ISACA Protection of Information Assets 5

Question 1

Which of the following cloud deployment models gives an organization the MOST control over its security configurations?

Accepted Answer

Private cloud

Answer

A private cloud is dedicated to a single organization, giving it full control over security configurations, policies, and infrastructure.

Question 2

An IS auditor reviewing an organization's key management practices should verify that cryptographic keys are:

Accepted Answer

Generated using approved algorithms and protected throughout their lifecycle

Answer

Effective key management requires keys to be generated with approved algorithms and protected (encrypted, access-controlled) across their entire lifecycle.

Question 3

Which of the following BEST describes a man-in-the-middle (MITM) attack?

Accepted Answer

An attacker secretly intercepts and potentially alters communications between two parties

Answer

In a MITM attack, the attacker secretly positions themselves between two communicating parties to intercept, read, or modify data.

Question 4

Which of the following is the MOST important consideration when implementing a data classification scheme?

Accepted Answer

Controls applied to data must be commensurate with the value and sensitivity of the data

Answer

Security controls should be proportional to the value and sensitivity of the data to balance protection costs with the actual risk.

Question 5

A port scan reveals that TCP port 23 is open on a server. What risk does this MOST likely indicate?

Accepted Answer

Telnet is running, transmitting credentials in plaintext

Answer

TCP port 23 is the default port for Telnet, which transmits all data including passwords in cleartext, posing a significant confidentiality risk.

(ISACA) Information Systems Audit and Control Association Certification Practice Test

(ISACA) Information Systems Audit and Control Association Certification Practice Test

ISACA Protection of Information Assets 5