GBA 6780 - Chapter 7 Quiz
Curtis is conducting an audit of an identity management system. Which question is NOT likely to be in the scope of his audit? -Does the organization have an effective password policy? -Does the firewall properly block unsolicited network connection attempts? -Who grants approval for access requests? -Is the password policy uniformly enforced?
Does the firewall properly block unsolicited network connection attempts?
T/F: A report indicating that a system's disk is 80 percent full is a good indication that something is wrong with that system.
False
T/F: Committee of Sponsoring Organizations (COSO) is a set of best practices for IT management.
False
T/F: Regarding log monitoring, false negatives are alerts that seem malicious but are not real security events.
False
Anthony is responsible for tuning his organization's intrusion detection system. He notices that the system reports an intrusion alert each time that an administrator connects to a server using Secure Shell (SSH). What type of error is occurring? -Remote administration error -False positive error -Clipping error -False negative error
False positive error
When should an organization's managers have an opportunity to respond to the findings in an audit? -Managers should write a report after receiving the final audit report. -Managers should include their responses to the draft audit report in the final audit report. -Managers should not have an opportunity to respond to audit findings. -Managers should write a letter to the Board following receipt of the audit report.
Managers should include their responses to the draft audit report in the final audit report.
Which security testing activity uses tools that scan for services running on systems? -Reconnaissance -Penetration testing -Network mapping -Vulnerability testing
Network mapping
Which regulatory standard would NOT require audits of companies in the United States? -Sarbanes-Oxley Act (SOX) -Personal Information Protection and Electronic Documents Act (PIPEDA) -Health Insurance Portability and Accountability Act (HIPAA) -Payment Card Industry Data Security Standard (PCI DSS)
Personal Information Protection and Electronic Documents Act (PIPEDA)
Christopher is designing a security policy for his organization. He would like to use an approach that allows a reasonable list of activities but does not allow other activities. Which permission level is he planning to use? -Promiscuous -Permissive -Prudent -Paranoid
Prudent
Which activity is an auditor least likely to conduct during the information-gathering phase of an audit? -Vulnerability testing -Report writing -Penetration testing -Configuration review
Report writing
Which item is an auditor least likely to review during a system controls audit? -Resumes of system administrators -Incident records -Application logs -Penetration test results
Resumes of system administrators
Emily is the information security director for a large company that handles sensitive personal information. She is hiring an auditor to conduct an assessment demonstrating that her firm is satisfying requirements regarding customer private data. What type of assessment should she request? -SOC 1 -SOC 2 -SOC 3 -SOC 4
SOC 3
Gina is preparing to monitor network activity using packet sniffing. Which technology is most likely to interfere with this effort if used on the network? -Transmission Control Protocol/Internet Protocol (TCP/IP) -Secure Sockets Layer (SSL) -Domain Name System (DNS) -Dynamic Host Configuration Protocol (DHCP)
Secure Sockets Layer (SSL)
Isaac is responsible for performing log reviews for his organization in an attempt to identify security issues. He has a massive amount of data to review. What type of tool would best assist him with this work? -Security information and event management (SIEM) -Intrusion prevention system (IPS) -Data loss prevention (DLP) -Virtual private network (VPN)
Security information and event management system (SIEM)
Which intrusion detection system strategy relies upon pattern matching? -Behavior detection -Traffic-based detection -Statistical detection -Signature detection
Signature detection
What type of security monitoring tool would be most likely to identify an unauthorized change to a computer system? -Network IDS -System integrity monitoring -CCTV -Data loss prevention
System integrity monitoring
T/F: After audit activities are completed, auditors perform data analysis.
True
Fran is conducting a security test of a new application. She does not have any access to the source code or other details of the application she is testing. What type of test is Fran conducting? -Black-box test -White-box test -Grey-box test -Blue-box test
Black-box test
Which audit data collection method helps ensure that the information-gathering process covers all relevant areas? -Checklist -Interviews -Questionnaires -Observation
Checklist
T/F: An auditing benchmark is the standard by which a system is compared to determine whether it is securely configured
True
