Thẻ ghi nhớ: IAP301 - RE - SU 2023

Question 1:

is a separate platform used to collect logs from platforms throughout the network.

A. Keylogger software

B. Log server

C. SQL injection

D. SCADA (Supervisory Control and Data Acquisition) system

E. None of the mentioned

B. Log server

Question 2:

A change agent typically will

(i) ensure current processes are working.

(ii) ensure application code changes are well understood

(iii) challenge whether a company's existing processes represent the best approach

A. (i)

B. (ii)

C. (iii)

D. All of the mentioned

E. None of the mentioned

C. (iii)

Question 3:

In the context of workstation central management systems,

refers to tracking what workstation and related network devices exist.

A. inventory management

B. patch management

C. security management

D. discovery management

E. help desk management

F. log management

D. discovery management

Question 4:

Any product of human intellect that is unique and not obvious with some value in the marketi

A. 3D printers

B. laptops

C. IP (intellectual property)

D. IP (internet proxy)

E. None of the mentioned

C. IP (intellectual property)

Question 5:

A DMZ separates a LAN from

A. Phone network

B. Internet

C. Cellular network

D. VoIP Network

E. None of the mentioned

B. Internet

Question 6:

To get employees to comply and accept security policies, the organization must understand the employees' motivations or needs.

A. True

B. False

A. True

Question 7:

is a formal process that controls changes to systems. It ensures changes have minir operations.

A. Change management

B. CM (Configuration Management)

C. CMDB (Configuration Management Database)

D. FDCC (Federal Desktop Core Configuration)

E. None of the mentioned

A. Change management

Question 8:

Generally, having five to 10 data classifications works best to cover all the possible data needs of an organization.

A. True

B. False

B. False

Question 9:

refers to a role that deals with all aspects of information such as security, quality, de availability; responsible for data quality.

A. Layered security approach

B. Head of information management

C. SOD (Separation of Duties)

D. Value delivery

E. None of the mentioned

B. Head of information management

Question 10:

A BIA is not required when creating a BCP.

A. True

B. False

B. False

Question 11:

A firewall is generally considered an example of a(n) control.

A. preventive

B. correlative

C. associative

D. corrective

E. None of the mentioned

A. preventive

Question 12:

is a strong indicator that awareness training is NOT effective.

A. A firewall breach

B. Sharing your password with a supervisor

C. Sharing a laptop with a coworker

D. A fire in the data center

E. None of the mentioned

B. Sharing your password with a supervisor

Question 13:

is a framework that aligns strategic goals, operations effectiveness, reporting, and cor objectives; not technology specific.

A. COSO (Committee of Sponsoring Organizations)

B. COBIT (Control Objectives for Information and related Technology)

C. ERM (Enterprise Risk Management)

D. OCTAVE (Operationally Critical Threat, Asset, and Vulnerability Evaluation)

E. None of the mentioned

A. COSO (Committee of Sponsoring Organizations)

Question 14:

A CISO must escalate risks if the business unit is not responsive.

A. True

B. False

A. True

Question 15:

is the software that runs applications (operating system), or software that allows a co communicate over a network.

(i) Application software

(ii) System software

(iii) Both (i) and (ii)

A. (i)

B. (ii)

C. (iii)

D. None of the mentioned

B. (ii)

Question 16:

It's easier to quantify leading practices than best practices.

A. True

B. False

B. False

Question 17:

is NOT an access control.

A. Authentication

B. Authorization

C. Decryption

D. Logging

E. None of the mentioned

C. Decryption

Question 18:

is a policy that discusses what is acceptable when using the company email system

A. System access policy

B. Clean desk policy

C. Privacy policy

D. Walk out policy

E. E-mail policy

E. E-mail policy

Question 19:

Which departments should review policies and standards before official approval? (Choose 4 answers)

A. Technical

B. Legal

C. HR

D. Maintenance

E. Audit

A. Technical, B. Legal, C. HR, E. Audit

Question 20:

When creating laws and regulations, the government's sole concern is the privacy of the indi

A. True

B. False

B. False

Question 21:

is an example of a manual control.

(i) Background checks

(ii) Authentication

(iii) Access rights reviews

A. (i)

B. (ii)

C. (iii)

D. (i) and (iii)

E. All of the mentioned

D. (i) and (iii)

Question 22:

Public relations IRT member is responsible for handling the media.

A. True

B. False

A. True

Question 23:

is the act of protecting information systems or IT infrastructures from unauthorized us disruption, or destruction.

A. IA (Information Assurance)

B. ISS (Information Systems Security)

C. ISS management life cycle

D. Policy

E. None of the mentioned

B. ISS (Information Systems Security)

Question 24:

All incidents regardless of how small should be handled by an incident response team.

A. True

B. False

B. False

Question 25:

Implementation and enforcement of policies is a challenge. The biggest hindrance to implem policies is the factor.

A. human

B. machine

C. computer

D. environmental

E. None of the mentioned

A. human

Question 26:

is a deviation from a centrally supported and approved IT security standard and can because of a lack of preparedness by the organization to comply with a standard or due to th technology that has not been sanctioned by the standards.

A. Compliance

B. Exception

C. InfoSec Program Charter

D. IT Policy Framework

E. None of the mentioned

B. Exception

Question 27:

is a logical structure that is established to organize policy documentation into grouping categories that make it easier for employees to find and understand the contents of various p documents.

A. Compliance

B. Exception

C. InfoSec Program Charter

D. IT Policy Framework

E. None of the mentioned

D. IT Policy Framework

Question 28:

is a set of standards and technologies used to query and manage systems and appli network. It is used on the Internet and on internal networks.

A. SNMP (Simple Network Management Protocol)

B. WBEM (Web-Based Enterprise Management)

C. SCAP (Security Content Automation Protocol)

D. WMI (Windows Management Instrumentation)

E. None of the mentioned

B. WBEM (Web-Based Enterprise Management)

Question 29:

is a domain in the ISACA Risk IT framework that ensures that risk management acti business goals, objectives, and tolerances.

A. Risk appetite

B. Risk Evaluation

C. Risk Governance

D. Risk Response

E. None of the mentioned

C. Risk Governance

Question 30:

is a domain in the ISACA Risk IT framework that ensures that risk management acti business goals, objectives, and tolerances.

A. Risk appetite

B. Risk Evaluation

C. Risk Governance

D. Risk Response

E. None of the mentioned

C. Risk Governance