Question 1

Kuzman Jovan called a meeting of the top management at Jovan Capital Management.Number one on the agenda was computer system security."The risk of security breach incidents has become unacceptable," he said,and turned to the Chief Information Officer."What do you intend to do?" Which of the following is the best answer?
A)Evaluate and modify the system using COBOL.
B)Evaluate and modify the system using the CTC checklist.
C)Evaluate and modify the system using the Trust Services framework
D)Evaluate and modify the system using the COSO Internal Control Framework.

Accepted Answer

The Trust Services framework is designed specifically for assessing and improving information system security. COBOL is a programming language and would not be applicable in this situation. The CTC checklist and COSO Internal Control Framework are not as directly related to information system security as the Trust Services framework.

Question 2

According to the Trust Services Framework,the reliability principle of integrity is achieved when the system produces data that
A)is available for operation and use at times set forth by agreement.
B)is protected against unauthorized physical and logical access.
C)can be maintained as required without affecting system availability, security, and integrity.
D)is complete, accurate, and valid.

Accepted Answer

The reliability principle of integrity is achieved when the system produces data that is complete, accurate, and valid. Options A, B, and C refer to other principles such as availability, confidentiality, and maintainability, respectively.

Question 3

The Trust Services Framework reliability principle that states access to the system and its data should be accessible to meet operational and contractual obligations to legitimate users is known as
A)availability.
B)security.
C)privacy.
D)integrity.

Accepted Answer

The reliability principle that states access to the system and its data should be accessible to meet operational and contractual obligations to legitimate users is availability. Security relates to safeguarding data from unauthorized access or threats, privacy relates to protecting personally identifiable information, and integrity relates to maintaining data accuracy and consistency.

Question 4

There are "white hat" hackers and "black hat" hackers.Cowboy451 was one of the "black hat" hackers.He had researched an exploit and determined that he could penetrate the target system,download a file containing valuable data,and cover his tracks in eight minutes.Six minutes into the attack he was locked out of the system.Using the notation of the time-based model of security,which of the following must be true?
A)P < 6
B)D = 6
C)P = 6
D)P > 6

Accepted Answer

The answer of There are "white hat" hackers and "black...

Question 5

Identify a party below who was involved with developing the Trust Services Framework.
A)FASB
B)COSO
C)AICPA
D)PCAOB

Accepted Answer

The AICPA (American Institute of Certified Public Accountants) was involved with developing the Trust Services Framework.

Question 6

In the time-based model of information security,P represents
A)the time it takes to respond to and stop the attack.
B)the time it takes for the organization to detect that an attack is in progress.
C)the time it takes an attacker to break through the various controls that protect the organization's information assets.
D)the time it takes to assess threats and select risk response.

Accepted Answer

P represents the time it takes an attacker to break through the various controls that protect the organization's information assets in the time-based model of information security. This model focuses on understanding and improving the time dynamics involved in detecting, responding to, and mitigating security threats.

Question 7

The Trust Services Framework reliability principle that states personal information should be protected from unauthorized disclosure is known as
A)availability.
B)security.
C)privacy.
D)integrity.

Accepted Answer

The privacy principle in the Trust Services Framework focuses on the protection of sensitive and personal information from unauthorized access, use, disclosure, and destruction. It ensures that organizations have the appropriate policies, procedures, and controls in place to safeguard the confidentiality of personal information.

Question 8

It was 8:03 A.M.when Jiao Jan,the Network Administrator for South Asian Technologies,was informed that the intrusion detection system had identified an ongoing attempt to breach network security.By the time that Jiao had identified and blocked the attack,the hacker had accessed and downloaded several files from the company's server.Using the notation for the time-based model of security,in this case
A)D > P
B)P > D
C)P > C
D)C > P

Accepted Answer

The answer of It was 8:03 A.M.when Jiao Jan,the Network...

Question 9

Which of the following is not one of the essential criteria for successfully implementing each of the principles that contribute to systems reliability,as discussed in the Trust Services Framework?
A)Developing and documenting policies.
B)Effectively communicating policies to all outsiders.
C)Designing and employing appropriate control procedures to implement policies.
D)Monitoring the system and taking corrective action to maintain compliance with policies.

Accepted Answer

While communicating policies is an important part of maintaining systems reliability, it is not listed as one of the essential criteria for successfully implementing each of the principles in the Trust Services Framework. The essential criteria are developing and documenting policies, designing and employing appropriate control procedures to implement policies, and monitoring the system and taking corrective action to maintain compliance with policies.

Question 10

Information security procedures protect information integrity by
A)preventing fictitious transactions.
B)reducing the system cost.
C)making the system more efficient.
D)making it impossible for unauthorized users to access the system.

Accepted Answer

The answer of Information security procedures protect information integrity by
A)preventing...

Question 11

Security is a technology issue and not just a management issue.

Accepted Answer

Security is both a technology and a management issue, as it requires policies, procedures, and awareness at the management level in addition to technological solutions to protect information and systems.

Question 12

According to the Trust Services Framework,the reliability principle of availability is achieved when the system produces data that
A)is available for operation and use at times set forth by agreement.
B)is protected against unauthorized physical and logical access.
C)can be maintained as required without affecting system availability, security, and integrity.
D)is complete, accurate, and valid.

Accepted Answer

The reliability principle of availability is specifically focused on ensuring that data is available for operation and use at times agreed upon by the parties involved, such as in a service level agreement. This means that the data must be accessible and usable by authorized parties during specified periods of time. Options B and C relate more to the security principle of confidentiality and the processing principle of maintainability, respectively. Option D relates to the accuracy and validity principle of integrity.

Question 13

The Trust Services Framework reliability principle that states that users must be able to enter,update,and retrieve data during agreed-upon times is known as
A)availability.
B)security.
C)maintainability.
D)integrity.

Accepted Answer

The reliability principle described in the question refers to the availability of the system or service. Availability means that the system or service is available for use by users during agreed-upon times, and users are able to enter, update, and retrieve data as needed. Security refers to protecting the system or service from unauthorized access and attacks, maintainability relates to the ability to maintain and update the system or service, and integrity refers to the accuracy and completeness of data.

Question 14

Describe the five principles of the Trust Services Framework.Select one of the principles and discuss the why it is important to an organization.

Accepted Answer

The answer of Describe the five principles of the Trust...

Question 15

The Trust Services Framework reliability principle that states sensitive information be protected from unauthorized disclosure is known as
A)availability.
B)security.
C)confidentiality.
D)integrity.

Accepted Answer

The principle that sensitive information must be protected from unauthorized disclosure is known as confidentiality. The other principles - availability, security, and integrity - all have different focuses. Availability relates to ensuring that the information is available to authorized parties when needed, security relates to protecting the information from unauthorized access or modification, and integrity relates to the accuracy and completeness of the information.

Question 16

Which of the following is not one of the three fundamental information security concepts?
A)Information security is a technology issue based on prevention.
B)Security is a management issue, not a technology issue.
C)The idea of defense-in-depth employs multiple layers of controls.
D)The time-based model of security focuses on the relationship between preventive, detective and corrective controls.

Accepted Answer

The three fundamental information security concepts are confidentiality, integrity, and availability. These concepts are not just technology issues but encompass organizational policies, procedures, and practices. Therefore, option A is not one of the three fundamental information security concepts.

Question 17

If the time an attacker takes to break through the organization's preventive controls is greater than the sum of the time required to detect the attack and the time required to respond to the attack,then security is
A)effective.
B)ineffective.
C)overdone.
D)undermanaged.

Accepted Answer

If the time the attacker takes to break through the preventive controls is greater than the sum of the time required to detect and respond to the attack, then it means that the organization's preventive controls are effective. This is because the preventive controls were able to delay and deter the attacker from gaining access. Furthermore, the detection and response time would have been sufficient for the organization to prevent or mitigate any damages caused by the attack, suggesting that the security measures in place are adequate.

Question 18

According to the Trust Services Framework,the confidentiality principle of integrity is achieved when the system produces data that
A)is available for operation and use at times set forth by agreement.
B)is protected against unauthorized physical and logical access.
C)can be maintained as required without affecting system availability, security, and integrity.
D)is complete, accurate, and valid.

Accepted Answer

The answer of According to the Trust Services Framework,the confidentiality...

Question 19

The Trust Services Framework reliability principle that states access to the system and its data should be controlled and restricted to legitimate users is known as
A)availability.
B)security.
C)privacy.
D)integrity.

Accepted Answer

The reliability principle that deals with control and restriction of access to the system and its data is known as security.

Question 20

In the time-based model of information security,D represents
A)the time it takes to respond to and stop the attack.
B)the time it takes for the organization to detect that an attack is in progress.
C)the time it takes an attacker to break through the various controls that protect the organization's information assets.
D)the time it takes to assess threats and select risk response.

Accepted Answer

In the time-based model of information security, D represents the time it takes for the organization to detect that an attack is in progress. A represents the time it takes to respond to and stop the attack, C represents the time it takes an attacker to break through the various controls that protect the organization's information assets, and D represents the time it takes to assess threats and select risk response. Therefore, the best choice for D would be B.

Quiz 8: Controls for Information Security

According to the Trust Services Framework,the reliability principle of integrity is achieved when the system produces data that

The Trust Services Framework reliability principle that states access to the system and its data should be accessible to meet operational and contractual obligations to legitimate users is known as

Identify a party below who was involved with developing the Trust Services Framework.

In the time-based model of information security,P represents

The Trust Services Framework reliability principle that states personal information should be protected from unauthorized disclosure is known as

Which of the following is not one of the essential criteria for successfully implementing each of the principles that contribute to systems reliability,as discussed in the Trust Services Framework?

Information security procedures protect information integrity by

Security is a technology issue and not just a management issue.

According to the Trust Services Framework,the reliability principle of availability is achieved when the system produces data that

The Trust Services Framework reliability principle that states that users must be able to enter,update,and retrieve data during agreed-upon times is known as

Describe the five principles of the Trust Services Framework.Select one of the principles and discuss the why it is important to an organization.

The Trust Services Framework reliability principle that states sensitive information be protected from unauthorized disclosure is known as

Which of the following is not one of the three fundamental information security concepts?

If the time an attacker takes to break through the organization's preventive controls is greater than the sum of the time required to detect the attack and the time required to respond to the attack,then security is

According to the Trust Services Framework,the confidentiality principle of integrity is achieved when the system produces data that

The Trust Services Framework reliability principle that states access to the system and its data should be controlled and restricted to legitimate users is known as

In the time-based model of information security,D represents