ISACA Protection of Information Assets 3

Question 1

Which of the following BEST describes the purpose of a digital certificate?

Accepted Answer

Binding a public key to an authenticated identity

Answer

A digital certificate binds a public key to a verified identity, enabling trust in public key infrastructure (PKI).

Question 2

An IS auditor discovers that developers have direct access to the production environment. What is the PRIMARY risk?

Accepted Answer

Unauthorized or untested changes may be introduced into production

Answer

Developer access to production violates segregation of duties and could allow unauthorized, untested changes that impact integrity and availability.

Question 3

What is the PRIMARY purpose of a honeypot in an information security architecture?

Accepted Answer

Detecting and studying attacker techniques by luring them to a decoy system

Answer

A honeypot is a decoy system designed to attract and observe attackers, providing intelligence on their techniques and intent.

Question 4

During a penetration test, the tester has full knowledge of the system architecture and source code. This approach is called:

Accepted Answer

White-box testing

Answer

White-box (or crystal-box) testing gives the tester complete knowledge of the internal system, enabling thorough coverage of the codebase.

Question 5

Which of the following network segmentation techniques BEST isolates a web-facing server from internal corporate resources?

Accepted Answer

Placing the server in a DMZ (demilitarized zone)

Answer

A DMZ isolates public-facing servers from internal networks using firewalls, limiting the blast radius of a compromise.

(ISACA) Information Systems Audit and Control Association Certification Practice Test