Sample Exam 3 Flashcards
Which of the following system development life cycle stages is MOST suitable for incorporating internal controls?
A.Development
B.Testing
C.Implementation
D.Design
D is the correct answer.
Justification
Internal control requirements should be incorporated during development; however, unless the team already started incorporating internal controls during the preceding design phase, the project may incur a rework cost, and the incorporation effort will likely affect project deliverables, project cost and the project time line.
Incorporating internal control requirements as late as the testing stage is likely to adversely affect project deliverables, project cost and the project time line.
Incorporating internal control requirements as late as the implementation stage is too late and may pose significant risk to the enterprise.
Internal controls should be incorporated in the new system development at the earliest stage possible (i.e., at the design stage).
Which of the following is the MOST important information to include in a risk treatment plan that already has an appropriate resolution and a date for completion?
A.responsible personnel.
B.mitigating factors.
C.likelihood of occurrence.
D.cost of completion.
A is the correct answer.
Justification
Risk response activities must be assigned to a responsible person or group; if this assignment is not included, it will be unclear who will implement the countermeasure.
Mitigating factors can be included but are not as important as responsible personnel.
Compensating controls can be included but are not as important as responsible personnel.
Cost for completion is an optional field and is not necessary.
Which of the following assessments of an enterprise’s risk monitoring process will provide the BEST information about its alignment with industry-leading practices?
A.A capability assessment by an outside firm
B.A self-assessment of capabilities
C.An independent benchmark of capabilities
D.An internal audit review of capabilities
C is the correct answer.
Justification
A capability assessment by an outside firm does not assess the enterprise against industry peers or competitors and only provides the opinion of the examiner as to what are or are not industry-leading practices.
A process capability self-assessment does not assess the enterprise against industry peers or competitors. It provides the opinion of the examiner and in the case of a self-assessment is not independent of the process to be reviewed.
An independent benchmark of capabilities allows an enterprise to understand its level of capability compared to other enterprises within its industry. This allows the enterprise to identify industry-leading practices and its level of capability associated with those practices.
An internal audit review of capabilities does not assess the enterprise against industry peers or competitors. Audits generally measure capabilities against corporate standards, not necessarily against industry-leading practices.
Which of the following activities is MOST important in determining the risk mitigation strategy?
A.Review vulnerability assessment results.
B.Perform a cost-benefit analysis related to risk acceptance.
C.Conduct a business impact analysis of affected areas.
D.Align the strategy with the security controls framework.
B is the correct answer.
Justification
Results from a vulnerability assessment are used in a risk assessment to determine the level of risk but are not used in the selection of a mitigation strategy.
Risk mitigation ensures that residual risk is maintained at an acceptable level. Cost-benefit analysis ensures that the cost of mitigating risk does not exceed the cost to the enterprise if an incident should occur.
Business impact analysis facilitates development of mitigation and recovery strategy because it documents processes, key deliverables and recovery time objectives. However, the cost of mitigation is the key criterion for the enterprise.
Understanding the enterprise’s security controls framework assists with design and implementation of controls once the mitigation strategy is determined for a given risk.
Which of the following would BEST help finalize the risk treatment plan?
A.Vulnerability analysis
B.B. Impact analysis
C.Cost-benefit analysis
D.SWOT analysis
C is the correct answer.
Justification
A vulnerability analysis provides insight into which risk to treat but is not useful when evaluating risk treatment options.
Impact analysis is a part of the risk assessment but on its own would not help finalize a risk treatment plan.
A cost-benefit analysis helps determine if the benefit of a control outweighs the cost of implementing the control.
A SWOT (strengths, weaknesses, opportunities and threats) analysis can be helpful, but the results must be translated in terms of risk, including costs and benefits, to be useful.
Which of the following issues would be of MOST concern to the board of directors when assessing a company’s risk management capability?
A.The third line of defense is acting independently of the other lines.
B.The second line of defense is checking and challenging the first line.
C.Internal audit is preparing the risk management strategy.
D.Each line of defense is conducting its own planning independently.
D is the correct answer.
Justification
It is expected that the third line of defense would act independently of the other lines.
Checking and challenging the first line of defense is one of the roles of the second line and would not represent a concern.
Preparing the risk management strategy is an expected internal audit activity and should not be a concern.
Joint planning across the three lines of defense is key to achieving an effective risk management capability. If each line is planning independently, it is an indicator that the lines of defense are not working as expected.
A key objective when monitoring information systems control effectiveness against the enterprise’s external requirements is to:
A.design the applicable information security controls for external audits.
B.create the enterprise’s information security policy provisions for third parties.
C.ensure that the enterprise’s legal obligations have been satisfied.
D.identify those legal obligations that apply to the enterprise’s security practices.
C is the correct answer.
Justification
Control design occurs in the risk treatment phase instead of in the monitoring phase.
Creating the information security policy should occur well in advance of control monitoring.
Legal obligations are one of the principal external requirements that necessitate compliance monitoring.
The identification of the legal obligations should occur before risk treatment, so that the proper controls may be designed.
What is the PRIMARY reason that an enterprise would establish segregation of duties controls?
A.To restrict users to the minimum level of access required to perform their jobs
B.To ensure that any sensitive financial transactions cannot violate corporate policy
C.To restrict users to working on systems that reflect their areas of expertise
D.To prevent errors or fraudulent activity on high-risk transactions
D is the correct answer.
Justification
Limiting access to the minimum level needed to perform a job function (least privilege) is not the reason for segregation of duties (SoD). It also does not necessarily deliver a SoD outcome. If an enterprise permits the same person to officially hold several roles that should have been segregated, application of least privilege will legitimately assign that person all the access needed to perform all the assigned roles.
Even with SoD, a violation c take place. SoD just makes it harder to breach policy without collusion.
Restricting users to the limits of their expertise is likely a good idea in terms of productivity and error reduction, but SoD focuses on making it necessary for more than one person to participate in completing a specific business process or transaction, which may involve only one system.
It is considerably more difficult for fraudulent activities to be arranged and to go undetected over a long-term period when more than one person is involved. Enterprises establish SoD for precisely that reason, ensuring that any fraudulent activities that do occur require collusion, which decreases the likelihood of occurrence and increases the likelihood of detection.
Which of the following BEST ensures that identified risk remains at an acceptable level?
A.Reviewing controls periodically, according to the risk treatment plan
B.Listing each risk as a separate entry in the risk register
C.Creating a separate risk register for every department
D.Maintaining a key risk indicator for assets in the risk register
A is the correct answer.
Justification
Controls deployed according to the risk treatment plan should provide the desired results, because the risk treatment plan is based on management’s acceptance of residual risk and management’s approval of deployment steps in the plan.
Listing each risk as a separate entry in the risk register may help in better evaluating the risk, but the register in itself does not ensure risk management of identified risk at a reasonable level.
Creating a separate risk register for every department may help inform development of better risk assessment exercises, but separation of registers does not necessarily ensure risk management of identified risk at a reasonable level.
Maintaining a key risk indicator for assets in the risk register may improve the overall risk management cycle, but the register in itself does not ensure that the management of identified risk has been performed according to the risk action plan.
What is the BEST method to validate the effectiveness of an enterprise’s patching program?
A.Conduct penetration testing.
B.Conduct a risk identification initiative.
C.Carry out vulnerability scans.
D.Review the requests for change.
C is the correct answer.
Justification
Penetration testing is not the most effective way of validating the effectiveness of an enterprise patching program as it could elevate risk on production systems.
A risk identification initiative will identify new and emerging risk but will not reveal information about the effectiveness of a patching control.
Performing vulnerability scans will enable the IT risk practitioner to determine if patches are being installed on a timely basis.
Requests for change are a valid input. However, requests for change do not mean a patch is applied and do not identify new vulnerabilities.
Which of the following statements is a risk scenario?
A.The password for the configuration of the tape backup system is set to the vendor default.
B.A program that processes records does not include data input validation.
C.Dedicated capacity for processing on an enterprise system exceeds projected maximum usage, resulting in wasted infrastructure resources.
D.Attackers develop a new piece of malware based on a known, but patched, vulnerability.
C is the correct answer.
Justification
If the password to configure a tape backup system is set to its vendor default, the password reflects the state of a technology control. Its state is not an event that could result in a loss.
A program that processes records without data input validation presents a vulnerability. It is not an event that could result in a loss.
Dedicated processing capacity that exceeds projected maximum usage and therefore results in wasted infrastructure resources constitutes potential loss.
If attackers develop a new piece of malware based on a known, but patched, vulnerability, their actions constitute a threat, but not a valid risk, because the vulnerability has already been patched.
After a laptop has been identified as lost or stolen, which of the following BEST mitigates the risk of unauthorized access to the information on the device?
A.Remote wipe capabilities
B.Encryption
C.Data classification policy
D.Application download restrictions
B is the correct answer.
Justification
The ability to remote-wipe the corporate information from the laptop would help mitigate the risk if done in a timely manner once the device is identified as lost or stolen. However, remote wipe on its own may not be reliable because an attacker may power off the device to prevent it from receiving a remote wipe signal.
Encryption of the laptop would best protect against risk impacting the confidentiality and integrity of the information residing on the device.
A data classification policy would not mitigate the risk of unauthorized access to information on a lost or stolen laptop.
Application download restrictions, while addressing other risk (such as malware), would not directly mitigate the risk associated with loss or theft.
Which of the following activities should a risk professional perform to determine whether firewall deployments are deviating from the enterprise’s information security policy?
A.Review the firewall parameter settings.
B.Review the firewall intrusion prevention system logs.
C.Review the firewall hardening procedures.
D.Analyze the firewall log file for recent attacks.
A is the correct answer.
Justification
Firewall parameter settings will tie in with the configurations linked to the governing security policy. If the parameter settings differ from what policy states or requires, then there is a deviation.
Reviewing the intrusion protection system logs may point out, to some extent, which packets were not blocked at the firewall level. To determine whether the firewall is compliant with the enterprise’s security policy, one has to review the parameters—such as firewall rules for traffic management, connectivity and firewall configurations.
Reviewing firewall hardening procedures will help a risk professional understand what was expected for security of the firewall, and a review of the actual firewall settings is necessary to establish whether the deployments deviate from the enterprise’s security policy.
There can be attacks on the firewall for which the enterprise may not have formally defined rules in the security policy; analyzing firewall logs for recent attacks does not imply that a firewall policy deviation is present.
Which of the following would create the GREATEST benefit for an enterprise deploying new IT infrastructure processing personal data?
A.Privacy by design
B.Privacy notices
C.Data encryption
D.Data classification
A is the correct answer.
Justification
Privacy by design embeds privacy within the IT infrastructure life cycle.
Privacy notices are informational and will not impact the new IT infrastructure deployment.
Data encryption is relevant and provides some benefit. However, privacy by design embeds privacy principles throughout the whole IT infrastructure life cycle.
Data classification is limited to the data component within the IT infrastructure, whereas privacy by design impacts the entire IT infrastructure life cycle.
Testing compliance of a response and recovery plan should begin by conducting a:
A.tabletop exercise.
B.review of archived logs.
C.penetration test.
D.business impact analysis.
A is the correct answer.
Justification
Tabletop exercises simulate incidents to test the response capability of an enterprise. The exercise involves scenarios that require a coordinated response to realistic incidents developing in real time. Participants gather to formulate responses to each development. Tabletop exercises are used extensively by police, fire and emergency medical services to gather key personnel who practice response and recovery in the context of simulated incidents likely within a given jurisdiction.
Logs provide a way to trace the activities performed during the vulnerability assessment.
Penetration tests highlight specific weaknesses; although these tests generally are very controlled, they do not provide the depth and breadth of a tabletop exercise.
A business impact analysis provides input to the response and recovery plan at a given point in time and reflects the viewpoint of business owners. It should be used as the basis for building test scripts to validate compliance, but in and of itself, it is not a testing tool.
A lack of adequate controls represents:
A.a vulnerability.
B.an impact.
C.an asset.
D.a threat.
A is the correct answer.
Justification
Lack of adequate controls represents a vulnerability, exposing sensitive information and data to the risk of malicious damage, attack, or unauthorized access by hackers. This could result in a loss of sensitive information, financial loss, legal penalties, etc.
Impact is the measure of financial loss incurred by a threat or incident.
Assets have tangible or intangible value worth protecting and include people, systems, infrastructure, finances and reputation.
A threat is a potential cause of a security incident.
Which of the following BEST describes the objective of a business impact analysis?
A.The identification of threats, risk and vulnerabilities that can adversely affect the enterprise
B.The development of procedures for initial response and stabilization during an emergency
C.The identification of time-sensitive critical business functions and interdependencies
D.The development of communication procedures in case of a crisis
C is the correct answer.
Justification
The identification of threats, risk and vulnerabilities is the objective of risk identification and analysis.
The development of procedures for initial response and stabilization during an emergency is a key output of preparedness and response planning.
Identification of time-sensitive critical business functions and interdependencies is a deliverable of the business impact analysis (BIA); the BIA includes metrics like recovery-time objectives and recovery-point objectives.
Communication procedures are beneficial to every business process, including crisis management; however, they are not the main deliverable of the BIA and relate more closely to business continuity and disaster recovery planning.
Which of the following principles of information security is of the GREATEST concern to a social media outlet for political or news-related content?
A.Integrity
B.Confidentiality
C.Availability
D.Nonrepudiation
C is the correct answer.
Justification
An integrity problem will not have the immediate and widespread effect of an availability problem. Integrity is usually the responsibility of the social media user.
Confidentiality is the responsibility of the user, and at the user’s discretion.
For a social media outlet, availability is of the greatest concern because integrity, confidentiality and nonrepudiation are not the greatest concerns of social media outlet customers.
Nonrepudiation is a concern in social media because a user can create a profile claiming to be someone else. However, this is the responsibility of social media users.
Which of the following is MOST important for effective risk management?
A.Assignment of risk owners to identified risk
B.Ensuring compliance with regulatory requirements
C.Integration of risk management into operational processes
D.Implementation of a risk avoidance strategy
A is the correct answer.
Justification
It is of utmost importance to assign risk to individual owners and therein maximize accountability.
Regulatory compliance is a relatively small part of risk management.
Risk management should be integrated into strategic, tactical and operational processes of an enterprise.
Risk avoidance is not always feasible in a business environment.
Which of the following choices poses the MOST significant threat to a project?
A.A lack of feedback upon project completion
B.A lack of unit testing
C.Missed opportunities from lessons learned
D.Misunderstanding the requirements
D is the correct answer.
Justification
Post-completion feedback is useful for documenting lessons learned and improving future projects, but it does not affect the success of the project to which the feedback relates.
Unit testing eliminates flaws in a project’s deliverables before they are presented as final, but the more fundamental threat posed by misunderstanding requirements is not addressed in unit testing.
Lessons learned can help make future projects more effective. However, lessons that fall short of causing a project to fail are not as significant as misunderstanding original requirements, which can result in delivery of outcomes that fail to meet business objectives.
Projects exist to deliver specific outcomes, as stated in requirements. If requirements are misunderstood, a project can be successful in terms of its internal criteria, scheduling and budget, yet result in a business failure because the project will not have delivered business value.
During the initial phase of the system development life cycle, the risk professional provided input on how to secure the proposed system. The project team prepared a list of requirements for use in designing the system. Which of the following tasks MUST be accomplished before moving on to the system design phase?
A.The risk associated with the proposed system and controls is accepted by management.
B.Various test scenarios that will be used to test the controls are documented.
C.The project budget is increased to include additional costs for security.
D.Equipment and software are procured to meet the security requirements.
A is the correct answer.
Justification
The risk acceptance decision is made by senior management. Before moving further into the project, it is important to have sign-off that management acknowledges and accepts the risk that is associated with this project. If management does not accept the risk, then there is no point in proceeding any further.
As risk is being identified, it is good to begin developing scenarios to test the system against that risk, but this is not a critical step before moving into the design phase.
At the end of each phase, a go/no-go decision should be made by management based on project feasibility and risk. However, it may not be necessary to revise the budget at this time.
It is too early in the process to begin the procurement of system components.
Which of the following MOST effectively ensures that service provider controls are within the guidelines set forth in the enterprise’s information security policy?
A.Service level monitoring
B.Penetration testing
C.Security awareness training
D.Periodic auditing
D is the correct answer.
Justification
Service level monitoring helps pinpoint the service provider’s operational issues but is not designed to ensure compliance.
Penetration testing helps identify system vulnerabilities but is not designed to ensure compliance.
Security awareness training is a preventive measure to increase user awareness of the information security policy but is not designed to ensure compliance.
Periodic audits help ensure compliance with the enterprise’s information security policy.
What is the FIRST step for a risk practitioner when an enterprise has decided to outsource all IT services and support to a third party?
A.Validate that the internal systems of the service provider are secure.
B.Enforce the regulations and standards associated with outsourcing data management for restrictions on transborder data flow.
C.Ensure that security requirements are addressed in all contracts and agreements.
D.Build a business case to perform an on-site audit of the third-party vendor.
C is the correct answer.
Justification
A risk practitioner will rarely have access to validate the security of a third party, and must seek other assurances from an external audit or other standards.
A risk practitioner can advise on risk associated with outsourcing and regulations but cannot enforce such rules.
A contract only covers the topics listed in the contract. If security is not explicitly included in the contract terms, the enterprise may not be properly protected.
Even though IT management has been outsourced, the enterprise that outsourced the service function remains responsible for protecting its data.
Which of the following information systems controls is the BEST way to detect malware?
A.Reviewing changes to file size
B.Reviewing administrative-level changes
C.Reviewing audit logs
D.Reviewing incident logs
A is the correct answer.
Justification
One method to detect malware is to compare current executables and files with historical sizes and time stamps.
Administrative-level changes will not detect the presence of malware. They will provide a trigger to investigate depending on the number of administrative-level changes.
Audit logs do not hold data at a granular enough level to enable malware discovery.
Incident logs are used to identify a root cause that contributed to the introduction of malware.
Which of the following BEST enables a peer review of an enterprise’s risk management process?
A.A balanced scorecard
B.An industry survey
C.A capability maturity model
D.A framework
C is the correct answer.
Justification
A balanced scorecard is a coherent set of performance measures organized into four categories that include traditional financial measures, customer processes, internal business processes and learning and growth perspectives.
An industry survey does provide a view of current practices; however, because survey results are generally presented in an aggregated manner, they do not enable a peer review of an enterprise’s risk management process.
A capability maturity model describes essential elements and criteria for effective processes for one or more disciplines. It also outlines an evolutionary improvement path from ad hoc, immature processes to disciplined, mature processes with improved quality and effectiveness.
A framework is a set of concepts, assumptions and practices that define how a given discipline or function can be approached or understood; relationships among its various components; roles of those involved; and conceptual and organizational boundaries.
The marketing department procures a third-party application for global enterprise use. During assessment of the application, it is discovered that it poses some risk to data privacy regulations (i.e., violates or does not address data transfer and data privacy requirements as regulated) within certain regions where the enterprise operates. If the third-party application is implemented globally, which of the following roles will be responsible for the risk it poses to the business?
A.The marketing department
B.The IT department
C.The data privacy officer
D.The chief risk officer
B is the correct answer.
Justification
The marketing department, which is the business owner of the application, will be accountable for the risk and for ensuring that the application is in compliance with the IT policy for the implementation of new tools and applications within the infrastructure.
The IT department is responsible for the risk posed by this application. The IT department has a policy in place that states that no tool or application can be implemented within the production infrastructure without a risk assessment and mitigation of all risk to an acceptable level. According to ISACA’s COBIT 5 framework, responsibility rests with those who must ensure that the activities are completed successfully.
The data privacy officer will support, in an advisory role, the controls that will be implemented to address and mitigate the data transfer and data privacy requirements.
The chief risk officer will support, in an advisory role, the controls that will be implemented to address and mitigate the data transfer and data privacy requirements.
The FIRST step in identifying and assessing IT risk is to:
A.confirm the risk tolerance level of the enterprise.
B.identify threats and vulnerabilities.
C.gather information on the current and future environment.
D.review past incident reports and response activity.
C is the correct answer.
Justification
A risk practitioner must understand the risk appetite of senior management and the associated risk tolerance level. However, risk tolerance primarily informs risk response and does not facilitate risk identification and assessment.
Identification of relevant threats and vulnerabilities is important but must be supplemented by consideration of pending changes to the enterprise’s environment; anticipated changes may widen or narrow the scope of relevance.
The first step in any risk assessment is to gather information about the current state and pending internal and external changes to the enterprise’s environment (scope, technology, incidents, modifications, etc.).
While the review of past incident reports may be an input for the identification and assessment of IT risk, focusing on these factors is not adequate.
An enterprise implements lagging key risk indicators in order to:
A.gather data to report to management.
B.predict an approaching risk event.
C.proactively monitor the current state of the risk profile.
D.conduct forecasting for the risk event.
A is the correct answer.
Justification
Lagging, or backward-looking, key risk indicators (KRIs) can be used to report data to management.
Leading, or forward-looking, KRIs can predict risk events, not lagging KRIs.
Leading KRIs are used to proactively monitor and control the current state of the risk profile, not lagging KRIs.
Leading KRIs can provide future-looking data for forecasting of risk events, not lagging KRIs.
The application of information classification is the responsibility of the:
A.information security officer.
B.information owner.
C.information systems auditor.
D.information custodian.
B is the correct answer.
Justification
The information security officer has functional responsibility for security and does not determine the classification of information.
The information owner determines classification based on the criticality and sensitivity of information.
The information systems auditor examines security and does not determine the classification of information.
The information custodian preserves the confidentiality, availability and integrity of information and does not determine the classification of information.
Which of the following would BEST measure the effectiveness of operational controls?
A.Control matrix
B.Key performance indicator
C.Statement of applicability
D.Key control indicator
D is the correct answer.
Justification
The control matrix is a tool used to analyze a systems flowchart (and related narrative) to determine the control plans appropriate to a process and to relate those plans to the control goals of the process.
Key performance indicators do not measure the effectiveness of operational risk controls
Statement of applicability is specific to the ISO 27001 standard, and although it has a list of controls, it will not help in measuring the effectiveness of particular operational risk controls.
Key control indicators, also referred to as control effectiveness indicators, are metrics that provide information on the degree to which a control is working.
