ISACA Protection of Information Assets 2 — Questions and Answers
Question 1: Which encryption mode is most appropriate for encrypting large amounts of data where parallel processing is desired?
- Electronic Codebook (ECB)
- Cipher Block Chaining (CBC)
- Counter (CTR) (Correct answer)
- Output Feedback (OFB)
Correct answer: Counter (CTR)
Counter (CTR) mode allows parallel encryption and decryption of blocks, making it ideal for large data sets.
Question 2: A data owner is PRIMARILY responsible for which of the following?
- Implementing technical security controls
- Classifying data and defining access rules (Correct answer)
- Monitoring network traffic for anomalies
- Patching vulnerabilities in systems storing the data
Correct answer: Classifying data and defining access rules
The data owner is accountable for classifying information and establishing appropriate access control policies.
Question 3: Which of the following BEST describes a rainbow table attack?
- Brute-force guessing every possible password
- Using precomputed hash values to reverse password hashes (Correct answer)
- Intercepting credentials during network transmission
- Exploiting weak random number generators in hash algorithms
Correct answer: Using precomputed hash values to reverse password hashes
A rainbow table attack uses precomputed tables of hash values to quickly reverse hashed passwords.
Question 4: An organization wants to ensure that sensitive data cannot be recovered after hard drive disposal. Which method provides the STRONGEST assurance?
- Logical formatting of the drive
- Overwriting with a single pass of zeros
- Degaussing the magnetic media
- Physical destruction of the drive (Correct answer)
Correct answer: Physical destruction of the drive
Physical destruction (shredding, crushing) provides the strongest assurance that data cannot be recovered from disposed media.
Question 5: Which access control model assigns permissions based on the sensitivity label of information and the security clearance of users?
- Discretionary Access Control (DAC)
- Role-Based Access Control (RBAC)
- Mandatory Access Control (MAC) (Correct answer)
- Attribute-Based Access Control (ABAC)
Correct answer: Mandatory Access Control (MAC)
Mandatory Access Control (MAC) uses security labels and clearances to govern access, and is common in government/military environments.
Question 6: A security information and event management (SIEM) system is PRIMARILY used to:
- Prevent malware from executing on endpoints
- Aggregate and correlate security events for real-time analysis (Correct answer)
- Encrypt data stored in databases
- Scan networks for open vulnerabilities
Correct answer: Aggregate and correlate security events for real-time analysis
SIEM systems collect, aggregate, and correlate log and event data from multiple sources to detect and alert on security incidents.
Question 7: Which of the following is the MOST effective control to prevent unauthorized changes to firewall rule sets?
- Regular vulnerability scanning of the firewall
- Change management process with mandatory peer review (Correct answer)
- Intrusion detection monitoring at the firewall
- Automatic firewall rule expiration policies
Correct answer: Change management process with mandatory peer review
A formal change management process with peer review ensures firewall changes are authorized, tested, and documented before implementation.
ISACA Protection of Information Assets 2
Which encryption mode is most appropriate for encrypting large amounts of data where parallel processing is desired?