CA Foundation Business Economics Questions 2023 - Part 32
Fri, 03 Mar 2023
1. The PRIMARY reason for involving information security at each stage in the systems development life cycle (SDLC) is to identify the security implications and potential solutions required for:
A) identifying vulnerabilities in the system.
B) sustaining the organization's security posture.
C) the existing systems that will be affected.
D) complying with segregation of duties.
2. The implementation of continuous monitoring controls is the BEST option where:
A) incidents may have a high impact and frequency
B) legislation requires strong information security controls
C) incidents may have a high impact but low frequency
D) Electronic commerce is a primary business driver
3. A third party was engaged to develop a business application. Which of the following would an information security manager BEST test for the existence of back doors?
A) System monitoring for traffic on network ports
B) Security code reviews for the entire application
C) Reverse engineering the application binaries
D) Running the application from a high-privileged account on a test system
4. An information security manager reviewing firewall rules will be MOST concerned if the firewall allows:
A) source routing.
B) broadcast propagation.
C) unregistered ports.
D) nonstandard protocols.
5. What is the MOS T cost-effective means of improving security awareness of staff personnel?
A) Employee monetary incentives
B) User education and training
C) A zero-tolerance security policy
D) Reporting of security infractions
A) identifying vulnerabilities in the system.
B) sustaining the organization's security posture.
C) the existing systems that will be affected.
D) complying with segregation of duties.
2. The implementation of continuous monitoring controls is the BEST option where:
A) incidents may have a high impact and frequency
B) legislation requires strong information security controls
C) incidents may have a high impact but low frequency
D) Electronic commerce is a primary business driver
3. A third party was engaged to develop a business application. Which of the following would an information security manager BEST test for the existence of back doors?
A) System monitoring for traffic on network ports
B) Security code reviews for the entire application
C) Reverse engineering the application binaries
D) Running the application from a high-privileged account on a test system
4. An information security manager reviewing firewall rules will be MOST concerned if the firewall allows:
A) source routing.
B) broadcast propagation.
C) unregistered ports.
D) nonstandard protocols.
5. What is the MOS T cost-effective means of improving security awareness of staff personnel?
A) Employee monetary incentives
B) User education and training
C) A zero-tolerance security policy
D) Reporting of security infractions
1. Right Answer: B
Explanation: It is important to maintain the organization's security posture at all times. The focus should not be confined to the new system being developed or acquired, or to the existing systems in use. Segregation of duties is only part of a solution to improving the security of the systems, not the primary reason to involve security in the systems development life cycle (SDLC).
2. Right Answer: A
Explanation: Continuous monitoring control initiatives are expensive, so they have to be used in areas where the risk is at its greatest level. These areas are the ones with high impact and high frequency of occurrence. Regulations and legislations that require tight IT security measures focus on requiring organizations to establish an IT security governance structure that manages IT security with a risk-based approach, so each organization decides which kinds of controls are implemented.Continuous monitoring is not necessarily a requirement. Measures such as contingency planning are commonly used when incidents rarely happen but have a high impact each time they happen. Continuous monitoring is unlikely to be necessary. Continuous control monitoring initiatives are not needed in all electronic commerce environments. There are some electronic commerce environments where the impact of incidents is not high enough to support the implementation of this kind of initiative.
3. Right Answer: B
Explanation: Security' code reviews for the entire application is the best measure and will involve reviewing the entire source code to detect all instances of back doors. System monitoring for traffic on network ports would not be able to detect all instances of back doors and is time consuming and would take a lot of effort. Reverse engineering the application binaries may not provide any definite clues. Back doors will not surface by running the application on high-privileged accounts since back doors are usually hidden accounts in the applications.
4. Right Answer: A
Explanation: If the firewall allows source routing, any outsider can carry out spoofing attacks by stealing the internal (private) IP addresses of the organization. Broadcast propagation, unregistered ports and nonstandard protocols do not create a significant security exposure.
5. Right Answer: B
Explanation: User education and training is the most cost-effective means of influencing staff to improve security since personnel are the weakest link in security. Incentives perform poorly without user education and training. A zero-tolerance security policy would not be as good as education and training. Users would not have the knowledge to accurately interpret and report violations without user education and training.
Explanation: It is important to maintain the organization's security posture at all times. The focus should not be confined to the new system being developed or acquired, or to the existing systems in use. Segregation of duties is only part of a solution to improving the security of the systems, not the primary reason to involve security in the systems development life cycle (SDLC).
2. Right Answer: A
Explanation: Continuous monitoring control initiatives are expensive, so they have to be used in areas where the risk is at its greatest level. These areas are the ones with high impact and high frequency of occurrence. Regulations and legislations that require tight IT security measures focus on requiring organizations to establish an IT security governance structure that manages IT security with a risk-based approach, so each organization decides which kinds of controls are implemented.Continuous monitoring is not necessarily a requirement. Measures such as contingency planning are commonly used when incidents rarely happen but have a high impact each time they happen. Continuous monitoring is unlikely to be necessary. Continuous control monitoring initiatives are not needed in all electronic commerce environments. There are some electronic commerce environments where the impact of incidents is not high enough to support the implementation of this kind of initiative.
3. Right Answer: B
Explanation: Security' code reviews for the entire application is the best measure and will involve reviewing the entire source code to detect all instances of back doors. System monitoring for traffic on network ports would not be able to detect all instances of back doors and is time consuming and would take a lot of effort. Reverse engineering the application binaries may not provide any definite clues. Back doors will not surface by running the application on high-privileged accounts since back doors are usually hidden accounts in the applications.
4. Right Answer: A
Explanation: If the firewall allows source routing, any outsider can carry out spoofing attacks by stealing the internal (private) IP addresses of the organization. Broadcast propagation, unregistered ports and nonstandard protocols do not create a significant security exposure.
5. Right Answer: B
Explanation: User education and training is the most cost-effective means of influencing staff to improve security since personnel are the weakest link in security. Incentives perform poorly without user education and training. A zero-tolerance security policy would not be as good as education and training. Users would not have the knowledge to accurately interpret and report violations without user education and training.
0 Comments
Leave a comment
Categories
Recent posts
CA Foundation Business Economics Questions 2023 - Part 31
Fri, 03 Mar 2023
CA Foundation Business Economics Questions 2023 - Part 30
Fri, 03 Mar 2023
