(CISM) General Flashcards

For a significant proposed purchase and new procedure for an organization, a risk assessment and business impact analysis (BIA) have been finished. The business department manager and the information security manager debate about who will be in charge of assessing the outcomes and identified risks. Which of the following would be the information security manager's BEST course of action?

Answer: Review of the risk assessment with executive management for final input

Executive management will be in the best position to consider the big picture and the trade-offs between security and functionality in the entire organization.

Who is responsible for making sure that data is categorized and that particular security precautions are taken?

Answer: Senior Management

Routine administration of all aspects of security is delegated, but top management must retain overall accountability.

Unusual server communication between internal and external parties may be observed to:

Answer: Record the trace of advanced persistent threats

The most important feature of target attacks as seen in advanced persistent threats is that malware secretly sends information back to a command and control server. Therefore, monitoring of outbound server communications that do not follow predefined routes will be the best control to detect such security events.

What authentication technique stops authentication replay?

Answer: Challenge/response mechanism

A challenge/response mechanism defeats replay attacks because the server issues a unique, one-time challenge each session, so a captured response is useless the next time. Password hashes, HTTP basic auth, and WEP all rely on static or reusable secrets that an attacker can intercept and replay.

IT risk management initiatives are MOST successful when they:

Answer: Integrated within business processes

IT risk management is most successful when integrated within business processes, because the people who own the processes have the context and authority to make risk decisions that stick. Keeping it confined to the IT department or treating it as a separate process isolates it from where risk actually occurs, and merely communicating it to employees doesn't embed it into operations.

Which of the following is the BEST technique to catch an intruder who breaks into a network without doing any damage?

Answer: Install a honeypot on the network

A honeypot is the best tool to catch a non-destructive intruder because it's a decoy system designed to lure and observe attackers while keeping real assets safe. Baselines, penetration testing, and default settings are preventive or assessment measures—they don't actively detect or study an intruder already moving inside the network.

Which of the following poses the BIGGEST risk to an enterprise resource planning (ERP) system's security?

Answer: Operating system security patches have not been applied

Missing operating system security patches pose the biggest risk because every application, including the ERP, depends on the OS layer, so an unpatched OS exposes the widest attack surface. A single switch, unlogged ad hoc reporting, and default database settings are concerns but far narrower in scope than a vulnerable underlying operating system.