無料提供されるISFS問題集とISFSリアル試験問題 [Q23-Q39]

4/5 - (1 vote)

無料提供されるISFS問題集とISFSリアル試験問題

EXIN ISFS実際の問題とブレーン問題集

EXIN ISFS 認定試験の出題範囲：

トピック	出題範囲
トピック 1	Explain the consequences of not reporting security incidents Explain the objective of the classification of information
トピック 2	Explain why legislation and regulations are important for the reliability of information Explain the difference between data and information
トピック 3	Describe access security measures such as the segregation of duties and the use of passwords Name the most important roles in the security organization
トピック 4	Explain the relationship between risks and security measures Describe the risks involved with insufficient physical security measures
トピック 5	Understand the concepts cryptography, digital signature,and certificate Explain the concepts threat, risk and risk analysis
トピック 6	Describe various ways in which security measures may be structured or arranged Summarize how security incidents are reported and what information is required
トピック 7	Describe the effects of escalation within the organization Explain the relationship between a threat and a risk
トピック 8	Give examples of legislation related to information security Outline the objectives and the content of a security policy

新問題 23
Logging in to a computer system is an access-granting process consisting of three steps: identification, authentication and authorization.
What occurs during the first step of this process: identification?

The first step consists of checking if the user is using the correct certificate.

The first step consists of checking if the user appears on the list of authorized users.

The first step consists of comparing the password with the registered password.

The first step consists of granting access to the information to which the user is authorized.

新問題 24
What is the most important reason for applying segregation of duties?

Segregation of duties makes it clear who is responsible for what.

Segregation of duties ensures that, when a person is absent, it can be investigated whether he or she has been committing fraud.

Tasks and responsibilities must be separated in order to minimize the opportunities for business assets to be misused or changed, whether the change be unauthorized or unintentional.

Segregation of duties makes it easier for a person who is ready with his or her part of the work to take time off or to take over the work of another person.

Explanation

新問題 25
In most organizations, access to the computer or the network is granted only after the user has entered a correct username and password. This process consists of 3 steps: identification, authentication and authorization. What is the purpose of the second step, authentication?

In the second step, you make your identity known, which means you are given access to the system.

The authentication step checks the username against a list of users who have access to the system.

The system determines whether access may be granted by determining whether the token used is authentic.

During the authentication step, the system gives you the rights that you need, such as being able to read the data in the system.

新問題 26
What is an example of a physical security measure?

A code of conduct that requires staff to adhere to the clear desk policy, ensuring that confidential information is not left visibly on the desk at the end of the work day

An access control policy with passes that have to be worn visibly

The encryption of confidential information

Special fire extinguishers with inert gas, such as Argon

新問題 27
The Information Security Manager (ISM) at Smith Consultants Inc. introduces the following measures to assure information security:
-The security requirements for the network are specified.
-A test environment is set up for the purpose of testing reports coming from the database.
-The various employee functions are assigned corresponding access rights.
–
RFID access passes are introduced for the building. Which one of these measures is not a technical measure?

The specification of requirements for the network

Setting up a test environment

Introducing a logical access policy

Introducing RFID access passes

新問題 28
The consultants at Smith Consultants Inc. work on laptops that are protected by asymmetrical cryptography. To keep the management of the keys cheap, all consultants use the same key pair. What is the companys risk if they operate in this manner?

If the private key becomes known all laptops must be supplied with new keys.

If the Public Key Infrastructure (PKI) becomes known all laptops must be supplied with new keys.

If the public key becomes known all laptops must be supplied with new keys.

新問題 29
You are the first to arrive at work in the morning and notice that the CD ROM on which you saved contracts yesterday has disappeared. You were the last to leave yesterday. When should you report this information security incident?

This incident should be reported immediately.

You should first investigate this incident yourself and try to limit the damage.

You should wait a few days before reporting this incident. The CD ROM can still reappear and, in that case, you will have made a fuss for nothing.

新問題 30
Why do organizations have an information security policy?

In order to demonstrate the operation of the Plan-Do-Check-Act cycle within an organization.

In order to ensure that staff do not break any laws.

In order to give direction to how information security is set up within an organization.

In order to ensure that everyone knows who is responsible for carrying out the backup procedures.

新問題 31
You are a consultant and are regularly hired by the Ministry of Defense to perform analysis.
Since the assignments are irregular, you outsource the administration of your business to temporary workers.
You don’t want the temporary workers to have access to your reports. Which reliability aspect of the information in your reports must you protect?

Availability

Integrity

Confidentiality

新問題 32
A Dutch company requests to be listed on the American Stock Exchange. Which legislation within the scope of information security is relevant in this case?

Public Records Act

Dutch Tax Law

Sarbanes-Oxley Act

Security regulations for the Dutch government

新問題 33
You work in the IT department of a medium-sized company. Confidential information has got into the wrong hands several times. This has hurt the image of the company. You have been asked to propose organizational security measures for laptops at your company. What is the first step that you should take?

Formulate a policy regarding mobile media (PDAs, laptops, smartphones, USB sticks)

Appoint security personnel

Encrypt the hard drives of laptops and USB sticks

Set up an access control policy

Explanation/Reference:

新問題 34
You have a small office in an industrial areA. You would like to analyze the risks your company faces. The office is in a pretty remote location; therefore, the possibility of arson is not entirely out of the question. What is the relationship between the threat of fire and the risk of fire?

The risk of fire is the threat of fire multiplied by the chance that the fire may occur and the consequences thereof.

The threat of fire is the risk of fire multiplied by the chance that the fire may occur and the consequences thereof.

新問題 35
At Midwest Insurance, all information is classified. What is the goal of this classification of information?

To create a manual about how to handle mobile devices

Applying labels making the information easier to recognize

Structuring information according to its sensitivity

新問題 36
Which of these is not malicious software?

Phishing

Spyware

Virus

Worm

新問題 37
Which one of the threats listed below can occur as a result of the absence of a physical measure?

A user can view the files belonging to another user.

A server shuts off because of overheating.

A confidential document is left in the printer.

Hackers can freely enter the computer network.

新問題 38
We can acquire and supply information in various ways. The value of the information depends on whether it is reliable. What are the reliability aspects of information?

Availability, Information Value and Confidentiality

Availability, Integrity and Confidentiality

Availability, Integrity and Completeness

Timeliness, Accuracy and Completeness

新問題 39
Under which condition is an employer permitted to check if Internet and email services in the workplace are being used for private purposes?

The employer is permitted to check this if the employee is informed after each instance of checking.

The employer is permitted to check this if the employees are aware that this could happen.

The employer is permitted to check this if a firewall is also installed.

The employer is in no way permitted to check the use of IT services by employees.

Loading …