Ias 3

An organization has experienced a large amount of traffic being re-routed from its voice over IP (VoIP) packet network. The organization believes it is a victim of eavesdropping. Which of the following could result in eavesdropping of VoIP traffic?

Which of the following ensures a sender's authenticity and an emails Confidentiality?

An efficient use of public key infrastructure should encrypt the:

Which of the following cryptographic systems is most appropriate for bulk data encryption and small devices such as smart cards?

Disabling Which of the following would make wireless local area networks more secure against unauthorized access?

Which of the following is best suited for secure communications within a small group?

Which of the following is the most important action in recovering from a cyber attack?

What method might an IS auditor utilize to test wireless security at branch office locations?

Which of the following intrusion detection systems will most likely generate false alarms resulting from normal network activity?

When auditing security for a data center, an IS auditor should look for the presence of a voltage generator to ensure the:

Which of the following methods of suppressing a fire in a data center is the most effective and environmentally friendly

Which of the following environmental controls is appropriate to protect computer equipment against short term reductions in electrical power?

An IS auditor inspected a windowless room containing phone switching and networking equipment and documentation binders. The room was equipped with two handheld fire extinguishers- one filled with CO2, the other filled with Halon gas. Which of the following should be given highest priority in the auditor's report?

What is a risk associated with attempting to control physical access to sensitive areas such as computer rooms using card keys or locks?

An organization with extremely high security requirements is evaluating the effectiveness of biometric systems. Which of the following performance indicators is most important?

The most effective control for addressing the risk of piggybacking is:

The best overall quantitative measure of the performance of biometric control devices is:

Which of the following is the most effective control over visitor access to a data center?

In a public key infrastructure, a registration authority:

Confidentiality of the data transmitted in a wireless local area network is best protected if the session is:

Which of the following provides the most relevant information for proactivly strengthening security settings?

Over the long term, which of the following has the greatest potential to improve the security incident response system?

When reviewing an intrusion detection system, an IS auditor should be most concerned about which of the following?

Distribution denial-of-service attacks on internet sites are typically evoked by hackers using which of the following?

Validated digital signatures in an email software application will:

In transport mode, the use of the Encapsulating Security Payload protocol is advantageous over the Authentication Header protocol because it provides:

An IS auditor notes the intrusion detection system log entries related to port scanning are not being analyzed. This lack of analysis will most likely increase the risk of success of which of the following attacks?

IS management recently replaced it's existing wired local are network with a wireless infrastructure to accommodate the increased use of mobile devices within the organization. This will increase the risk of which of the following attacks?

Which of the following encryption techniques will best protect a wireless network from a man-in-the-middle attack?

The IS management of a multinational company is considering upgrading it's existing virtual private network to support voice-over IP communications via tunneling. Which of the following Considerations should be primarily addressed?

Which of the following antispam filtering techniques would best prevent a valid, variable length email message containing a heavily weighted spam keyword from being labeled as spam?

Which of the following public key infrastructure elements provides detailed descriptions for dealing with a compromised private key?

The use of residual biometric information to gain unauthorized access is an example of which of the following attacks?

Active radio frequency ID tags are subject to which of the following exposures?

When conducting a penetration test of an organization's internal network, which of the following approaches would best enable the conductor of the test to remain undetected on the network?

Two-factor authentication can be circumvented through which of the following attacks?

An organization can ensure that the recipients of emails from its employees can authenticate the identity of the sender by:

Sending a message and a message hash encrypted by the sender's private key will ensure:

Which of the following is a general operating system access control function?

Which of the following best restricts users to those functions needed to perform their duties?

Which of the following is a passive attack to a network?

An organization has a mix of access points that cannot be upgraded to stronger security and newer access points having advanced wireless security. An IS auditor recommends replacing the nonupgradable access points. Which of the following would best justify the IS auditor's recommendation?

For a discretionary access control to be effective, it must:

An instrument advisor emails periodic newsletters to clients and wants reasonable Assurance that no one has modified the news letter. The objective can be achieved by:

An IS auditor reviewing wireless network security determines that the Dynamic Host Configuration Protocol is disabled at all wireless access points. This practice:

An IS auditor examining a biometric user authentication system establishes the existence of a control weakness that would allow an unauthorized individual to update the centralized database on the server that is used to store biometric templates. Of the following, which is the best control against risk?

A virtual private network provides data confidentially by using:

A firm is considering using biometric fingerprint identification on all PCs that access critical data. This requires:

In auditing a web server, an IS auditor should be concerned about the risk of individuals gaining unauthorized access to confidential information through:

From a control perspective, the primary objective of classifying information assets is to:

An organization has been recently downsized. In light of this, an IS auditor decides to test logical access controls. The IS auditor's primary concern should be that:

An IS auditor reviewing access controls for a client-server environment should first:

To prevent IP spoofing attacks, a firewall should be configured to drop a packet if:

Which of the following aspects of symmetric key encryption influenced the development of asymmetric encryption?

The logical exposure associated with the use of a checkpoint restart procedure is:

Which of the following biometrics has been he highest reliability and lowest false acceptance rate?

An IS auditor reviewing the implementation of an intrusion detection system should be most concerned if:

Which of the following best describes the role of a directory server in a public key infrastructure?

An organization is using symmetric encryption. Which of the following would be a valid reason for moving to asymmetric encryption? Symeteic encryption:

Inadequate programing and coding practices introduce the risk of:

Which of the following would provide the best protection against the hacking of a computer connected to the Internet?

Which of the following would prevent unauthorized changes to information stored in a server's log?

When installing an intrusion detection system, which of the following is most important?

A hard disk containing confidential data was damaged beyond repair. What should be done to the hard disk to prevent access to the data residing on it?

In a public key infrastructure, Which of the following may be relied upon to prove that an online transaction was authorized by a specific customer?

After reviewing it's business processes, a large organization is deploying a new web application based on a VoIP technology. Which of the following is the most appropriate approach for implementing access control that will facilitate security management of VoIP web application?

Which of the following ensures confidentiality of information sent over the Internet?

To protect a VoIP infrastructure against a denial-of-service attack, it is most important to secure the:

In an online banking application, which of the following would best protect against identity theft?

Which of the following is a secure sockets layer?

Which of the following potentially blocks hacking attempts?

Which of the following is the best method for preventing the leakage of confidential information in a laptop computer?

A web server is attacked and comprised. Which of the following should be performed first to handle the incident?

To address a maintenance problem, a vendor needs remote access to a critical network the most secure and effective solution is to provide the vendor with a:

What is the best approach to mitigate the risk of a phishing attack?

The responsibility for authorizing access to application data should be with:

During an audit of the logical access control of an enterprise resource planning financial system an IS auditor found some user accounts shared by multiple individuals. The user IDs were based on roles rather than individual identities. These accounts allow access to financial transactions on the ERP. What should the IS auditor do?

The most likely explanation for a successful social engineering attack is:

A sender of an email message applies a digital signature to the digest of the message. This action provides assurance of the:

Minimum password length and password complexity verification are examples of:

An IS auditor finds that a DBA has read and write access to production data. the IS auditor should:

When using universal storage bus flash drive to transport confidential corporate data to an off site location, an effective control would be:

The best filter rule for protecting a network from being used as an amplifier in a denial of service attack is to deny all:

The network of an organization has been the victim of several intruders' attacks. Which of the following measures would allow for the early detection of such incidents?

The purpose of a deadman door controlling access to a computer facility is primarily to:

Which of the following is the most robust method for disposing of magnetic media that contains confidential information?

A company has decided to implement an electronic signature scheme based on public key infrastructure. The user's private key will be stored on the computer's hard drive and protected by a password. The most significant risk of this approach is:

Which of the following would be best prevented by a raised floor in the computer machine room?

A business application system accesses a corporate database using a single ID and password embedded in a program. Which of the following would provide efficient access control over the organization's data?

An IS auditor selects a server for a penetration test that will be carried out by a technical specialist. Which of the following is most important?

Which of the following would most effectively control the usage of universal storage bus storage devices?

After observing suspicious activities in a server, a manager requests forensic analysis. Which of the following findings should be of most concern to the investigator?

Which of the following would be the greatest cause for concern when data are sent over the Internet using HTTPS protocol?

Which of the following is the most reliable form of single factor personal identification?

Which of the following is the best practice to ensure that access authorizations are still valid?

A penetration test performed as part of evaluating network security:

A technical lead who was working on a major project has left the organization. The project manager reports suspicious system activities on one of the servers that is accessible to the whole team. What would be of greatest concern if discovered during a forensic investigation?

An organization is disposing of a number of laptop computers. Which of the following data destruction methods would be most effective?

Users are issued security tokens to be used in combination with a PIN to access the corporate virtual private network. Regarding the PIN, what is the most important rule to be included in a security policy?

A firewall is being deployed at a new location. Which of the following is the most important factor in insuring a successful deployment?

A data center has a badge-entry system. Which of the following is most important to protect the computing assets in the center?

The human resource department had developed a system to allow employees to enroll in benefits via a web site on the corporate Intranet. Which of the following would protect the confidentiality of the data?

What is the most prevalent security risk when an organization implements remote virtual private network access to its network?

An organization is using an enterprise resource management application. Which of the following would be an effective access control?