Question 1

Describe the function of a computer incident response team (CIRT)and the steps that a CIRT should perform following a security incident.

Accepted Answer

A CIRT is responsible for dealing with major security incidents and breaches.The team should include technical specialists and senior operations management.In response to a security incident,first the CIRT must recognize that a problem exists.Log analysis,intrusion detection systems can be used to detect problems and alert the CIRT.Second,the problem must be contained,perhaps by shutting down a server or curtailing traffic on the network.Third,the CIRT must focus on recovery.Corrupt programs may need to be reinstalled and data restored from backups.Finally,the CIRT must follow-up to discover how the incident occurred and to design corrective controls to prevent similar incidents in the future.

Question 2

Identify the statement below which is not a useful control procedure regarding access to system outputs.

Accepted Answer

A)  restricting access to rooms with printers 
B)  coding reports to reflect their importance 
C)  allowing visitors to move through the building without supervision 
D)  requiring employees to log out of applications when leaving their desk 
A)  restricting access to rooms with printers 
B)  coding reports to reflect their importance 
C)  allowing visitors to move through the building without supervision 
D)  requiring employees to log out of applications when leaving their desk C

Question 3

The process of turning off unnecessary features in the system is known as

Accepted Answer

A)  deep packet inspection. 
B)  hardening. 
C)  intrusion detection. 
D)  war dialing. 
A)  deep packet inspection. 
B)  hardening. 
C)  intrusion detection. 
D)  war dialing. B

Question 4

According to the Trust Services Framework,the reliability principle of integrity is achieved when the system produces data that

Accepted Answer

A)  is available for operation and use at times set forth by agreement. 
B)  is protected against unauthorized physical and logical access. 
C)  can be maintained as required without affecting system availability, security, and integrity. 
D)  is complete, accurate, and valid. 
A)  is available for operation and use at times set forth by agreement. 
B)  is protected against unauthorized physical and logical access. 
C)  can be maintained as required without affecting system availability, security, and integrity. 
D)  is complete, accurate, and valid.

Question 5

________ is/are an example of a detective control.

Accepted Answer

A)  Physical access controls 
B)  Encryption 
C)  Emergency response teams 
D)  Log analysis 
A)  Physical access controls 
B)  Encryption 
C)  Emergency response teams 
D)  Log analysis

Question 6

The Trust Services Framework reliability principle that states personal information should be protected from unauthorized disclosure is known as

Accepted Answer

A)  availability. 
B)  security. 
C)  privacy. 
D)  integrity. 
A)  availability. 
B)  security. 
C)  privacy. 
D)  integrity.

Question 7

Identify a party below who was involved with developing the Trust Services Framework.

Accepted Answer

A)  FASB 
B)  United States Congress 
C)  AICPA 
D)  IMA 
A)  FASB 
B)  United States Congress 
C)  AICPA 
D)  IMA

Question 8

Which of the following preventive controls are necessary to provide adequate security for social engineering threats?

Accepted Answer

A)  controlling remote access 
B)  encryption 
C)  host and application hardening 
D)  awareness training 
A)  controlling remote access 
B)  encryption 
C)  host and application hardening 
D)  awareness training

Question 9

Information security procedures protect information integrity by

Accepted Answer

A)  preventing fictitious transactions. 
B)  reducing the system cost. 
C)  making the system more efficient. 
D)  making it impossible for unauthorized users to access the system. 
A)  preventing fictitious transactions. 
B)  reducing the system cost. 
C)  making the system more efficient. 
D)  making it impossible for unauthorized users to access the system.

Question 10

Identify three ways users can be authenticated and give an example of each.

Accepted Answer

Users can be authenticated by

Question 11

The Trust Services Framework reliability principle that states sensitive information be protected from unauthorized disclosure is known as

Accepted Answer

A)  availability. 
B)  security. 
C)  confidentiality. 
D)  integrity. 
A)  availability. 
B)  security. 
C)  confidentiality. 
D)  integrity.

Question 12

The Trust Services Framework reliability principle that states that users must be able to enter,update,and retrieve data during agreed-upon times is known as

Accepted Answer

A)  availability. 
B)  security. 
C)  maintainability. 
D)  integrity. 
A)  availability. 
B)  security. 
C)  maintainability. 
D)  integrity.

Question 13

Identify six physical access controls.

Accepted Answer

Require visitors to sign in and receive

Question 14

It was 8:03 A.M.when Jiao Jan,the Network Administrator for South Asian Technologies,was informed that the intrusion detection system had identified an ongoing attempt to breach network security.By the time that Jiao had identified and blocked the attack,the hacker had accessed and downloaded several files from the company's server.Using the notation for the time-based model of security,in this case

Accepted Answer

A)  D > P 
B)  P > D 
C)  P > C 
D)  C > P 
A)  D > P 
B)  P > D 
C)  P > C 
D)  C > P

Question 15

Identify the best description of an access control matrix below.

Accepted Answer

A)  does not have to be updated 
B)  is used to implement authentication controls 
C)  matches the user's authentication credentials to his authorization 
D)  is a table specifying which portions of the system users are permitted to access 
A)  does not have to be updated 
B)  is used to implement authentication controls 
C)  matches the user's authentication credentials to his authorization 
D)  is a table specifying which portions of the system users are permitted to access

Question 16

If the time an attacker takes to break through the organization's preventive controls is greater than the sum of the time required to detect the attack and the time required to respond to the attack,then security is

Accepted Answer

A)  effective. 
B)  ineffective. 
C)  overdone. 
D)  undermanaged. 
A)  effective. 
B)  ineffective. 
C)  overdone. 
D)  undermanaged.

Question 17

In 2007,a major U.S.financial institution hired a security firm to attempt to compromise its computer network.A week later,the firm reported that it had successfully entered the system without apparent detection and presented an analysis of the vulnerabilities that had been found.This is an example of a

Accepted Answer

A)  preventive control. 
B)  detective control. 
C)  corrective control. 
D)  standard control. 
A)  preventive control. 
B)  detective control. 
C)  corrective control. 
D)  standard control.

Question 18

Explain social engineering.

Accepted Answer

Social engineering attacks use deception

Question 19

Cloud computing is generally more secure than traditional computing.

Accepted Answer

A) True 
 B)False

Question 20

The most effective method for protecting an organization from social engineering attacks is providing

Accepted Answer

A)  a firewall. 
B)  stateful packet filtering. 
C)  a demilitarized zone. 
D)  employee awareness training. 
A)  a firewall. 
B)  stateful packet filtering. 
C)  a demilitarized zone. 
D)  employee awareness training.

Describe the function of a computer incident response team (CIRT)and the steps that a CIRT should perform following a security incident.

Identify the statement below which is not a useful control procedure regarding access to system outputs.

The process of turning off unnecessary features in the system is known as

According to the Trust Services Framework,the reliability principle of integrity is achieved when the system produces data that

________ is/are an example of a detective control.

The Trust Services Framework reliability principle that states personal information should be protected from unauthorized disclosure is known as

Identify a party below who was involved with developing the Trust Services Framework.

Which of the following preventive controls are necessary to provide adequate security for social engineering threats?

Information security procedures protect information integrity by

Identify three ways users can be authenticated and give an example of each.

The Trust Services Framework reliability principle that states sensitive information be protected from unauthorized disclosure is known as

The Trust Services Framework reliability principle that states that users must be able to enter,update,and retrieve data during agreed-upon times is known as

Identify six physical access controls.

Identify the best description of an access control matrix below.

If the time an attacker takes to break through the organization's preventive controls is greater than the sum of the time required to detect the attack and the time required to respond to the attack,then security is

Explain social engineering.

Cloud computing is generally more secure than traditional computing.

The most effective method for protecting an organization from social engineering attacks is providing

Accounting Information Systems: an Overview

Overview of Transaction Processing and Enterprise Resource Planning Systems

Systems Documentation Techniques

Relational Databases

Computer Fraud

Computer Fraud and Abuse Techniques

Control and Accounting Information Systems

Confidentiality and Privacy Controls

Processing Integrity and Availability Controls

Auditing Computer-Based Information Systems

The Revenue Cycle: Sales to Cash Collections

The Expenditure Cycle: Purchasing to Cash Disbursements

The Production Cycle

The Human Resources Management and Payroll Cycle

General Ledger and Reporting System

Database Design Using the Rea Data Model

Implementing an Rea Model in a Relational Database

Special Topics in Rea Modeling

Introduction to Systems Development and Systems Analysis

Ais Development Strategies

Systems Design, implementation, and Operation

Filters

Exam 8: Controls for Information Security

Describe the function of a computer incident response team (CIRT)and the steps that a CIRT should perform following a security incident.

Identify the statement below which is not a useful control procedure regarding access to system outputs.

The process of turning off unnecessary features in the system is known as

According to the Trust Services Framework,the reliability principle of integrity is achieved when the system produces data that

________ is/are an example of a detective control.

The Trust Services Framework reliability principle that states personal information should be protected from unauthorized disclosure is known as

Identify a party below who was involved with developing the Trust Services Framework.

Which of the following preventive controls are necessary to provide adequate security for social engineering threats?

Information security procedures protect information integrity by

Identify three ways users can be authenticated and give an example of each.

The Trust Services Framework reliability principle that states sensitive information be protected from unauthorized disclosure is known as

The Trust Services Framework reliability principle that states that users must be able to enter,update,and retrieve data during agreed-upon times is known as

Identify six physical access controls.

Identify the best description of an access control matrix below.

If the time an attacker takes to break through the organization's preventive controls is greater than the sum of the time required to detect the attack and the time required to respond to the attack,then security is

Explain social engineering.

Cloud computing is generally more secure than traditional computing.

The most effective method for protecting an organization from social engineering attacks is providing

Accounting Information Systems: an Overview

Overview of Transaction Processing and Enterprise Resource Planning Systems

Systems Documentation Techniques

Relational Databases

Computer Fraud

Computer Fraud and Abuse Techniques

Control and Accounting Information Systems

Confidentiality and Privacy Controls

Processing Integrity and Availability Controls

Auditing Computer-Based Information Systems

The Revenue Cycle: Sales to Cash Collections

The Expenditure Cycle: Purchasing to Cash Disbursements

The Production Cycle

The Human Resources Management and Payroll Cycle

General Ledger and Reporting System

Database Design Using the Rea Data Model

Implementing an Rea Model in a Relational Database

Special Topics in Rea Modeling

Introduction to Systems Development and Systems Analysis

Ais Development Strategies

Systems Design, implementation, and Operation

Filters