Cisa Domain 4 Information Systems Operations, Maintenance And Support

Front 1

Facilitating telecommunications continuity by providing redundant combinations of local carrier T-1 lines, microwaves and/or coaxial cables to access the local communication loop is:

Back 1

last-mile circuit protection - multiple lines of communication are used to ensure that communication is always up. Last mile relates to a disaster. Its best to have as many options as possible in a disaster.

Front 2

Greatest concern as disaster recovery hotsite

Back 2

Disk space utilization data is not kept current. - This is a big issue because if the hot site doesn't have enough disk space, it could end up being completely useless if it ends up being used.

Front 3

Reduces the ability of one device to capture the packets that are meant for another device?

Back 3

Switches - Switches are at the lowest level of network security and transmit a packet to the device to which it is addressed. This reduces the ability of one device to capture the packets that are meant for another device

Front 4

System testing

Back 4

is testing conducted on a complete, integrated system to evaluate the system's compliance with its specified requirements. This testing is more comprehensive, and best used when trying to determine if a vulnerability, across multiple systems, has been patched and corrected.

Front 5

Greatest risk when changing vendors for incident resolution.

Back 5

Application owners are not aware of the change. They should be aware, and this is the greatest risk, as if there was an incident, and application owners did not know about the change in vendors, they would not know how to react or who to contacts during an incident.

Front 6

Cloud computing issues

Back 6

SLA does not address responsibility of the vendor (cloud hoster) in the event of a security breach. This is important as if there is a breach, the vendor should inform all parties involved that a security breach occurred, and then determine who was at fault.

Front 7

When can staging and job set up be used as a compensating control for a defective control

Back 7

An example of this is when a backup system is configured improperly. If its configured improperly, the configuration could be corrected while the job is being staged and set up.

Front 8

Effective means of ensuring that production source code and object code is sycronized

Back 8

Date and time stamp reviews of source and object code. This ensures that code already in production is synced.

Front 9

Privileged (admin) accounts are used to make critical configuration changes. What is the best way to limit this risk

Back 9

Supervisory approval and review is performed for changes made with admin accounts

Front 10

Encapsulation

Back 10

is an object oriented technology characteristic that prevents accessing of properties of methods of the object that have not been defined as public. An object defines a communication interface with exterior and only that which belongs to an interface that can be accessed

Front 11

Benefits of Prototypes

Back 11

Prototypes can save a significant amount of time and money. They do have disadvantges: poor internal controls, changes controls become more complicated, and additional functions not usually intended are added.

Front 12

Benefit of Object Oriented Design

Back 12

the ability to re-use modules.

Front 13

What is a sequence check?

Back 13

A sequence check involves increasing the order of numbering and would validate whether the vouchers are in sequence and, thus, prevent duplicate vouchers

Front 14

White box testing

Back 14

Asseses the effectiveness of software program logic. Specifically, test data is used in determining procedural accuracy of a programs logic path.

Front 15

Network traffic analysis

Back 15

a type of passive security attack where the attacker analyses network traffic in the background with the purpose of trying to guess the type of traffic taking place

Front 16

Within a database, this type of key preserves referential integrity, by ensuring that a specific row can not be deleted in one table unless it is present in another

Back 16

foreign key - In a relational database with referential integrity, the use of foreign keys would prevent events such as primary key changes and record deletions, resulting in orphaned relations within the database. It should not be possible to delete a row from a customer table when the customer number (primary key) of that row is stored with live orders on the orders table (the foreign key to the customer table). A primary key works in one table, so it is not able to provide/ensure referential integrity by itself. Secondary keys that are not foreign keys are not subject to referential integrity checks. Public key is related to encryption and not linked in any way to referential integrity.

Front 17

Benefits of SQL language

Back 17

allows for portability of an application.

Front 18

What is black box testing

Back 18

a type of penetration test that assumes no prior knowledge of the infrastructure trying to be tested.

Front 19

what is encapsulation

Back 19

This is a security type used in VPNs.

Encapsulation, or tunneling, is a technique used to carry the traffic of one protocol over a network that does not support that protocol directly.

Front 20

What are hash totals?

Back 20

Can be used to DETECT errors in data processing.

Front 21

How does an investment portfolio analysis help support prioritization of new it projects

Back 21

It provides a clear focus for where to invest $, but also help determine projects that should be terminated. A business risk analysis, is performed within an investment portfolio analysis, and but it not the best method for prioritizing it projects

Front 22

Why is it important to have clocks synced across an org

Back 22

It assist in investigating incidents. It ensures audit logs are accurate

Front 23

What is diverse routing?

Back 23

Routes traffic through split level cable or duplicate cable facilities. This can be accomplished through different and or duplicate cable strengths. This includes having cables run into a site in multiple locations so if one goes out another line would still be up.

Front 24

Why are stop or freezing points used when designing a new system

Back 24

to require that changes after that point be evaluated for cost effectiveness

Front 25

What is an effective method to control account / password sharing

Back 25

Provide security awareness training for employees, explaining why shared passwords is a bad idea

Front 26

What to do when finding an exception, for example, back ups failed and no evidence of restart is present

Back 26

Select additional samples to see if this is a systematic problem. If the problem persists, talk to management and see if they have an explanation

Front 27

Most secure firewall

Back 27

A screened-subnet firewall, also used as a demilitarized zone (DMZ), utilizes two packet filtering routers and a bastion host. This provides the most secure firewall system, since it supports both network- and application-level security while defining a separate DMZ network

Front 28

Stateful-inspection firewall

Back 28

works on transport layer and keeps track of destination ip addresses of each packet that leaves the organization's internal network.

Front 29

Screened-hosted firewall

Back 29

Utilizes a packet filtering router and bastion host. This approach implements basis network layer security (packet filtering) and application server security (proxy services)

Front 30

Dual-horned firewall

Back 30

is a more restrictive form of the screened host firewall, configuring one interface for information servers and another for private network hosts.

Front 31

Bastion host

Back 31

special purpose computer specifically designed and configured to withstand an attack. Typically hosts just one application, like a proxy server. The bastion host is usually outside of the firewall of in the DMZ.

Front 32

What is RPO (recovery point objective)

Back 32

Defines the point in time in which it is necessary to to recover data. It always quantifies in terms of time, the permissible amount of data loss in the case of interruption.

Front 33

Greatest concern with a company's governance model

Back 33

that policies are not reviewed on a regular basis.

Front 34

Risk of giving programmers access to production data

Back 34

they may see data that is sensitive, or unsantized, that they should not see

Front 35

UDP

Back 35

Simple transmission model, without implicit handshakes or data integrity checks, thus its possible that packets arrive out of order.

Front 36

what is a semantic characteristic

Back 36

a characteristic of how data is interpreted. This would be an important concern when migrating data from a legacy system to an ARP, because you want to ensure that data is interpreted the same way, even though differences in database schemas could exist.

Front 37

arithmetic characteristic

Back 37

represents certain aspects of the data structure, and internal definition to the data base. Not as important as how data is interpreted.

Front 38

alternative to SOD controls

Back 38

procedures in place to ensure that only approved changes are implemented

Front 39

what is an immunizer

Back 39

they help defend against viruses by appending sections of themselves to files. The continually check for changes and reports changes as possible viral behavior.

Front 40

CAATS

Back 40

Can be used to find a duplicate invoice record. Computer aided audit techniques (CAATs) look for items that meet the selection criteria (duplicate invoices)

Front 41

The first step of a risk management program

Back 41

Inventory of assets - This make sense, as the first thing you need to do is find out what assets you have.

Front 42

Common failure of IT Systems

Back 42

users do not participate in defining the requirements of the system.

Front 43

Best evidence to verify evidence or a review control

Back 43

see a sample of one, where evidence of follow up was required, and ensure that they were actioned on.

Front 44

Distributed denial of service attacks are typically evoked by way

Back 44

Trojan horse - used to take over a computer and send tons of requests to bog down the target system.

Front 45

Why are programming standards useful?

Back 45

they help ensure quality code is produced for future products. If people are using the same standard, code should maintain quality

Front 46

What is an applet?

Back 46

An applet is a JAVA program that it sent over the network from the web server, through a web browser to the client machine. The code is then run on the machine. Since the server does not run the program and the output is not sent over the network, the performance on the web server and network - over which the server and client are connected, drastically improves through the use of applets.

Front 47

What is Function Point Analysis (FPA)

Back 47

FPA is a technique used to determine the size of a development task based on a number of function points. Function points are factors such as inputs, outputs, inquires, and logical internal sites.

Front 48

What is an ITF (Integrated Test Facility)

Back 48

An ITF creates a ficitious entity in the database to process test transactions simultaneously with live input. Its advantage is that does not require separate testing processes. However, careful planning is required, and test data must be isolated from production data.

Front 49

What is configuration management?

Back 49

Configuration management can help assist in recording baselines for software releases. It does this as it provides automated tools that can record software release baselines.

Front 50

What do raised floors in a data center best prevent?

Back 50

Damage of wires around computers and servers. This allows wires and cables to be installed underneath the floor, thus protecting them from damage on the open floor, like if someone was to trip on them.

Front 51

What is timebox management?

Back 51

It sets specific time and cost boundaries for projects.

Front 52

What Is Program Evaluation review technique

Back 52

PERT is a principle of obtaining project timeliness based on project events for 3 likely scenarios (worst, best, normal). The timelines is then calculated with a predefined formula and identifies critical path, which identifies the key activities that must be prioritized .

Front 53

What is a software baseline?

Back 53

A software baseline provides a cutoff point for the design of the system and allows the project to proceed as scheduled without being delayed by scope creep

Front 54

What is an example of a severe role SOD violation?

Back 54

Security admins also having developer rights.

Front 55

What is the first step in the problem management mechanism?

Back 55

Exception reporting. You first need to report the issue to stakeholders before you can start analysis

Front 56

Difference between hashing and encryption

Back 56

hashing is irreversible. Hashing works one way; by applying a hashing algorithm to a message, a message hash/digest is created. If the same hashing algorithm is applied to the message digest, it will not result in the original message. As such, hashing is irreversible, while encryption is reversible

Front 57

What is the industry standard for evaluating a projects progress at any given point in time?

Back 57

Earned Value Analysis. EVA is an industry standard method for measuring a project's progress at any given point in time, forecasting its completion date and final cost, and analyzing variances in the schedule and budget as the project proceeds. It compares the planned amount of work with what has actually been completed to determine if the cost, schedule and work accomplished are progressing in accordance with the plan. EVA works most effectively if a well-formed work breakdown structure exists.

Front 58

What is the greatest concern with reviewing a organization's governance model?

Back 58

That the org's information security policy is not periodically reviewed by senior management. This shows that management is not staying actively engaged with managing the company's IT risks.

Front 59

What is the most cost effective way for reducing defects encountered during the software development process?

Back 59

Inspections of code and design are a proven software quality technique. An advantage of this approach is that defects are identified before they propagate through the development life cycle. This reduces the cost of correction as less rework is involved.

Front 60

What is public key infrastructure (PKI) and how is it used?

Back 60

Public key or asymmetric encryption require larger keys and required by CPU power, thus are less efficient. In contract, symmetric encryption is faster and relies on the inherent security of the process to for exchanging the secret key. To enjoy the benefits of both asymmetric and symmetric encryption, a symmetric session key is exchanged using public key methods, and which it serves as the secret key for encrypting/decrypting messages sent between parties.

Front 61

What is a good control to provide confidentiality, reliability, and integrity of data

Back 61

PKI (public key infrastructure) is the best overall technology for this purpose. It encrypts data, which provides for confidentiality and and reliability. You know data can is confidentially because its encrypted, and you know its reliable, because it hasn't been messed within in transfer.

Front 62

What is the primary benefits of an IT manager

Back 62

To ensure that internal SLAs (Service Level Agreements) mandated by the business are met by IT

Front 63

What is a critical component of networking management?

Back 63

Configuration management is critical. If you aren't configuring the various devices together, they won't communicate, which is the whole point of maintaining a successful network.

Front 64

Who is responsible for maintaining / creating an information security policy?

Back 64

The Board of Directors. The security committee also functions with helping with the security policy, but under the direction of the BoD.

Front 65

How does SSL (Secure Socket Layer) address the confidentiality of a message?

Back 65

SSL uses a symmetric key for message encryption.

Front 66

What type of data validation check is effective in detecting transposition and transcription errors?

Back 66

Check digit, is like a concatenation of all data fields. It can be used to make sure all data from one source was correctly transposed to a different source. A check digit is a numeric value that is calculated mathematically and is appended to data to ensure that the original data have not been altered, e.g., an incorrect, but valid, value substituted for the original. This control is effective in detecting transposition and transcription errors.

Front 67

What is the most important element when designing a data warehouse?

Back 67

Quality of metadata. If the source data is garbage, any quieries from you data warehouse will be garbage too.

Front 68

What is the most effective way to determine account balances from one database have been correctly migrated to another?

Back 68

Performing sample testing of the migrated account balances will involve the comparison of a selection of individual transactions from the database before the migration.

Front 69

What is an advantage of whitebox texting?

Back 69

White box testing assesses the effectiveness of software program logic. Specifically, test data are used in determining procedural accuracy or conditions of a program's logic paths

Front 70

If 2 departments both want a report that shows profitability for a specific product, and the 2 depts get different answers, which is because they have different data definitions for the production, how can they best be addressed?

Back 70

Organizational data governance practices be put in place. his choice directly addresses the problem. An organizationwide approach is needed to achieve effective management of data assets. This includes enforcing standard definitions of data elements, which is part of a data governance initiative

Front 71

What must you secure when protected a VOIP infrastructure from a denial of service attack?

Back 71

Session border controllers - Session border controllers enhance the security in the access network and in the core. In the access network, they hide a user's real address and provide a managed public address. This public address can be monitored, minimizing the opportunities for scanning and DoS attacks. Session border controllers permit access to clients behind firewalls while maintaining the firewall's effectiveness. In the core, session border controllers protect the users and the network. They hide network topology and users' real addresses. They can also monitor bandwidth and quality of service.

Front 72

Who should review and approve system deliverables as they are defined and accomplished to ensure the successful completion and implementation of a new business system application?

Back 72

User management assumes ownership of the project and resulting system, allocates qualified representatives to the team, and actively participates in system requirements definition, acceptance testing and user training. User management should review and approve system deliverables as they are defined and accomplished or implemented.

Front 73

What is FAR (False-acceptance rate) and when would it be applicaple?

Back 73

FAR is the frequency of accepting an unauthorized person as authorized, thereby granting access when it should be denied. In an organization with high security requirements, such as those using biometic security systems.

Front 74

What is the primary objective of business continuity and disaster recovery plans ?

Back 74

"Since human life is invaluable, the main priority of any business continuity and disaster recovery plan should be to protect people. All other priorities are important but are secondary objectives of a business continuity and disaster recovery plan.

Front 75

A new project does not meed end-user requirements. What is the best reccomendation to prevent this?

Back 75

"Use the waterfall method throughout the development process. The waterfall method helps ensure that errors are detected early in the development process. Waterfall development is a procedure-focused development cycle with formal sign-off at the completion of each level.

Front 76

What is the initial step of creating a firewall policy?

Back 76

Identification of applications to be accessed externally

Front 77

What is shadow file processing?

Back 77

In shadow file processing, exact duplicates of the files are maintained at the same site or at a remote site. The two files are processed concurrently. This is used for critical data files, such as airline booking systems. The example used in the practice question was for an airline.

Front 78

What is Bayesian (statistical) filtering

Back 78

Bayesian filtering applies statistical modeling to messages by performing a frequency analysis on each word within the message and then evaluating the message as a whole. Therefore, it can ignore a suspicious keyword if the entire message is within normal bounds.

Front 79

What is nonrepudiation?

Back 79

In reference to digital security, nonrepudiation means to ensure that a transferred message has been sent and received by the parties claiming to have sent and received the message. Nonrepudiation is a way to guarantee that the sender of a message cannot later deny having sent the message and that the recipient cannot deny having received the message.

Front 80

What is the public key infrastructure and how is it used in ecommerce?

Back 80

PKI is the administrative infrastructure for digital certificates and encryption key pairs. The qualities of an acceptable digital signature are: it is unique to the person using it; it is capable of verification; it is under the sole control of the person using it; and it is linked to data in such a manner that if data are changed, the digital signature is invalidated. PKI meets these tests. Because PKI is unique to the message sender, it can be used to verify that a specific person sent a message. Also because PKI can ensure verification, it can ensure that a message was indeed sent, thus making is valuable in non-repudiation, which essentially ensures that a message was sent and received. Its like paying extra from USPS to provide a delivery confirmation.

Front 81

What is a control self assessment (CSA)?

Back 81

The primary objective of a CSA program is to leverage the internal audit function by shifting some of the control monitoring responsibilities to the functional area line managers. The success of a CSA program depends on the degree to which line managers assume responsibility for controls.

Front 82

What is a paper test?

Back 82

A paper test is appropriate for testing a BCP. It is a walk-through of the entire plan, or part of the plan, involving major players in the plan's execution, who reason out what may happen in a particular disaster.

Front 83

What is discovery sampling and when it is best used?

Back 83

Discovery sampling is used when and auditor is trying to determine what type of event has occurred, such a fraud our sales returns.

Front 84

What is slack time and what does it relate to?

Back 84

Slack time relates to project management and cricital path. It denotes how much activity can be delayed beyond its earliest start date without causing any problems in the complete of the due date. Activites with slack time will not be on the critical path.

Front 85

What is critical path?

Back 85

The path of execution that accomplishes the minimum yet most important objectives of the project. The critical path is also the longest singal route through a network diagram and shortest time to accomplish the main objective. Critical path items represent mandatory tasks that must be completed, or they would wreck the project.

Front 86

Name an important consideration for local and online system backups?

Back 86

"Ensuring periodic dumps of transaction logs is the only safe way of preserving timely historical data. The volume of activity usually associated with an online system makes other more traditional methods of backup impractical.

Front 87

When reviewing a risk management process, what is the most important consideration?

Back 87

IT risk should be present in business terms. This helps all stakeholders understand the IT risks which will help ensure successful implementation of the risk plan to be developed.

Front 88

What is the most effective and environmentally friendly way to put out a fire in a data center?

Back 88

Dry pipe sprinkers. They are effective, and do not threaten life

Front 89

What is war driving?

Back 89

Uses a wireless ethernet card in promiscuous mode and a powerful antenna to penetrate wireless networks from outside.

Front 90

What are powerline conditions and when are they used?

Back 90

Power line conditioners are used to compensate for peaks and valleys in the power supply and reduce peaks in the power flow to what is needed by the machine. Any valleys are removed by power stored in the equipment. These can be used to protect computer equipment from short term reductions in power.

Front 91

Who is responsible for authorizing access rights to production data and systems?

Back 91

Data owners are responsible as they are aware who should have access on a need to know basis. System administrators and security administrators are both data custodian roles; they are responsible for ensuring the appropriate safeguards are available and functional, but not who is responsible for authorizing who has access to the data.

Front 92

What is double blind testing?

Back 92

In double-blind testing, the penetration tester has little or limited knowledge about the target system, and personnel at the target site have not been informed that a test is being performed. Since the administrator and security staff at the target are not aware of the test, it can effectively evaluate the incident handling and response capability of the system administrator.

Front 93

What is the purpose of code signing?

Back 93

it assures that code has not been subsequently modified.

Front 94

Why would an auditor use source code comparison software?

Back 94

As part of program change testing, an auditor will used source code comparison software to examine source code changes without information from IS personnel. This is in an effor to obtain indepdent confirmation of source code changes.

Front 95

What is a limitation of an instruction detection system?

Back 95

It cannot detect attacks with encrypted. This is an important limitation.

Front 96

What are functional acknowledgements?

Back 96

Funtional transactions are standard EDI transactions that tell trading partners that their electronic documents we received. Thus they can be used as an audit trail for all EDI transactions.

Front 97

What is a virus wall and how is it used?

Back 97

In an interconnected corporate network, virus scanning software, used as an integral part of firewall technologies, is referred to as a virus wall. Virus walls scan incoming traffic with the intent of detecting and removing viruses before they enter the protected network. The presence of virus walls does not preclude the necessity for installing virus detection software on servers and workstations within the network, but network-level protection is most effective the earlier the virus is detected.

Front 98

What is web of trust and when is it best used?

Back 98

Web of trust is a key distribution method suitable for communication in a small group. It ensures pretty good privacy (PGP) and distributes the public keys of users within a group.

Front 99

When testing operating system integrity of a sever, what should you look for?

Back 99

Verify that privileged programs or services cannot be invoked by user programs. If user-level programs can interfere with privileged programs or services, then changes to system parameters and operating system (OS) integrity issues could result. A privilege escalation attack occurs when a user with limited authority is able to perform actions beyond what he/she has been authorized to do. For example, consider a program scheduling utility that often can run with “system level” authority and allows the user to run a program that his/her security profile ordinarily would not allow. Configuration features of the OS, such as file permissions for critical files, must be set correctly to ensure that privilege escalation attacks are less likely to occur.

Front 100

What is attribute sampling and when is it primarily used?

Back 100

Attribute sampling, generally applied in COMPLIANCE testing situations, deals with the presence or absence of the attribute and provides conclusions that are expressed in rates of incidence. For example, when trying to test whether or not a # of purchase orders have been appropriately approved. You are checking the existence of an appropriate approval.

Front 101

What prepardness testing and when is it typically used?

Back 101

When testing disaster recovery plans, Preparedness tests involve simulation of the entire environment (in phases) and help the team to better understand and prepare for the actual test scenario. They are cost effectively and efficient.

Front 102

What is a virus wall and how is it used?

Back 102

In an interconnected corporate network, virus scanning software, used as an integral part of firewall technologies, is referred to as a virus wall. Virus walls scan incoming traffic with the intent of detecting and removing viruses before they enter the protected network. The presence of virus walls does not preclude the necessity for installing virus detection software on servers and workstations within the network, but network-level protection is most effective the earlier the virus is detected.

Front 103

What is web of trust and when is it best used?

Back 103

Web of trust is a key distribution method suitable for communication in a small group. It ensures pretty good privacy (PGP) and distributes the public keys of users within a group.

Front 104

When testing operating system integrity of a sever, what should you look for?

Back 104

Verify that privileged programs or services cannot be invoked by user programs. If user-level programs can interfere with privileged programs or services, then changes to system parameters and operating system (OS) integrity issues could result. A privilege escalation attack occurs when a user with limited authority is able to perform actions beyond what he/she has been authorized to do. For example, consider a program scheduling utility that often can run with “system level” authority and allows the user to run a program that his/her security profile ordinarily would not allow. Configuration features of the OS, such as file permissions for critical files, must be set correctly to ensure that privilege escalation attacks are less likely to occur.

Front 105

What is attribute sampling and when is it primarily used?

Back 105

Attribute sampling, generally applied in COMPLIANCE testing situations, deals with the presence or absence of the attribute and provides conclusions that are expressed in rates of incidence. For example, when trying to test whether or not a # of purchase orders have been appropriately approved. You are checking the existence of an appropriate approval.

Front 106

What prepardness testing and when is it typically used?

Back 106

When testing disaster recovery plans, Preparedness tests involve simulation of the entire environment (in phases) and help the team to better understand and prepare for the actual test scenario. They are cost effectively and efficient.

Front 107

What is atomicity and what topic is is relevant to?

Back 107

This is in relation to databases and transaction processing features. Atomicity guarantees that either the entire transaction is processed or none of it is.

Front 108

What is the best way to encrypt data on mobile devices?

Back 108

Elliptical curve cryptography (ECC). Requires limited bandwidth resources and is suitable for encrypting mobile devices

Front 109

What is traffic engineering and what does it relate to?

Back 109

Traffic engineering relates to VOIP networks. To ensure that quality of service requirements are achieved, the VoIP service over the WAN should be protected from packet losses, latency or jitter. To reach this objective, the network performance can be managed using statistical techniques such as traffic engineering.

Front 110

What is a benefit of open source software?

Back 110

From a strategic point of view, if an organization decides that it is undesirable to rely on a single provider for a software solution, the organization may decide to embrace an OSS strategy. Additionally, there are multiple providers of OSS. Many OSS applications are available free of charge, although there may be some costs related to converting to OSS.

Front 111

What is the most appropriate fire supression system to be used in a data center?

Back 111

FM-200 is safer to use than carbon dioxide. It is considered a clean agent for use in gaseous fire suppression applications.

Front 112

What type of testing do you use when trying to determine if a if a new or modified system will can operate in the target environment without impacting other existing systems?

Back 112

The purpose of sociability testing is to confirm that a new or modified system can operate in its target environment without adversely impacting existing systems. This should cover the platform that will perform primary application processing and interfaces with other systems, as well as changes to the desktop in a client-server or web development.

Front 113

What is an intergrity checker?

Back 113

Integrity checkers are used in antivirus software. They are considered the most effective type of a antivirus software. Integrity checkers compute a binary number on a known virus-free program that is then stored in a database file. This number is called a cyclical redundancy check (CRC). When that program is called to execute, the checker computes the CRC on the program about to be executed and compares it to the number in the database. A match means no infection; a mismatch means that a change in the program has occurred. A change in the program could mean a virus.

Front 114

When in contract for a hot, warm, or cold site, what is the primary consideration of the contract?

Back 114

The # of subscribers permitted to use the site at one time. This is important because too many subscribers in the building at one time could affect your ability to use the site in times of a disaster.

Front 115

The type of Business Continuity Plan (BCP) test that involves participation of all relevant members of the crisis management / response team, in order to practice proper coordination?

Back 115

"Table - top: The primary purpose of table-top testing is to practice proper coordination since it involves all or some of the crisis team members and is focused more on coordination and communications issues than on technical process details. Functional testing involves mobilization of personnel and resources at various geographic sites. Full-scale testing involves enterprisewide participation and full involvement of external organizations. Walk-through testing requires the least effort of the options given. Its aim is to promote familiarity of the BCP to critical personnel from all areas.

Front 116

What is a risk of backing up data for a service dealing with confidential medical data.

Back 116

"For a company working with confidential patient data, the loss of a backup tape is a significant incident. Privacy laws specify severe penalties for such an event, and the company's reputation could be damaged due to mandated reporting requirements. In order to gain assurance that tapes are being handled properly, the organization should perform audit tests that include frequent physical inventories and an evaluation of the controls in place at the third-party provider.

Front 117

What type of protocols should be reviewed when to detect unauthorized mappings between IP addresses and MAC addresses?

Back 117

Address Resolution Protocol (ARP) : ARP provides dynamic address mapping between an IP address and hardware address.

Front 118

What is Telnet access?

Back 118

Telnet may be used to manage remote devices on a corporate network. Using Telnet over the Internet is not secure because it is not encrypted and is prone to intrusion. A more secure method, such as secure shell (SSH), should be used.

Front 119

What are the benefits of the top-down approach of software testing?

Back 119

It helps identify errors in interfaces sooner. Starting from the top (the end user perspective, not a super granual like looking at atomic units or modules.) helps in identifying links between application modules and databases earlier on.

Front 120

What was asymmetric encryption developed?

Back 120

It was because symmetric encryption required the distribution of keys to all parties involved, which can be hard to do with encrypting data for many external parties, like an -ecommerce website. Eventhough asymmetric requires more processing power that symmetric in ecryption, its is better when dealing with large groups of people needed data to be encrypted during transfer.

Front 121

What is an intergrity checker?

Back 121

Integrity checkers are used in antivirus software. They are considered the most effective type of a antivirus software. Integrity checkers compute a binary number on a known virus-free program that is then stored in a database file. This number is called a cyclical redundancy check (CRC). When that program is called to execute, the checker computes the CRC on the program about to be executed and compares it to the number in the database. A match means no infection; a mismatch means that a change in the program has occurred. A change in the program could mean a virus.

Front 122

When in contract for a hot, warm, or cold site, what is the primary consideration of the contract?

Back 122

The # of subscribers permitted to use the site at one time. This is important because too many subscribers in the building at one time could affect your ability to use the site in times of a disaster.

Front 123

The type of Business Continuity Plan (BCP) test that involves participation of all relevant members of the crisis management / response team, in order to practice proper coordination?

Back 123

"Table - top: The primary purpose of table-top testing is to practice proper coordination since it involves all or some of the crisis team members and is focused more on coordination and communications issues than on technical process details. Functional testing involves mobilization of personnel and resources at various geographic sites. Full-scale testing involves enterprisewide participation and full involvement of external organizations. Walk-through testing requires the least effort of the options given. Its aim is to promote familiarity of the BCP to critical personnel from all areas.

Front 124

What is a risk of backing up data for a service dealing with confidential medical data.

Back 124

"For a company working with confidential patient data, the loss of a backup tape is a significant incident. Privacy laws specify severe penalties for such an event, and the company's reputation could be damaged due to mandated reporting requirements. In order to gain assurance that tapes are being handled properly, the organization should perform audit tests that include frequent physical inventories and an evaluation of the controls in place at the third-party provider.

Front 125

What type of protocols should be reviewed when to detect unauthorized mappings between IP addresses and MAC addresses?

Back 125

Address Resolution Protocol (ARP) : ARP provides dynamic address mapping between an IP address and hardware address.

Front 126

What is Telnet access?

Back 126

Telnet may be used to manage remote devices on a corporate network. Using Telnet over the Internet is not secure because it is not encrypted and is prone to intrusion. A more secure method, such as secure shell (SSH), should be used.

Front 127

What are the benefits of the top-down approach of software testing?

Back 127

It helps identify errors in interfaces sooner. Starting from the top (the end user perspective, not a super granual like looking at atomic units or modules.) helps in identifying links between application modules and databases earlier on.

Front 128

What was asymmetric encryption developed?

Back 128

It was because symmetric encryption required the distribution of keys to all parties involved, which can be hard to do with encrypting data for many external parties, like an -ecommerce website. Eventhough asymmetric requires more processing power that symmetric in ecryption, its is better when dealing with large groups of people needed data to be encrypted during transfer.

Front 129

What are the benefits of bottom-up test approach for testing software?

Back 129

The bottom-up approach to software testing begins with the testing of atomic units, such as programs and modules, and works upward until a complete system testing has taken place. The advantages of using a bottom-up approach to software testing are the fact that there is no need for stubs or drivers and errors in critical modules are found earlier

Front 130

What is the risk of a mainframe application not have designated owners of user groups?

Back 130

Without an owner to provide approval for user access to the group, unauthorized individuals could potentially gain access to any sensitive data within the rights of the group. Revoking access to terminated users is a compensating control for the normal termination process and is also a detective control.

Front 131

When trying to discover potential anomalies in user or system behavior, why type of test or system should be used?

Back 131

"Trend/variance detection tools look for anomalies in user or system behavior, such as invoices with increasing invoice numbers. CASE tools are used to assist in software development. Embedded (audit) data collection software, such as systems control audit review file (SCARF) or systems audit review file (SARF), is used to provide sampling and production statistics, but not to conduct an audit log analysis. Heuristic scanning tools are a type of virus scanning used to indicate possible infected codes.

Front 132

What should an auditor do with auditing a proxy based firewall?

Back 132

"verify that the filters applied to services such as HTTP are effective. A proxy-based firewall works as an intermediary (proxy) between the service or application and the client. It makes a connection with the client and opens a different connection with the server and, based on specific filters and rules, analyzes all the traffic between the two connections. Unlike a packet-filtering gateway, a proxy-based firewall does not forward any packets. Mapping between MAC and IP addresses is a task for protocols such as ARP/RARP.

Front 133

When talking to management about a Disater recovery process, what should the main goal of the meeting be?

Back 133

"The goal of the meeting is to confirm the factual accuracy of the audit findings and present an opportunity for management to agree on corrective action. Management approval of the corrective actions is not required since this is not the role of the auditor. Implementation of corrective actions should be done after the factual accuracy of findings has been established, but the work of implementing corrective action is not typically assigned to the IS auditor since this would impair the auditor's independence. Clarifying the scope and limitations of the audit should be done during the entrance meeting, not during the exit meeting.

Front 134

What is a suitable BCP test to perform after a new system has been added and the BCP has been reflected to list the new system?

Back 134

"The expectation is that the basic mechanics of recovery for the new system are understood and the recovery infrastructure has been put into place. An appropriate test now would be to involve actual resources in a simulated recovery exercise. This exercise would test the new recovery infrastructure under controlled conditions. Assuming that recovery options have been actively considered during development (as they would need to be for a mission-critical system), a paper walk-through would be of limited value. A security assessment or penetration test is vital for any application exposed to the Internet, but should have been performed much earlier in the process. Choice D is not correct because performing a failover test is not adequate to assess the degree to which the organization is prepared to recover from a wider range of problems.

Front 135

What is a major risk of USB devices?

Back 135

Since USB drives tend to be small, they are susceptible to theft or loss. This represents the greatest risk to the organization. Good general IT controls will include the scanning of USB drives for malware once they are inserted in a computer. The risk of malware in an otherwise robust environment is not as great as the risk of loss or theft.

Front 136

What is a good control to mitigate the risk of programmers in a small organization are allowed to move apps directly to the production environment.

Back 136

"An independent review of access controls would most likely detect segregation of duties conflicts. An auditor should consider application access. For example, if the programmer moves an application to production, the programmer should not have the ability to post transactions to the general ledger. Independent postimplementation testing would not be as effective because the system could be accepted by the end user without detecting the undocumented functionality. An independent review of user requirements would not be as effective because the system could meet user requirements and still include undocumented functionalities. An independent review of user acceptance would not be as effective because the system could be accepted by the end users, and the undocumented functionalities could remain undetected.

Front 137

Which of the following is the MOST effective access control to help ensure confidentiality?

Back 137

MAC is enforced by administrators and cannot be changed by end users. This is a typically effective preventive access control. PKI is used for public key/private key encryption. While PKI can be stored in the authorization mechanism by itself, it is not an access control.

Front 138

Which of the following attacks targets the Secure Sockets Layer (SSL)?

Back 138

Main in the Middle> Attackers can establish a fake SSL server to accept user's SSL traffic and then route to the real SSL server, so that sensitive information can be discovered.

Front 139

The FIRST step in a successful attack to a system would be:

Back 139

"Successful attacks start by gathering information about the target system. This is done in advance so that the attacker gets to know the target systems and their vulnerabilities. All of the other choices are based on the information gathered.

Front 140

An IS auditor is evaluating the effectiveness of the organization's change management process. What is the MOST important control that the IS auditor should look for to ensure system availability

Back 140

"The most important control for ensuring system availability is to implement a sound testing plan and procedures which are consistently followed. The other options can be important considerations, but are not as important as the consistency and reliability of and testing before migration and “going live.” The quality of the testing process is critical to ensure system availability.

Front 141

An IS auditor finds that client requests were processed multiple times when received from different independent departmental databases, which are synchronized weekly. What would be the BEST recommendation?

Back 141

"Keeping the data in one place is the best way to ensure that data are stored without redundancy and that all users have the same data on their systems. Although increasing the frequency may help to minimize the problem, the risk of duplication cannot be eliminated completely because parallel data entry is still possible. Business requirements will most likely dictate where data processing activities are performed. Changing the business structure to solve an IT problem is not practical or politically feasible. Detective controls do not solve the problem of duplicate processing, and would require that an additional process be implemented to handle the discovered duplicates.

Front 142

Which of the following activities should the business continuity manager perform FIRST after the replacement of hardware at the primary information processing facility?

Back 142

An IT assets inventory is the basic input for the business continuity/disaster recovery plan, and the plan must be updated to reflect changes in the IT infrastructure.

Front 143

Upon receipt of the initial signed digital certificate the user will decrypt the certificate with the public key of the:

Back 143

"A CA is a network authority that issues and manages security credentials and public keys for message encryption. As a part of the public key infrastructure, a CA checks with an RA to verify information provided by the requestor of a digital certificate. If the RA verifies the requestor's information, the CA can issue a certificate. The CA signs the certificate with its private key for distribution to the user. Upon receipt, the user will decrypt the certificate with the CA's public key.

Front 144

The risk of dumpster diving is BEST mitigated by:

Back 144

Dumpster diving is used to steal documents or computer media that were not properly discarded. Users should be educated to know the risk of carelessly discarding sensitive documents and other items.

Front 145

Which of the following is the PRIMARY objective of the business continuity plan (BCP) process?

Back 145

The BCP process primarily focuses on managing and mitigating risk during recovery of operations due to an event that affected operations. A. The BCP in itself does not provide assurance of continuing operations; however, it helps the organization to respond to disruptions to critical business processes.

Front 146

Naming conventions for system resources are important for access control because they:

Back 146

"reduce the number of rules required to adequately protect resources. Naming conventions for system resources are important for the efficient administration of security controls. The conventions can be structured, so resources beginning with the same high-level qualifier can be governed by one or more generic rules. This reduces the number of rules required to adequately protect resources, which in turn facilitates security administration and maintenance efforts.

Front 147

The IS auditor is reviewing an organization's human resources (HR) database implementation. The IS auditor discovers that the database servers are clustered for high availability, all default database accounts have been removed and database audit logs are kept and reviewed on a weekly basis. What other area should the IS auditor check to ensure that the databases are appropriately secured?

Back 147

"Database initialization parameters. When a database is opened, many of its configuration options are governed by initialization parameters. These parameters are usually governed by a file (“init.ora” in the case of Oracle DBMS) which contains many settings. The system initialization parameters address many “global” database settings, including authentication, remote access and other critical security areas. In order to effectively audit a database implementation, the IS auditor must examine the database initialization parameters

Front 148

The MAJOR advantage of a component-based development approach is the:

Back 148

support of multiple development environments. Components written in one language can interact with components written in other languages or running on other machines, which can increase the speed of development. Software developers can then focus on business logic.

Front 149

An IS auditor is reviewing a project that is using an agile software development approach. Which of the following should the IS auditor expect to find?

Back 149

" Postiteration reviews that identify lessons learned for future use in the project. A key tenet of the agile approach to software project management is ongoing team learning to refine project management and software development processes as the project progresses. One of the best ways to achieve this is that the team considers and documents what worked well and what could have worked better at the end of each iteration and identifies improvements to be implemented in subsequent iterations.

Front 150

When reviewing an intrusion detection system (IDS), an IS auditor should be MOST concerned about which of the following?

Back 150

"Attacks not being identified by the system. Attacks not being identified by the system present a higher risk, because they are unknown and no action will be taken to address the attack. Although the number of false-positives is a serious issue, the problem will be known and can be corrected. Often, IDS reports are first analyzed by an automated tool to eliminate known false-positives, which generally are not a problem. An IDS does not block any traffic.

Front 151

Which of the following is the BEST control to mitigate the risk of pharming attacks to an Internet banking application

Back 151

"Domain name system (DNS) server security hardening. The pharming attack redirects the traffic to an unauthorized web site by exploiting vulnerabilities of the DNS server. In order to avoid this kind of attack, it is necessary to eliminate any known vulnerability that could allow DNS poisoning. Older versions of DNS software are vulnerable to this kind of attack and should be patched. User registration, password policies, awareness and the use of IDSs/IPSs cannot mitigate pharming attacks because they do not prevent manipulation of DNS records.

Front 152

A proposed transaction processing application will have many data capture sources and outputs in paper and electronic form. To ensure that transactions are not lost during processing, an IS auditor should recommend the inclusion of:

Back 152

"Automated systems balancing would be the best way to ensure that no transactions are lost as any imbalance between total inputs and total outputs would be reported for investigation and correction. Validation controls and internal credibility checks are certainly valid controls, but will not detect and report lost transactions. In addition, although a clerical procedure could be used to summarize and compare inputs and outputs, an automated process is less susceptible to error.

Front 153

Which of the following controls would be the MOST comprehensive in a remote access network with multiple and diverse subsystems?

Back 153

"The most comprehensive control in this situation is password implementation and administration. While firewall installations are the primary line of defense, they cannot protect all access and, therefore, an element of risk remains. A proxy server is a type of firewall installation; thus, the same rules apply. The network administrator may serve as a control, but typically this would not be comprehensive enough to serve on multiple and diverse systems.

Front 154

An IS auditor has been asked to review the implementation of a customer relationship management (CRM) system for a large organization. The IS auditor discovered the project incurred significant overbudget expenses and scope creep caused the project to miss key dates. Which of the following should the IS auditor recommend for future projects?

Back 154

Use of a software baseline provides a cutoff point for the design of the system and allows the project to proceed as scheduled without being delayed by scope creep. A. While project management training is a good practice, it does not necessarily prevent scope creep without the use of a software baseline and a robust requirements change process.

Front 155

An efficient use of public key infrastructure (PKI) should encrypt the:

Back 155

" symmetric session key. Public key (asymmetric) cryptographic systems require larger keys (1,024 bits) and involve intensive and time-consuming computations. In comparison, symmetric encryption is considerably faster, yet relies on the security of the process for exchanging the secret key. To enjoy the benefits of both systems, a symmetric session key is exchanged using public key methods, after which it serves as the secret key for encrypting/decrypting messages sent between two parties.

Front 156

Which of the following will MOST successfully identify overlapping key controls in business application systems?

Back 156

"Replacing manual monitoring with an automated auditing solution. As part of the effort to realize continuous audit management (CAM), there are cases for introducing an automated monitoring and auditing solution. All key controls need to be clearly aligned for systematic implementation; thus, analysts have the opportunity to come across unnecessary or overlapping key controls in existing systems

Front 157

Failure in which of the following testing stages would have the GREATEST impact on the implementation of new application software?

Back 157

Acceptance testing. Acceptance testing is the final stage before the software is installed and is available for use. The greatest impact would occur if the software fails at the acceptance testing level, as this could result in delays and cost overruns. System testing is undertaken by the developer team to determine if the software meets user requirements per specifications.

Front 158

An IS auditor is reviewing a corporate web server. Which of the following should be of MOST concern to the IS auditor?

Back 158

Web servers should have up-to-date patches because they are accessible to the Internet and are prone to attack. C. While logging is important, lack of system patching is a more significant issue.

Front 159

An IS auditor uses computer-assisted audit techniques (CAATs) to collect and analyze data. Which of the following attributes of evidence is MOST affected by the use of CAATs?

Back 159

Because the data are directly collected by the IS auditor, the audit findings can be reported with an emphasis on the reliability of the records that are produced and maintained in the system. The reliability of the source of information used provides reassurance on the findings generated. Relevance of audit evidence pulled by CAATs is determined by the audit objective, and the use of CAATs does not have as direct of an impact on relevance as reliability does.

Front 160

An online stock trading firm is in the process of implementing a system to provide secure email exchange with its customers. What is the BEST option to ensure confidentiality, integrity and nonrepudiation?

Back 160

A digital certificate contains the public key and identifying information about the owner of the public key. The associated private key pair is kept secret with the owner. These certificates are generally verified by a trusting authority, with the purpose of associating a person's identity with the public key. Email confidentiality and integrity are obtained by following the public key–private key encryption. With the digital certificate verified by the trusted third party, nonrepudiation of the sender is obtained. Symmetric key encryption uses a single-pass phrase to encrypt and decrypt the message. While this type of encryption is strong, it suffers from the inherent problem of needing to share the pass phrase in a secure manner.

Front 161

Which of the following is the MOST important skill an IS auditor should develop to understand the constraints of conducting an audit?

Back 161

Audits often involve resource management and deadlines similar to project management best practices.

Front 162

Which of the following would an IS auditor use to determine if unauthorized modifications were made to production programs?

Back 162

"Compliance testing. Determining that only authorized modifications are made to production programs would require the change management process be reviewed to evaluate the existence of a trail of documentary evidence. Compliance testing would help to verify that the change management process has been applied consistently. It is unlikely that the system log analysis would provide information about the modification of programs. Forensic analysis is a specialized technique for criminal investigation. An analytical review assesses the general control environment of an organization.

Front 163

A technical lead who was working on a major project has left the organization. The project manager reports suspicious system activities on one of the servers that is accessible to the whole team. Which of the following would be of GREATEST concern during a forensic investigation?

Back 163

"Audit logs are critical to the investigation of the event; however, if not enabled, misuse of the logon ID of the technical lead and the guest account could not be established. The logon ID of the technical lead should have been deleted as soon as the employee left the organization but, without audit logs, misuse of the ID is difficult to prove. Spyware installed on the system is a concern but could have been installed by any user and, again, without the presence of logs, discovering who installed the spyware is difficult. A Trojan installed on the system is a concern, but it can be done by any user as it is accessible to the whole group and, without the presence of logs, investigation would be difficult.

Front 164

When auditing a role-based access control system (RBAC), the IS auditor noticed that some IT security employees have system administrator privileges on some servers which allows them to modify or delete transaction logs. Which would be the BEST recommendation that the IS auditor should make?

Back 164

Allowing IT security employees access to transaction logs is often unavoidable because having system administrator privileges is required for them to do their job. The best control in this case, to avoid unauthorized modifications of transaction logs, is to write the transaction logs to WORM drive media in real time. It is important to note that simply backing up the transaction logs to tape is not adequate since data could be modified prior (typically at night) to the daily backup job execution.

Front 165

An organization has an integrated development environment (IDE) on which the program libraries reside on the server, but modification/development and testing are done from PC workstations. Which of the following would be a strength of an IDE?

Back 165

Expands the programming resources and aids available. One of the recognized strengths of an IDE is that it expands the programming resources and the aids that are available by maintaining all development tools centrally on the server along with the environment.

Front 166

Which of the following is an advantage of an integrated test facility (ITF)?

Back 166

"Periodic testing does not require separate test processes. ITF creates a fictitious entity in the database to process test transactions simultaneously with live input. Its advantage is that periodic testing does not require separate test processes. However, careful planning is necessary, and test data must be isolated from production data.

Front 167

After discovering a security vulnerability in a third-party application that interfaces with several external systems, a patch is applied to a significant number of modules. Which of the following tests should an IS auditor recommend?

Back 167

"Given the extensiveness of the patch and its interfaces to external systems, system testing is most appropriate. Interface testing is not enough, and stress or black box testing are inadequate in these circumstances.

Front 168

Which of the following types of risk could result from inadequate software baselining?

Back 168

C. A software baseline is the cutoff point in the design and development of a system. Beyond this point, additional requirements or modifications to the scope must go through formal, strict procedures for approval based on a business cost-benefit analysis. Failure to adequately manage a system through baselining can result in uncontrolled changes in a project's scope and may incur time and budget overruns.

Front 169

Which of the following should be a MAJOR concern for an IS auditor reviewing a business continuity plan (BCP)?

Back 169

C. The effectiveness of a BCP can best be determined through tests. If results of tests are not documented, then there is no basis for feedback, updates, etc. NOT B. The contact lists are an important part of the BCP; however, they are not as important as documenting the test results.

Front 170

Which of the following is the MOST effective control for restricting access to unauthorized Internet sites in an organization?

Back 170

"Routing outbound Internet traffic through a content-filtering proxy server. A content-filtering proxy server will effectively monitor user access to Internet sites and block access to unauthorized web sites. Choice B is not correct because when a client web browser makes a request to an Internet site, those requests are outbound from the corporate network. A reverse proxy server is used to allow secure remote connection to a corporate site, not to control employee web access. Choice C is not correct because a firewall exists to block unauthorized inbound network traffic. Some firewalls can be used to block or allow access to certain sites, but are typically not well-suited to this task. Choice D is not correct because, while client software utilities do exist to block inappropriate content, installing and maintaining additional software on a large number of PCs is less effective than controlling the access from a single, centralized proxy server.

Front 171

An organization stores and transmits sensitive customer information within a secure wired network. It has implemented an additional wireless local area network (WLAN) to support general-purpose staff computing needs. A few employees with WLAN access have legitimate business reasons for also accessing customer information. Which of the following represents the BEST control to ensure separation of the two networks?

Back 171

"Install a firewall between the networks. In this case, a firewall could be used as a strong control to allow authorized users on the wireless network to access the wired network. While having two physically separate networks would ensure the security of customer data, it would make it impossible for authorized wireless users to access that data. While a VLAN would provide separation of the two networks, it is possible, with sufficient knowledge, for an attacker to gain access to one VLAN from the other. Similarly, a dedicated router between the two networks would separate them; however, this would be less secure than a firewall.

Front 172

In addition to the backup considerations for all systems, which of the following is an important consideration in providing backup for online systems?

Back 172

"Ensuring periodic dumps of transaction logs. Ensuring periodic dumps of transaction logs is the only safe way of preserving timely historical data. The volume of activity usually associated with an online system makes other more traditional methods of backup impractical.

Front 173

The PRIMARY objective of conducting a postimplementation review for a business process automation project is to:

Back 173

Ensuring that the project meets the intended business requirements is the primary objective of a postimplementation review.

Front 174

Which of the following processes will be MOST effective in reducing the risk that unauthorized software on a backup server is distributed to the production server?

Back 174

"Review changes in the software version control system. It is common practice for software changes to be tracked and controlled using version control software. An IS auditor should review reports or logs from this system to identify the software that is promoted to production. Even if replication may be conducted manually with due care, there still remains a risk to copying unauthorized software from one server to another. If unauthorized code were introduced onto the backup server by developers, controls on the production server and the software version control system should mitigate this risk. Review of the access log will identify staff access or the operations performed; however, it may not provide enough information to detect the release of unauthorized software

Front 175

A proposed transaction processing application will have many data capture sources and outputs in paper and electronic form. To ensure that transactions are not lost during processing, an IS auditor should recommend the inclusion of:

Back 175

"Automated systems balancing would be the best way to ensure that no transactions are lost as any imbalance between total inputs and total outputs would be reported for investigation and correction. Validation controls and internal credibility checks are certainly valid controls, but will not detect and report lost transactions. In addition, although a clerical procedure could be used to summarize and compare inputs and outputs, an automated process is less susceptible to error.

Front 176

Information for detecting unauthorized input from a terminal would be BEST provided by the:

Back 176

"The transaction journal would record all transaction activity, which then could be compared to the authorized source documents to identify any unauthorized input. A console log printout is not the best, because it would not record activity from a specific terminal. An automated suspense file listing would only list transaction activity where an edit error occurred, while the user error report would only list input that resulted in an edit error.

Front 177

Which of the following represents the GREATEST risk created by a reciprocal agreement for disaster recovery made between two companies?

Back 177

Developments may result in hardware and software incompatibility. If one organization updates its hardware and software configuration, it may mean that it is no longer compatible with the systems of the other party in the agreement. This may mean that each company is unable to use the facilities at the other company to recover their processing following a disaster. Resources being unavailable when needed are an intrinsic risk in any reciprocal agreement, but this is a contractual matter and is not the greatest risk.

Front 178

To prevent IP spoofing attacks, a firewall should be configured to drop a packet if:

Back 178

IP spoofing takes advantage of the source-routing option in the IP protocol. With this option enabled, an attacker can insert a spoofed source IP address.

Front 179

Which of the following is the BEST way to handle obsolete magnetic tapes before disposing of them?

Back 179

"Degaussing the tapes. The best way to handle obsolete magnetic tapes is to degauss them. This action leaves a very low residue of magnetic induction, essentially erasing the data from the tapes.

Front 180

Which of the following is an example of the defense in-depth security principle?

Back 180

Using a firewall as well as logical access controls on the hosts to control incoming network traffic. Defense in-depth means using different security mechanisms that back each other up. When network traffic passes the firewall unintentionally, the logical access controls form a second line of defense.

Front 181

An IS auditor performing an independent classification of systems should consider a situation where functions could be performed manually at a tolerable cost for an extended period of time as:

Back 181

"sensitive. Sensitive functions are best described as those that can be performed manually at a tolerable cost for an extended period of time. Critical functions are those that cannot be performed unless they are replaced by identical capabilities and cannot be replaced by manual methods. Vital functions refer to those that can be performed manually but only for a brief period of time; this is associated with lower costs of disruption than critical functions. Noncritical functions may be interrupted for an extended period of time at little or no cost to the company, and require little time or cost to restore.

Front 182

Which of the following BEST describes the objective of an IS auditor discussing the audit findings with the auditee?

Back 182

"Confirm the findings, and develop a course of corrective action. Before communicating the results of an audit to senior management, the IS auditor should discuss the findings with the auditee. The goal of such a discussion is to confirm the accuracy of the findings and to develop a course of corrective action. Based on this discussion, the IS auditor will finalize the report and present the report to relevant levels of senior management.

Front 183

An IS auditor discovers that developers have operator access to the command line of a production environment operating system. Which of the following controls would BEST mitigate the risk of undetected and unauthorized program changes to the production environment?

Back 183

Hash keys are calculated periodically for programs and matched against hash keys calculated for the most recent authorized versions of the programs. The matching of hash keys over time would allow detection of changes to files.

Front 184

An IS auditor should ensure that review of online electronic funds transfer (EFT) reconciliation procedures should include:

Back 184

"tracing . Tracing involves following the transaction from the original source through to its final destination. In EFT transactions, the direction on tracing may start from the customer-printed copy of the receipt, checking the system audit trails and logs, and finally checking the master file records for daily transactions. Vouching is usually performed on manual or batch-processing systems. In this scenario, the funds are transferred electronically and there is no manual processing. In online processing, authorizations are normally done automatically by the system. Correction entries are normally done by an individual other than the person entrusted to do reconciliations.

Front 185

An IS auditor is testing employee access to a large financial system. The IS auditor selected a sample from the current employee list provided by the auditee. Which of the following evidence is the MOST reliable to support the testing?

Back 185

"A list of accounts with access levels generated by the system. The access list generated by the system is the most reliable because it is the most objective evidence to perform a comparison against the samples selected. The evidence is objective because it was generated by the system rather than by an individual. A verbal statement itself is not adequate evidence for substantive tests. In most cases, documentary evidence should be collected to support the auditee's verbal statements. The HR documents signed by managers are good evidence; however, they are not as objective as the system-generated access list. The observations are good evidence to understand the internal control structure; however, observations are not efficient for a large number of users. Observations are not objective enough for substantive tests.

Front 186

Which of the following is the MOST critical and contributes the greatest to the quality of data in a data warehouse?

Back 186

"Accuracy of the source data. Accuracy of source data is a prerequisite for the quality of the data in a data warehouse. Credibility of the data source, accurate extraction processes and accurate transformation routines are all important, but would not change inaccurate data into quality (accurate) data.

Front 187

When using a digital signature, the message digest is computed:

Back 187

"by both the sender and the receiver. A digital signature is an electronic identification of a person or entity. It is created by using asymmetric encryption. To verify integrity of data, the sender uses a cryptographic hashing algorithm against the entire message to create a message digest to be sent along with the message. Upon receipt of the message, the receiver will recompute the hash using the same algorithm and compare results with what was sent to ensure the integrity of the message.

Front 188

Which of the following is the BEST method to ensure that the business continuity plan (BCP) remains up to date?

Back 188

"The group walks through the different scenarios of the plan, from beginning to end. A structured walk-through test gathers representatives from each department who will review the plan and identify weaknesses.

Front 189

Of the following alternatives, the FIRST approach to developing a disaster recovery strategy would be to assess whether:

Back 189

"a cost-effective, built-in resilience can be implemented. It is critical to initially identify information assets that can be made more resilient to disasters, e.g., diverse routing, alternate paths or multiple communication carriers. It is impossible to remove all existing and future threats. The optimization of the RTO and efforts to minimize the cost of recovery come later in the development of the disaster recovery strategy.

Front 190

In a client-server architecture, a domain name service (DNS) is MOST important because it provides the:

Back 190

"resolution service for the name/address. DNS is utilized primarily on the Internet for resolution of the name/address of the web site. It is an Internet service that translates domain names into IP addresses. As names are alphabetic, they are easier to remember. However, the Internet is based on IP addresses. Every time a domain name is used, a DNS service must translate the name into the corresponding IP address. The DNS system has its own network. If one DNS server does not know how to translate a particular domain name, it asks another one, and so on, until the correct IP address is returned.

Front 191

A message signed with a digital signature cannot be repudiated by the sender because a digital signature:

Back 191

"authenticates contents and sender at the time of signature. Digital signatures for the sender are attested by the certificate authority and can be verified by the recipient; therefore, repudiation is not possible. Additionally, the digital signature mechanism ensures the integrity of the message content by creating a one-way hash at both the source and destination and then comparing the two.

Front 192

A database administrator (DBA) who needs to make emergency changes to a database after normal working hours should log in:

Back 192

"with their named account to make the changes. Logging in using the named user account before using the DBA account provides accountability by noting the person making the changes. The DBA account is typically a shared user account. The shared account makes it difficult to establish the identity of the support user who is performing the database update. The server administrative accounts are shared and may be used by multiple support users. In addition, the server privilege accounts may not have the ability to perform database changes. The use of a normal user account would not have sufficient privileges to make changes on the database.

Front 193

After a disaster declaration, the media creation date at a warm recovery site is based on the:

Back 193

recovery point objective (RPO). The RPO is determined based on the acceptable data loss in case of a disruption of operations. It indicates the earliest point in time that is acceptable to recover the data. The RPO effectively quantifies the permissible amount of data loss in case of interruption. The media creation date will reflect the point to which data are to be restored or the RPO.

Front 194

Which of the following would BEST help to prioritize project activities and determine the timeline for a project?

Back 194

"Program evaluation review technique (PERT). The PERT method works on the principle of obtaining project timelines based on project events for three likely scenarios (worst, best, normal). The timeline is calculated by a predefined formula and identifies the critical path, which identifies the key activities that must be prioritized. EVA is a technique to track project cost versus project deliverables, but does not assist in prioritizing tasks. A Gantt chart is a simple project management tool and would help with the prioritization requirement, but it is not as effective as PERT. FPA measures the complexity of input and output, and does not help to prioritize project activities.

Front 195

Which of the following is the BEST control to prevent the deletion of audit logs by unauthorized individuals in an organization?

Back 195

Only select personnel should have rights to view or delete audit logs. Granting access to audit logs to only system administrators and security administrators would reduce the possibility of these files being deleted. Choice B is not correct because, in order for servers and applications to operate correctly,

Front 196

When developing a disaster recovery plan, the criteria for determining the acceptable downtime should be the:

Back 196

"maximum tolerable outage. The recovery time objective (RTO) is determined based on the acceptable downtime in case of a disruption of operations. It indicates the maximum tolerable outage that an organization considers to be acceptable before a system or process must resume following a disaster.

Front 197

An IS auditor discovers that the chief information officer (CIO) of an organization is using a wireless broadband modem utilizing global system for mobile communications (GSM) technology. This modem is being used to connect the CIO's laptop to the corporate virtual private network (VPN) when the CIO travels outside of the office. The IS auditor should:

Back 197

"do nothing since the inherent security features of GSM technology are appropriate. The inherent security features of GSM technology combined with the use of a VPN are appropriate. Choice A would be the correct answer since the confidentiality of the communication on the GSM radio link is ensured by the use of encryption and the use of a VPN signifies that an encrypted session is established between the laptop and the corporate network. GSM is a global standard for cellular telecommunications that can be used for both voice and data. Currently deployed commercial GSM technology has multiple overlapping security features which prevent eavesdropping, session hijacking or unauthorized use of the GSM carrier network. While other wireless technologies such as 802.11b wireless local area network (LAN) technologies have been designed to allow the user to adjust or even disable security settings, GSM does not allow any devices to connect to the system unless all relevant security features are active and enabled. Choice B would not be correct because, as stated above, encryption is a part of the defined GSM technology and is already in use. Choices C and D may apply to a wireless LAN, but they do not apply to a GSM network device.

Front 198

Electromagnetic emissions from a terminal represent an exposure because they:

Back 198

"can be detected and displayed. Emissions can be detected by sophisticated equipment and displayed, thus giving unauthorized persons access to data. They should not cause disruption of CPUs or effect noise pollution. TEMPEST is a term referring to the investigation and study of compromising emanations of unintentional intelligence-bearing signals that, if intercepted and analyzed, may reveal their contents.

Front 199

Web application developers sometimes use hidden fields on web pages to save information about a client session. This technique is used, in some cases, to store session variables that enable persistence across web pages, such as maintaining the contents of a shopping cart on a retail web site application. The MOST likely web-based attack due to this practice is:

Back 199

"parameter tampering . Web application developers sometimes use hidden fields to save information about a client session or to submit hidden parameters, such as the language of the end user, to the underlying application. Since hidden form fields do not display in the browser, developers may feel safe passing unvalidated data in the hidden fields (to be validated later). This practice is not safe since an attacker can intercept, modify and submit requests which can discover information or perform functions that the web developer never intended. The malicious modification of web application parameters is known as parameter tampering. Cross-site scripting involves the compromise of the web page to redirect users to content on the attacker web site. The use of hidden fields has no impact on the likelihood of a cross-site scripting attack since these fields are static content that cannot ordinarily be modified to create this type of attack. Web applications use cookies to save session state information on the client machine so that the user does not need to log on every time a page is visited. Cookie poisoning refers to the interception and modification of session cookies in order to impersonate the user or steal logon credentials. The use of hidden fields has no relation to cookie poisoning. Stealth commanding is the hijacking of a web server by the installation of unauthorized code. While the use of hidden forms may increase the risk of server compromise, the most common server exploits involve vulnerabilities of the server operating system or web server.

Front 200

With respect to the outsourcing of IT services, which of the following conditions should be of GREATEST concern to an IS auditor?

Back 200

"Outsourced activities are core and provide a differentiated advantage to the organization. An organization's core activities generally should not be outsourced, because they are what the organization does best; an IS auditor observing that should be concerned. An IS auditor should not be concerned about the other conditions because specification of periodic renegotiation in the outsourcing contract is a best practice. Outsourcing contracts cannot be expected to cover every action and detail expected of the parties involved, while multisourcing is an acceptable way to reduce risk.

Front 201

During an audit of a business continuity plan (BCP), an IS auditor found that, although all departments were housed in the same building, each department had a separate BCP. The IS auditor recommended that the BCPs be reconciled. Which of the following areas should be reconciled FIRST?

Back 201

"Evacuation plan. Protecting human resources during a disaster-related event should be addressed first. Having separate BCPs could result in conflicting evacuation plans, thus jeopardizing the safety of staff and clients. Choices B, C and D may be unique to each department and could be addressed separately, but still should be reviewed for possible conflicts and/or the possibility of cost reduction, but only after the issue of human safety has been analyzed.

Front 202

During an audit of an enterprise that is dedicated to e-commerce, the IS manager states that digital signatures are used when receiving communications from customers. To substantiate this, an IS auditor must prove that which of the following is used?

Back 202

"A hash of the data that is transmitted and encrypted with the customer's PRIVATE key. The calculation of a hash, or digest, of the data that are transmitted and its encryption require the public key of the client (receiver) and is called a signature of the message, or digital signature. The receiver performs the same process and then compares the received hash, once it has been decrypted with their private key, to the hash that is calculated with the received data. If they are the same, the conclusion would be that there is integrity in the data that have arrived and the origin is authenticated. The concept of encrypting the hash with the private key of the originator provides nonrepudiation since it can only be decrypted with their public key and the private key would not be known to the recipient. Simply put, in a key-pair situation, anything that can be decrypted by a sender's public key must have been encrypted with their private key, so they must have been the sender, i.e., nonrepudiation. Choice C is incorrect because, if this were the case, the hash could not be decrypted by the recipient, so the benefit of nonrepudiation would be lost and there could be no verification that the message had not been intercepted and amended. A digital signature is created by encrypting with a private key. A person creating the signature uses their own private key, otherwise everyone would be able to create a signature with any public key. Therefore, the signature of the client is created with the client's private key, and this can be verified—by the enterprise—using the client's public key. Choice B is the correct answer because, in this case, the customer uses their private key to sign the hash data.

Front 203

Reconfiguring which of the following firewall types will prevent inward downloading of files through the File Transfer Protocol (FTP)?

Back 203

"Application gateway. An application gateway firewall is effective in preventing applications such as FTPs from entering the organization network. A circuit gateway firewall is able to prevent paths or circuits, not applications, from entering the organization's network. A packet filter firewall or screening router will allow or prevent access based on IP packets/address.

Front 204

Which of the following would BEST help prevent structured query language (SQL) injection attacks of a web application?

Back 204

"Built-in input validations exist within the application. SQL injection is caused when web applications do not properly validate input. By entering special characters, and even SQL commands, into form fields, attackers can trick the web application into returning data that the programmer never intended or bypassing security controls. Hence, input validations would help in preventing SQL injection attacks. Avoiding queries to the database from web applications and use of Dynamic SQL are not realistic and not the best options to consider. Review of the queries structure by a DBA is a good practice, but automated input validation is a better preventive control.

Front 205

During a change control audit of a production system, an IS auditor finds that the change management process is not formally documented and that some migration procedures failed. What should the IS auditor do next?

Back 205

"Gain more assurance on the findings through root cause analysis. A change management process is critical to IT production systems. Before recommending that the organization take any other action (e.g., stopping migrations, redesigning the change management process), the IS auditor should gain assurance that the incidents reported are related to deficiencies in the change management process and not caused by some process other than change management.

Front 206

"During an IS audit of a global organization, the IS auditor discovers that the organization uses voice-over IP (VoIP) over the Internet as the sole means of voice connectivity among all offices. Which of the following presents the MOST significant risk for the organization's VoIP infrastructure?

Back 206

"Distributed denial-of-service (DDoS) attack. The use of VoIP does not introduce any unique risk with respect to equipment failure, so choice A is not correct. A DDoS attack would potentially disrupt the organization's ability to communicate among its offices and have the highest impact. Toll fraud occurs when someone compromises the phone system and makes unauthorized long-distance calls. While toll fraud may cost the business money, the more severe risk would be the disruption of service. Social engineering, which involves gathering sensitive information in order to launch an attack, can be exercised over any kind of telephony.

Front 207

An IT executive of an insurance company asked an external auditor to evaluate the user IDs for emergency access (fire call ID). The IS auditor found that fire call accounts are granted without a predefined expiration date. What should the IS auditor recommend?

Back 207

"Review of the access control privilege authorization process. In this case, the IS auditor should recommend reviewing the process of access control management. Emergency system administration-level access should only be granted on an as-needed basis and configured to a predefined expiration date. Accounts with temporary privileges require strong controls to limit the lifetime of the privileges and use of these accounts should be closely monitored. Choice B is not correct because, while implementing an IMS may solve the problem, it would be most cost-efficient to first review access privileges. Enhancing procedures to audit changes made to sensitive customer data (choice C) does not prevent the misuse of these accounts and should be performed after reviewing the process. It is not realistic to grant fire call accounts only to managers (choice D).

Front 208

A benefit of quality of service (QoS) is that the:

Back 208

"participating applications will have bandwidth guaranteed. The main function of QoS is to optimize network performance by assigning priority to business applications and end users, through the allocation of dedicated parts of the bandwidth to specific traffic. Choice A is not true because the communication itself will not be improved. While the speed of data exchange for specific applications could be faster, availability will not be improved. The QoS tools that many carriers are using do not provide reports of service levels; however, there are other tools that will generate service-level reports. Even when QoS is integrated with firewalls, virtual private networks (VPNs), encryption tools and others, the tool itself is not intended to provide security controls.

Front 209

When reviewing a disaster recovery plan (DRP), an IS auditor should be MOST concerned with the lack of:

Back 209

"process owner involvement. Process owner involvement is a critical part of the business impact analysis (BIA), which is used to create the DRP. If the IS auditor determined that process owners were not involved, this would be a significant concern. While well-documented testing procedures are important, unless process owners are involved there is no way to know whether the testing procedures are valid. An alternate processing facility may be a requirement to meet the needs of the business; however, such a decision needs to be based on the BIA. A data classification scheme is important to ensure that controls over data are appropriate; however, this is a lesser concern than a lack of process owner involvement.

Front 210

What is the BEST backup strategy for a large database with data supporting online sales?

Back 210

"Weekly full backup with daily incremental backup. Weekly full backup and daily incremental backup is the best backup strategy; it ensures the ability to recover the database and yet reduces the daily backup time requirements. A full backup normally requires a couple of hours, and therefore it can be impractical to conduct a full backup every day. Clustered servers provide a redundant processing capability, but are not a backup. Mirrored hard disks will not help in case of disaster.

Front 211

When reviewing system parameters, an IS auditor's PRIMARY concern should be that:

Back 211

"they are set to meet security and performance requirements. The primary concern is to find the balance between security and performance. Recording changes in an audit trail and periodically reviewing them is a detective control; however, if parameters are not set according to business rules, monitoring of changes may not be an effective control. Reviewing changes to ensure they are supported by appropriate documents is also a detective control. If parameters are set incorrectly, the related documentation and the fact that these are authorized does not reduce the impact. Restriction of access to parameters ensures that only authorized staff can access the parameters; however, if the parameters are set incorrectly, restricting access will still have an adverse impact.

Front 212

An IS auditor is reviewing an organization's controls over email encryption. The company's policy states that all sent email must be encrypted to protect the confidentiality of the message because the organization shares nonpublic information through email. To ensure that personnel are complying with the policy, an IS auditor must be sure the message is:

Back 212

"encrypted with the recipient's public key and decrypted with the recipient's private key. Encrypting with the public key and decrypting with the recipient's private key ensures message confidentiality. Conversely, encrypting with the private key and decrypting with the sender's public key ensures that the message came from the sender; however, it does not guarantee message encryption. With public key infrastructure (PKI), a message encrypted with a private key must be decrypted with a public key, and vice versa.

Front 213

A company has contracted with an external consulting firm to implement a commercial financial system to replace its existing system developed in-house. In reviewing the proposed development approach, which of the following would be of GREATEST concern?

Back 213

"A quality plan is not part of the contracted deliverables. A quality plan is an essential element of all projects. It is critical that the contracted supplier be required to produce such a plan. The quality plan for the proposed development contract should be comprehensive and encompass all phases of the development and include which business functions will be included and when. Acceptance is normally managed by the user area, since they must be satisfied that the new system will meet their requirements. If the system is large, a phased-in approach to implementing the application is a reasonable approach. Prototyping is a valid method of ensuring that the system will meet business requirements.

Front 214

When developing a formal enterprise security program, the MOST critical success factor (CSF) would be the:

Back 214

"effective support of an executive sponsor. The executive sponsor would be in charge of supporting the organization's strategic security program, and would aid in directing the organization's overall security management activities. Therefore, support by the executive level of management is the most CSF. None of the other choices are effective without visible sponsorship of top management.

Front 215

An IS auditor examining a biometric user authentication system establishes the existence of a control weakness that would allow an unauthorized individual to update the centralized database on the server that is used to store biometric templates. Of the following, which is the BEST control against this risk?

Back 215

Kerberos. Kerberos is a network authentication protocol for client-server applications that can be used to restrict access to the database to authorized users. Choices B and C are incorrect because vitality detection and multimodal biometrics are controls against spoofing and mimicry attacks. Before-image/after-image logging of database transactions is a detective control, as opposed to Kerberos, which is a preventative control.

Front 216

Which of the following is the GREATEST concern associated with the use of peer-to-peer computing?

Back 216

"Data leakage. Peer-to-peer computing can share the contents of a user hard drive over the Internet. The risk that sensitive data could be shared with others is the greatest concern.

Front 217

An organization stores and transmits sensitive customer information within a secure wired network. It has implemented an additional wireless local area network (WLAN) to support general-purpose staff computing needs. A few employees with WLAN access have legitimate business reasons for also accessing customer information. Which of the following represents the BEST control to ensure separation of the two networks?

Back 217

"Install a dedicated router between the two networks. In this case, a firewall could be used as a strong control to allow authorized users on the wireless network to access the wired network. While having two physically separate networks would ensure the security of customer data, it would make it impossible for authorized wireless users to access that data. While a VLAN would provide separation of the two networks, it is possible, with sufficient knowledge, for an attacker to gain access to one VLAN from the other. Similarly, a dedicated router between the two networks would separate them; however, this would be less secure than a firewall.

Front 218

During which phase of software application testing should an organization perform the testing of architectural design?

Back 218

"Integration testing. Integration testing evaluates the connection of two or more components that pass information from one area to another. The objective is to utilize unit-tested modules, thus building an integrated structure according to the design. Acceptance testing determines whether the solution meets the requirements of the business and is performed after system staff have completed the initial system test. This testing includes both quality assurance testing (QAT) and user acceptance testing (UAT), although not combined. System testing relates a series of tests by the test team or system maintenance staff to ensure that the modified program interacts correctly with other components. System testing references the functional requirements of the system. Unit testing references the detailed design of the system and uses a set of cases that focus on the control structure of the procedural design to ensure that the internal operation of the program performs according to specification.

Front 219

Disaster recovery planning (DRP) addresses the:

Back 219

"technological aspect of business continuity planning (BCP). DRP is the technological aspect of BCP. Business resumption planning addresses the operational part of BCP.

Front 220

When conducting an IT security risk assessment, the IS auditor asked the IT security officer to participate in a risk identification workshop with users and business unit representatives. What is the MOST important recommendation that the IS auditor should make to obtain successful results and avoid future

Back 220

"Ensure that the IT security risk assessment has a clearly defined scope. The IT risk assessment should have a clearly defined scope in order to be efficient and meet the objectives of risk identification. The IT risk assessment should include relationships with risk assessments in other areas, if appropriate. The other choices involve how risk is ranked and rated, but the success of the entire assessment process depends on making sure that the scope is broad enough to capture all significant risk that is still achievable. If the scope is too broad, the risk assessment process will be too difficult, and this can cause future conflicts.

Front 221

An IS auditor has been assigned to review IT structures and activities recently outsourced to various providers. Which of the following should the IS auditor determine FIRST?

Back 221

The contractual warranties of the providers support the business needs of the organization. The complexity of IT structures matched by the complexity and interplay of responsibilities and warranties may affect or void the effectiveness of those warranties and the reasonable certainty that the business needs will be met. All other choices are important, but not as potentially dangerous as the interplay of the diverse and critical areas of the contractual responsibilities of the outsourcers.

Front 222

An IS auditor reviewing the authentication controls of an organization should be MOST concerned if:

Back 222

system administrators use shared login credentials. The use of shared login credentials makes accountability impossible. The wrong answer: If user accounts are not locked after multiple failed attempts, a brute force attack could be used to gain access to the system. While this is a risk, a typical user would have limited system access compared to an administrator.

Front 223

A consulting firm has created an FTP site for the purpose of receiving financial data and has communicated the site's address, user ID and password to the financial services company in separate email messages. The company is to transmit its data to the FTP site after manually encrypting the data. The IS auditor's GREATEST concern with this process is that:

Back 223

"the FTP name and credentials are transmitted in cleartext during data transfer. Credentials that are transmitted in cleartext are vulnerable to compromise through the use of packet sniffers or other means. Once the site credentials are compromised, an unauthorized external party may download sensitive company data. Even though the data should be encrypted, there is always the possibility that since the process to encrypt the data was manual that a user forgot to encrypt sensitive data before transmitting them. Additionally, once the data have been accessed by an unauthorized external party, they may be cracked at leisure. While email transmittal of credentials is not optimal, the site address, user ID and password were sent in separate messages. The chance of all three messages being intercepted at random is low. The overall risk of using FTP is greater than the risk of password compromise via email. This is not a risk because personnel at the consulting firm require access to these data per the company's request. Tracing accountability is of minimal concern compared to the compromise of sensitive data.

Front 224

When auditing a proxy-based firewall, an IS auditor should:

Back 224

"verify that the filters applied to services such as HTTP are effective. A proxy-based firewall works as an intermediary (proxy) between the service or application and the client. It makes a connection with the client and opens a different connection with the server and, based on specific filters and rules, analyzes all the traffic between the two connections. Unlike a packet-filtering gateway, a proxy-based firewall does not forward any packets. Mapping between MAC and IP addresses is a task for protocols such as ARP/RARP. WRONG Answer test whether routing information is forwarded by the firewall.

Front 225

An IS auditor is reviewing a corporate web server. Which of the following should be of MOST concern to the IS auditor?

Back 225

"System patches are not applied. Web servers should have up-to-date patches because they are accessible to the Internet and are prone to attack. Wrong Answer: The network address translation is not enabled. Network address translation does not have any impact on server security and therefore is not a concern.

Front 226

In a public key infrastructure (PKI), a registration authority:

Back 226

" verifies information supplied by the subject requesting a certificate. - > A registration authority is responsible for verifying information supplied by the subject requesting a certificate, and verifies the requestor's right to request certificate attributes and that the requestor actually possesses the private key corresponding to the public key being sent. Certification authorities, not registration authorities, actually issue certificates once verification of the information has been completed; because of this, choice B is incorrect. On the other hand, the sender who has control of their private key signs the message, not the registration authority. Registering signed messages is not a task performed by registration authorities.

Front 227

An IS auditor examining a biometric user authentication system establishes the existence of a control weakness that would allow an unauthorized individual to update the centralized database on the server that is used to store biometric templates. Of the following, which is the BEST control against this risk?

Back 227

Kerberos -> Kerberos is a network authentication protocol for client-server applications that can be used to restrict access to the database to authorized users. Choices B and C are incorrect because vitality detection and multimodal biometrics are controls against spoofing and mimicry attacks. Before-image/after-image logging of database transactions is a detective control, as opposed to Kerberos, which is a preventative control.

Front 228

In a public key infrastructure (PKI), a registration authority:

Back 228

" verifies information supplied by the subject requesting a certificate. - > A registration authority is responsible for verifying information supplied by the subject requesting a certificate, and verifies the requestor's right to request certificate attributes and that the requestor actually possesses the private key corresponding to the public key being sent. Certification authorities, not registration authorities, actually issue certificates once verification of the information has been completed; because of this, choice B is incorrect. On the other hand, the sender who has control of their private key signs the message, not the registration authority. Registering signed messages is not a task performed by registration authorities.

Front 229

An IS auditor examining a biometric user authentication system establishes the existence of a control weakness that would allow an unauthorized individual to update the centralized database on the server that is used to store biometric templates. Of the following, which is the BEST control against this risk?

Back 229

Kerberos -> Kerberos is a network authentication protocol for client-server applications that can be used to restrict access to the database to authorized users. Choices B and C are incorrect because vitality detection and multimodal biometrics are controls against spoofing and mimicry attacks. Before-image/after-image logging of database transactions is a detective control, as opposed to Kerberos, which is a preventative control.

Front 230

Transmitting redundant information with each character or frame to facilitate detection and correction of errors is called a:

Back 230

"forward error control. Forward error control involves transmitting additional redundant information with each character or frame to facilitate detection and correction of errors. In feedback error control, only enough additional information is transmitted so the receiver can identify that an error has occurred. Choices B and D are both error detection methods but not error correction methods. Block sum check is an extension of parity check wherein an additional set of parity bits is computed for a block of characters. A cyclic redundancy check is a technique wherein a single set of check digits is generated, based on the contents of the frame, for each frame transmitted.

Front 231

The responsibilities of a disaster recovery relocation team include:

Back 231

coordinating the process of moving from the hot site to a new location or to the restored original location.

Front 232

The responsibilities of a offsite storage team include:

Back 232

obtaining, packaging and shipping media and records to the recovery facilities, as well as establishing and overseeing an offsite storage schedule.

Front 233

The responsibilities of a transportation team include:

Back 233

locating a recovery site, if one has not been predetermined, and coordinating the transport of company employees to the recovery site.

Front 234

The responsibilities of a salvage team include:

Back 234

managing the relocation project and conducting a more detailed assessment of the damage to the facilities and equipment.

Front 235

An IS auditor who is auditing the software acquisition process will ensure that the:

Back 235

contract is reviewed and approved by the legal counsel before it is signed. The process to review and approve the contract is one of the most important steps in the software acquisition process. An IS auditor should verify that legal counsel reviewed and approved the contract before management signs the contract.

Front 236

Which of the following would MOST effectively enhance the security of a challenge-response based authentication system?

Back 236

Selecting a more robust algorithm to generate challenge strings. Challenge response-based authentication is prone to session hijacking or man-in-the-middle attacks. Security management should be aware of this and engage in risk assessment and control design when they employ this technology.

Front 237

A certificate authority (CA) can delegate the processes of:

Back 237

establishing a link between the requesting entity and its public key. Establishing a link between the requesting entity and its public key is a function of a registration authority. This may or may not be performed by a CA; therefore, this function can be delegated. Revocation and suspension and issuance and distribution of the subscriber certificate are functions of the subscriber certificate life cycle management, which the CA must perform. Generation and distribution of the CA public key is a part of the CA key life cycle management process and, as such, cannot be delegated.