CISA - 5

After identifying potential security vulnerabilities, what should be the IS auditor's next step?

• To evaluate potential countermeasures and compensatory controls

• To implement effective countermeasures and compensatory controls

• To perform a business impact analysis of the threats that would exploit

  the vulnerabilities

• To immediately advise senior management of the findings

Which of the following is the BEST method for preventing the leakage of confidential information from a laptop computer?

• Encrypt the hard disk with the owner's public key

• Enable the boot password (hardware-based password)

• Use a biometric authentication device

• Use two-factor authentication to logon to the notebook

The MOST important difference between hashing and encryption is that hashing:

• Is irreversible

• Output is the same length as the original message

• Is concerned with integrity and security

• Is the same at the sending and receiving end

Which of the following cryptography options would increase overhead/cost?

• A use of symmetric encryption keys instead of asymmetric

• A use of long asymmetric encryption keys

• The hash is encrypted rather than the message

• A use of secret key

Which of the following would be of the MOST concern to an IS auditor reviewing a virtual private network (VPN) implementation? Computers on the network are located:

• On the enterprise internal network

• At the backup site

• In employees' homes

• At the enterprise's remote offices

The PRIMARY reason for using digital signatures is to ensure data:

• Confidentiality

• Integritiy

• Availability

• Timeliness

Which of the following is an example of a passive attack initiated through the Internet?

• Traffic analysis

• Masquerading

• Denial of service

• E-mail spoofing

What method might ISauditor utilize to test wireless security at branch office locations?

• War dialing

• social engineering

• war driving

• password cracking

Which of the following physical access controls effectively reduces the risk of piggybacking?

• Biometric door locks

• Combination door locks

• Deadman doors

• Bolting door locks

The MOST effective biometric control system is the one:

• Which has the highest equal-error rate (EER)

• Which has the lowest (EER)

• For which the false-rejection rate (FRR) is equal to the false-

  acceptance rate (FAR

• For which the FRR is equal to the failure-to-enroll rate (FER)