Information Asset Security and Controls 1.0

Question 1

What concern is being primarily addressed when upgrading an existing virtual private network to support Voice-over Internet Protocol communication via tunneling?

Answer 1

Reliability and Quality of service (QoS)

i.e. Voice communications require consistent levels of service, which may be provided through QoS and class of service controls

Question 2

WHAT would be considered an effective control for restricting access to unauthorized Internet sites in an organization?

Answer 2

Routing outbound Internet traffic through a content-filtering proxy server

i.e. this will effectively monitor user access to Internet sites and block access to unauthorized web sites

Question 3

What is a secure and economical method for connecting a private network over the Internet in a small- to medium-sized organization?

Answer 3

A Virtual Private Network (VPN)

i.e. this method allows data to travel securely from a private network to the Internet

Question 4

What risk is increased when an entity replaces its existing wired local area network with a wireless infrastructure (to accommodate the increased use of mobile devices)?

Answer 4

War Driving

i.e. This attack uses a wireless Ethernet card, set in promiscuous mode, and a powerful antenna to penetrate wireless systems from outside

Question 5

WHAT is the “ BEST” way to minimize unauthorized access to unattended end-user PC systems?

Answer 5

Enforcing the use of a password-protected screen saver

Question 6

WHAT is a Major factor with regard to the privacy of the accounting data (when dealing with a new cloud-based accounting service provider)?

Answer 6

Return or destruction of information

i.e. The most important consideration with regard to the privacy of the data is the clause concerning the return or secure destruction of information at the end of the contract

Question 7

How does a Secure Socket Layer (SSL) ensure confidentiality of a message?

Answer 7

BY using symmetric encryption

Question 8

WHAT would be considered a significant threat for an IS auditor when reviewing the logical access to an application?

Answer 8

The file storing the application ID password is in cleartext in the production code

• Compromise of the application ID password can result in untraceable, unauthorized changes to production data

Question 9

What type of control will most effectively detect the presence of bursts of errors in network transmissions?

Answer 9

Cyclic redundancy check (CRC)

i.e. CRC can detect all single-bit and double-bit errors

Question 10

What type of IS attack is the “Replay” attack?

Answer 10

One that uses residual biometric information to gain unauthorized access

E.g. Residual biometric characteristics, such as fingerprints left on a biometric capture device, may be reused by an attacker to gain unauthorized access

Question 11

WHAT is an effective control to ensure accountability for users accessing sensitive data in an human resource management system (HRMS)?

Answer 11

Audit trails

I.e. This capture which user, at what time, and date, along with other details, has performed a transaction

Question 12

What is the difference between the Encapsulating Security Payload protocol and the authentication header protocol?

Answer 12

The Encapsulating Security Payload protocol provides confidentiality via encryption

Question 13

What would allow for the automated assurance that proper data files are being used during processing?

Answer 13

File header record

Question 14

What type of firewalls provides the greatest degree of control (and level of granularity)?

Answer 14

Application Gateway

Question 15

WHAT is the purpose of having a voltage regulator at a data center from an IS audit perspective?

Answer 15

To ensure hardware is protected against power surges.

i.e. this protects against short-term power fluctuations

Question 16

WHAT is the primary objective of classifying information assets (from a control (perspective)?

Answer 16

To establish guidelines for the level of access controls that should be assigned

i.e. This helps management establish guidelines for the level of access controls that should be assigned

Question 17

HOW can the confidentiality of transmitted data best be delivered?

Answer 17

By encrypting the session key with the receiver’s public key

i.e. This helps ensure that the session key can only be obtained using the receiver’s private key

Question 18

How can an IS auditor best assess whether the enterprise properly manages staff member access to the operating system?

Answer 18

By determining whether the enterprise performs periodic reviews of user activity logs

i.e. Reviewing these logs may identify users performing activities that should not have been permitted

Question 19

What should an IS auditor first assess involving an organization’s defined IT security baseline?

Answer 19

Sufficiency

i.e. The IS auditor should first evaluate the definition of the minimum baseline level by ensuring the sufficiency of the control baseline to meet security requirements

Question 20

What would be considered a great overall control for an Internet business looking for confidentiality, reliability and integrity of data?

Answer 20

Secure Sockets Layer (SSL)

i.e. This sets up a secure channel for communications providing confidentiality through a combination of public and symmetric key encryption and integrity through hash message authentication code