CA Foundation Business Economics Questions 2023 - Part 32
Fri, 03 Mar 2023
Inspirational journeys
Follow the stories of academics and their research expeditions
CISM—Certified Information Security Manager - Part 190
1. Detailed business continuity plans should be based PRIMARILY on:
A) consideration of different alternatives.
B) the solution that is least expensive.
C) strategies that cover all applications.
D) strategies validated by senior management.
2. A web server in a financial institution that has been compromised using a super-user account has been isolated, and proper forensic processes have been followed. The next step should be to:
A) rebuild the server from the last verified backup.
B) place the web server in quarantine.
C) shut down the server in an organized manner.
D) rebuild the server with original media and relevant patches.
3. Evidence from a compromised server has to be acquired for a forensic investigation. What would be the BEST source?
A) A bit-level copy of all hard drive data
B) The last verified backup stored offsite
C) Data from volatile memory
D) Backup servers
4. In the course of responding 10 an information security incident, the BEST way to treat evidence for possible legal action is defined by:
A) international standards.
B) local regulations.
C) generally accepted best practices.
D) organizational security policies.
5. Emergency actions are taken at the early stage of a disaster with the purpose of preventing injuries or loss of life and:
A) determining the extent of property damage.
B) preserving environmental conditions.
C) ensuring orderly plan activation.
D) reducing the extent of operational damage.
A) consideration of different alternatives.
B) the solution that is least expensive.
C) strategies that cover all applications.
D) strategies validated by senior management.
2. A web server in a financial institution that has been compromised using a super-user account has been isolated, and proper forensic processes have been followed. The next step should be to:
A) rebuild the server from the last verified backup.
B) place the web server in quarantine.
C) shut down the server in an organized manner.
D) rebuild the server with original media and relevant patches.
3. Evidence from a compromised server has to be acquired for a forensic investigation. What would be the BEST source?
A) A bit-level copy of all hard drive data
B) The last verified backup stored offsite
C) Data from volatile memory
D) Backup servers
4. In the course of responding 10 an information security incident, the BEST way to treat evidence for possible legal action is defined by:
A) international standards.
B) local regulations.
C) generally accepted best practices.
D) organizational security policies.
5. Emergency actions are taken at the early stage of a disaster with the purpose of preventing injuries or loss of life and:
A) determining the extent of property damage.
B) preserving environmental conditions.
C) ensuring orderly plan activation.
D) reducing the extent of operational damage.
1. Right Answer: D
Explanation: A recovery strategy identifies the best way to recover a system in ease of disaster and provides guidance based on detailed recovery procedures that can be developed. Different strategies should be developed and all alternatives presented to senior management. Senior management should select the most appropriate strategy from the alternatives provided. The selected strategy should be used for further development of the detailed business continuity plan. The selection of strategy depends on criticality of the business process and applications supporting the processes. It need not necessarily cover all applications. All recovery strategies have associated costs, which include costs of preparing for disruptions and putting them to use in the event of a disruption. The latter can be insured against, but not the former. The best recovery option need not be the least expensive.
2. Right Answer: D
Explanation: The original media should be used since one can never be sure of all the changes a super-user may have made nor the timelines in which these changes were made. Rebuilding from the last known verified backup is incorrect since the verified backup may have been compromised by the super-user at a different time.Placing the web server in quarantine should have already occurred in the forensic process. Shut down in an organized manner is out of sequence and no longer a problem. The forensic process is already finished and evidence has already been acquired.
3. Right Answer: A
Explanation: The bit-level copy image file ensures forensic quality evidence that is admissible in a court of law. Choices B and D may not provide forensic quality data for investigative work, while choice C alone may not provide enough evidence.
4. Right Answer: B
Explanation: Legal follow-up will most likely be performed locally where the incident took place; therefore, it is critical that the procedure of treating evidence is in compliance with local regulations. In certain countries, there are strict regulations on what information can be collected. When evidence collected is not in compliance with local regulations, it may not be admissible in court. There are no common regulations to treat computer evidence that are accepted internationally. Generally accepted best practices such as a common chain-of-custody concept may have different implementation in different countries, and thus may not be a good assurance that evidence will be admissible. Local regulations always take precedence over organizational security policies.
5. Right Answer: D
Explanation: During an incident, emergency actions should minimize or eliminate casualties and damage to the business operation, thus reducing business interruptions.Determining the extent of property damage is not the consideration; emergency actions should minimize, not determine, the extent of the damage. Protecting/ preserving environmental conditions may not be relevant. Ensuring orderly plan activation is important but not as critical as reducing damage to the operation.
Explanation: A recovery strategy identifies the best way to recover a system in ease of disaster and provides guidance based on detailed recovery procedures that can be developed. Different strategies should be developed and all alternatives presented to senior management. Senior management should select the most appropriate strategy from the alternatives provided. The selected strategy should be used for further development of the detailed business continuity plan. The selection of strategy depends on criticality of the business process and applications supporting the processes. It need not necessarily cover all applications. All recovery strategies have associated costs, which include costs of preparing for disruptions and putting them to use in the event of a disruption. The latter can be insured against, but not the former. The best recovery option need not be the least expensive.
2. Right Answer: D
Explanation: The original media should be used since one can never be sure of all the changes a super-user may have made nor the timelines in which these changes were made. Rebuilding from the last known verified backup is incorrect since the verified backup may have been compromised by the super-user at a different time.Placing the web server in quarantine should have already occurred in the forensic process. Shut down in an organized manner is out of sequence and no longer a problem. The forensic process is already finished and evidence has already been acquired.
3. Right Answer: A
Explanation: The bit-level copy image file ensures forensic quality evidence that is admissible in a court of law. Choices B and D may not provide forensic quality data for investigative work, while choice C alone may not provide enough evidence.
4. Right Answer: B
Explanation: Legal follow-up will most likely be performed locally where the incident took place; therefore, it is critical that the procedure of treating evidence is in compliance with local regulations. In certain countries, there are strict regulations on what information can be collected. When evidence collected is not in compliance with local regulations, it may not be admissible in court. There are no common regulations to treat computer evidence that are accepted internationally. Generally accepted best practices such as a common chain-of-custody concept may have different implementation in different countries, and thus may not be a good assurance that evidence will be admissible. Local regulations always take precedence over organizational security policies.
5. Right Answer: D
Explanation: During an incident, emergency actions should minimize or eliminate casualties and damage to the business operation, thus reducing business interruptions.Determining the extent of property damage is not the consideration; emergency actions should minimize, not determine, the extent of the damage. Protecting/ preserving environmental conditions may not be relevant. Ensuring orderly plan activation is important but not as critical as reducing damage to the operation.
Tags:
it certification certified it it exams isaca certification isaca cgeit isaca cisa isaca cism isaca cobit 5 isaca crisc isaca questions practice exams pratice quests risc maangement it management it questions isaca answers isaca practice isaca dumps isaca test test questions questins and answer explanation0 Comments
Categories
Recent posts
CA Foundation Business Economics Questions 2023 - Part 31
Fri, 03 Mar 2023
CA Foundation Business Economics Questions 2023 - Part 30
Fri, 03 Mar 2023
Leave a comment