ISACA Protection of Information Assets 3 — Questions and Answers
Question 1: Which of the following BEST describes the purpose of a digital certificate?
- Encrypting data transmitted between two parties
- Binding a public key to an authenticated identity (Correct answer)
- Generating one-time passwords for authentication
- Storing private keys in a secure repository
Correct answer: Binding a public key to an authenticated identity
A digital certificate binds a public key to a verified identity, enabling trust in public key infrastructure (PKI).
Question 2: An IS auditor discovers that developers have direct access to the production environment. What is the PRIMARY risk?
- Increased software licensing costs
- Unauthorized or untested changes may be introduced into production (Correct answer)
- Developers may be exposed to sensitive business data
- Application performance may degrade due to developer testing
Correct answer: Unauthorized or untested changes may be introduced into production
Developer access to production violates segregation of duties and could allow unauthorized, untested changes that impact integrity and availability.
Question 3: What is the PRIMARY purpose of a honeypot in an information security architecture?
- Encrypting sensitive data to prevent unauthorized access
- Detecting and studying attacker techniques by luring them to a decoy system (Correct answer)
- Filtering malicious traffic before it reaches production systems
- Storing backup copies of critical data in an isolated environment
Correct answer: Detecting and studying attacker techniques by luring them to a decoy system
A honeypot is a decoy system designed to attract and observe attackers, providing intelligence on their techniques and intent.
Question 4: During a penetration test, the tester has full knowledge of the system architecture and source code. This approach is called:
- Black-box testing
- Gray-box testing
- White-box testing (Correct answer)
- Red team testing
Correct answer: White-box testing
White-box (or crystal-box) testing gives the tester complete knowledge of the internal system, enabling thorough coverage of the codebase.
Question 5: Which of the following network segmentation techniques BEST isolates a web-facing server from internal corporate resources?
- VPN tunneling between segments
- Placing the server in a DMZ (demilitarized zone) (Correct answer)
- Using a host-based firewall on the server
- Deploying an intrusion prevention system on the server
Correct answer: Placing the server in a DMZ (demilitarized zone)
A DMZ isolates public-facing servers from internal networks using firewalls, limiting the blast radius of a compromise.
Question 6: Which of the following is an example of a compensating control when segregation of duties cannot be fully implemented?
- Disabling all user access until the conflict is resolved
- Implementing enhanced logging and supervisory review of transactions (Correct answer)
- Requiring dual signatures on all system configurations
- Outsourcing the conflicting functions to a third party
Correct answer: Implementing enhanced logging and supervisory review of transactions
Enhanced logging and supervisory review acts as a compensating control by increasing the likelihood that unauthorized activity will be detected.
Question 7: A vulnerability assessment differs from a penetration test in that a vulnerability assessment:
- Requires explicit written authorization from system owners
- Identifies and reports weaknesses without actively exploiting them (Correct answer)
- Is performed only by external third-party security firms
- Simulates a full attack chain to achieve a specific objective
Correct answer: Identifies and reports weaknesses without actively exploiting them
A vulnerability assessment identifies and classifies security weaknesses, while a penetration test actively exploits them to demonstrate real-world impact.
ISACA Protection of Information Assets 3
Which of the following BEST describes the purpose of a digital certificate?