Domain-5 Questions

1.
Hash function will address which of the concerns about electronic message:

A. Message confidentiality
B. Message integrity
C. Message availability.
D. Message compression

2. Digital signature will address which of the concerns about electronic message:
A. Authentication and integrity of data
B. Authentication and confidentiality of data
C. Confidentiality and integrity of data
D. Authentication and availability of data

Digital signature provides integrity, authentication and non-repudiation for electronic message. It does not ensure message confidentiality or availability of data. Digital Signature is created in below two steps:Step 1: Create Hash (Message digest) of the message.Step 2: Encrypt the hash (as derived above) with private key of the sender. 

3.
A digital signature is created by the sender to prove message integrity by :

 A.encrypting the message with the sender's private key. Upon receiving the data, the recipient can decrypt the data using the sender's public key.
B. encrypting the message with the recipient's public key. Upon receiving the data, the recipient can decrypt the data using the recipient's public key.
C. initially using a hashing algorithm to produce a hash value or message digest from the entire message contents. Upon receiving the data, the recipient can independently create it.
D.encrypting the message with the sender's public key. Upon receiving the data, the recipient can decrypt the data using the recipient's private key.

Digital Signature is created in below two steps:Step 1: Create Hash (Message digest) of the message.Step 2: Encrypt the hash (as derived above) with private key of the sender.

4.
Digital signature addresses which of the following concerns about electronic message?
A.


A. Unauthorized archiving
B.


B. Confidentiality
C.


C. Unauthorized copying
D.


D. Alteration

5.
Which of the following is used to address the risk of hash being compromised ?


A. Digital signatures


B. Message encryption


C. Email password

D. Disabling SSID broadcast.

Digital signature is created by encrypting hash of the message. Encrypted hash cannot be altered without knowing public key of sender. 

6.
Digital signature provides which of the following?


A. Non-repudiation, confidentiality and integrity

B. Integrity, privacy and non-repudiation


C. Integrity, authentication and non-repudiation

D. Confidentiality , privacy and non-repudiation

Digital signature provides integrity, authentication and non-repudiation for electronic message. It does not ensure message confidentiality or availability of data.

7.
The MAIN reason for using digital signatures is to ensure data:
A.


A. privacy.
B.


B. integrity.
C.


C. availability.
D.


D. confidentiality

Digital signatures provide integrity because hash of the message changes in case of any unauthorised changes in the data (file, mail, document, etc.) thus ensuring data integrity. 

8.
Which of the following message services provides the strongest evidence that a specific action has occurred?
A. Proof of delivery
B. Non-repudiation
C. Proof of submission
D. Authorization

Non-repudiation is the assurance that someone cannot deny something. Non-repudiation services provide evidence that a specific action occurred Typically, non-repudiation refers to the ability to ensure that a party to a contract or a communication cannot deny the authenticity of their signature on a document or the sending of a message that they originated.. Digital signatures are used to provide non-repudiation. 

9.
Which of the following ensures a sender's authenticity ?

A. Encrypting the hash of the message with the sender's private key

B. Encrypting the message with the receiver's Public key

C. Encrypting the hash of the message with the sender's public


D. Encrypting the message with the receiver's private key

Sender encrypts the hash of the message using his private key. The receiver can decrypt the same with the public key of the sender, ensuring authenticity of the message. If recipient is able to decrypt the message successfully with public key of sender, then it proves authentication i.e message is infact sent from the sender. It ensures non-repudiation i.e sender cannot repudiate having sent the message. 

10.
An organisation states that digital signatures are used when receiving communications from customers. This is done by :


A. A hash of the data that is transmitted and encrypted with the organisation’s private key


B. A hash of the data that is transmitted and encrypted with the customer's private key


C. A hash of the data that is transmitted and encrypted with the customer's public key


D. A hash of the data that is transmitted and encrypted with the organisation's public key

Digital Signature is created in below two steps:Step 1: Create Hash (Message digest) of the message.Step 2: Encrypt the hash (as derived above) with private key of the sender.In above scenario, sender is customer. Hence hash to be encrypted by using customer’s (sender’s) private key. 

11.
Digital signatures helps to:
A.


A. help detect spam.
B.


B. provide confidentiality.
C.


C. add to the workload of gateway servers.
D.


D. decreases available bandwidth.

12.
Basic difference between hashing & encryption is that hashing:
A. cannot be reversed.

B. can be reversed.

C. is concerned with integrity and security.

D. creates output of bigger length than original message. 

Hashing works one way. By applying a hashing algorithm to a message, a message hash/digest is created. If the same hashing algorithm is applied to the message digest, it will not result in the original message. As such, hashing is irreversible, while encryption is reversible. This is the basic difference between hashing and encryption.  

13.
An organization is sharing critical information to vendors through email. Organization can ensure that the recipients of e-mails (i.e vendors) can authenticate the identity of the sender (i.e employees) by:

A. employees digitally signs their email messages.

B. employees encrypting their email messages.

C. employees compressing their email messages.

D. password protecting all e-mail messages. 

By digitally signing all e-mail messages, the receiver will be able to validate the authenticity of the sender. Encrypting all e-mail messages would not ensure the authenticity of the sender . 

14.
Digital signature ensures that the sender cannot later deny generating and sending the message. This is known as:
A.


A. Integrity.
B.


B. authentication.
C.


C. nonrepudiation.
D.


D. security.
15.
In an e-commerce application, which of the following should be rely on to prove that the transactions were actually made?
A.


A. Proof of delivery
B.


B. Authentication
C.


C. Encryption
D.


D. Non-repudiation
16.
Mr. A has sent a message along with encrypted (by A’s private key) hash of the message to Mr. B. This will ensure:
A. authenticity and integrity.
B. authenticity and confidentiality.
C. integrity and privacy.
D. privacy and nonrepudiation. 

Explanation: In the above case, message is not encrypted (only hash is encrypted) and hence it will not ensure privacy or confidentiality. Encryption of the hash will ensure authencity and integrity. 

17.
Digital signatures require the:

A. signer to have a public key of sender and the receiver to have a private key of the sender.
B. signer to have a private key of the sender and the receiver to have a public key of the sender.
C. signer and receiver to have a public key.
D. signer and receiver to have a private key. 


18.
A digital signature contains a hash value (message digest) to:

A. ensure message integrity.

B. define the encryption algorithm.

C. confirm the identity of the originator.

D. compress the message. 

The message digest is calculated and included in a digital signature to prove that the message has not been altered. It should be the same value as a recalculation performed upon receipt. Hence it helps to ensure message integrity. 


19.
Which of the following should be disabled to increase security of wireless network against unauthorized access?

A. MAC (Media Access Control) address filtering

B. Encryption

C. WPA-2 (Wi-Fi Protected Access Protocol)

D. SSID (service set identifier) broadcasting 

A Service Set Identifier (SSID) is the network name broadcasted by a router and it is visible for all wireless devices. When a device searches the area for wireless networks it will detect the SSID. Disabling SSID broadcasting adds security by making it more difficult for unauthorized users to find the network.For better security controls, MAC filtering & WPA-2 should be enabled (and not disabled). 


20.
Which of the following technique is more relevant to test wireless (Wi-Fi) security of an organization?
 
A. WPA-2

B. War dialling

C. War driving

D. Social Engineering

‘War Driving’ technique is used by hacker for unauthorised access to wireless infrastructure. War driving is a technique in which wireless equipped computer is used to locate and gain access to wireless networks. Same is done by driving or walking in and around building. ‘War Driving’ is also used by auditors to test wireless.WPA-2 is an encryption standard and not a technique to test the security.War dialling is a technique for gaining access to a computer or a network through the dialling of defined blocks of telephone numbers. 

Question Set05

(1) When reviewing a digital certificate verification process, which of the following findings represents the MOST significant risk?
A. There is no registration authority (RA) for reporting key compromises.
B. The certificate revocation list (CRL) is not current.
C. Digital certificates contain a public key that is used to encrypt messages and verify digital signatures.
D. Subscribers report key compromises to the certificate authority (CA).


Explanation:
If the certificate revocation list (CRL) is not current, there could be a digital certificate that is not revoked that could be used for unauthorized or fraudulent activities. The certificate authority (CA) can assume the responsibility if there is no registration authority (RA). Digital certificates containing a public key that is used to encrypt messages and verifying digital signatures is not a risk. Subscribers reporting key compromises to the CA is not a risk since reporting this to the CA enables the CA to take appropriate action.
(2) When using a digital signature, the message digest is computed:
A. only by the sender.
B. only by the receiver.
C. by both the sender and the receiver.
D. by the certificate authority (CA).


Explanation:
A digital signature is an electronic identification of a person or entity. It is created by using asymmetric encryption. To verify integrity of data, the sender uses a cryptographic hashing algorithm against the entire message to create a message digest to be sent along with the message. Upon receipt of the message, the receiver will recompute the hash using the same algorithm and compare results with what was sent to ensure the integrity of the message.
(3) Which of the following would effectively verify the originator of a transaction?
A. Using a secret password between the originator and the receiver
B. Encrypting the transaction with the receiver’s public key
C. Using a portable document format (PDF) to encapsulate transaction content
D. Digitally signing the transaction with the source’s private key


Explanation:
A digital signature is an electronic identification of a person, created by using a public key algorithm, to verify to a recipient the identity of the source of a transaction and the integrity of its content. Since they are a ‘shared secret’ between the user and the system itself, passwords are considered a weaker means of authentication. Encrypting the transaction with the recipient’s public key will provide confidentiality for the information, while using a portable document format(PDF) will probe the integrity of the content but not necessarily authorship.
(4) The MOST effective control for addressing the risk of piggybacking is:
A. a single entry point with a receptionist.
B. the use of smart cards.
C. a biometric door lock.
D. adeadman door.


Explanation:
Deadman doors are a system of using a pair of (two) doors. For the second door to operate, the first entry door must close and lock with only one person permitted in the holding areA . This reduces the risk of an unauthorized person following an authorized person through a secured entry (piggybacking). The other choices are all physical controls over entry to a secure area but do not specifically address the risk of piggybacking.
(5) The BEST overall quantitative measure of the performance of biometric control devices is:
A. false-rejection rate.
B. false-acceptance rate.
C. equal-error rate.
D. estimated-error rate.


Explanation:
A low equal-error rate (EER) is a combination of a low false-rejection rate and a low false- acceptance rate. EER, expressed as a percentage, is a measure of the number of times that the false-rejection and false-acceptance rates are equal. A low EERis the measure of the more effective biometrics control device. Low false-rejection rates or low false-acceptance rates alone do not measure the efficiency of the device. Estimated-error rate is nonexistent and therefore irrelevant.
(6) Which of the following is the MOST effective control over visitor access to a data center?
A. Visitors are escorted.
B. Visitor badges are required.
C. Visitors sign in.
D. Visitors are spot-checked by operators.


Explanation:
Escorting visitors will provide the best assurance that visitors have permission to access the data processing facility. Choices B and C are not reliable controls. Choice D is incorrect because visitors should be accompanied at all times while they are on the premises, not only when they are in the data processing facility.
(7) The use of residual biometric information to gain unauthorized access is an example of which of the following attacks?
A. Replay
B. Brute force
C. Cryptographic
D. Mimic


Explanation:
Residual biometric characteristics, such as fingerprints left on a biometric capture device, may be reused by an attacker to gain unauthorized access. A brute force attack involves feeding the biometric capture device numerous different biometric samples. A cryptographic attack targets the algorithm or the encrypted data, in a mimic attack, the attacker reproduces characteristics similar to those of the enrolled user, such as forging a signature or imitating a voice.
(8) A firm is considering using biometric fingerprint identification on all PCs that access critical datA.
This requires:
A. that a registration process is executed for all accredited PC users.
B. the full elimination of the risk of a false acceptance.
C. the usage of the fingerprint reader be accessed by a separate password.
D. assurance that it will be impossible to gain unauthorized access to critical data.


Explanation:
The fingerprints of accredited users need to be read, identified and recorded, i.e., registered, before a user may operate the system from the screened PCs. Choice B is incorrect, as the false- acceptance risk of a biometric device may be optimized, but will never be zero because this would imply an unacceptably high risk of false rejection. Choice C is incorrect, as the fingerprint device reads the token (the user’s fingerprint) and does not need to be protected in itself by a password. Choice Dis incorrect because the usage of biometric protection on PCs does not guarantee that other potential security weaknesses in the system may not be exploited to access protected data.
(9) Which of the following biometrics has the highest reliability and lowest false-acceptance rate (FAR)?
A. Palm scan
B. Face recognition
C. Retina scan
D. Hand geometry


Explanation:
Retina scan uses optical technology to map the capillary pattern of an eye’s retinA . This is highly reliable and has the lowest false-acceptance rate (FAR) among the current biometric methods. Use of palm scanning entails placing a hand on a scannerwhere a palm’s physical characteristics are captured. Hand geometry, one of the oldest techniques, measures the physical characteristics of the user’s hands and fingers from a three dimensional perspective. The palm and hand biometric techniques lackuniqueness in the geometry datA . In face biometrics, a reader analyzes the images captured for general facial characteristics. Though considered a natural and friendly biometric, the main disadvantage of face recognition is the lack of uniqueness, which means that people looking alike can fool the device.
(10) The MOST likely explanation for a successful social engineering attack is:
A. that computers make logic errors.
B. that people make judgment errors.
C. the computer knowledge of the attackers.
D. the technological sophistication of the attack method.

Question Set04

(01) When protecting an organization’s IT systems, which of the following is normally the next line of defense after the network firewall has been compromised?
A. Personal firewall
B. Antivirus programs
C. Intrusion detection system (IDS)
D. Virtual local area network (VLAN) configuration


Explanation:
An intrusion detection system (IDS) would be the next line of defense after the firewall. It would detect anomalies in the network/server activity and try to detect the perpetrator. Antivirus programs, personal firewalls and VI_AN configurations would be later in the line of defense.

(02)

In wireless communication, which of the following controls allows the device receiving the communications to verify that the received communications have not been altered in transit?
A. Device authentication and data origin authentication
B. Wireless intrusion detection (IDS) and prevention systems (IPS)
C. The use of cryptographic hashes
D. Packet headers and trailers


Explanation:
Calculating cryptographic hashes for wireless communications allows the device receiving the communications to verify that the received communications have not been altered in transit. This prevents masquerading and message modification attacks. Device authentication and data origin authentication is not the correct answer since authenticating wireless endpoints to each other prevents man-in-the-middle attacks and masquerading. Wireless iDS / lPSs is not the correct answer since wireless IDS/ lPSshave the ability to detect misconfigured devices and rogue devices, and detect and possibly stop certain types of attacks. Packet headers and trailers alone do not ensure that the content has not been altered.
(03) An organization is planning to replace its wired networks with wireless networks. Which of the following would BEST secure the wireless network from unauthorized access?
A. Implement Wired Equivalent Privacy (WEP)
B. Permit access to only authorized Media Access Control (MAC) addresses
C. Disable open broadcast of service set identifiers (SSID)
D. Implement Wi-Fi Protected Access (WPA) 2


Explanation:
Wi-Fi Protected Access (WPA) 2 implements most of the requirements of the IEEE 802.11i standard. The Advanced Encryption Standard (AESJ used in WPA2 provides better security. Also, WPA2 supports both the Extensible Authentication Protocol and the preshared secret key authentication model. Implementing Wired Equivalent Privacy (WEP) is incorrect since it can be cracked within minutes. WEP uses a static key which has to be communicated to all authorized users, thus management is difficult. Also, there is a greater vulnerability if the static key is not changed at regular intervals. The practice of allowing access based on Media Access Control (MAC) is not a solution since MAC addresses can be spoofed by attackers to gain access to the network. Disabling open broadcast of service set identifiers (SSID) is not the correct answer as they cannot handle access control.
(04) An IS auditor is reviewing a software-based firewall configuration. Which of the following represents the GREATEST vulnerability? The firewall software:
A. is configured with an implicit deny rule as the last rule in the rule base.
B. is installed on an operating system with default settings.
C. has been configured with rules permitting or denying access to systems or networks.
D. is configured as a virtual private network (VPN) endpoint.


Explanation:
Default settings are often published and provide an intruder with predictable configuration information, which allows easier system compromise. To mitigate this risk, firewall software should be installed on a system using a hardened operating system that has limited functionality, providing only the services necessary to support the firewall software. Choices A, C and D are normal or best practices for firewall configurations.
(05) The GREATEST risk posed by an improperly implemented intrusion prevention system (IPS) is:
A. that there will be too many alerts for system administrators to verify.
B. decreased network performance due to IPS traffic.
C. the blocking of critical systems or services due to false triggers.
D. reliance on specialized expertise within the IT organization.


Explanation:
An intrusion prevention system (IPS) prevents a connection or service based on how it is programmed to react to specific incidents. If the packets are coming from a spoofed address and the IPS is triggered based on previously defined behavior, it maybiock the service or connection of a critical internal system. The other choices are risks that are not as severe as blocking critical systems or services due to false triggers.
(06) The MOST effective control for reducing the risk related to phishing is:
A. centralized monitoring of systems.
B. including signatures for phishing in antivirus software.
C. publishing the policy onantiphishing on the intranet.
D. security training for all users.



Explanation:
Phishing is a type of e-mail attack that attempts to convince a user that the originator is genuine, with the intention of obtaining information. Phishing is an example of a social engineering attack. Any social engineering type of attack can best Decontrolled through security and awareness training.

Question Set03

(01)

The network of an organization has been the victim of several intruders’ attacks. Which of the following measures would allow for the early detection of such incidents?
A. Antivirus software
B. Hardening the servers
C. Screening routers
D. Honeypots


Explanation:
Honeypots can collect data on precursors of attacks. Since they serve no business function, honeypots are hosts that have no authorized users other than the honeypot administrators. All activity directed at them is considered suspicious. Attackers will scan and attack honeypots , giving administrators data on new trends and attack tools, particularly malicious code. However, honeypots are a supplement to, not a replacement for, properly securing networks, systems and applications. If honeypots are to be used by an organization, qualified incident handlers and intrusion detection analysts should manage them. The other choices do not provide indications of potential attacks.
 
(02) 
A company has decided to implement an electronic signature scheme based on public key infrastructure. The user’s private key will be stored on the computer’s hard drive and protected by a password. The MOST significant risk of this approach is:
A. use of the user’s electronic signature by another person if the password is compromised.
B. forgery by using another user’s private key to sign a message with an electronic signature.
C. impersonation of a user by substitution of the user’s public key with another person’s public key.
D. forgery by substitution of another person’s private key on the computer.

Explanation:
The user’s digital signature is only protected by a password. Compromise of the password would enable access to the signature. This is the most significant risk. Choice B would require subversion of the public key infrastructure mechanism, which is very difficult and least likely.
Choice C would require that the message appear to have come from a different person and therefore the true user’s credentials would not be forged. Choice D has the same consequence as choice C.
 
(03) 
An IS auditor selects a server for a penetration test that will be carried out by a technical specialist.
Which of the following is MOST important?
A. The tools used to conduct the test
B. Certifications held by the IS auditor
C. Permission from the data owner of the server
D. An intrusion detection system (IDS) is enabled


Explanation:
The data owner should be informed of the risks associated with a penetration test, what types of tests are to be conducted and other relevant details. All other choices are not as important as the data owner’s responsibility for the security of the data assets.
 
(04)
 After observing suspicious activities in a server, a manager requests a forensic analysis. Which of the following findings should be of MOST concern to the investigator?
A.Server is a member of a workgroup and not part of the server domain
B. Guest account is enabled on the server
C. Recently, 100 users were created in the server
D. Audit logs are not enabled for the server


Explanation:
Audit logs can provide evidence which is required to proceed with an investigation and should not be disabled. For business needs, a server can be a member of a workgroup and, therefore, not a concern. Having a guest account enabled on a system is apoor security practice but not a forensic investigation concern. Recently creating 100 users in the server may have been required to meet business needs and should not be a concern.
 
(05) 
Which of the following would be the GREATEST cause for concern when data are sent over the Internet using HTTPS protocol?
A. Presence of spyware in one of the ends
B. The use of a traffic sniffing tool
C. The implementation of an RSA-compliant solution
D. A symmetric cryptography is used for transmitting data


Explanation:
Encryption using secure sockets layer/transport layer security (SSL/TLS) tunnels makes it difficult to intercept data in transit, but when spyware is running on an end user’s computer, data are collected before encryption takes place. The other choices are related to encrypting the traffic, but the presence of spyware in one of the ends captures the data before encryption takes place.
 
(06)
A firewall is being deployed at a new location. Which of the following is the MOST important factor in ensuring a successful deployment?
A. Reviewing logs frequently
B. Testing and validating the rules
C. Training a local administrator at the new location
D. Sharing firewall administrative duties


Explanation:
A mistake in the rule set can render a firewall insecure. Therefore, testing and validating the rules is the most important factor in ensuring a successful deployment. A regular review of log files would not start until the deployment has been completed. Training a local administrator may not be necessary if the firewalls are managed from a central location. Having multiple administrators is a good idea, but not the most important.

(07)
 An IS auditor finds that conference rooms have active network ports. Which of the following is MOST important to ensure?
A. The corporate network is using an intrusion prevention system (IPS)
B. This part of the network is isolated from the corporate network
C. A single sign-on has been implemented in the corporate network
D. Antivirus software is in place to protect the corporate network


Explanation:
If the conference rooms have access to the corporate network, unauthorized users may be able to connect to the corporate network; therefore, both networks should be isolated either via a firewall or being physically separated. An I PS would detect possible attacks, but only after they have occurred. A single sign-on would ease authentication management. Antivirus software would reduce the impact of possible viruses; however, unauthorized users would still be able to access the corporate network, which is the biggest risk.
(08) What is the BEST action to prevent loss of data integrity or confidentiality in the case of an e-commerce application running on a LAN, processing electronic fund transfers (EFT) and orders?
A. Using virtual private network (VPN) tunnels for data transfer
B. Enabling data encryption within the application
C. Auditing the access control to the network
D. Logging all changes to access lists


Explanation:
The best way to ensure confidentiality and integrity of data is to encrypt it using virtual private network (VPN) tunnels. This is the most common and convenient way to encrypt the data traveling over the network. Data encryption within the application is less efficient than VPN. The other options are good practices, but they do not directly prevent the loss of data Integrity and confidentiality during communication through a network.
(09) When conducting a penetration test of an IT system, an organization should be MOST concerned with:
A. the confidentiality of the report.
B. finding all possible weaknesses on the system.
C. restoring all systems to the original state.
D. logging all changes made to the production system.


Explanation:
All suggested items should be considered by the system owner before agreeing to penetration tests, but the most important task is to be able to restore all systems to their original state. Information that is created and/or stored on the tested systems should be removed from these systems. If for some reason, at the end of the penetration test, this is not possible, all files (with their location) should be identified in the technical report so that the client’s technical staff will be able to remove these after the report has been received.
(10) Which of the following penetration tests would MOST effectively evaluate incident handling and response capabilities of an organization?
A. Targeted testing
B. External testing
C. internal testing
D. Double-blind testing


Explanation:
In a double-blind test, the administrator and security staff are not aware of the test, which will result in an assessment of the incident handling and response capability in an organization. In targeted, external, and internal testing, the system administrator and security staff are aware of the tests since they are informed before the start of the tests.

Question Set02

01. 
In transport mode, the use of the Encapsulating Security Payload (ESP) protocol is advantageous over the Authentication Header (AH) protocol because it provides:
A. connectionless integrity.
B. data origin authentication.
C. antireplay service.
D. confidentiality.


Explanation:
Both protocols support choices A, B and C, but only the ESP protocol provides confidentiality via encryption.

02.

An IS auditor notes that IDS log entries related to port scanning are not being analyzed. This lack of analysis will MOST likely increase the risk of success of which of the following attacks?
A. Denial-of-service
B. Replay
C. Social engineering
D. Buffer overflow


Explanation:
Prior to launching a denial-of-service attack, hackers often use automatic port scanning software to acquire information about the subject of their attack. A replay attack is simply sending the same packet again. Social engineering exploits end- uservulnerabilities , and buffer overflow attacks exploit poorly written code.

03. 

Which of the following encryption techniques will BEST protect a wireless network from a man-in- the-middle attack?
A. 128-bit wired equivalent privacy (WEP)
B. MAC-basedpre-sharedkey(PSK)
C. Randomly generated pre-shared key (PSKJ)
D. Alphanumeric service set identifier (SSID)

Explanation:
A randomly generated PSK is stronger than a MAC-based PSK, because the MAC address of a computer is fixed and often accessible. WEP has been shown to be a very weak encryption technique and can be cracked within minutes. The SSID is broadcast on the wireless network in plaintext.
  04.

Which of the following public key infrastructure (PKI) elements provides detailed descriptions for dealing with a compromised private key?
A. Certificate revocation list (CRL)
B. Certification practice statement (CPS)
C. Certificate policy (CP)
D. PKI disclosure statement (PDS)
Explanation:
The CPS is the how-to part in policy-based PKI. The CRL is a list of certificates that have been revoked before their scheduled expiration date. The CP sets the requirements that are subsequently implemented by the CPS. The PDS covers critical items.such as the warranties, limitations and obligations that legally bind each party.

05.

An IS auditor reviewing access controls for a client-server environment should FIRST:
A. evaluate the encryption technique.
B. identify the network access points.
C. review the identity management system.
D. review the application level access controls.


Explanation:
A client-server environment typically contains several access points and utilizes distributed techniques, increasing the risk of unauthorized access to data and processing. To evaluate the security of the client server environment, all network accesspoints should be identified. Evaluating encryption techniques, reviewing the identity management system and reviewing the application level access controls would be performed at a later stage of the review.
 
 6.
To prevent IP spoofing attacks, a firewall should be configured to drop a packet if:
A. the source routing field is enabled.
B. it has a broadcast address in the destination field.
C. a reset flag (RST) is turned on for the TCP connection.
D. dynamic routing is used instead of static routing.


Explanation:
IP spoofing takes advantage of the source-routing option in the IP protocol. With this option enabled, an attacker can insert a spoofed source IP address. The packet will travel the network according to the information within the source-routing field, bypassing the logic in each router, including dynamic and static routing (choice D). Choices B and C do not have any relation to IP spoofing attacks. If a packet has a broadcast destination address (choice B), it will be sent to all addresses in the subnet. Turning on the reset flag (RST) (choice C) is part of the normal procedure to end a TCP connection.

7.

To address a maintenance problem, a vendor needs remote access to a critical network. The MOST secure and effective solution is to provide the vendor with a:
A. Secure Shell (SSH-2) tunnel for the duration of the problem.
B. two-factor authentication mechanism for network access.
C. dial-in access.
D. virtual private network (VPN) account for the duration of the vendor support contract.


Explanation:
For granting temporary access to the network, a Secure Shell (SSH-2) tunnel is the best approach. It has auditing features and allows restriction to specific access points. Choices B, C and D all give full access to the internal network. Two-factor authentication and virtual private network (VPN) provide access to the entire network and are suitable for dedicated users. Dial-in access would need to be closely monitored or reinforced with another mechanism to ensure authentication to achieve thesame level of security as SSH-2.
 
8.
 What is the BEST approach to mitigate the risk of a phishing attack?
A. implement an intrusion detection system (IDS)
B. Assess web site security
C. Strong authentication
D. User education


Explanation:
Phishing attacks can be mounted in various ways; intrusion detection systems (IDSs) and strong authentication cannot mitigate most types of phishing attacks. Assessing web site security does not mitigate the risk. Phishing uses a server masqueradingas a legitimate server. The best way to mitigate the risk of phishing is to educate users to take caution with suspicious internet communications and not to trust them until verified. Users require adequate training to recognize suspicious web pagesand e-mail.
 
9.
 A sender of an e-mail message applies a digital signature to the digest of the message. This action provides assurance of the:
A. date and time stamp of the message.
B. identity of the originating computer.
C. confidentiality of the message’s content.
D. authenticity of the sender.

Explanation:
The signature on the digest can be used to authenticate the sender. It does not provide assurance of the date and time stamp or the identity of the originating computer. Digitally signing an e-mail message does not prevent access to its content and,therefore , does not assure confidentiality.

10.

The BEST filter rule for protecting a network from being used as an amplifier in a denial of service (DoS) attack is to deny all:
A. outgoing traffic with IP source addressesexterna! to the network.
B. incoming traffic with discernible spoofed IP source addresses.
C. incoming traffic with IP options set. D. incoming traffic to critical hosts.

Explanation:
Outgoing traffic with an IP source address different than the IP range in the network is invalid, in most of the cases, it signals a DoS attack originated by an internal user or by a previously compromised internal machine; in both cases, applying this filter will stop the attack.

 

CLARIFICATION ON VULNERABILITY & THREAT:
ONE OF THE FAVORITE AND MOST PREFERRED GAME OF ISACA IS TO GET US CONFUSED BETWEEN THE TERMS ‘VULNERABILITY’ AND ‘THREAT’ DURING CISA EXAMS. LET US UNDERSTAND BASIC DIFFERENCE BETWEEN THE TWO SO THEY CANNOT TRICK US ANYMORE.

WHAT IS A THREAT?
A THREAT IS WHAT WE’RE TRYING TO PROTECT AGAINST.OUR ENEMY COULD BE EARTHQUAKE, FIRE, HACKERS, MALWARE, SYSTEM FAILURE, CRIMINALS AND MANY OTHER UNKNOWN FORCES. THREATS ARE NOT IN OUR CONTROL.

WHAT IS VULNERABILITY?
VULNERABILITY IS A WEAKNESS OR GAP IN OUR PROTECTION EFFORTS. VULNERABILITY CAN BE IN FORM OF WEAK CODING, MISSING ANTI-VIRUS, WEAK ACCESS CONTROL AND OTHER RELATED FACTORS. VULNERABILITIES CAN BE CONTROLLED BY US.
TYPES OF RISK:
INHERENT RISK: THE RISK THAT AN ACTIVITY WOULD POSE IF NO CONTROLS OR OTHER MITIGATING FACTORS WERE IN PLACE (THE GROSS RISK OR RISK BEFORE CONTROLS).
RESIDUAL RISK: THE RISK THAT REMAINS AFTER CONTROLS ARE TAKEN INTO ACCOUNT (THE NET RISK OR RISK AFTER CONTROLS).
DETECTION RISK: RISK THAT THE AUDITORS FAIL TO DETECT A MATERIAL MISSTATEMENT IN THE FINANCIAL STATEMENTS.
CONTROL RISK: RISK THAT A MISSTATEMENT COULD OCCUR BUT MAY NOT BE DETECTED AND CORRECTED OR PREVENTED BY ENTITY’S INTERNAL CONTROL MECHANISM
AUDIT RISK: INHERENT RISK X CONTROL RISK X DETECTION RISKZ

STEPS OF RISK ASSESSMENT:

-First step is to identify the assets. (in some cases critical process)

-Second step is to identify relevant risk. (vulnerability/threat)

-Third step is to do impact analysis. (qualitative or quantitative)

-Fourth step is prioritizing the risk on the basis of impact.

-Fifth step is to evaluate controls.

-Sixth step is to apply appropriate controls.