(81) The purpose of a deadman
door controlling access to a computer facility is primarily to:
A. prevent
piggybacking.
B. prevent toxic gases from entering
the data center.
C. starve a fire of oxygen
D. prevent an excessively rapid entry
to, or exit from, the facility.
Explanation:
The purpose of a deadman door controlling access to a computer facility is primarily intended to prevent piggybacking. Choices B and C could be accomplished with a single self-closing door. Choice D is invalid, as a rapid exit may be necessary in some circumstances, e.g., a fire.
The purpose of a deadman door controlling access to a computer facility is primarily intended to prevent piggybacking. Choices B and C could be accomplished with a single self-closing door. Choice D is invalid, as a rapid exit may be necessary in some circumstances, e.g., a fire.
(82) Which of the following is
the MOST reliable form of single factor personal identification?
A. Smart card
B. Password
C. Photo identification
D. iris
scan
Explanation:
Since no two irises are alike, identification and verification can be done with confidence. There is no guarantee that a smart card is being used by the correct person since it can be shared, stolen or lost and found. Passwords can be shared and, if written down, carry the risk of discovery. Photo IDs can be forged or falsified.
Since no two irises are alike, identification and verification can be done with confidence. There is no guarantee that a smart card is being used by the correct person since it can be shared, stolen or lost and found. Passwords can be shared and, if written down, carry the risk of discovery. Photo IDs can be forged or falsified.
(83) A data center has a
badge-entry system. Which of the following is MOST important to protect the computing
assets in the center?
A. Badge readers are installed in
locations where tampering would be noticed
B. The computer that controls the badge
system is backed up frequently
C. A
process for promptly deactivating lost or stolen badges exists
D. All badge entry attempts are logged
Explanation:
Tampering with a badge reader cannot open the door, so this is irrelevant. Logging the entry attempts may be of limited value. The biggest risk is from unauthorized individuals who can enter the data center, whether they are employees or not. Thus, a process of deactivating lost or stolen badges is important. The configuration of the system does not change frequently, therefore frequent backup is not necessary.
Tampering with a badge reader cannot open the door, so this is irrelevant. Logging the entry attempts may be of limited value. The biggest risk is from unauthorized individuals who can enter the data center, whether they are employees or not. Thus, a process of deactivating lost or stolen badges is important. The configuration of the system does not change frequently, therefore frequent backup is not necessary.
(84) Which of the following
physical access controls effectively reduces the risk of piggybacking?
A. Biometric door locks
B. Combination door locks
C. Deadman
doors
D. Bolting door locks
Explanation:
Deadman doors use a pair of doors. For the second door to operate, the first entry door must close and lock with only one person permitted in the holding areA . This effectively reduces the risk of piggybacking. An individual’s unique body features such as voice, retina, fingerprint or signature activate biometric door locks; however, they do not prevent or reduce the risk of piggybacking. Combination door locks, also known as cipher locks, use a numeric key pad or dial to gain entry. They do notprevent or reduce the risk of piggybacking since unauthorized individuals may still gain access to the processing center. Bolting door locks require the traditional metal key to gain entry. Unauthorized individuals could still gain access to the processing center along with an authorized individual.
Deadman doors use a pair of doors. For the second door to operate, the first entry door must close and lock with only one person permitted in the holding areA . This effectively reduces the risk of piggybacking. An individual’s unique body features such as voice, retina, fingerprint or signature activate biometric door locks; however, they do not prevent or reduce the risk of piggybacking. Combination door locks, also known as cipher locks, use a numeric key pad or dial to gain entry. They do notprevent or reduce the risk of piggybacking since unauthorized individuals may still gain access to the processing center. Bolting door locks require the traditional metal key to gain entry. Unauthorized individuals could still gain access to the processing center along with an authorized individual.
(85) The MOST effective
biometric control system is the one:
A. which has the highest equal-error
rate (EER).
B. which
has the lowest EER.
C. for which the false-rejection rate
(FRR) is equal to the false-acceptance rate (FAR).
D. for which the FRR is equal to the
failure-to-enroll rate (FER).
Explanation:
The equal-error rate (EER) of a biometric system denotes the percent at which the false- acceptance rate (FAR) is equal to the false-rejection rate (FRR). The biometric that has the lowest EER is the most effective. The biometric that has the highestEER is the most ineffective. For any biometric, there will be a measure at which the FRR will be equal to the FAR. This is the EER.
FER is an aggregate measure of FRR.
The equal-error rate (EER) of a biometric system denotes the percent at which the false- acceptance rate (FAR) is equal to the false-rejection rate (FRR). The biometric that has the lowest EER is the most effective. The biometric that has the highestEER is the most ineffective. For any biometric, there will be a measure at which the FRR will be equal to the FAR. This is the EER.
FER is an aggregate measure of FRR.
(86) Which of the following is
the BEST way to satisfy a two-factor user authentication?
A. A
smart card requiring the user’s PIN
B. User ID along with password
C. Iris scanning plus fingerprint
scanning
D. A magnetic card requiring the user’s
PIN
Explanation:
A smart card addresses what the user has. This is generally used in conjunction with testing what the user knows, e.g., a keyboard password or personal identification number (PIN). An ID and password, what the user knows, is a single-factor user authentication. Choice C is not a two-factor user authentication because it is only biometric. Choice D is similar to choice A, but the magnetic card may be copied; therefore, choice A is the best way to satisfy a two-factor user authentication.
A smart card addresses what the user has. This is generally used in conjunction with testing what the user knows, e.g., a keyboard password or personal identification number (PIN). An ID and password, what the user knows, is a single-factor user authentication. Choice C is not a two-factor user authentication because it is only biometric. Choice D is similar to choice A, but the magnetic card may be copied; therefore, choice A is the best way to satisfy a two-factor user authentication.
(87) What should an
organization do before providing an external agency physical access to its
information processing facilities (IPFs)?
A. The processes of the external agency
should be subjected to an IS audit by an independent agency.
B. Employees of the external agency
should be trained on the security procedures of the organization.
C. Any access by an external agency
should be limited to the demilitarized zone (DMZ).
D. The
organization should conduct a risk assessment and design and implement
appropriate controls.
Explanation:
Physical access of information processing facilities (IPFs) by an external agency introduces additional threats into an organization. Therefore, a risk assessment should be conducted and controls designed accordingly. The processes of the external agency are not of concern here. It is the agency’s interaction with the organization that needs to be protected. Auditing their processes would not be relevant in this scenario. Training the employees of the external agency may be one control procedure, but could be performed after access has been granted. Sometimes an external agency may require access to the processing facilities beyond the demilitarized zone (DMZ). For example, an agency which undertakes maintenance of servers may require access to the main
server room. Restricting access within the DMZ will not serve the purpose.
Physical access of information processing facilities (IPFs) by an external agency introduces additional threats into an organization. Therefore, a risk assessment should be conducted and controls designed accordingly. The processes of the external agency are not of concern here. It is the agency’s interaction with the organization that needs to be protected. Auditing their processes would not be relevant in this scenario. Training the employees of the external agency may be one control procedure, but could be performed after access has been granted. Sometimes an external agency may require access to the processing facilities beyond the demilitarized zone (DMZ). For example, an agency which undertakes maintenance of servers may require access to the main
server room. Restricting access within the DMZ will not serve the purpose.
(88) An IS auditor is reviewing
the physical security measures of an organization. Regarding the access card
system, the IS auditor should be MOST concerned that:
A. nonpersonalized
access cards are given to the cleaning staff, who use a sign-in sheet but show
no proof of identity.
B. access cards are not labeled with
the organization’s name and address to facilitate easy return of a lost card.
C. card issuance and rights
administration for the cards are done by different departments, causing
unnecessary lead time for new cards.
D. the computer system used for
programming the cards can only be replaced after three weeks in the event of a
system failure.
Explanation:
Physical security is meant to control who is entering a secured area, so identification of all individuals is of utmost importance. It is not adequateto trust unknown external people by allowing them to write down their alleged name without proof, e.g., identity card, driver’s license. Choice B is not a concern because if the name and address of the organization was written on the card, a malicious finder could use the card to enter the organization’s premises. Separating card issuance from technical rights management is a method to ensure a proper segregation of duties so that no single person can produce a functioning card for a restrictedarea within the organization’s premises. Choices B and C are good practices, not concerns. Choice D may be a concern, but not as important since a system failure of the card programming device would normally not mean that the readers do not functionanymore . It simply means that no new cards can be issued, so this option is minor compared to the threat of improper identification.
Physical security is meant to control who is entering a secured area, so identification of all individuals is of utmost importance. It is not adequateto trust unknown external people by allowing them to write down their alleged name without proof, e.g., identity card, driver’s license. Choice B is not a concern because if the name and address of the organization was written on the card, a malicious finder could use the card to enter the organization’s premises. Separating card issuance from technical rights management is a method to ensure a proper segregation of duties so that no single person can produce a functioning card for a restrictedarea within the organization’s premises. Choices B and C are good practices, not concerns. Choice D may be a concern, but not as important since a system failure of the card programming device would normally not mean that the readers do not functionanymore . It simply means that no new cards can be issued, so this option is minor compared to the threat of improper identification.
(89) Which of the following is
the BEST way to handle obsolete magnetic tapes before disposing of them?
A. Overwriting the tapes
B. initializing the tape labels
C. Degaussing
the tapes
D. Erasing the tapes
Explanation:
The best way to handle obsolete magnetic tapes is to degauss them. This action leaves a very low residue of magnetic induction, essentially erasing the data from the tapes. Overwriting or erasing the tapes may cause magnetic errors but would not remove the data completely. Initializing the tape labels would not remove the data that follows the label.
The best way to handle obsolete magnetic tapes is to degauss them. This action leaves a very low residue of magnetic induction, essentially erasing the data from the tapes. Overwriting or erasing the tapes may cause magnetic errors but would not remove the data completely. Initializing the tape labels would not remove the data that follows the label.
(90) Which of the following is the
MOST important objective of data protection?
A. identifying persons who need access
to information
B. Ensuring
the integrity of information
C. Denying or authorizing access to the
IS system
D. Monitoring logical accesses
Explanation:
Maintaining data integrity is the most important objective of data security. This is a necessity if an organization is to continue as a viable and successful enterprise. The other choices are important techniques for achieving the objective of data integrity.
Maintaining data integrity is the most important objective of data security. This is a necessity if an organization is to continue as a viable and successful enterprise. The other choices are important techniques for achieving the objective of data integrity.
- Muhammad Idham Azhari
No comments:
Post a Comment