Domain 1 Exam.
A minimum of 70% is required to pass.
#1. We are implementing several new standards and frameworks in our organization. We have decided to do scoping on one of the standards we are implementing. What will that entail?
#2. Which is the first step in a business impact analysis?
〇：Creating Data Collection Techniques
Of the steps listed, the first step in a Business Impact Analysis (BIA) is to create a data collection technique. The BCP committee will use questionnaires, surveys, and interviews to collect key person information on how different tasks are accomplished within the organization, along with any relevant dependencies of processes, transactions, or services. Process flow diagrams should be created from this data and used throughout the BIA and planning and development phases.
×：Risk calculations for each different business function
This is incorrect because the risk for each business function is calculated after the business function has been identified. And before that happens, the BCP team needs to collect data from key personnel. To calculate the risk for each business function, qualitative and quantitative impact information must be collected, properly analyzed, and interpreted. Once the data analysis is complete, it should be reviewed with the most knowledgeable people in the company to ensure that the results are relevant and to explain the actual risks and impacts facing the organization. This will flush out any additional data points that were not captured initially and allow for a full understanding of all possible business impacts.
×：Identifying Critical Business Functions
Image B is incorrect because the identification of critical business functions is done after the BCP committee has learned about the business functions that exist by interviewing and surveying key individuals. Once the data collection phase is complete, the BCP committee conducts an analysis to determine which processes, devices, or business activities are critical. If a system stands on its own, does not affect other systems, and is less critical, it can be classified as a Tier 2 or Tier 3 recovery step. In other words, these resources are not processed in the recovery phase until the most critical (Tier 1) resources are up and running.
×：Vulnerability and Threat Identification to Business Functions
This is not the first step and is incorrect because it identifies vulnerabilities and threats to business functions toward the end of the business impact analysis. It is the last of the steps listed in the answer. Threats can be man-made, natural, or technical. It is important to identify all possible threats and estimate their likelihood of occurring. When developing these plans, some issues may not be immediately apparent. These issues are best addressed by groups conducting scenario-based exercises. This ensures that when the threat becomes reality, the plan will have an impact on all business tasks, departments, and critical operations. The more issues that are planned for, the better prepared you will be should these events occur.
#3. Which attacks occur regardless of system architecture and installed software?
〇：Social Engineering
Social engineering is an attack that invites human error rather than system. It occurs regardless of system architecture and installed software.
×：DDoS Attacks
A DDoS attack is a mass DoS attack against a target website or server from multiple computers.
×：Ransomware
Ransomware is malware that freezes data by encrypting it and demands a ransom from the owner.
×：Zero-day attacks
A zero-day attack is an attack on a vulnerability that was disclosed before it was fixed.
#4. Lee is the new security manager responsible for ensuring that his company complies with the European Union Principles on Privacy when interacting with its European partners. Which of the following laws or regulations contain a set of principles dealing with the transmission of data that is considered private?
〇：Data Protection Directive
In many cases, the European Union (EU) takes personal privacy more seriously than most other countries in the world and therefore adheres to strict laws regarding data considered personal information based on the European Union Principles for the Protection of Personal Data. This set of principles addresses the use and communication of information that is considered private in nature. These principles and how to comply with them are contained in the EU Data Protection Directive. All European states must comply with these principles, and all companies doing business with EU companies must follow this directive if their business involves the exchange of privacy-type data.
×：Organization for Economic Cooperation and Development (OECD)
Image B is incorrect because the Organization for Economic Cooperation and Development (OECD) is an international organization that brings together different governments to help address the economic, social, and governance challenges of a globalized economy. For this reason, the OECD has developed national guidelines to ensure that data is properly protected and that everyone adheres to the same kinds of rules.
×：Federal Private Sector Bill
The Federal Private Bill is incorrect. There is no official bill by this name.
×：Privacy Protection Act
The Privacy Protection Act is the wrong answer. There is no official legislation by this name.
#5. Which of the following attacks are related to availability?
〇：DDoS attacks
Availability is one of the properties of the CIA triad that indicates service continuity. An attack that threatens the continuity of service corresponds to a DDoS attack that sends a large number of requests and causes a service outage. Therefore, the correct answer is “DDoS attack”.
×: Wheeling
Whaling is a spear-phishing attack that targets a socially recognized person or organization.
×: TOC/TOU
TOC/TOU is a software bug that occurs when the system is modified between the time a condition is checked and the time the results of that check are used. In many cases, the attack replaces one file with another between looking for the file and reading the file.
×: DRAM
RAM (Random Access Memory) is memory used for CPU and screen displays, etc. DRAM is RAM that is only stored for short periods of time and requires periodic refreshing.
#6. Which of the following is a critical first step in disaster recovery and emergency response planning?
〇：Completing the Business Impact Analysis
Of the steps listed in this question, completing the Business Impact Analysis is the highest priority. The BIA is essential in determining the most critical business functions and identifying the threats associated with them. Qualitative and quantitative data must be collected, analyzed, interpreted, and presented to management.
×：Test and Drill Plan
Test and drill is wrong because it is part of the last step in disaster recovery and contingency planning. Because the environment is constantly changing, it is important to test your business continuity plan on a regular basis. Testing and disaster recovery drills and exercises should be performed at least once a year. The exercises should be done in sections or at specific times that require logistical planning, as most firms cannot afford these exercises to disrupt production or productivity.
×：Determining alternatives for off-site backup facilities
This is incorrect because it is part of the contingency strategy that is done in the middle of the disaster recovery and contingency planning process. In the event of a major disaster, an alternate off-site backup capability is required. Typically, contracts are established with third-party vendors to provide such services. The client pays a monthly fee to retain the right to use the facility when needed and then pays an activation fee when they need to use that facility.
×：Organize and prepare related documentation
This is incorrect because the relevant documentation is organized and created around the time the disaster recovery and contingency planning process is completed. Procedures should be documented. This is because time-consuming schedules are confusing when they are actually needed. Documentation should include information on how to install images, configure the operating system and server, and install utilities and proprietary software. Other documentation should include call trees and contact information for specific vendors, emergency agencies, off-site facilities, etc.
#7. Steve, the department manager, has been asked to participate on a committee responsible for defining acceptable levels of risk to the organization, reviewing risk assessments and audit reports, and approving significant changes to security policies and programs. Which committee do you participate on?
〇：Security Management Committee
Steve serves on the Security Steering Committee, which is responsible for making decisions on tactical and strategic security issues within the company. The committee consists of individuals from across the organization and should meet at least quarterly. In addition to the responsibilities outlined in this question, the Security Steering Committee is responsible for establishing a clearly defined vision statement that supports it in cooperation with the organizational intent of the business. It should provide support for the goals of confidentiality, integrity, and availability as they relate to the business goals of the organization. This vision statement should be supported by a mission statement that provides support and definition to the processes that apply to the organization and enable it to reach its business goals.
Each organization may call it by a different name, or they may be entrusted with a series of definition-to-approval processes for security. In this case, the term “operations” is the closest that comes to mind.
×：Security Policy Committee
This is incorrect because senior management is the committee that develops the security policy. Usually, senior management has this responsibility unless they delegate it to an officer or committee. The security policy determines the role that security plays within the organization. It can be organizational, issue specific, or system specific. The Governing Board does not directly create the policy, but reviews and approves it if acceptable.
×：Audit Committee
Incorrect because it provides independent and open communication between the Board of Directors, management, internal auditors, and external auditors. Its responsibilities include the system of internal controls, the engagement and performance of the independent auditors, and the performance of the internal audit function. The Audit Committee reports its findings to the Governing Board, but does not fail to oversee and approve the security program.
×：Risk Management Committee
Incorrect as it is to understand the risks facing the organization and work with senior management to bring the risks down to acceptable levels. This committee does not oversee the security program. The Security Steering Committee typically reports its findings to the Risk Management Committee on information security. The risk management committee should consider the entire business risk, not just the IT security risk.
#8. They downloaded and ran an application via the Internet that looked useful, and now their computer won’t run at all. What type of malware is this?
〇：Trojan Horse
A Trojan horse is a seemingly harmless piece of malware that is contagious. Have you ever downloaded a nasty image and suddenly your computer stopped working?
×：Spyware
Spyware is malware that looks harmless when it does its evil. It secretly takes information from your computer to the outside.
×：Virus
Viruses are malware that can spread without user intervention and attach itself to other programs. It looks harmless but does not match in that it downloads applications.
×：Data diddlers
A data diddler is malware that gradually changes data over time.
#9. Which of the following is a correct action-directed defense?
〇：Regular training to change employee attitudes
Behavior-directed controls are intended to direct the behavior required of employees as part of organizational management. Regular training that changes employee awareness falls under the action-directed type. Therefore, the correct answer is “Regular training to change employee attitudes”.
×：Remotely directed defenses using drone audits
This falls under reinforcing (compensating) defensive measures.
×：Defensive measures to be behavioral psychological barriers due to physical barriers
This is a physical (physically) defensive measure.
×：Developing recurrence prevention measures to review certain actions
This is a corrective measure.
#10. Planned business continuity procedures provide many benefits to an organization. Which of the following is NOT a benefit of business continuity planning?
〇：Tell your business partner that your company is not ready
Planned business continuity procedures can provide an organization with many benefits. In addition to the other response options listed previously, organizations can provide a quick and appropriate response to an emergency, mitigate the impact on their business, and work with outside vendors during the recovery period. Efforts in these areas should communicate to business partners that they are prepared in the event of a disaster.
×：Resuming Critical Business Functions
This is incorrect because a business continuity plan allows an organization to resume critical business functions. As part of the BCP development, the BCP team conducts a business impact analysis that includes identifying the maximum allowable downtime for critical resources. This effort helps the team prioritize recovery efforts so that the most critical resources can be recovered first.
×：Protecting Lives and Ensuring Safety
Business continuity planning allows organizations to protect lives and ensure safety, which is wrong. People are a company’s most valuable asset. Therefore, human resources are an integral part of the recovery and continuity process and must be fully considered and integrated into the plan. Once this is done, a business continuity plan will help a company protect its employees.
×：Ensure business viability
This is a fallacy because a well-planned business continuity plan can help a company ensure the viability of its business. A business continuity plan provides methods and procedures for dealing with long-term outages and disasters. It involves moving critical systems to another environment while the original facility is being restored and conducting business operations in a different mode until normal operations return. In essence, business continuity planning addresses how business is conducted after an emergency.
#11. If you have little or no computer experience, but you have unauthorized access, what methods do you think the perpetrator is using? Which of the following comes closest?
〇：Shoulder Surfing Attacks
Shoulder surfing is a type of browsing attack in which an attacker looks over the shoulder of another person to see what is being typed on that person’s monitor items or keyboard. Of the attacks listed, this is the easiest to perform in that it requires no knowledge of the computer system. Therefore, the correct answer is a shoulder surfing attack.
×：Dictionary attack
A dictionary attack is an unauthorized login that targets users who use words as passwords.
×：Side-channel attack
A side-channel attack is an attack that eavesdrops on system data from physical information.
×：Timing Attacks
A timing attack is an attack in which various input information is given to a device that processes ciphers, and the cipher key or other information is deduced from the difference in processing time. If processing time is taken, it can be inferred as a rough indication that the process is proceeding normally as a process, and so on.
#12. Which of the following describes the relationship between COBIT and ITIL?
〇：COBIT defines IT goals, ITIL provides process-level procedures
COBIT is a framework developed by ISACA (formerly the Information Systems Audit and Controls) and the IT Governance Institute (ITGI). It defines goals for controls, not just security needs, to ensure that IT is properly managed and that IT is responsive to business needs. The IT Infrastructure Library (ITIL) is the de facto standard for IT service management best practices. A customizable framework, ITIL provides goals, the general activities required to achieve these goals, and the input and output values for each process required to achieve these determined goals. In essence, COBIT addresses “what needs to be accomplished” and ITIL addresses “how to accomplish”.
×：COBIT is a model of IT governance, ITIL is a model of corporate governance.
While COBIT can be used as a model for IT governance, ITIL is wrong because it is not a model for corporate governance. In fact, the Committee of Sponsoring Organizations of the Treadway Commission (COSO) is a model of corporate governance. COBIT is derived from the COSO framework. COBIT can be thought of as a way to accomplish many COSO goals, but only from an IT perspective. To achieve many of the goals addressed in COBIT, organizations can use ITIL, which provides process-level steps to achieve IT service management goals.
×：COBIT is a model for corporate governance, ITIL is customizable for IT service management.
As mentioned above, COBIT is incorrect because it can be used as a model for IT governance, not corporate governance. COSO is a model of corporate governance. The second half of the answer is correct. ITIL is a customizable framework and is available as either a series of books or online for IT service management.
×：COBIT provides a business objectives framework, ITIL provides an IT service level objectives framework.
This is inappropriate because COBIT defines the control objectives that should be used to properly manage IT, enabling IT to address business needs as well as IT security needs. ITIL provides steps to achieve IT service management goals related to business needs. ITIL was created because of the increased reliance on information technology to meet business needs.
#13. Sue is charged with implementing several security controls to protect the company’s e-mail system, including antivirus and antispam software. What approach does her company take to address the risks posed by its systems?
〇：Risk Mitigation
Risk can be addressed in four basic ways: transfer, avoidance, mitigation, and acceptance. Sue reduces the risk posed by her e-mail system by implementing security controls such as antivirus and anti-spam software. This is also referred to as risk mitigation, where risk is reduced to a level considered acceptable. Risk can be mitigated by improving procedures, changing the environment, erecting barriers to threats, and implementing early detection techniques to stop threats when they occur and reduce damage.
×：Risk Acceptance
This is inappropriate because risk acceptance does not involve spending on protection or countermeasures such as anti-virus software. When accepting a risk, one should be aware of the level of risk faced and the potential damage costs and decide to keep it without implementing countermeasures. If the cost/benefit ratio indicates that the cost of countermeasures exceeds the potential losses, many companies will accept the risk.
×：Risk Avoidance
Wrong because it would mean discontinuing the activity that is causing the risk. In this case, Sue’s firm decides to continue using e-mail. A company may choose to terminate an activity that introduces risk if the risk outweighs the business needs of the activity. For example, a company may choose to block social media websites in some departments because of the risk to employee productivity.
×：Risk Transfer
This is incorrect because it involves sharing risk with other entities, as in the purchase of insurance to transfer some of the risk to the insurance company. Many types of insurance are available to firms to protect their assets. If a company determines that its total or excess risk is too high to gamble, it can purchase insurance.
#14. What kind of person does the word sabotage, the root of the word sabotage, refer to?
#15. Which of the following is an incorrect mapping of information security standards published jointly by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC)?
〇：ISO / IEC 27005 – Guidelines for Bodies Providing Audits and Certification of Information Security Management Systems
The ISO / IEC 27005 standard is a guideline for information security risk management. ISO / IEC 27005 is an international standard on how risk management should be implemented within the framework of an ISMS.
×：ISO / IEC 27002 – Code of practice for information security management
This is not correct because it is a code of practice for information security management. Therefore, it has the correct mapping. ISO / IEC 27002 provides best practice recommendations and guidelines for starting, implementing, or maintaining an ISMS.
×：ISO / IEC 27003 – ISMS Implementation Guidelines
This is incorrect as it is a guideline for ISMS implementation. Therefore, it has the correct mapping. Focuses on the key aspects necessary for the successful design and implementation of an ISMS according to ISO / IEC 27001:2005. It describes the ISMS specification and design process from its inception to the creation of an implementation plan.
×：ISO / IEC 27004 – Guidelines for Information Security Management Measurement and Metrics Framework
This is incorrect because it is a guideline for an information security management measurement and metrics framework. Therefore, it has the correct mapping. It provides guidance on the development and use of measures to assess the effectiveness of an ISMS and a group of controls or controls, as specified in ISO / IEC 27001.
#16. There are three core rules in the U.S. HIPAA. Which of the following is NOT a core rule?
#17. What is called taking reasonable action to prevent a security breach?
〇：Due Care
Confidentiality means that the company does everything it could reasonably have done to prevent a security breach under the circumstances and takes appropriate control and action in the event of a security breach. In short, it means that the company is acting responsibly by practicing common sense and prudent management. If a company has a facility that is not fire-immune, its arsonist will be only a small part of this tragedy. The company is responsible for providing fire-resistant building materials, alarms, exits, fire extinguishers, and backup fire detection and suppression systems, all critical information specific areas that could be affected by a fire. If a fire were to burn the company’s building and all records (customer data, inventory records, and information needed to rebuild the business) were to disappear, the company would not take precautions to ensure that it is protected against that loss. For example, it would be possible to back up to an off-site location. In this case, employees, shareholders, customers, and anyone else affected could potentially sue the company. However, if the company has done all that is expected of it in terms of the points mentioned so far, it is difficult to sue without success if proper care (dee care) is not taken.
×：Downstream Liability
Is wrong because one firm’s activities (or lack thereof) may have a negative impact on other firms. If either company fails to provide the required level of protection and its negligence affects the partners with whom it cooperates, the affected company can sue the upstream company. For example, suppose Company A and Company B have built an extranet. Company A has not implemented controls to detect and address viruses. Company A is infected with a harmful virus, which infects Company B through the extranet. The virus destroys critical data and causes a major disruption to Company B’s production. Company B can therefore sue Company A for negligence. This is an example of downstream liability.
×：Liability
Incorrect, as it generally refers to the obligation and expected behavior or actions of a particular party. Obligations can have a defined set of specific actions required, which is a more general and open approach that allows parties to determine how to fulfill specific obligations.
×：Due diligence
A better answer to this question. Liability is not considered a legal term as with the other answers. Due diligence is because the firm has properly investigated all of its possible weaknesses and vulnerabilities. Before you can understand how to properly protect yourself, you need to know that you are protecting yourself. To understand the real level of risk, investigate and assess the real level of vulnerability. Even after these steps and assessments have been made, effective controls and protective measures can be identified and implemented. Due diligence means identifying all potential risks, but an appropriate response is one that actually mitigates the risk.
#18. NIST defines best practices for creating a continuity plan. Which phases identify and prioritize critical functions and systems?
〇：Conduct business impact analysis
While no specific scientific equation must be followed to create a continuity plan, certain best practices have been proven over time. The National Institute of Standards and Technology (NIST) organization is responsible for developing and documenting many of these best practices so that they are readily available to all. NIST outlines seven steps in Special Publication 800-34 Rev 1, Continuity Planning Guide for Federal Information Systems. Conduct a business impact analysis. Identify preventive controls. Develop a contingency strategy. Develop an information systems contingency plan. Ensure testing, training, and exercises of the plan. Ensure the plan is maintained. Conduct a business impact analysis by identifying critical functions and systems and prioritize them as needed. It also includes identifying vulnerabilities and threats and calculating risks.
×：Identify preventive controls
Wrong because critical functions and systems are prioritized and preventive controls need to be identified after their vulnerabilities, threats, and identified risks (all of which are part of a business impact analysis). Conducting a business impact analysis involves step 2, which is to create a continuity plan, and step 3, which is to identify preventive controls.
×：Develop a Continuity Plan Policy Statement
This is incorrect because you need to create a policy that provides the guidance needed to develop a business continuity plan and assigns authority to the roles needed to perform these tasks. This is the first step in creating a business continuity plan and is done before identifying and prioritizing critical systems and functions that are part of the business impact analysis.
×：Create contingency strategies
Creating a contingency strategy is incorrect because it requires formulating a method to ensure that systems and critical functions are brought online quickly. Before this can be done, a business impact analysis must be performed to determine critical systems and functions and prioritize them during recovery.
#19. Which of the following is not an official risk methodology created for the purpose of analyzing security risks?
〇：AS / NZS 4360
AS / NZS 4360 can be used for security risk analysis, but it was not created for that purpose. It takes a much broader approach to risk management than other risk assessment methods, such as NIST or OCTAVE, which focus on IT threats and information security risks. AS / NZS 4360 can be used to understand a firm’s financial, capital, personnel safety, and business decision-making risks.
×：FAP
Incorrect as there is no formal FAP risk analysis methodology.
×：OCTAVE
Image B is incorrect because it focuses on IT threats and information security risks. OCTAVE is intended for use in situations that manage and direct information security risk assessments within an organization. Employees of an organization are empowered to determine the best way to assess security.
×：NIST SP 800-30
Wrong because it is specific to IT threats and how they relate to information threats. Focus is primarily on systems. Data is collected from network and security practices assessments and from people within the organization. Data is used as input values for the risk analysis steps outlined in the 800-30 document.
