as possible.
B. It is not concerned with the effects of the assessment on other systems.
C. It is a predictive test aimed at assessing the future performance of a system.
D. Ideally it is fully automated, with no human involvement.
A. One of the principal goals of a vulnerability assessment is to identify as many security flaws as possible within a given system, while being careful not to disrupt
other systems.
An assessment whose goal is to assess the susceptibility of an organization to social engineering attacks is best classified as
A. Physical testing
B. Personnel testing
C. Vulnerability testing
D. Network testing
B. Social engineering is focused on people, so personnel testing is the best answer.
Which of the following is an assessment that affords the auditor detailed knowledge
of the system’s architecture before conducting the test?
A. White box testing
B. Gray box testing
C. Black box testing
D. Zero knowledge testing
A. White box testing gives the tester detailed information about the internal workings of the system under study. Gray box testing provides some information,
so it is not the best answer to this question.
Vulnerability scans normally involve all the following except
A. The identification of active hosts on the network
B. The identification of malware on all hosts
C. The identification of misconfigured settings
D. The identification of operating systems
B. Vulnerability testing does not normally include scanning hosts for malware. Instead, it focuses on finding flaws that malware could potentially exploit.
Security event logs can best be protected from tampering by which of the following?
A. Encrypting the contents using asymmetric key encryption
B. Ensuring every user has administrative rights on their own workstations
C. Using remote logging over simplex communications media
D. Storing the event logs on DVD-RW
C. Using a remote logging host raises the bar for attackers because if they are able to compromise one host, they would have to compromise the remote logger in
order to tamper with the logs. The use of a simplex channel further hinders the attackers.
Synthetic transactions are best described as
A. Real user monitoring (RUM)
B. Transactions that fall outside the normal purpose of a system
C. Transactions that are synthesized from multiple users’ interactions with the system
D. A way to test the behavior and performance of critical services
D. Synthetic transactions are those that simulate the behavior of real users, but are not the result of real user interactions with the system. They allow an organization to ensure that services are behaving properly without having to rely
on user complaints to detect problems.
Suppose you want to study the actions an adversary may attempt against your system and test the effectiveness of the controls you have emplaced to mitigate
the associated risks. Which of the following approaches would best allow you to accomplish this goal?
A. Misuse case testing
B. Use case testing
C. Real user monitoring (RUM)
D. Fuzzing
A. Misuse case testing allows us to document both an adversary’s desired actions on a system and the controls that are meant to thwart that adversary. It is similar
to developing use cases, but with a malicious user’s actions in mind instead of those of legitimate users.
Code reviews include all of the following except
A. Ensuring the code conforms to applicable coding standards
B. Discussing bugs, design issues, and anything else that comes up about the code
C. Agreeing on a “disposition” for the code
D. Fuzzing the code
D. Fuzzing is a technique for detecting flaws in the code by bombarding it with massive amounts of random data. This is not part of a code review, which focuses on analyzing the source code, not its response to random data.
Interface testing could involve which of the following?
A. The application programming interface (API)
B. The graphical user interface (GUI)
C. Both of the above
D. None of the above
C. Interface testing covers the exchange points within different components of the system. The API is the exchange point between the system and the libraries it leverages, while the GUI is the exchange point between the system and the users. Testing either of these would constitute an interface test.
What is a key performance indicator (KPI)?
A. A value for a factor that denotes that some condition is met
B. The result of comparing multiple measurements
C. A significant indicator that shows the performance of an ISMS
D. A quantitative observation of a factor of an ISMS at a point in time
C. Key performance indicators (KPIs) are indicators that are particularly significant in showing the performance of an ISMS compared to its stated goals.
Because every KPI is a metric, answer B (the partial definition of a metric) would also be correct but would not be the best answer since it leaves out the significance and purpose of the metric
Which of the following is true about key risk indicators (KRIs)?
A. They tell managers where an organization stands with regard to its goals.
B. They are inputs to the calculation of single loss expectancy (SLE).
C. They tell managers where an organization stands with regard to its risk appetite.
D. They represent an interpretation of one or more metrics that describes the
effectiveness of the ISMS.
C. Key risk indicators (KRIs) allow managers to understand when specific activities of the organization are moving it toward a higher level of risk. They are
useful to understanding changes and managing the overall risk.
