Enterprise Security Integration Flashcards
The security triad does not include which of the following? A. Availability B. Integrity C. Authenticity D. Confidentiality
C. The security triad consists of confidentiality, availability, and integrity.
\_\_\_\_\_\_\_\_\_\_\_\_\_\_ is about proving the veracity of the claim. A. Accountability B. Authentication C. Non-repudiation D. Accessibility
B. The purpose of authentication is to prove the veracity of the claim.
Granularity is most closely associated with which of the following terms? A. Accountability B. Authentication C. Non-repudiation D. Accessibility
B. Granularity is most closely associated with the term authentication.
According to the process described in this chapter for building security controls, what is the last step? A. Discover protection needs.
B. Design system security architecture.
C. Audit.
D. Implement system security.
D. According to the process described in this chapter for building security controls, the last step is to implement system security.
______________ is the practice of organizing and documenting a company’s IT assets so that planning, management, and expansion can be enhanced. A. Value delivery
B. COBIT
C. Performance measurement
D. Enterprise architecture
D. Enterprise architecture is the practice of organizing and documenting a company’s IT assets so that planning, management, and expansion can be enhanced.
For what purpose is software escrow most commonly used? A. Offsite backup B. Vendor bankruptcy C. Redundancy D. Insurance coverage
B. Software escrow is most commonly used in cases of vendor bankruptcy.
If someone in payroll wanted to commit fraud, which of the following would force them to collude with someone from accounting? A. Background checks B. Dual control C. Mandatory vacation D. Job rotation
B. Dual controls would force someone in payroll to collude with someone from accounting in order to commit fraud.
A \_\_\_\_\_\_\_\_\_\_\_\_\_\_ is a top-tier security document that provides an overall view of security. A. Policy B. Procedure C. Baseline D. Guideline
A. A policy is a top-tier document that gives you an overall view of security.
Which of the following does not help in preventing fraud? A. Mandatory vacations B. Job rotation C. Job enlargement D. Separation of duties
C. Separation of duties, job rotation, and mandatory vacations are management controls that can help in preventing fraud. Job enlargement does not prevent fraud because it is not a control and its purpose is to expand the scope of an employee’s work.
Which type of document defines a minimum level of security? A. Policy B. Standard C. Baseline D. Procedure
C. A baseline defines a minimum level of security.
Fault tolerance is best described as what type of control? A. Recovery B. Preventive C. Detective D. Corrective
D. Fault tolerance is best described as a corrective control.
What form of testing verifies inner logic? A. Pilot B. Black box C. White box D. Regression
C. White box testing verifies inner logic.
Which form of testing is used to verify that program inputs and outputs are correct? A. Pilot B. Black box C. White box D. Regression
D. Regression testing is used after a change to verify that inputs and outputs are correct.
Security awareness training is best described as a \_\_\_\_\_\_\_\_\_\_\_\_\_\_ control. A. Recovery B. Preventive C. Detective D. Corrective
B. Security awareness training is best described as a preventive control.
Which of the following is the correct sequence of actions in access control mechanisms?
A. Access profiles, authentication, authorization, and identification
B. Security rules, identification, authorization, and authentication
C. Identification, authentication, authorization, and accountability
D. Audit trails, authorization, accountability, and identification
C. Identification comes before authentication and authorization comes after authentication. Accountability is last, and it is the stage where user actions are recorded.
