Scenario Based Lead Auditor Day#1

Which option below presents a vulnerability in Webos’s client system?

• The updated version of the software

• The database encryption problems

• The maternity leave of the software development team leader

Answer explanation

Webos’s client was vulnerable to external attacks due to serious flaws in the system and encryption, authentication, and other database problems, which are classified as vulnerabilities of a system.

Webos’s project failed due to the lack of segregation of duties during the maternity leave of the software development team leader. Which of the following is a threat that can impact Webos in this situation?

• Failure to produce management reports

• Insufficient software testing

• Unauthorized use of the system

Answer explanation

The first two options reflect weaknesses in the company’s procedures. As such, they represent vulnerabilities. Unauthorized use of the system, on the other hand, is a threat that the company can face in such situations.

Webos conducted technical investigations after its partners reported security incidents. What is the aim of implementing this security control?

• To control software operations

• To report the occurrence of an error or omission

• To correct the problems and prevent their recurrence

Answer explanation

Technical investigations following a security incident are corrective controls that aim to correct the problems and prevent their recurrence.

By segregating the duties of the software development team, Webos implemented:

• A managerial control

• Administrative control

• Legal control

Answer explanation

Segregation of duties is a control related to the organizational structure, so it is classified as administrative control.

Migration to the Windows Azure SQL database would solve the availability problems by reducing the _____________.

• Disruption of operations

• Invasion of privacy of users

• Leak of sensitive information

Answer explanation

Migration to the Windows Azure SQL database helps in solving database availability problems that can cause disruption of operations.  The first option is an example of an impact on availability, while the other two are impacts to the confidentiality.