ExamGecko
Search Search Login
Home Home / Isaca / IT Risk Fundamentals
Question list
Search
Search
Open VPLUS File
Convert VPLUS to PDF

Related questions

Which of the following is used to estimate the frequency and magnitude of a given risk scenario?
Which of the following is the PRIMARY concern with vulnerability assessments?
An enterprise has moved its data center from a flood-prone area where it had experienced significant service disruptions to one that is not a flood zone. Which risk response strategy has the organization selected?
Which of the following is MOST likely to promote ethical and open communication of risk management activities at the executive level?
Which of the following is the MAIN objective of governance?
Which of the following would be considered a cyber-risk?
Which of the following is of GREATEST concern when aggregating risk information in management reports?
Which of the following risk analysis methods gathers different types of potential risk ideas to be validated and ranked by an individual or small groups during interviews?
Which of the following statements on an organization's cybersecurity profile is BEST suited for presentation to management?
The MOST important reason to monitor implemented controls is to ensure the controls:

Question 29 - IT Risk Fundamentals discussion

Report
Export

Which of the following is an example of an inductive method to gather information?

A.

Vulnerability analysis

Answers
A.

Vulnerability analysis

B.

Controls gap analysis

Answers
B.

Controls gap analysis

C.

Penetration testing

Answers
C.

Penetration testing

Suggested answer: C

Explanation:

Penetration testing is an example of an inductive method to gather information. Here's why:

Vulnerability Analysis: This typically involves a deductive approach where existing knowledge of vulnerabilities is applied to identify weaknesses in the system. It is more of a systematic analysis rather than an exploratory method.

Controls Gap Analysis: This is a deductive method where existing controls are evaluated against standards or benchmarks to identify gaps. It follows a structured approach based on predefined criteria.

Penetration Testing: This involves actively trying to exploit vulnerabilities in the system to discover new security weaknesses. It is an exploratory and inductive method, where testers simulate attacks to uncover security flaws that were not previously identified.

Penetration testing uses an inductive approach by exploring and testing the system in various ways to identify potential security gaps, making it the best example of an inductive method.

ISA 315 Anlage 5 and 6: Understanding vulnerabilities, threats, and controls in IT systems.

GoBD and ISO-27001 guidelines on minimizing attack vectors and conducting security assessments.

These references ensure a comprehensive understanding of the concerns and methodologies involved in IT risk and audit processes.

Show Answer
asked 18/11/2024
marius trif
47 questions
PreviousPreviousNextNext
User
Your answer:
0 comments
Sorted by

Leave a comment first

ExamGecko

Copyright @2023 ExamGecko | All right reserved

Mail us: [email protected]
About us
Contact us
Twitter X
Facebook
Medium
Convert VPLUS to PDF
Open VPLUS files Easily and Quickly
Privacy Policy
Disclaimer
Terms