ISACA Protection of Information Assets 4

Question 1

Which of the following BEST describes the concept of defense-in-depth?

Accepted Answer

Applying multiple overlapping security controls so that the failure of one does not expose the system

Answer

Defense-in-depth uses multiple layers of security controls so that if one layer fails, others still provide protection.

Question 2

An organization implements multifactor authentication (MFA). Which combination represents true multifactor authentication?

Accepted Answer

A PIN and a smart card

Answer

A PIN (something you know) combined with a smart card (something you have) satisfies two distinct authentication factors.

Question 3

Which of the following BEST describes the role of a Certificate Revocation List (CRL)?

Accepted Answer

A list of digital certificates that have been invalidated before their expiration date

Answer

A CRL is published by a CA to list certificates that have been revoked and should no longer be trusted.

Question 4

Data loss prevention (DLP) tools are PRIMARILY designed to:

Accepted Answer

Detect and prevent unauthorized transmission of sensitive data

Answer

DLP tools inspect data in motion, at rest, and in use to prevent sensitive information from leaving the organization without authorization.

Question 5

Which type of malware disguises itself as legitimate software to trick users into installing it?

Accepted Answer

Trojan horse

Answer

A Trojan horse masquerades as benign or useful software while carrying a malicious payload, tricking users into executing it.

(ISACA) Information Systems Audit and Control Association Certification Practice Test