The most effective control to protect information assets in a data center from theft by a vendor is to monitor and restrict vendor activities. A vendor may have legitimate access to the data center for maintenance or support purposes, but they may also have malicious intentions or be compromised by an attacker. By monitoring and restricting vendor activities, the organization can ensure that the vendor only performs authorized tasks and does not access or tamper with sensitive data or equipment. Issuing an access card to the vendor, concealing data devices and information labels, and restricting use of portable and wireless devices are also useful controls, but they are not as effective as monitoring and restricting vendor activities in preventing theft by a vendor. References:
* CISA Review Manual, 27th Edition, page 3381
* CISA Review Questions, Answers & Explanations Database - 12 Month Subscription

Explanation/Reference:
Explanation:
Traffic for the internal network that did not originate from the mail gateway is a sign that firewall-1 is not functioning properly. This may have been be caused by an attack from a hacker. Closing firewa!l-2 is the first thing that should be done, thus preventing damage to the internal network. After closing firewall-2, the malfunctioning of firewall-1 can be investigated. The IDS should trigger the closing of firewall-2 either automatically or by manual intervention. Between the detection by the IDS and a response from the system administrator valuable time can be lost, in which a hacker could also compromise firewall-2. An entry in the log is valuable for later analysis, but before that, the IDS should close firewall-2. If firewall-1 has already been compromised by a hacker, it might not be possible for the IDS to close it.

Section: Protection of Information Assets
Explanation:
As part of the IEEE 802.11 standard ratified in September 1999, WEP uses the stream cipher RC4 for
confidentiality and the CRC-32 checksum for integrity.

Section: Protection of Information Assets
Explanation:
Off-site data storage should be kept synchronized when preparing for the recovery of timesensitive data such as that resulting from transaction processing.

Section: Protection of Information Assets
Explanation:
An IS auditor's responsibilities for detecting fraud include evaluating fraud indicators and deciding whether
any additional action is necessary or whether an investigation should be recommended. The IS auditor
should notify the appropriate authorities within the organization only if it has determined that the indicators
of fraud are sufficient to recommend an investigation. Normally, the IS auditor does not have authority to
consult with external legal counsel.