Thẻ ghi nhớ: IAP301 - SU 2024 - FE

Question 1:

What metrics must you gauge to attain operational consistency among the following?

A. Consistency

B. Quality

C. Results

D. All of the above

D. All of the above

Question 2:

Which of the following do you need to measure to achieve operational consistency?

A. Consistency

B. Quality

C. Results

D. All of the above

D. All of the above

Question 3:

In the event of a severe security breach, who is ultimately responsible, according to regulators and the public?

A. Company officers

B. The CIO

C. The ISO

D. The data owner

A. Company officers

Question 4:

An IT policy framework charter includes which of the following?

A. The program's purpose and mission

B. The program's scope within the organization

C. Assignment of responsibilities for program implementation

D. Compliance management

E. All of the above

E. All of the above

Question 5:

What characteristics do entrepreneurs typically possess among the following? (Select two)

A. Innovators

B. Well educated in business management

C. More likely to take risks

D. Averse to change

A. Innovators

C. More likely to take risks

Question 6:

Why is the language in HR policies frequently deliberately ambiguous?

A. To avoid being interpreted as an unintended promise

B. To start lawsuits

C. To avoid being too severe for new hires

D. All are incorrect

A. To avoid being interpreted as an unintended promise

Question 7:

Which of the following attempts to identify where sensitive data is currently stored?

A. Data Leakage Protection Inventory

B. DLP Encryption Key

C. Data Loss Protection Perimeter

D. DLP Trojans

A. Data Leakage Protection Inventory

Question 8:

You need to retain data for what major reasons?

A. Legal obligation

B. Needs of the business

C. For recovery

D. All of the above

D. All of the above

Question 9:

What qualities should the data owner possess?

A. Is in a senior position within the business

B. Understands the data operations of the business

C. Understands the importance and value of the information to the business

D. Understand the ramifications of inaccurate data or unauthorized access

E. All of the above

E. All of the above

Question 10:

Data in transit is what type of data?

A. Data backup tapes being moved to a recovery facility

B. Data on your USB drive

C. Data traversing a network

D. Data being stored for later transmission

C. Data traversing a network

Question 11:

Requesting to borrow someone's keycard might be considered an example of

A. Social engineering

B. Phishing

C. Spoofing

D. All are incorrect

A. Social engineering

Question 12:

Which one of the following is not considered an IT security policy framework?

A. COBIT

B. ISO

C. ERM

D. OCTAVE

C. ERM

Question 13:

What are the network requirements outlined by PCI DSS among the following?

A. Network segregation

B. Penetration testing

C. Virus scanning

D. All are correct

D. All are correct

Question 14:

What is applicable to both GRC and ERM among the following?

A. Defines an approach to reduce risk

B. Applies rigid framework to eliminate redundant controls, policies, and efforts

C. Passively enforces security policy

D. Seeks line of sight into root causes of risks

A. Defines an approach to reduce risk

Question 15:

What are the control objectives associated with PCI DSS among the following?

A. Maintain an information security policy

B. Protect cardholder data

C. Alert when credit cards are illegally used

D. A and B only

D. A and B only

Question 16:

What factors contribute to the necessity of establishing security policies among the following?

A. Shareholder value

B. Regulations

C. Technology vulnerabilities and limitations

D. All of the above

D. All of the above

Question 17:

What is not required in modern-day CISO positions?

A. Must rely on the organization to enforce policy

B. Needs to have strong law enforcement background

C. Needs to build relationships and consensus

D. Must influence behavior and change culture to enforce policy

B. Needs to have strong law enforcement background

Question 18:

In which of the following areas might a company monitor its employees' actions?

A. Internet

B. E-mail

C. Computers

D. All of the above

D. All of the above

Question 19:

Good sources for security policies and standards include which of the following?

A. U.S. Government

B. Private companies selling standards

C. Professional organizations

D. Vendors

E. All of the above

E. All of the above

Question 20:

Which of the following does an acceptable use policy relate to?

A. Server-to-server communication

B. Users accessing the Internet

C. Encryption when transmitting files

D. Server-to-server communication & Encryption when transmitting files

E. Users accessing the Internet & Encryption when transmitting files

B. Users accessing the Internet

Question 21:

An operating system and different applications are installed on a system. The system is then locked down with various settings. You want the same operating system, applications, and settings deployed to 50 other computers. What's the easiest way?

A. Scripting

B. Imaging

C. Manually

D. Spread the work among different departments

B. Imaging

Question 22:

What is the difference between a BCP and a DRP?

A. A BCP focuses on the business recovery and DRP focuses on technology recovery.

B. A DRP focuses on the business recovery and BCP focuses on technology recovery.

C. There is no difference. The two terms mean the same thing.

A. A BCP focuses on the business recovery and DRP focuses on technology recovery.

Question 23:

How important is it to identify the attacker before issuing a final IRT report?

A. Critically important; do not issue the report without it

B. Moderately important; nice to have but issue the report if not available

C. Not important; focus on the incident and do not include identity of attacker even if you have it

D. Important, but allow law enforcement to brief management about attacker's identity

B. Moderately important; nice to have but issue the report if not available

Question 24:

What value does a forensic tool bring?

A. Gathers evidence

B. Helps evidence to be accepted by the court

C. Can take a bit image of a machine

D. All of the above

D. All of the above

Question 25:

When analyzing an incident. you must try to determine which of the following?

A. The tool used to attack

B. The vulnerability that was exploited

C. The result of the attack

D. All of the above

D. All of the above

Question 26:

What is included in the charter of an IT policy framework?

A. The program's purpose and mission

B. The program's scope within the organization

C. Assignment of responsibilities for program implementation

D. All are correct

D. All are correct

Question 27:

When building a policy framework, which of the following information systems factors should be considered?

A. Unauthorized access to and use of the system

B. Unauthorized disclosure of information

C. Disruption of the system

D. Modification of information

E. Destruction of information resources

F. All of the above

F. All of the above

Question 28:

What is the difference between risk appetite and risk tolerance?

A. Risk tolerance measures impact and likelihood, while risk appetite measures variance from a target goal.

B. Risk appetite measures impact and likelihood, while risk tolerance measures variance from a target goal.

C. There is no difference between these two.

B. Risk appetite measures impact and likelihood, while risk tolerance measures variance from a target goal.

Question 29:

An individual with inside information on how an organization operates is known as a

A. Insider

B. Shareholders

C. Auditor

D. Administrators

A. Insider

Question 30:

Which of the following factors is the most likely to necessitate security awareness?

A. Law

B. Customers

C. Shareholders

D. All are correct

D. All are correct

Question 31:

What does an acceptable use policy pertain to among the following?

A. Server-to-server communication

B. Users accessing the Internet

C. Encryption when transmitting files

D. A and B

B. Users accessing the Internet

Question 32:

System accounts are also known as ______ accounts.

A. Service

B. Root

C. Standard

D. All are incorrect

A. Service

Question 33:

An organization wants to reduce the possibility of outages when changes are implemented on the network. What should the organization use?

A. Change management

B. Configuration management

C. Configuration management database

D. Simple Network Management Protocol

A. Change management

Question 34:

Within which of the following would the steps for implementing security controls on a firewall be documented?

A. Policy

B. Control standard

C. Baseline standard

D. Procedure

D. Procedure

Question 35:

A DMZ separates a LAN from which of the following?

A. Phone network

B. Internet

C. Cellular network

D. VoIP Network

B. Internet

Question 36:

Which of the following are reliable sources for security policies and standards?

A. U.S. Government

B. Private companies selling standards

C. All are incorrect

D. All are correct

D. All are correct

Question 37:

What is the difference between a stateless firewall and a stateful one?

A. A stateful firewall looks at each packet individually and a stateless firewall examines the packet in context the connection and other packets.

B. A stateless firewall looks at each packet individually and a stateful firewall examines the packet in context the connection and other packets.

C. No difference

B. A stateless firewall looks at each packet individually and a stateful firewall examines the packet in context the connection and other packets.

Question 38:

In the absence of a policy accompanied by controls that limit employees from installing personal software on a company workstation, what potential consequences could a company face?

A. Malware on the network

B. Lawsuits from software licensing issues

C. Loss of productivity

D. All are correct

D. All are correct

Question 39:

The minimum standard in authentication for businesses involves the utilization of

A. IDs and Passwords

B. Retinal scans

C. Smart cards

D. Biometric authentication

A. IDs and Passwords

Question 40:

Dedicated network devices specifically designed to establish and oversee VPN traffic are termed VPN

A. Concentrators

B. Routers

C. Switches

D. Gateways

A. Concentrators

Question 41:

There is a statement "All private WANs require constant encryption". What's your opinion?

A. Private WANs may not need encryption.

B. Encryption is optional for private WANs.

C. Private WANs should be encrypted only occasionally.

D. Encryption is essential for private WANs.

A. Private WANs may not need encryption.

Question 42:

John works in the accounting department but travels to other company locations. He must present the past quarter's figures to the chief executive officer (CEO) in the morning. He forgot to update the PowerPoint presentation on his desktop computer at the main office. What is at issue here?

A. Unauthorized access to the system

B. Integrity of the data

C. Availability of the data

D. Nonrepudiation of the data

E. Unauthorized use of the system

C. Availability of the data

Question 43:

Which of the following is not an organizational challenge when implementing security policies?

A. Accountability

B. Surplus of funding

C. Lack of priority

D. Tight schedules

B. Surplus of funding

Question 44:

Which type of plan is critical to ensuring security awareness reaches specific types of users?

A. Rollout plan

B. Media plan

C. Executive project plan

D. Communications plan

D. Communications plan

Question 45:

What are typical actions involved in crafting documents like security policies, standards, and procedures?

A. Design, development, publication, coding, and testing

B. Feasibility, development, approval, implementation, and integration

C. Initiation, evaluation, development, approval, publication, implementation, and maintenance

D. Design, coding, evaluation, approval, publication, and implementation

C. Initiation, evaluation, development, approval, publication, implementation, and maintenance

Question 46:

Which control type is connected with responding to and resolving a security incident?

A. Deterrent

B. Compensating

C. Corrective

D. Detective

C. Corrective

Question 47:

What are two functions typically performed by a policy change control board?

A. Assesses policies and standards and makes recommendations for change

B. Determines the policy and standards library numbering scheme

C. Implements technical controls as business conditions change

D. Reviews requested changes to the policy framework

A. Assesses policies and standards and makes recommendations

for change

Question 48:

Policies pertaining to information systems security should facilitate corporate operations. The constant protection of system data is the main goal of these policies. This is accomplished by managing several information system components that, at some point, either directly or indirectly impact regular operations. Supporting operations has several benefits, some of which are more common than others. Which of the following ISS policy elements applies to business operations support?

A. Controlling change to the IT infrastructure

B. Protecting data at rest and in transit

C. Protecting systems from the insider threat

D. All are correct

D. All are correct

Question 49:

Which of the following are generally accepted as IA tenets but not ISS tenets?

A. Confidentiality

B. Integrity

C. Availability

D. Authentication

D. Authentication

Question 50:

The challenge lies in implementing and enforcing policies. The biggest hindrance to policy implementation is the

A. Human

B. Efficiency

C. Innovation

D. History

A. Human