CA Foundation Business Economics Questions 2023 - Part 32
Fri, 03 Mar 2023
Inspirational journeys
Follow the stories of academics and their research expeditions
CISA—Certified Information Systems Auditor - Part 307
1. A data center has a badge-entry system. Which of the following is MOST important to protect the computing assets in the center?
A) Badge readers are installed in locations where tampering would be noticed
B) The computer that controls the badge system is backed up frequently
C) A process for promptly deactivating lost or stolen badges exists
D) All badge entry attempts are logged
2. Which of the following physical access controls effectively reduces the risk of piggybacking?
A) Biometric door locks
B) Combination door locks
C) Deadman doors
D) Bolting door locks
3. The MOST effective biometric control system is the one:
A) which has the highest equal-error rate (EER).
B) which has the lowest EER.
C) for which the false-rejection rate (FRR) is equal to the false-acceptance rate (FAR).
D) for which the FRR is equal to the failure-to-enroll rate (FER).
4. Which of the following is the BEST way to satisfy a two-factor user authentication?
A) A smart card requiring the user's PIN
B) User ID along with password
C) Iris scanning plus fingerprint scanning
D) A magnetic card requiring the user's PIN
5. What should an organization do before providing an external agency physical access to its information processing facilities (IPFs)?
A) The processes of the external agency should be subjected to an IS audit by an independent agency.
B) Employees of the external agency should be trained on the security procedures of the organization.
C) Any access by an external agency should be limited to the demilitarized zone (DMZ).
D) The organization should conduct a risk assessment and design and implement appropriate controls.
A) Badge readers are installed in locations where tampering would be noticed
B) The computer that controls the badge system is backed up frequently
C) A process for promptly deactivating lost or stolen badges exists
D) All badge entry attempts are logged
2. Which of the following physical access controls effectively reduces the risk of piggybacking?
A) Biometric door locks
B) Combination door locks
C) Deadman doors
D) Bolting door locks
3. The MOST effective biometric control system is the one:
A) which has the highest equal-error rate (EER).
B) which has the lowest EER.
C) for which the false-rejection rate (FRR) is equal to the false-acceptance rate (FAR).
D) for which the FRR is equal to the failure-to-enroll rate (FER).
4. Which of the following is the BEST way to satisfy a two-factor user authentication?
A) A smart card requiring the user's PIN
B) User ID along with password
C) Iris scanning plus fingerprint scanning
D) A magnetic card requiring the user's PIN
5. What should an organization do before providing an external agency physical access to its information processing facilities (IPFs)?
A) The processes of the external agency should be subjected to an IS audit by an independent agency.
B) Employees of the external agency should be trained on the security procedures of the organization.
C) Any access by an external agency should be limited to the demilitarized zone (DMZ).
D) The organization should conduct a risk assessment and design and implement appropriate controls.
1. Right Answer: C
Explanation: Tampering with a badge reader cannot open the door, so this is irrelevant. Logging the entry attempts may be of limited value. The biggest risk is from unauthorized individuals who can enter the data center, whether they are employees or not. Thus, a process of deactivating lost or stolen badges is important. The configuration of the system does not change frequently, therefore frequent backup is not necessary.
2. Right Answer: C
Explanation: Deadman doors use a pair of doors. For the second door to operate, the first entry door must close and lock with only one person permitted in the holding areA.This effectively reduces the risk of piggybacking. An individual's unique body features such as voice, retina, fingerprint or signature activate biometric door locks; however, they do not prevent or reduce the risk of piggybacking. Combination door locks, also known as cipher locks, use a numeric key pad or dial to gain entry.They do not prevent or reduce the risk of piggybacking since unauthorized individuals may still gain access to the processing center. Bolting door locks require the traditional metal key to gain entry. Unauthorized individuals could still gain access to the processing center along with an authorized individual.
3. Right Answer: B
Explanation: The equal-error rate (EER) of a biometric system denotes the percent at which the false- acceptance rate (FAR) is equal to the false-rejection rate (FRR). The biometric that has the lowest EER is the most effective. The biometric that has the highest EER is the most ineffective. For any biometric, there will be a measure at which the FRR will be equal to the FAR. This is the EER. FER is an aggregate measure of FRR.
4. Right Answer: A
Explanation: A smart card addresses what the user has. This is generally used in conjunction with testing what the user knows, e.g., a keyboard password or personal identification number (PIN). An ID and password, what the user knows, is a single-factor user authentication. Choice C is not a two- factor user authentication because it is only biometric. Choice D is similar to choice A, but the magnetic card may be copied; therefore, choice A is the best way to satisfy a two-factor user authentication.
5. Right Answer: D
Explanation: Physical access of information processing facilities (IPFs) by an external agency introduces additional threats into an organization. Therefore, a risk assessment should be conducted and controls designed accordingly. The processes of the external agency are not of concern here. It is the agency's interaction with the organization that needs to be protected. Auditing their processes would not be relevant in this scenario. Training the employees of the external agency may be one control procedure, but could be performed after access has been granted. Sometimes an external agency may require access to the processing facilities beyond the demilitarized zone (DMZ). For example, an agency which undertakes maintenance of servers may require access to the main server room. Restricting access within the DMZ will not serve the purpose.
Explanation: Tampering with a badge reader cannot open the door, so this is irrelevant. Logging the entry attempts may be of limited value. The biggest risk is from unauthorized individuals who can enter the data center, whether they are employees or not. Thus, a process of deactivating lost or stolen badges is important. The configuration of the system does not change frequently, therefore frequent backup is not necessary.
2. Right Answer: C
Explanation: Deadman doors use a pair of doors. For the second door to operate, the first entry door must close and lock with only one person permitted in the holding areA.This effectively reduces the risk of piggybacking. An individual's unique body features such as voice, retina, fingerprint or signature activate biometric door locks; however, they do not prevent or reduce the risk of piggybacking. Combination door locks, also known as cipher locks, use a numeric key pad or dial to gain entry.They do not prevent or reduce the risk of piggybacking since unauthorized individuals may still gain access to the processing center. Bolting door locks require the traditional metal key to gain entry. Unauthorized individuals could still gain access to the processing center along with an authorized individual.
3. Right Answer: B
Explanation: The equal-error rate (EER) of a biometric system denotes the percent at which the false- acceptance rate (FAR) is equal to the false-rejection rate (FRR). The biometric that has the lowest EER is the most effective. The biometric that has the highest EER is the most ineffective. For any biometric, there will be a measure at which the FRR will be equal to the FAR. This is the EER. FER is an aggregate measure of FRR.
4. Right Answer: A
Explanation: A smart card addresses what the user has. This is generally used in conjunction with testing what the user knows, e.g., a keyboard password or personal identification number (PIN). An ID and password, what the user knows, is a single-factor user authentication. Choice C is not a two- factor user authentication because it is only biometric. Choice D is similar to choice A, but the magnetic card may be copied; therefore, choice A is the best way to satisfy a two-factor user authentication.
5. Right Answer: D
Explanation: Physical access of information processing facilities (IPFs) by an external agency introduces additional threats into an organization. Therefore, a risk assessment should be conducted and controls designed accordingly. The processes of the external agency are not of concern here. It is the agency's interaction with the organization that needs to be protected. Auditing their processes would not be relevant in this scenario. Training the employees of the external agency may be one control procedure, but could be performed after access has been granted. Sometimes an external agency may require access to the processing facilities beyond the demilitarized zone (DMZ). For example, an agency which undertakes maintenance of servers may require access to the main server room. Restricting access within the DMZ will not serve the purpose.
Tags:
it certification certified it it exams isaca certification isaca cgeit isaca cisa isaca cism isaca cobit 5 isaca crisc isaca questions practice exams pratice quests risc maangement it management it questions isaca answers isaca practice isaca dumps isaca test test questions questins and answer explanation0 Comments
Categories
Recent posts
CA Foundation Business Economics Questions 2023 - Part 31
Fri, 03 Mar 2023
CA Foundation Business Economics Questions 2023 - Part 30
Fri, 03 Mar 2023
Leave a comment