AIS51313 C1 Review

Which of the following is the BEST way to minimize unauthorized access to unattended end-user PC systems?

• Enforce use of a password-protected screen saver

• Implement proximity-based authentication system

• Terminate user session at predefined intervals

• Adjust power management settings so the monitor screen is blank

The implementation of which of the following would MOST effectively prevent unauthorized access to a system administration account on a web server?

• Host intrusion detection software installed on the server

• Password expiration and lockout policy

• Password complexity rules

• Two-factor authentication

A new business application has been designed in a large, complex organization and the business owner has requested that the various reports be viewed on a “need to know” basis. Which of the following access control methods would be the BEST method to achieve this requirement?

• Mandatory

• Role-based

• Discretionary

• Single sign-on

Which of the following is an effective preventive control to ensure that a database administrator (DBA) complies with the custodianship of the enterprise’s data?

• Exception reports

• Segregation of duties

• Review of access logs and activities

• Management supervision

An employee has received a digital photo frame as an gift and has connected it to his/her work PC to transfer digital photos. The PRIMARY risk that this scenario introduces is that:

• the photo frame storage media could be used to steal corporate data.

• the drivers for the photo frame may be incompatible and crash the user’s PC.

• the employee may bring inappropriate photographs into the office.

• the photo frame could be infected with malware.

An organization discovers that the computer of the chief financial officer has been infected with malware that includes a keystroke logger and a rootkit. The FIRST action to take would be to:

• Contact the appropriate law enforcement authorities to begin an investigation.

• Immediately ensure that no additional data are compromised.

• Disconnect the PC from the network.

• Update the antivirus signature on the pc to ensure that the malware or virus is detected and removed.

The IS auditor is reviewing Findings from a prior IS audit of a hospital. One finding indicates that the organization was using email to communicate sensitive patient issues.The IT manager indicates that to address this finding, the organization has implemented digital signatures for all email users. What should the IS auditor’s response be?

• Digital signatures are not adequate to protect confidentiality

• Digital signatures are adequate to protect confidentiality

• The IS auditor should gather more information about the specific implementation.

• The IS auditor should recommend implementation of digital watermarking for secure email.

To ensure that an organization is complying with privacy requirements, an IS auditor should FIRST review:

• the IT infrastructure

• organizational policies,standards and procedures.

• legal and regulatory requirements.

• adherence to organizational policies,standards and procedures.

A human resources company offers wireless Internet access to its guests, after authenticating with a generic user ID and password. The generic ID and password are requested from the reception desk. Which of the following controls BEST addresses the situation?

• The password for the wireless network is changed on a weekly basis

• A stateful inspection firewall is used between the public wireless and company networks.

• The public wireless network is physically segregated from the company network.

• An intrusion detection system is deployed within the wireless network.

An IS auditor is reviewing a third-party agreement for a new cloud-based accounting service provider. Which of the following considerations is the MOST’ important with regard to the privacy of the accounting data?

• Data retention, backup and recovery

• Return or destruction of information

• Network and intrusion detection

• A patch management process