CA Foundation Business Economics Questions 2023 - Part 32
Fri, 03 Mar 2023
Inspirational journeys
Follow the stories of academics and their research expeditions
CISA—Certified Information Systems Auditor - Part 293
1. An investment advisor e-mails periodic newsletters to clients and wants reasonable assurance that no one has modified the newsletter. This objective can be achieved by:
A) encrypting the hash of the newsletter using the advisor's private key.
B) encrypting the hash of the newsletter using the advisor's public key.
C) digitally signing the document using the advisor's private key.
D) encrypting the newsletter using the advisor's private key.
2. An IS auditor reviewing wireless network security determines that the Dynamic Host Configuration Protocol is disabled at all wireless access points. This practice:
A) reduces the risk of unauthorized access to the network.
B) is not suitable for small networks.
C) automatically provides an IP address to anyone.
D) increases the risks associated with Wireless Encryption Protocol (WEP).
3. A virtual private network (VPN) provides data confidentiality by using:
A) Secure Sockets Layer (SSL)
B) Tunneling
C) Digital signatures
D) Phishing
4. In auditing a web server, an IS auditor should be concerned about the risk of individuals gaining unauthorized access to confidential information through:
A) common gateway interface (CGI) scripts.
B) enterprise Java beans (EJBs).
C) applets.
D) web services.
5. An IS auditor reviewing access controls for a client-server environment should FIRST:
A) evaluate the encryption technique.
B) identify the network access points.
C) review the identity management system.
D) review the application level access controls.
A) encrypting the hash of the newsletter using the advisor's private key.
B) encrypting the hash of the newsletter using the advisor's public key.
C) digitally signing the document using the advisor's private key.
D) encrypting the newsletter using the advisor's private key.
2. An IS auditor reviewing wireless network security determines that the Dynamic Host Configuration Protocol is disabled at all wireless access points. This practice:
A) reduces the risk of unauthorized access to the network.
B) is not suitable for small networks.
C) automatically provides an IP address to anyone.
D) increases the risks associated with Wireless Encryption Protocol (WEP).
3. A virtual private network (VPN) provides data confidentiality by using:
A) Secure Sockets Layer (SSL)
B) Tunneling
C) Digital signatures
D) Phishing
4. In auditing a web server, an IS auditor should be concerned about the risk of individuals gaining unauthorized access to confidential information through:
A) common gateway interface (CGI) scripts.
B) enterprise Java beans (EJBs).
C) applets.
D) web services.
5. An IS auditor reviewing access controls for a client-server environment should FIRST:
A) evaluate the encryption technique.
B) identify the network access points.
C) review the identity management system.
D) review the application level access controls.
1. Right Answer: A
Explanation: There is no attempt on the part of the investment advisor to prove their identity or to keep the newsletter confidential. The objective is to assure the receivers that it came to them without any modification, i.e., it has message integrity. Choice A is correct because the hash is encrypted using the advisor's private key. The recipients can open the newsletter, recompute the hash and decrypt the received hash using the advisor's public key. If the two hashes are equal, the newsletter was not modified in transit. Choice B is not feasible, for no one other than the investment advisor can open it. Choice C addresses sender authentication but not message integrity. Choice D addresses confidentiality, but not message integrity, because anyone can obtain the investment advisor's public key, decrypt the newsletter, modify it and send it to others. The interceptor will not be able to use the advisor's private key, because they do not have it.Anything encrypted using the interceptor's private key can be decrypted by the receiver only by using their public key.
2. Right Answer: A
Explanation: Dynamic Host Configuration Protocol (DHCP) automatically assigns IP addresses to anyone connected to the network. With DHCP disabled, static IP addresses must be used and represent less risk due to the potential for address contention between an unauthorized device and existing devices on the network. Choice B is incorrect because DHCP is suitable for small networks.Choice C is incorrect because DHCP does not provide IP addresses when disabled. Choice D is incorrect because disabling of the DHCP makes it more difficult to exploit the well-known weaknesses in WEP.
3. Right Answer: B
Explanation: VPNs secure data in transit by encapsulating traffic, a process known as tunneling. SSL is a symmetric method of encryption between a server and a browser.Digital signatures are not used in the VPN process, while phishing is a form of a social engineering attack.
4. Right Answer: A
Explanation: Common gateway interface (CGI) scripts are executable machine independent software programs on the server that can be called and executed by a web server page. CGI performs specific tasks such as processing inputs received from clients. The use of CGI scripts needs to be evaluated, because as they run in the server, a bug in them may allow a user to gain unauthorized access to the server and from there gain access to the organization's network.Applets are programs downloaded from a web server and executed on web browsers on client machines to run any web-based applications. Enterprise java beans (EJBs) and web services have to be deployed by the web server administrator and are controlled by the application server. Their execution requires knowledge of the parameters and expected return values.
5. Right Answer: B
Explanation: A client-server environment typically contains several access points and utilizes distributed techniques, increasing the risk of unauthorized access to data and processing. To evaluate the security of the client server environment, all network access points should be identified. Evaluating encryption techniques, reviewing the identity management system and reviewing the application level access controls would be performed at a later stage of the review.
Explanation: There is no attempt on the part of the investment advisor to prove their identity or to keep the newsletter confidential. The objective is to assure the receivers that it came to them without any modification, i.e., it has message integrity. Choice A is correct because the hash is encrypted using the advisor's private key. The recipients can open the newsletter, recompute the hash and decrypt the received hash using the advisor's public key. If the two hashes are equal, the newsletter was not modified in transit. Choice B is not feasible, for no one other than the investment advisor can open it. Choice C addresses sender authentication but not message integrity. Choice D addresses confidentiality, but not message integrity, because anyone can obtain the investment advisor's public key, decrypt the newsletter, modify it and send it to others. The interceptor will not be able to use the advisor's private key, because they do not have it.Anything encrypted using the interceptor's private key can be decrypted by the receiver only by using their public key.
2. Right Answer: A
Explanation: Dynamic Host Configuration Protocol (DHCP) automatically assigns IP addresses to anyone connected to the network. With DHCP disabled, static IP addresses must be used and represent less risk due to the potential for address contention between an unauthorized device and existing devices on the network. Choice B is incorrect because DHCP is suitable for small networks.Choice C is incorrect because DHCP does not provide IP addresses when disabled. Choice D is incorrect because disabling of the DHCP makes it more difficult to exploit the well-known weaknesses in WEP.
3. Right Answer: B
Explanation: VPNs secure data in transit by encapsulating traffic, a process known as tunneling. SSL is a symmetric method of encryption between a server and a browser.Digital signatures are not used in the VPN process, while phishing is a form of a social engineering attack.
4. Right Answer: A
Explanation: Common gateway interface (CGI) scripts are executable machine independent software programs on the server that can be called and executed by a web server page. CGI performs specific tasks such as processing inputs received from clients. The use of CGI scripts needs to be evaluated, because as they run in the server, a bug in them may allow a user to gain unauthorized access to the server and from there gain access to the organization's network.Applets are programs downloaded from a web server and executed on web browsers on client machines to run any web-based applications. Enterprise java beans (EJBs) and web services have to be deployed by the web server administrator and are controlled by the application server. Their execution requires knowledge of the parameters and expected return values.
5. Right Answer: B
Explanation: A client-server environment typically contains several access points and utilizes distributed techniques, increasing the risk of unauthorized access to data and processing. To evaluate the security of the client server environment, all network access points should be identified. Evaluating encryption techniques, reviewing the identity management system and reviewing the application level access controls would be performed at a later stage of the review.
Tags:
it certification certified it it exams isaca certification isaca cgeit isaca cisa isaca cism isaca cobit 5 isaca crisc isaca questions practice exams pratice quests risc maangement it management it questions isaca answers isaca practice isaca dumps isaca test test questions questins and answer explanation0 Comments
Categories
Recent posts
CA Foundation Business Economics Questions 2023 - Part 31
Fri, 03 Mar 2023
CA Foundation Business Economics Questions 2023 - Part 30
Fri, 03 Mar 2023
Leave a comment