Info security chapter 7

Which regulatory standard would NOT require audits of companies in the United States?

Personal Info protection and electronic documents act (PIPEDA)

Which audit data collection method helps ensure that the information-gathering process covers all relevant areas?

checklist

What is a set of concepts and policies for managing IT infrastructure, development, and operations?

IT infrastructure library (ITIL)

Christopher is designing a security policy for his organization. He would like to use an approach that allows a reasonable list of activities but does not allow other activities. Which permission level is he planning to use?

Prudent

Emily is the information security director for a large company that handles sensitive personal information. She is hiring an auditor to conduct an assessment demonstrating that her firm is satisfying requirements regarding customer private data. What type of assessment should she request?

SOC 3

Fran is conducting a security test of a new application. She does not have any access to the source code or other details of the application she is testing. What type of test is Fran conducting?

black-box test

What information should an auditor share with the client during an exit interview?

details on major issues

Jacob is conducting an audit of the security controls at an organization as an independent reviewer. Which question would NOT be part of his audit?

is the security control likely to become obsolete in the near future?

Which security testing activity uses tools that scan for services running on systems?

network mapping

Which item is an auditor least likely to review during a system controls audit?

resumes of system administrators

When should an organization's managers have an opportunity to respond to the findings in an audit?

managers should include their responses to the draft audit report in the final audit report

Which activity is an auditor least likely to conduct during the information-gathering phase of an audit?

report writing

Gina is preparing to monitor network activity using packet sniffing. Which technology is most likely to interfere with this effort if used on the network?

secure socket layer (SSL)

Isaac is responsible for performing log reviews for his organization in an attempt to identify security issues. He has a massive amount of data to review. What type of tool would best assist him with this work?

security info and event management (SIEM)

Which intrusion detection system strategy relies upon pattern matching?

signature detection

What type of security monitoring tool would be most likely to identify an unauthorized change to a computer system?

system integrity monitoring

Ricky is reviewing security logs to independently assess security controls. Which security review process is Ricky engaging in?

audit