CA Foundation Business Economics Questions 2023 - Part 32
Fri, 03 Mar 2023
Inspirational journeys
Follow the stories of academics and their research expeditions
CISM—Certified Information Security Manager - Part 127
1. What is the BEST way to ensure users comply with organizational security requirements for password complexity?
A) Include password construction requirements in the security standards
B) Require each user to acknowledge the password requirements
C) Implement strict penalties for user noncompliance
D) Enable system-enforced password configuration
2. Which of the following is the MOST appropriate method for deploying operating system (OS) patches to production application servers?
A) Batch patches into frequent server updates
B) Initially load the patches on a test machine
C) Set up servers to automatically download patches
D) Automatically push all patches to the servers
3. Which of the following would present the GREATEST risk to information security?
A) Virus signature files updates are applied to all servers every day
B) Security access logs are reviewed within five business days
C) Critical patches are applied within 24 hours of their release
D) Security incidents are investigated within five business days
4. The PRIMARY reason for using metrics to evaluate information security is to:
A) identify security weaknesses.
B) justify budgetary expenditures.
C) enable steady improvement.
D) raise awareness on security issues.
5. What is the BEST method to confirm that all firewall rules and router configuration settings are adequate?
A) Periodic review of network configuration
B) Review intrusion detection system (IDS) logs for evidence of attacks
C) Periodically perform penetration tests
D) Daily review of server logs for evidence of hacker activity
A) Include password construction requirements in the security standards
B) Require each user to acknowledge the password requirements
C) Implement strict penalties for user noncompliance
D) Enable system-enforced password configuration
2. Which of the following is the MOST appropriate method for deploying operating system (OS) patches to production application servers?
A) Batch patches into frequent server updates
B) Initially load the patches on a test machine
C) Set up servers to automatically download patches
D) Automatically push all patches to the servers
3. Which of the following would present the GREATEST risk to information security?
A) Virus signature files updates are applied to all servers every day
B) Security access logs are reviewed within five business days
C) Critical patches are applied within 24 hours of their release
D) Security incidents are investigated within five business days
4. The PRIMARY reason for using metrics to evaluate information security is to:
A) identify security weaknesses.
B) justify budgetary expenditures.
C) enable steady improvement.
D) raise awareness on security issues.
5. What is the BEST method to confirm that all firewall rules and router configuration settings are adequate?
A) Periodic review of network configuration
B) Review intrusion detection system (IDS) logs for evidence of attacks
C) Periodically perform penetration tests
D) Daily review of server logs for evidence of hacker activity
1. Right Answer: D
Explanation: Automated controls are generally more effective in preventing improper actions. Policies and standards provide some deterrence, but are not as effective as automated controls.
2. Right Answer: B
Explanation: Some patches can conflict with application code. For this reason, it is very important to first test all patches in a test environment to ensure that there are no conflicts with existing application systems. For this reason, choices C and D are incorrect as they advocate automatic updating. As for frequent server updates, this is an incomplete (vague) answer from the choices given.
3. Right Answer: D
Explanation: Security incidents are configured to capture system events that are important from the security perspective; they include incidents also captured in the security access logs and other monitoring tools. Although, in some instances, they could wait for a few days before they are researched, from the options given this would have the greatest risk to security. Most often, they should be analyzed as soon as possible. Virus signatures should be updated as often as they become available by the vendor, while critical patches should be installed as soon as they are reviewed and tested, which could occur in 24 hours.
4. Right Answer: C
Explanation: The purpose of a metric is to facilitate and track continuous improvement. It will not permit the identification of all security weaknesses. It will raise awareness and help in justifying certain expenditures, but this is not its main purpose.
5. Right Answer: C
Explanation: Due to the complexity of firewall rules and router tables, plus the sheer size of intrusion detection systems (IDSs) and server logs, a physical review will be insufficient. The best approach for confirming the adequacy of these configuration settings is to periodically perform attack and penetration tests.
Explanation: Automated controls are generally more effective in preventing improper actions. Policies and standards provide some deterrence, but are not as effective as automated controls.
2. Right Answer: B
Explanation: Some patches can conflict with application code. For this reason, it is very important to first test all patches in a test environment to ensure that there are no conflicts with existing application systems. For this reason, choices C and D are incorrect as they advocate automatic updating. As for frequent server updates, this is an incomplete (vague) answer from the choices given.
3. Right Answer: D
Explanation: Security incidents are configured to capture system events that are important from the security perspective; they include incidents also captured in the security access logs and other monitoring tools. Although, in some instances, they could wait for a few days before they are researched, from the options given this would have the greatest risk to security. Most often, they should be analyzed as soon as possible. Virus signatures should be updated as often as they become available by the vendor, while critical patches should be installed as soon as they are reviewed and tested, which could occur in 24 hours.
4. Right Answer: C
Explanation: The purpose of a metric is to facilitate and track continuous improvement. It will not permit the identification of all security weaknesses. It will raise awareness and help in justifying certain expenditures, but this is not its main purpose.
5. Right Answer: C
Explanation: Due to the complexity of firewall rules and router tables, plus the sheer size of intrusion detection systems (IDSs) and server logs, a physical review will be insufficient. The best approach for confirming the adequacy of these configuration settings is to periodically perform attack and penetration tests.
Tags:
it certification certified it it exams isaca certification isaca cgeit isaca cisa isaca cism isaca cobit 5 isaca crisc isaca questions practice exams pratice quests risc maangement it management it questions isaca answers isaca practice isaca dumps isaca test test questions questins and answer explanation0 Comments
Categories
Recent posts
CA Foundation Business Economics Questions 2023 - Part 31
Fri, 03 Mar 2023
CA Foundation Business Economics Questions 2023 - Part 30
Fri, 03 Mar 2023
Leave a comment