Which of the following BEST facilitates the development of metrics for repotting to senior management on vulnerability management efforts?

Tracking vulnerabilities and the remediation efforts to mitigate them

Reviewing business impact analysis (BIA) results

Regularly benchmarking the number of new vulnerabilities identified with industry peers

Tracking vulnerabilities and the remediation efforts to mitigate them

Monitoring the frequency of vulnerability assessments using automated scans

What is the MAIN consideration when storing backup files?

Protecting the off-site data backup copies from unauthorized access

Utilizing solid slate device (SSDJ media for quick recovery

Storing backup files on public cloud storage

Protecting the off-site data backup copies from unauthorized access

Storing copies on-site for ease of access during incident response

Which of the following is MOST important to ensure the successful implementation of continuous auditing?

Budget for additional storage hardware

Budget for additional technical resources

Which of the following is a computer-software vulnerability that is unknown to those who would be interested in mitigating the vulnerability?

Cross-site scripting vulnerability

Which of the following is an example of an application security control?

User security awareness training

Which of the following is a limitation of intrusion detection systems (IDS)?

Application-level vulnerabilities

Limited evidence on intrusive activity

Application-level vulnerabilities

Lack of Interface with system tools

Weak passwords for the administration console

What would be an IS auditor's BEST response to an IT managers statement that the risk associated with the use of mobile devices in an organizational setting is the same as for any other device?

Replication of privileged access and the greater likelihood of physical loss increases risk levels.

The risk associated with mobile devices is less than that of other devices and systems.

The risk associated with mobile devices cannot be mitigated with similar controls for workstations.

The ability to wipe mobile devices and disable connectivity adequately mitigates additional

Which of the following is the MOST serious consequence of mobile device loss or theft?

Cost of purchasing replacement devices

Installation of unauthorized applications

Which of the following is EASIEST for a malicious attacker to detect?

Susceptibility to reverse engineering

Use of insufficient cryptography

Insecure storage of sensitive data

Susceptibility to reverse engineering

Ability to tamper with mobile code

Which of the following should an IS auditor do FIRST to ensure cyber security-related legal and regulatory requirements are followed by an organization?

Determine if the cybersecurity program is mapped to relevant legal and regulatory requirements.

Review the most recent legal and regulatory audit report conducted by an independent party.

Determine if there is a formal process to review changes in legal and regulatory requirements. D Obtain a list of relevant legal and regulatory requirements.

Which of the following BEST characterizes security mechanisms for mobile devices?

Easy to control through mobile device management

Comparatively weak relative to workstations

Inadequate for organizational use

Configurable and reliable across device types

Which of the following is the GREATEST drawback when using the AICPA/CICA Trust Sen/ices to evaluate a cloud service provider?

Lack of specificity m the principles

Incompatibility with cloud service business model

Lack of specificity m the principles

Omission of confidentiality in the criteria

Inability to issue SOC 2 or SOC 3 reports

Which of the following is a MAIN benefit of using Security as a Service (SECaaS) providers?

Significant investments and specialized security skills are not required.

Enterprises can use the latest technologies to counter threats that are constantly evolving.

SECaaS providers are compliant with specific security requirements and new regulations.

Available security services from providers are affordable to enterprises of all sizes.

The risk of an evil twin attack on mobile devices is PRIMARILY due to:

generic names that mobile devices will accept without verification.

tokens stored as plain text in many mobile device applications.

use of data transmission that is not always encrypted.

generic names that mobile devices will accept without verification.

weak authentication protocols in wireless networks.

Which of the following is a feature of a stateful inspection firewall?

It is capable of detecting and blocking sophisticated attacks

It tracks the destination IP address of each packet that leaves the organization's internal network.

It is capable of detecting and blocking sophisticated attacks

It prevents any attack initiated and originated by an insider.

It translates the MAC address to the destination IP address of each packet that enters the organization's internal network.

Which of the following is the GREATEST risk pertaining to sensitive data leakage when users set mobile devices to 'always on' mode?

Authorization tokens could be exploited.

An adversary can predict a user's login credentials.

Mobile connectivity could be severely weakened.

A user's behavior pattern can be predicted.

Authorization tokens could be exploited.

An IS auditor has learned that a cloud service provider has not adequately secured its application programming interface (API). Which of the following is MOST important for the auditor to consider in an assessment of the potential risk factors?

Confidentiality, integrity, and availability

Which of the following is the MOST cost-effective technique for implementing network security for human resources (HR) desktops and internal laptop users in an organization?

Layer 3 virtual private network

Which of the following is the MOST important consideration when choosing between different types of cloud services?

Emerging risk and infrastructure scalability

Security features available on demand

Reputation of the cloud providers

Strong data loss prevention (DLP) solutions help protect information in which of the following states?

Operating system application and database levels

Public restricted, and confidential

Data sent, data received, and data deleted

A data loss prevention (DLP) program helps protect an organization from:

exfiltration of sensitive data.

unauthorized access to servers and applications.

unauthorized data modification.

exfiltration of sensitive data.

Isaca Cybersecurity Audit Practice Test 2 - Free Online Exam Questions 41-75

Using digital evidence to provide validation that an attack has actually occurred is an example of;

Become a Premium Member for full access

Unlock Premium Member

Isaca Cybersecurity Audit Practice Test 2

Question

Isaca Cybersecurity Audit Practice Tests

Practice Tests