CA Foundation Business Economics Questions 2023 - Part 32
Fri, 03 Mar 2023
Inspirational journeys
Follow the stories of academics and their research expeditions
CISA—Certified Information Systems Auditor - Part 269
1. An organization has been recently downsized, in light of this, an IS auditor decides to test logical access controls. The IS auditor's PRIMARY concern should be that:
A) all system access is authorized and appropriate for an individual's role and responsibilities.
B) management has authorized appropriate access for all newly-hired individuals.
C) only the system administrator has authority to grant or modify access to individuals.
D) access authorization forms are used to grant or modify access to individuals.
2. The logical exposure associated with the use of a checkpoint restart procedure is:
A) denial of service.
B) an asynchronous attack
C) wire tapping.
D) computer shutdown.
3. Inadequate programming and coding practices introduce the risk of:
A) phishing.
B) buffer overflow exploitation.
C) SYN flood.
D) brute force attacks.
4. Which of the following would prevent unauthorized changes to information stored in a server's log?
A) Write-protecting the directory containing the system log
B) Writing a duplicate log to another server
C) Daily printing of the system log
D) Storing the system log in write-once media
5. After reviewing its business processes, a large organization is deploying a new web application based on a VoIP technology. Which of the following is the MOST appropriate approach for implementing access control that will facilitate security management of the VoIP web application?
A) Fine-grained access control
B) Role-based access control (RBAC)
C) Access control lists
D) Network/service access control
A) all system access is authorized and appropriate for an individual's role and responsibilities.
B) management has authorized appropriate access for all newly-hired individuals.
C) only the system administrator has authority to grant or modify access to individuals.
D) access authorization forms are used to grant or modify access to individuals.
2. The logical exposure associated with the use of a checkpoint restart procedure is:
A) denial of service.
B) an asynchronous attack
C) wire tapping.
D) computer shutdown.
3. Inadequate programming and coding practices introduce the risk of:
A) phishing.
B) buffer overflow exploitation.
C) SYN flood.
D) brute force attacks.
4. Which of the following would prevent unauthorized changes to information stored in a server's log?
A) Write-protecting the directory containing the system log
B) Writing a duplicate log to another server
C) Daily printing of the system log
D) Storing the system log in write-once media
5. After reviewing its business processes, a large organization is deploying a new web application based on a VoIP technology. Which of the following is the MOST appropriate approach for implementing access control that will facilitate security management of the VoIP web application?
A) Fine-grained access control
B) Role-based access control (RBAC)
C) Access control lists
D) Network/service access control
1. Right Answer: A
Explanation: The downsizing of an organization implies a large number of personnel actions over a relatively short period of time. Employees can be assigned new duties while retaining some or all of their former duties. Numerous employees may be laid off. The auditor should be concerned that an appropriate segregation of duties is maintained, that access is limited to what is required for an employee's role and responsibilities, and that access is revoked for those that are no longer employed by the organization. Choices B, C and D are all potential concerns of an IS auditor, but in light of the particular risks associated with a downsizing, should not be the primary concern.
2. Right Answer: B
Explanation: Asynchronous attacks are operating system-based attacks. A checkpoint restart is a feature that stops a program at specified intermediate points for later restart in an orderly manner without losing data at the checkpoint. The operating system saves a copy of the computer programs and data in their current state as well as several system parameters describing the mode and security level of the program at the time of stoppage. An asynchronous attack occurs when an individual with access to this information is able to gain access to the checkpoint restart copy of the system parameters and change those parameters such that upon restart the program would function at a higher-priority security level.
3. Right Answer: B
Explanation: Buffer overflow exploitation may occur when programs do not check the length of the data that are input into a program. An attacker can send data that exceed the length of a buffer and override part of the program with malicious code. The countermeasure is proper programming and good coding practices. Phishing, SYN flood and brute force attacks happen independently of programming and coding practices.
4. Right Answer: D
Explanation: Storing the system log in write-once media ensures the log cannot be modified. Write- protecting the system log does not prevent deletion or modification, since the superuser or users that have special permission can override the write protection. Writing a duplicate log to another server or daily printing of the system log cannot prevent unauthorized changes.
5. Right Answer: B
Explanation: Authorization in this VoIP case can best be addressed by role-based access control (RBAC) technology. RBAC is easy to manage and can enforce strong and efficient access controls in large-scale web environments including VoIP implementation. Access control lists and fine- grained access control on VoIP web applications do not scale to enterprise wide systems, because they are primarily based on individual user identities and their specific technical privileges. Network/ service addresses VoIP availability but does not address application-level access or authorization.
Explanation: The downsizing of an organization implies a large number of personnel actions over a relatively short period of time. Employees can be assigned new duties while retaining some or all of their former duties. Numerous employees may be laid off. The auditor should be concerned that an appropriate segregation of duties is maintained, that access is limited to what is required for an employee's role and responsibilities, and that access is revoked for those that are no longer employed by the organization. Choices B, C and D are all potential concerns of an IS auditor, but in light of the particular risks associated with a downsizing, should not be the primary concern.
2. Right Answer: B
Explanation: Asynchronous attacks are operating system-based attacks. A checkpoint restart is a feature that stops a program at specified intermediate points for later restart in an orderly manner without losing data at the checkpoint. The operating system saves a copy of the computer programs and data in their current state as well as several system parameters describing the mode and security level of the program at the time of stoppage. An asynchronous attack occurs when an individual with access to this information is able to gain access to the checkpoint restart copy of the system parameters and change those parameters such that upon restart the program would function at a higher-priority security level.
3. Right Answer: B
Explanation: Buffer overflow exploitation may occur when programs do not check the length of the data that are input into a program. An attacker can send data that exceed the length of a buffer and override part of the program with malicious code. The countermeasure is proper programming and good coding practices. Phishing, SYN flood and brute force attacks happen independently of programming and coding practices.
4. Right Answer: D
Explanation: Storing the system log in write-once media ensures the log cannot be modified. Write- protecting the system log does not prevent deletion or modification, since the superuser or users that have special permission can override the write protection. Writing a duplicate log to another server or daily printing of the system log cannot prevent unauthorized changes.
5. Right Answer: B
Explanation: Authorization in this VoIP case can best be addressed by role-based access control (RBAC) technology. RBAC is easy to manage and can enforce strong and efficient access controls in large-scale web environments including VoIP implementation. Access control lists and fine- grained access control on VoIP web applications do not scale to enterprise wide systems, because they are primarily based on individual user identities and their specific technical privileges. Network/ service addresses VoIP availability but does not address application-level access or authorization.
Tags:
it certification certified it it exams isaca certification isaca cgeit isaca cisa isaca cism isaca cobit 5 isaca crisc isaca questions practice exams pratice quests risc maangement it management it questions isaca answers isaca practice isaca dumps isaca test test questions questins and answer explanation0 Comments
Categories
Recent posts
CA Foundation Business Economics Questions 2023 - Part 31
Fri, 03 Mar 2023
CA Foundation Business Economics Questions 2023 - Part 30
Fri, 03 Mar 2023
Leave a comment