Question 1

Which of the following best describes the 'Security' principle in the Trust Services Framework?

Accepted Answer

Controlling and restricting access to the system and data to legitimate users.

Question 2

According to the time-based model of information security, security is considered effective if:

Accepted Answer

$$ P \u003e D + C $$

Question 3

Which of the following is NOT a preventive control for mitigating the risk of attack?

Accepted Answer

Log analysis

Question 4

A company wants to verify the identity of users before granting access to its system. Which of the following is NOT a method of authentication?

Accepted Answer

Authorization matrix

Question 5

Which control is designed to detect attacks by analyzing logs of network traffic permitted to pass the firewall?

Accepted Answer

Intrusion Detection System (IDS)

Question 6

A company implements a honeypot in its network. What is the primary purpose of this control?

Accepted Answer

To provide early warning that an insider or outsider is attempting to search for confidential information.

Question 7

Which of the following is a responsibility of the Computer Incident Response Team (CIRT)?

Accepted Answer

Responding to attacks against the organization's information system.

Question 8

Which of the following is a potential negative impact of virtualization and cloud computing on information security?

Accepted Answer

Risk of theft or destruction if unsupervised physical access occurs.

Question 9

A company is considering the implementation of multifactor authentication. Which combination below best represents multifactor authentication?

Accepted Answer

Smart card and password

Question 10

Which process ensures that modifications to hardware, software, or processes do not reduce systems reliability?

Accepted Answer

Change control and change management

Question 11

An organization wants to ensure that only authorized personnel can access sensitive data. Which Trust Services Principle does this most directly relate to?

Accepted Answer

Confidentiality

Question 12

Which of the following is an example of a detective control?

Accepted Answer

Continuous monitoring

Question 13

A company is attacked and the time to break through preventive controls is 10 minutes, the time to detect the attack is 8 minutes, and the time to respond is 3 minutes. According to the time-based model, is the security effective?

Accepted Answer

No, because $$ P \u003c D + C $$ ($$ 10 \u003c 11 )$$

Question 14

Which of the following is NOT a key component of the security life cycle?

Accepted Answer

Perform financial audits

Question 15

Which control would be most effective in preventing unauthorized entry into a company's data center?

Accepted Answer

Physical security access controls

Question 16

Which of the following best describes the role of senior management in information security?

Accepted Answer

Senior management involvement and support is essential throughout all phases of the security life cycle.

Question 17

Which of the following is an example of a preventive IT solution?

Accepted Answer

Antimalware controls

Question 18

A company wants to ensure that data are processed accurately, completely, and in a timely manner. Which Trust Services Principle is this?

Accepted Answer

Processing integrity

Question 19

Which of the following is a detective control that can provide early warning of an insider attempting to access confidential information?

Accepted Answer

Honeypot

Question 20

Which of the following is a key risk associated with cloud computing?

Accepted Answer

Unsupervised physical access leading to theft or destruction

Controls for Information Security: Trust Services Framework and Security in Accounting Information Systems

Study Guide - Practice Questions

Study Guide - Flashcards