Quiz 7 Information Security Fundamentals

Ricky is reviewing security logs to independently assess security controls. Which security review process is Ricky engaging in?

Audit

Which audit data collection method helps ensure that the information-gathering process covers all relevant areas?

Checklist

What information should an auditor share with the client during an exit interview?

Details on major issues - *pg. 228 of textbook*

Curtis is conducting an audit of an identity management system. Which question is NOT likely to be in the scope of his audit?

Does the firewall properly block unsolicited network connection attempts?

A report indicating that a system's disk is 80 percent full is a good indication that something is wrong with that system.

False

An SOC 1 report primarily focuses on security.

False - *pg. 222 of textbook*

During the secure phase of a security review, you review and measure all controls to capture actions and changes on the system.

False - it's *monitor* on *pg. 218 of textbook*

The four main types of logs that you need to keep to support security auditing include event, access, user, and security.

False - it's not user, it should include *event, access, security, and audit*

Regarding log monitoring, false negatives are alerts that seem malicious but are not real security events.

False - *False Positive*

Committee of Sponsoring Organizations (COSO) is a set of best practices for IT management.

False - it's *COBIT*

Anthony is responsible for tuning his organization's intrusion detection system. He notices that the system reports an intrusion alert each time that an administrator connects to a server using Secure Shell (SSH). What type of error is occurring?

False positive error - *pg 232 of textbook*

Isaac is responsible for performing log reviews for his organization in an attempt to identify security issues. He has a massive amount of data to review. What type of tool would best assist him with this work?

Intrusion prevention system (IPS)?? - wrong

Jacob is conducting an audit of the security controls at an organization as an independent reviewer. Which question would NOT be part of his audit?

Is the security control likely to become obsolete in the near future? - *pg. 220 of textbook*

When should an organization's managers have an opportunity to respond to the findings in an audit?

Managers should include their responses to the draft audit report in the final audit report.

Performing security testing includes vulnerability testing and penetration testing.

Performing security testing includes vulnerability testing and penetration testing.

Which regulatory standard would NOT require audits of companies in the United States?

Personal Information Protection and Electronic Documents Act (PIPEDA) - *pg. 221 of textbook*

Christopher is designing a security policy for his organization. He would like to use an approach that allows a reasonable list of activities but does not allow other activities. Which permission level is he planning to use?

Prudent - *pg. 219 of textbook*

Which activity is an auditor least likely to conduct during the information-gathering phase of an audit?

Report writing - *pg. 226 of textbook*

Which intrusion detection system strategy relies upon pattern matching?

Signature detection

What is NOT generally a section in an audit report?

System configurations - *pg. 228 of textbook*

What type of security monitoring tool would be most likely to identify an unauthorized change to a computer system?

System integrity monitoring

An auditing benchmark is the standard by which a system is compared to determine whether it is securely configured.

True

Data loss prevention (DLP) uses business rules to classify sensitive information to prevent unauthorized end users from sharing it.

True

During an audit, an auditor compares the current setting of a computer or device with a benchmark to help identify differences.

True

In security testing, reconnaissance involves reviewing a system to learn as much as possible about the organization, its systems, and its networks.

True

Regarding an intrusion detection system (IDS), stateful matching looks for specific sequences appearing across several packets in a traffic stream rather than justin individual packets.

True

Many jurisdictions require audits by law.

True - *pg. 220 of textbook*

SOC 2 reports are created for internal and other authorized stakeholders and are commonly implemented for service providers, hosted data centers, and managed cloud computing providers.

True