Question 1

The ________ disseminates information about fraud,errors,breaches and other improper system uses and their consequences.

Accepted Answer

A) chief information officer 
B) chief operations officer 
C) chief security officer 
D) computer emergency response team 
A) chief information officer 
B) chief operations officer 
C) chief security officer 
D) computer emergency response team

Question 2

In the time-based model of information security,P represents

Accepted Answer

A) the time it takes to respond to and stop the attack. 
B) the time it takes for the organization to detect that an attack is in progress. 
C) the time it takes an attacker to break through the various controls that protect the organization's information assets. 
D) the time it takes to assess threats and select risk response. 
A) the time it takes to respond to and stop the attack. 
B) the time it takes for the organization to detect that an attack is in progress. 
C) the time it takes an attacker to break through the various controls that protect the organization's information assets. 
D) the time it takes to assess threats and select risk response.

Question 3

The steps that criminals take to study their target's physical layout to learn about the controls it has in place is called

Accepted Answer

A) scanning and mapping the target. 
B) social engineering. 
C) research. 
D) reconnaissance. 
A) scanning and mapping the target. 
B) social engineering. 
C) research. 
D) reconnaissance.

Question 4

Describe the steps in the security life cycle.

Accepted Answer

There are four steps in the security lif

Question 5

Which of the following is commonly true of the default settings for most commercially available wireless access points?

Accepted Answer

A) The security level is set at the factory and cannot be changed. 
B) Security is set to an adjustable level that changes depending on the wireless network the device is connected. 
C) Security is set to the lowest level that the device is capable of handling. 
D) Security is set to the highest level that the device is capable of handling. 
A) The security level is set at the factory and cannot be changed. 
B) Security is set to an adjustable level that changes depending on the wireless network the device is connected. 
C) Security is set to the lowest level that the device is capable of handling. 
D) Security is set to the highest level that the device is capable of handling.

Question 6

New employees of Baker Technologies are assigned user names and appropriate permissions.Each of them were given a company's issued laptop that have an integrated fingerprint reader.In order to log in,the user's fingerprint must be recognized by the reader.This is an example of a(n)

Accepted Answer

A) authorization control. 
B) biometric device. 
C) remote access control. 
D) defense in depth. 
A) authorization control. 
B) biometric device. 
C) remote access control. 
D) defense in depth.

Question 7

The most common input-related vulnerability is called the

Accepted Answer

A) softening attack. 
B) hardening attack. 
C) cross-site scripting attack. 
D) buffering attack. 
A) softening attack. 
B) hardening attack. 
C) cross-site scripting attack. 
D) buffering attack.

Question 8

Which of the following is an example of a detective control?

Accepted Answer

A) Physical access controls. 
B) Encryption. 
C) Continuous monitoring. 
D) Incident response teams. 
A) Physical access controls. 
B) Encryption. 
C) Continuous monitoring. 
D) Incident response teams.

Question 9

In the time-based model of information security,D represents

Accepted Answer

A) the time it takes to respond to and stop the attack. 
B) the time it takes for the organization to detect that an attack is in progress. 
C) the time it takes an attacker to break through the various controls that protect the organization's information assets. 
D) the time it takes to assess threats and select risk response. 
A) the time it takes to respond to and stop the attack. 
B) the time it takes for the organization to detect that an attack is in progress. 
C) the time it takes an attacker to break through the various controls that protect the organization's information assets. 
D) the time it takes to assess threats and select risk response.

Question 10

The steps that criminals take to find known vulnerabilities and learn how to take advantage of those vulnerabilities is called

Accepted Answer

A) scanning and mapping the target. 
B) social engineering. 
C) research. 
D) reconnaissance. 
A) scanning and mapping the target. 
B) social engineering. 
C) research. 
D) reconnaissance.

Question 11

Multi-factor authentication

Accepted Answer

A) involves the use of two or more basic authentication methods. 
B) is a table specifying which portions of the systems users are permitted to access. 
C) provides weaker authentication than the use of effective passwords. 
D) requires the use of more than one effective password. 
A) involves the use of two or more basic authentication methods. 
B) is a table specifying which portions of the systems users are permitted to access. 
C) provides weaker authentication than the use of effective passwords. 
D) requires the use of more than one effective password.

Question 12

This network access control determines which IP packets are allowed entry to a network and which are dropped.

Accepted Answer

A) access control list 
B) deep packet inspection 
C) stateful packet filtering 
D) static packet filtering 
A) access control list 
B) deep packet inspection 
C) stateful packet filtering 
D) static packet filtering

Question 13

The process that allows a firewall to be more effective by examining the data in the body of an IP packet,instead of just the header,is known as

Accepted Answer

A) deep packet inspection. 
B) stateful packet filtering. 
C) static packet filtering. 
D) an intrusion prevention system. 
A) deep packet inspection. 
B) stateful packet filtering. 
C) static packet filtering. 
D) an intrusion prevention system.

Question 14

Social engineering attacks often take place over the Internet.

Accepted Answer

A) True 
 B)False

Question 15

Identify one aspect of systems reliability that is not a source of concern with regards to a public cloud.

Accepted Answer

A) confidentiality 
B) privacy 
C) efficiency 
D) availability 
A) confidentiality 
B) privacy 
C) efficiency 
D) availability

Question 16

Information security procedures protect information integrity by

Accepted Answer

A) preventing fictitious transactions. 
B) reducing the system cost. 
C) making the system more efficient. 
D) making it impossible for unauthorized users to access the system. 
A) preventing fictitious transactions. 
B) reducing the system cost. 
C) making the system more efficient. 
D) making it impossible for unauthorized users to access the system.

Question 17

Describe the function of a computer incident response team (CIRT)and the steps that a CIRT should perform following a security incident.

Accepted Answer

A CIRT is responsible for dealing with m

Question 18

Identify a party below who was involved with developing the Trust Services Framework.

Accepted Answer

A) FASB 
B) COSO 
C) AICPA 
D) PCAOB 
A) FASB 
B) COSO 
C) AICPA 
D) PCAOB

Question 19

Cloud computing can potentially generate significant cost savings for an organization.

Accepted Answer

A) True 
 B)False

Question 20

According to the Trust Services Framework,the confidentiality principle of integrity is achieved when the system produces data that

Accepted Answer

A) is available for operation and use at times set forth by agreement. 
B) is protected against unauthorized physical and logical access. 
C) can be maintained as required without affecting system availability, security, and integrity. 
D) is complete, accurate, and valid. 
A) is available for operation and use at times set forth by agreement. 
B) is protected against unauthorized physical and logical access. 
C) can be maintained as required without affecting system availability, security, and integrity. 
D) is complete, accurate, and valid.

Exam 8: Controls for Information Security

The ________ disseminates information about fraud,errors,breaches and other improper system uses and their consequences.

In the time-based model of information security,P represents

The steps that criminals take to study their target's physical layout to learn about the controls it has in place is called

Describe the steps in the security life cycle.

Which of the following is commonly true of the default settings for most commercially available wireless access points?

New employees of Baker Technologies are assigned user names and appropriate permissions.Each of them were given a company's issued laptop that have an integrated fingerprint reader.In order to log in,the user's fingerprint must be recognized by the reader.This is an example of a(n)

The most common input-related vulnerability is called the

Which of the following is an example of a detective control?

In the time-based model of information security,D represents

The steps that criminals take to find known vulnerabilities and learn how to take advantage of those vulnerabilities is called

Multi-factor authentication

This network access control determines which IP packets are allowed entry to a network and which are dropped.

The process that allows a firewall to be more effective by examining the data in the body of an IP packet,instead of just the header,is known as

Social engineering attacks often take place over the Internet.

Identify one aspect of systems reliability that is not a source of concern with regards to a public cloud.

Information security procedures protect information integrity by

Describe the function of a computer incident response team (CIRT)and the steps that a CIRT should perform following a security incident.

Identify a party below who was involved with developing the Trust Services Framework.

Cloud computing can potentially generate significant cost savings for an organization.

According to the Trust Services Framework,the confidentiality principle of integrity is achieved when the system produces data that

Conceptual Foundations of Accounting Information Systems

Overview of Transaction Processing and Enterprise Resource Planning Systems

Systems Documentation Techniques

Relational Databases

Computer Fraud

Computer Fraud and Abuse Techniques

Control and Accounting Information Systems

Confidentiality and Privacy Controls

Processing Integrity and Availability Controls

Auditing Computer-Based Information Systems

The Revenue Cycle: Sales to Cash Collections

The Expenditure Cycle: Purchasing to Cash Disbursements

The Production Cycle

The Human Resources Management and Payroll Cycle

General Ledger and Reporting System

Database Design Using the Rea Data Model

Implementing an Rea Model in a Relational Database

Special Topics in Rea Modeling

Introduction to Systems Development and Systems Analysis

Ais Development Strategies

Systems Design, implementation, and Operation

Filters