questions Flashcards
Chad is a security practitioner tasked with ensuring that the information on the organization’s public website is not changed by anyone outside the organization.
This task is an example of ensuring _________.
- Integrity
Preventing unauthorized modification is the definition of integrity.
Which of the following is an example of a “Something you know” authentication factor?
- Password
A password is something the user knows and can present as an authentication factor to confirm an identity assertion.
Which of the following is an example of a “Something you are” authentication factor?
A photograph of your face
A system that collects transactional information and stores it in a record in order to show which users performed which actions is an example of providing ________.
Non-repudiation
Non-repudiation is the concept that users cannot deny they have performed transactions that they did, in fact, conduct. A system that keeps a record of user transactions provides non-repudiation.
What is the European Union (EU) law that grants legal protections to individual human privacy?
The General Data Protection Regulation (GDPR)
For which of the following systems would the security concept of availability probably be most important?
Medical systems that monitor patient condition in an intensive-care unit
Information that reflects patient condition is data that necessarily must be kept available in real time, because that data is directly linked to the patients’ well-being (and possibly their life). This is, by far, the most important of the options listed.
For which of the following assets is integrity probably the most important security aspect?
The file that contains passwords used to authenticate users
In risk management concepts, a(n) _________ is something a security practitioner might need to protect.
Asset
An asset is anything with value, and a security practitioner may need to protect assets.
In risk management concepts, a(n) ___________ is something or someone that poses risk to an organization or asset.
Threat
Of the following, which would probably not be considered a threat?
A laptop with sensitive data on it
Which of the following probably poses the most risk?
A high-likelihood, high-impact event
Within the organization, who can identify risk?
- Anyone
Kerpak works in the security office of a medium-sized entertainment company. Kerpak is asked to assess a particular threat, and he suggests that the best way to counter this threat would be to purchase and implement a particular security solution.
This is an example of _______.
- Mitigation (減少)
Applying a security solution (a type of control) is an example of mitigation.
Sophia is visiting Las Vegas and decides to put a bet on a particular number on a roulette wheel.
This is an example of _________.
Acceptance
Sophia is accepting the risk that the money will be lost, even though the likelihood is high; Sophia has decided that the potential benefit (winning the bet), while low in likelihood, is worth the risk.
Phrenal is selling a used laptop in an online auction. Phrenal has estimated the value of the laptop to be $100, but has seen other laptops of similar type and quality sell for both more and less than that amount. Phrenal hopes that the laptop will sell for $100 or more, but is prepared to take less for it if nobody bids that amount.
This is an example of ___________.
- Risk tolerance
Phrenal has decided there is an acceptable level of risk associated with the online sale of the laptop; this is within Phenol’s risk tolerance.
A software firewall is an application that runs on a device and prevents specific types of traffic from entering that device.
This is a type of ________ control.
- Technical
A software firewall is a technical control because it is a part of the IT environment.
At the airport, there are red lines painted on the ground next to the runway, which prohibits 禁止traffic from crossing it.
This is an example of a(n)______ control.
Physical
A bollard is a post set securely in the ground in order to prevent a vehicle from entering an area or driving past a certain point.
Bollards are an example of ______ controls.
Physical
Druna is a security practitioner tasked with ensuring that laptops are not stolen from the organization’s offices.
Which sort of security control would probably be best for this purpose?
Physical
Because laptops are tangible objects, and Druna is trying to ensure that these objects are not moved from a certain place, physical controls are probably best for the purpose.
Triffid Corporation has a policy that all employees must receive security awareness instruction before using email; the company wants to make employees aware of potential phishing attempts that the employees might receive via email.
What kind of control is this instruction?
Administrative
Both the policy and the instruction are administrative controls; rules and governance are administrative.
ISC2 publishes a Common Body of Knowledge (CBK) that IT security practitioners should be familiar with; this is recognized throughout the industry as a set of material that is useful for practitioners to refer to.
Certifications can be issued for demonstrating expertise in this Common Body of Knowledge.
What kind of document is the Common Body of Knowledge?
- Standard
The Common Body of Knowledge is used throughout the industry, recognized among many people, countries and organizations. This is a standard.
The city of Grampon wants to ensure that all of its citizens are protected from malware, so the city council creates a rule that anyone caught creating and launching malware within the city limits will receive a fine and go to jail.
What kind of rule is this?
Law
The city council is a governmental body making a legal mandate; this is a law.
The Triffid Corporation publishes a strategic overview of the company’s intent to secure all the data the company possesses. This document is signed by Triffid’s senior management.
What kind of document is this?
Policy
This is an internal, strategic document, and is therefore a policy.
Grampon municipal code requires that all companies that operate within city limits will have a set of processes to ensure employees are safe while working with hazardous 危險的 materials. Triffid Corporation creates a checklist of activities employees must follow while working with hazardous materials inside Grampon city limits.
The municipal code is a ______, and the Triffid checklist is a ________.
Law, procedure
The municipal code was created by a governmental body and is a legal mandate; this is a law. The Triffid checklist is a detailed set of actions which must be used by Triffid employees in specific circumstances; this is a procedure.
The Payment Card Industry (PCI) Council is a committee made up of representatives from major credit card providers (Visa, Mastercard, American Express) in the United States.
The PCI Council issues rules that merchants must follow if the merchants choose to accept payment via credit card. These rules describe best practices for securing credit card processing technology, activities for securing credit card information, and how to protect customers’ personal data.
This set of rules is a _____.
Standard
This set of rules is known as the Data Security Standard, and it is accepted throughout the industry.
Hoshi is an ISC2 member who works for the Triffid Corporation as a data manager.
Triffid needs a new firewall solution, and Hoshi is asked to recommend a product for Triffid to acquire and implement. Hoshi’s cousin works for a firewall vendor; that vendor happens to make the best firewall available.
What should Hoshi do?
- Disclose the relationship, but recommend the vendor/product
According to the third Canon of the ISC2 Code of Ethics, members are required to provide diligent and competent service to principals. Hoshi’s principal here is Triffid, Hoshi’s employer.
It would be inappropriate for Hoshi to select the cousin’s product solely based upon the family relationship; however, if the cousin’s product is, in fact, the best choice for Triffid, then Hoshi should recommend that product. In order to avoid any appearance of impropriety or favoritism, Hoshi needs to declare the relationship when making the recommendation.
Olaf is a member of ISC2 and a security analyst for Triffid Corporation.
During an audit, Olaf is asked whether Triffid is currently following a particular security practice. Olaf knows that Triffid is not adhering to that standard in that particular situation, but that saying this to the auditors will reflect poorly on Triffid.
What should Olaf do?
Tell the auditors the truth
The ISC2 Code of Ethics requires that members act honorably, honestly, justly, responsibly, and also advance and protect the profession. Both requirements dictate that Olaf should tell the truth to the auditors.
While the Code also says that Olaf should provide diligent and competent service to principals, and Olaf’s principal is Triffid in this case, lying does not serve Triffid’s best long-term interests, even if the truth has some negative impact in the short term.
Aphrodite is a member of ISC2 and a data analyst for Triffid Corporation. While Aphrodite is reviewing user log data, Aphrodite discovers that another Triffid employee is violating the acceptable use policy and watching streaming videos during work hours.
What should Aphrodite do?
- Inform Triffid management
Aphrodite is required by the ISC2 Code of Ethics to provide diligent and competent service to principals. This includes reporting policy violations to Triffid management (Triffid is the principal, in this case). A policy violation of this type is not a crime, so law enforcement does not need to be involved, and ISC2 has no authority over Triffid policy enforcement or employees.
Glena is an ISC2 member. Glena receives an email from a company offering a set of answers for an ISC2 certification exam.
What should Glena do?
Inform ISC2
You are reviewing log data from a router; there is an entry that shows a user sent traffic through the router at 11:45 am, local time, yesterday.
This is an example of a(n) _______.
Event
An event is any observable occurrence within the IT environment.
An attacker outside the organization attempts to gain access to the organization’s internal files. This is an example of a(n) ______.
- Intrusion
An intrusion is an attempt (successful or otherwise) to gain unauthorized access.
Who approves the incident response policy?
- The subject
The organization’s senior management are the only entities authorized to accept risk on behalf of the organization, and therefore all organizational policies must be approved by senior management.
Which of the following are not typically involved in incident detection?
Regulators
Typically, regulators do not detect incidents, nor alert organizations to the existence of incidents
What is the goal of Business Continuity efforts?
Keep critical business functions operational
Business Continuity efforts are about sustaining critical business functions during periods of potential interruption, such as emergencies, incidents, and disasters.
Which of the following is likely to be included in the business continuity plan?
Alternate work areas for personnel affected by a natural disaster
The business continuity plan should include provisions for alternate work sites, if the primary site is affected by an interruption, such as a natural disaster.
What is the most important goal of a business continuity effort?
Preserve health and human safety
What is the overall objective of a disaster recovery (DR) effort?
Return to normal, full operations
What is the risk associated with resuming full normal operations too soon after a DR effort?
The danger posed by the disaster might still be present
What is the risk associated with delaying resumption of full normal operations after a disaster?
The impact of running alternate operations for extended periods
Alternate operations are typically more costly than normal operations, in terms of impact to the organization; extended alternate operations could harm the organization as much as a disaster.
Gelbi is a Technical Support analyst for Triffid, Inc. Gelbi sometimes is required to install or remove software.
Which of the following could be used to describe Gelbi’s account?
Privileged
A privileged account is an account that typically needs greater permissions than a basic user.
