IGP Technology & Information Security 2 — Questions and Answers
Question 1: Which encryption standard is currently recommended by NIST for protecting sensitive US government data at rest?
- 3DES with 168-bit keys
- AES-256 (Correct answer)
- RC4 with 128-bit keys
- Blowfish with 256-bit keys
Correct answer: AES-256
NIST recommends AES-256 for protecting sensitive government data at rest, as 3DES is deprecated and RC4/Blowfish are not approved for federal use.
Question 2: In information governance, what does a Data Loss Prevention (DLP) system primarily do?
- Backs up data to offsite locations
- Monitors and restricts unauthorized transfer of sensitive data (Correct answer)
- Encrypts data stored on endpoints
- Scans for malware on corporate networks
Correct answer: Monitors and restricts unauthorized transfer of sensitive data
DLP systems detect and prevent unauthorized transmission or exfiltration of sensitive information across network, endpoint, and cloud channels.
Question 3: What is the primary purpose of a Security Information and Event Management (SIEM) system?
- Automatically patch vulnerabilities on servers
- Aggregate and correlate security logs for threat detection (Correct answer)
- Encrypt emails sent between employees
- Manage user identity provisioning
Correct answer: Aggregate and correlate security logs for threat detection
SIEM systems collect, aggregate, and correlate security event logs from multiple sources to enable real-time threat detection and incident response.
Question 4: An organization wants to ensure that only authorized users access specific cloud resources. Which control best enforces this at the identity layer?
- Network firewall rules
- Role-Based Access Control (RBAC) (Correct answer)
- Intrusion detection signatures
- SSL/TLS certificates
Correct answer: Role-Based Access Control (RBAC)
RBAC restricts cloud resource access based on users' assigned roles, ensuring only authorized individuals can access specific resources.
Question 5: Which concept describes the practice of granting users only the minimum access rights necessary to perform their job functions?
- Separation of duties
- Least privilege (Correct answer)
- Need to know
- Defense in depth
Correct answer: Least privilege
The principle of least privilege limits user permissions to the minimum required for their role, reducing the attack surface if credentials are compromised.
Question 6: When classifying information in an IG program, which factor is MOST important when determining security controls?
- The file format of the document
- The sensitivity and criticality of the information (Correct answer)
- The size of the data set
- The age of the information
Correct answer: The sensitivity and criticality of the information
Security controls in an IG program are driven by the sensitivity (confidentiality) and criticality (availability/integrity) of the information, not its format or size.
Question 7: What is the key difference between a vulnerability assessment and a penetration test?
- A vulnerability assessment exploits flaws while a penetration test only identifies them
- A vulnerability assessment identifies weaknesses while a penetration test actively exploits them (Correct answer)
- Penetration tests are automated and vulnerability assessments are manual
- Vulnerability assessments are performed by vendors and penetration tests by internal staff
Correct answer: A vulnerability assessment identifies weaknesses while a penetration test actively exploits them
Vulnerability assessments identify and rank security weaknesses, while penetration tests go further by actively attempting to exploit those weaknesses to demonstrate real impact.
IGP Technology & Information Security 2
Which encryption standard is currently recommended by NIST for protecting sensitive US government data at rest?