Information Security Controls Quiz

Play an AI-generated podcast conversation about this lesson

What type of control is a Computer Incident Response Team (CIRT)?

Detection

Response (correct)

Prevention

Protection

What is the primary function of authorization?

Verifying user identities

Scanning for malware

Restricting access to system resources (correct)

Monitoring network traffic

What is the goal of containment in an incident response process?

To recover from the incident

To eradicate the incident

To identify the cause of the incident

To prevent further damage from the incident (correct)

What is the first step in the attack process used by criminals?

Learn as much as possible about the target and its vulnerabilities Signup and view all the answers

What is the primary function of a demilitarized zone (DMZ)?

To provide a separate network for controlled access to internal systems Signup and view all the answers

What is not a basic step in an incident response process?

Patch management Signup and view all the answers

What is the primary purpose of identifying controls in a risk assessment?

To mitigate or reduce risk Signup and view all the answers

A company is considering implementing two control procedures to deal with a identified threat. What should be the primary consideration in deciding which control to implement?

The cost of implementing the control Signup and view all the answers

What is the type of computer attack that encrypts data and demands payment in exchange for the decryption key?

ransomware Signup and view all the answers

What is the concept of defense-in-depth?

Implementing multiple layers of security controls Signup and view all the answers

What is the term for a computer attack that captures data from information items as it travels over networks?

packet sniffers Signup and view all the answers

What is the primary purpose of continuous monitoring?

To detect security incidents Signup and view all the answers

Which type of computer attack steals contact lists, images, and other data using Bluetooth?

bluesnarfing Signup and view all the answers

What is the purpose of verifying the validity of credit or debit card numbers during an online transaction?

preventive controls Signup and view all the answers

What should be the primary concern of information security?

Protecting confidentiality, integrity, and availability of information resources Signup and view all the answers

What is the primary consideration for a managerial concern in information security?

Security policies and procedures Signup and view all the answers

What is the key principle of the COBIT 5 framework?

ensuring an approach where governance is effectively managed Signup and view all the answers

What is the term for a type of attack that takes place when you leave your phone's Bluetooth setting as discoverable and someone takes control of your phone and connects it to the Internet?

bluebugging Signup and view all the answers

What is the purpose of aligning with other standards at a low level?

To create a comprehensive framework for IT governance and management Signup and view all the answers

What is the primary focus of control activities in COSO's internal control model?

Control activities performed at the management level Signup and view all the answers

What is the structure of the ERM model developed by COSO?

A rigid three-dimensional structure with four fixed management objectives Signup and view all the answers

How does the ERM framework compare to the IC framework?

The ERM framework is more comprehensive than the IC framework Signup and view all the answers

Which type of control is superior to others?

There is no superior type of control Signup and view all the answers

What can assist management in reconciling the conflict between creativity and control?

Implementing a belief system that describes how a company creates value Signup and view all the answers

According to best practices, why should emergency changes be documented?

To maintain a record of changes made Signup and view all the answers

What is the purpose of change controls?

To segregate duties and maintain adequate controls Signup and view all the answers

What is the most effective way for a firewall to protect the perimeter?

All of the above are equally effective Signup and view all the answers

What is the primary risk associated with allowing employees to use personal portable devices to access corporate networks?

Employees may not consider security when using their devices Signup and view all the answers

What is the term for modifying default configurations to turn off unnecessary programs and features to improve security?

Hardening Signup and view all the answers

What is the term for a decoy system used to provide early warning that an insider or outsider is attempting to search for confidential information?

Honeypot Signup and view all the answers