M4 and M5

A company that relies heavily on one specific operating system which is used in the employee workstations and is embedded within devices that support the automated production line software. It is discovered the operating system has a vulnerability that could allow an attacker to force applications to not release memory segments after execution. Which of the following best describes the type of threat this vulnerability introduces?

• Injection attacks
• Memory corruption
• Denial of service
• Software locking

An IS auditor is auditing a proposed software acquisition. What should be kept in mind?

• operating system in use is compatible with various hardware platforms
• OS updates are scheduled before software to be acquired is implemented
• OS has the latest versions and updates
• the software system should be compatible with the current or planned OS

An IS auditor reviewing the operating system integrity of a server would PRIMARILY:

• verify that user programs do not invoke privileged programs and services
• determine whether administrator accounts have proper password controls
• ensure that file permissions are correct on configuration files
• verify that programs or services running on the server are from valid sources

An organization which has large number of suppliers wants to have an online update of the material supply. Therefore, it wishes to provide limited network access to its suppliers. Which of these options would be chosen?

• Extranet
• Dedicated line
• Internet
• Intranet

At which layer of the OSI model does a gateway operate?

• Networking
• Session
• Presentation
• Application

Due to increased level of attacks on an organization’s Internet, it has asked its audit team to recommend a detection and deterrent control against Internet attacks. Which of the below would be the BEST option?

• Honeypots
• CCTV
• VPN
• VLAN

During an audit where scope includes server environments, an IS auditor would be ensured with which of the below BEST providing the highest degree of server access control?

• A mantrap-monitored entryway to the server room
• Host-based intrusion detection combined with CCTV
• Network-based intrusion detection
• A fingerprint scanner facilitating biometric access control

During an IS audit, the IS auditor discovers that a wireless network is used within the enterprise's headquarters. What is the FIRST thing the auditor should check?

• The signal strength outside of the building
• The configuration settings
• The number of clients connected
• The IP address allocation mechanism

During data backup, which of the below would require special handling?

• System files
• Library files
• Application Files
• Database files

Employees in the company have received several e-mail messages from unknown sources that try and entice her to click a specific link using a “Click Here” approach. Which of the following best describes the most likely taking place in this situation?

• DNS pharming attack
• Embedded hyperlink is obfuscated
• Malware back-door installation
• Bi-directional injection attack