Question 1

Describe the concept of Internet of Things (IoT)and its security implications.

Accepted Answer

The term Internet of Things (IoT)refers

Question 2

Identify the primary means of protecting data stored in a cloud from unauthorized access.

Accepted Answer

A) authentication 
B) authorization 
C) virtualization 
D) securitization 
A) authentication 
B) authorization 
C) virtualization 
D) securitization

Question 3

Security is a technology issue and not just a management issue.

Accepted Answer

A) True 
 B)False

Question 4

Tools called ________ can be used to identify unused and,therefore,unnecessary programs that represent potential security threats.

Accepted Answer

A) router scanners 
B) vulnerabilities scanners 
C) deep inspection scanners 
D) TCP scanners 
A) router scanners 
B) vulnerabilities scanners 
C) deep inspection scanners 
D) TCP scanners

Question 5

Describe the five principles of the Trust Services Framework.Select one of the principles and discuss the why it is important to an organization.

Accepted Answer

The Trust Services Framework organizes I

Question 6

Which of the following is an example of a corrective control?

Accepted Answer

A) Physical access controls. 
B) Encryption. 
C) Intrusion detection. 
D) Incident response teams. 
A) Physical access controls. 
B) Encryption. 
C) Intrusion detection. 
D) Incident response teams.

Question 7

Which of the following is an example of a preventive control?

Accepted Answer

A) The creation of a "security-aware" culture. 
B) The creation of a "Log user friendly" culture. 
C) The creation of a "continuous monitoring" culture. 
D) The creation of a chief information security officer position. 
A) The creation of a "security-aware" culture. 
B) The creation of a "Log user friendly" culture. 
C) The creation of a "continuous monitoring" culture. 
D) The creation of a chief information security officer position.

Question 8

The steps that criminals take to trick an unsuspecting employee into granting them access is called

Accepted Answer

A) scanning and mapping the target. 
B) social engineering. 
C) research. 
D) reconnaissance. 
A) scanning and mapping the target. 
B) social engineering. 
C) research. 
D) reconnaissance.

Question 9

Explain social engineering.

Accepted Answer

Social engineering attacks use deception

Question 10

Logs need to be analyzed regularly to detect problems in a timely manner.

Accepted Answer

A) True 
 B)False

Question 11

A separate network located outside the organization's internal information system that permits controlled access from the Internet to selected resources is known as a(n)

Accepted Answer

A) demilitarized zone. 
B) intrusion detection system. 
C) intrusion prevention system. 
D) firewall. 
A) demilitarized zone. 
B) intrusion detection system. 
C) intrusion prevention system. 
D) firewall.

Question 12

In recent years,many of the attacks carried out by hackers have relied on this type of vulnerability in computer software.

Accepted Answer

A) Code mastication. 
B) Boot sector corruption. 
C) URL injection. 
D) Buffer overflow. 
A) Code mastication. 
B) Boot sector corruption. 
C) URL injection. 
D) Buffer overflow.

Question 13

A demilitarized zone

Accepted Answer

A) routes electronic communications within an organization. 
B) connects an organization's information system to the Internet. 
C) permits controlled access from the Internet to selected resources. 
D) serves as the main firewall. 
A) routes electronic communications within an organization. 
B) connects an organization's information system to the Internet. 
C) permits controlled access from the Internet to selected resources. 
D) serves as the main firewall.

Question 14

Describe the basic steps criminal use to attack an organization's information system.Select one of the steps and find a news story that relates to the step that you have chosen.

Accepted Answer

The basic steps criminals use to attack

Question 15

According to the Trust Services Framework,the reliability principle of availability is achieved when the system produces data that

Accepted Answer

A) is available for operation and use at times set forth by agreement. 
B) is protected against unauthorized physical and logical access. 
C) can be maintained as required without affecting system availability, security, and integrity. 
D) is complete, accurate, and valid. 
A) is available for operation and use at times set forth by agreement. 
B) is protected against unauthorized physical and logical access. 
C) can be maintained as required without affecting system availability, security, and integrity. 
D) is complete, accurate, and valid.

Question 16

Which of the following is not a step in an organization's incident response process?

Accepted Answer

A) Recognition. 
B) Recovery. 
C) Isolation. 
D) Containment. 
A) Recognition. 
B) Recovery. 
C) Isolation. 
D) Containment.

Question 17

________ is an authorized attempt by an internal audit team or an external security consultant to attempt to break into the organization's information system.

Accepted Answer

A) Log analysis test 
B) Intrusion test 
C) Penetration test 
D) Vulnerability test 
A) Log analysis test 
B) Intrusion test 
C) Penetration test 
D) Vulnerability test

Question 18

New employees of Baker Technologies are assigned user names and appropriate permissions.Their credentials are then entered into the company's information system's access control matrix.This is an example of a(n)

Accepted Answer

A) authentication control. 
B) biometric device. 
C) remote access control. 
D) authorization control. 
A) authentication control. 
B) biometric device. 
C) remote access control. 
D) authorization control.

Question 19

Identify three ways users can be authenticated and give an example of each.

Accepted Answer

Users can be authenticated by

Question 20

Explain the value of penetration testing.

Accepted Answer

Penetration testing involves an authoriz

Exam 8: Controls for Information Security

Describe the concept of Internet of Things (IoT)and its security implications.

Identify the primary means of protecting data stored in a cloud from unauthorized access.

Security is a technology issue and not just a management issue.

Tools called ________ can be used to identify unused and,therefore,unnecessary programs that represent potential security threats.

Describe the five principles of the Trust Services Framework.Select one of the principles and discuss the why it is important to an organization.

Which of the following is an example of a corrective control?

Which of the following is an example of a preventive control?

The steps that criminals take to trick an unsuspecting employee into granting them access is called

Explain social engineering.

Logs need to be analyzed regularly to detect problems in a timely manner.

A separate network located outside the organization's internal information system that permits controlled access from the Internet to selected resources is known as a(n)

In recent years,many of the attacks carried out by hackers have relied on this type of vulnerability in computer software.

A demilitarized zone

Describe the basic steps criminal use to attack an organization's information system.Select one of the steps and find a news story that relates to the step that you have chosen.

According to the Trust Services Framework,the reliability principle of availability is achieved when the system produces data that

Which of the following is not a step in an organization's incident response process?

________ is an authorized attempt by an internal audit team or an external security consultant to attempt to break into the organization's information system.

New employees of Baker Technologies are assigned user names and appropriate permissions.Their credentials are then entered into the company's information system's access control matrix.This is an example of a(n)

Identify three ways users can be authenticated and give an example of each.

Explain the value of penetration testing.

Conceptual Foundations of Accounting Information Systems

Overview of Transaction Processing and Enterprise Resource Planning Systems

Systems Documentation Techniques

Relational Databases

Computer Fraud

Computer Fraud and Abuse Techniques

Control and Accounting Information Systems

Confidentiality and Privacy Controls

Processing Integrity and Availability Controls

Auditing Computer-Based Information Systems

The Revenue Cycle: Sales to Cash Collections

The Expenditure Cycle: Purchasing to Cash Disbursements

The Production Cycle

The Human Resources Management and Payroll Cycle

General Ledger and Reporting System

Database Design Using the Rea Data Model

Implementing an Rea Model in a Relational Database

Special Topics in Rea Modeling

Introduction to Systems Development and Systems Analysis

Ais Development Strategies

Systems Design, implementation, and Operation

Filters