IAP301

You review how you are going to manage your IT investment such as contracts, new policy ideas, service level agreements (SLAs) which are stated commitment to provide a specific service level". In which phase of COBIT 5.0 does this situation belong to?

• a. Align, Plan, and Organize

• b. Build, Acquire, and Implement

• c. Deliver, Service, and Support

• d. Monitor, Evaluate, and Assess

Alice sends an email to Bob that says "I agree to purchase 100 widgets at $10 each." Bob receives the email and it is digitally signed by Alice's private key. The signature verifies that the email came from Alice. Later, Alice claims she never sent that email agreeing to purchase the widgets. However, Bob has the digitally signed email which proves the message came from Alice. What is the issue here ?

• a. Unauthorized access to the system

• b. Integrity of the data

• c. Availability of the data

• d. Nonrepudiation of the data

• e. Unauthorized use of the system

A major retailer recently began offering an augmented reality (AR) shopping app that allows customers to visualize products in their homes. During a routine security audit, the app developer uncovered that hackers could potentially access the smartphone cameras of users. Further, analysis showed that certain camera permissions were not configured properly, allowing malicious actors a way to activate cameras without the user's knowledge. Which of the following best describes the problem?

• a. A new threat was discovered.

  .

• b. A new vulnerability was discovered.

• c. A new risk was discovered.

• d. A new breach was discovered

A company is developing a new web application and wants to ensure it follows industry standards for security, accessibility, and interoperability. For security, they decide to implement authentication following the OpenID Connect standard. This allows users to login with their existing accounts from Google, Facebook etc. rather than creating new credentials. For accessibility, they ensure the application complies with guidelines. This covers aspects like color contrast, keyboard navigation, and screen reader functionality. For interoperability, they use common web standards like HTTP, HTML5, CSS, and JavaScript. What does the company apply?

• a. Policy

• b. Standard

• c. Procedure

• d. Guildline

An audit that is done by government agencies that assess the company's

compliance with laws and regulations is called ________.

• a. Self-Assessment

• b. Internal Audit

• c. External Audit

  .

• d. Regulator Audit

A hospital implements a new electronic health record (EHR) system. Shortly after deployment, nurses report that the system is very slow during peak hours of the day, delaying access to patient records. The hospital's IT team investigates and determines the EHR system is undersized for the number of concurrent users during busy shifts, causing performance lag. Which control should they apply to mitigate the problem?

• a. Preventative

• b. Correlative

• c. Detective

• d. Corrective

What is an detective control?

a. A control that stops behavior immediately and does not rely on human decisions

b. A control that does not stop behavior immediately and relies on human decisions

c. A control that does not stop behavior immediately but automates notification of incident

d. A control that stops behavior immediately and relies on human decisions

• a

• b

• c

• d

While a company encrypt data and has security controls around data transmission/storage, there is still a risk that data could be inadvertently exposed or stolen in a sophisticated cyberattack. Which of the following best describes the problem?

a. risk exposure

b. risk appetite

c. residual risk

d. risk tolerance

• a

• b

• c

• d

A publicly traded company is preparing its quarterly financial statements. The CEO pressures the CFO to manipulate revenue numbers to make the company's growth appear stronger than it actually was to boost the stock price. The CFO reluctantly agrees to falsify the financials. This is a act of __________ violation.

• a. Health Insurance Portability and Accountability Act (HIPAA)

• b. Gramm-Leach-Bliley Act (GLBA)

• c. Sarbanes-Oxley Act (SOX)

• d. Family Educational Rights and Privacy Act (FERPA)

Which of the following are control objectives for Payment Card Industry Data Security Standard (PCI DSS)?

• a. Maintain an information security policy

• b. Protect cardholder data

• c. Alert when credit cards are illegally used

• d. Build and maintain a secure network