An advantage of object-oriented system development is that it:
Correct Answer: D
Section: Information System Acquisition, Development and Implementation
Question 492
Which of the following should be the FIRST step m managing the impact of a recently discovered zero-day attack?
Correct Answer: C
The first step in managing the impact of a recently discovered zero-day attack is to identify vulnerable assets. A zero-day attack is a cyberattack that exploits a previously unknown or unpatched vulnerability in a software or system, before the vendor or developer has had time to fix it. Identifying vulnerable assets is crucial for managing the impact of a zero-day attack, because it helps to determine the scope and severity of the attack, prioritize the protection and mitigation measures, and isolate or quarantine the affected assets from further damage or compromise. The other options are not the first steps in managing the impact of a zero-day attack, because they either require more information about the vulnerable assets, or they are part of the subsequent steps of assessing, responding, or recovering from the attack. References: CISA Review Manual (Digital Version)1, Chapter 5, Section 5.2.4
Question 493
Which of the following is MOST appropriate to prevent unauthorized retrieval of confidential information stored in a business application system?
Correct Answer: C
Explanation The most appropriate control to prevent unauthorized retrieval of confidential information stored in a business application system is to enforce an internal data access policy. A data access policy defines who can access what data, under what conditions and for what purposes. It also specifies the roles and responsibilities of data owners, custodians and users, as well as the security measures and controls to protect data confidentiality, integrity and availability. By enforcing a data access policy, the organization can ensure that only authorized personnel can retrieve confidential information from the business application system. Applying single sign-on for access control, implementing segregation of duties and enforcing the use of digital signatures are also useful controls, but they are not sufficient to prevent unauthorized data retrieval without a clear and comprehensive data access policy. References: CISA Review Manual, 27th Edition, page 2301 CISA Review Questions, Answers & Explanations Database - 12 Month Subscription2
Question 494
A primary benefit derived from an organization employing control self-assessment (CSA) techniques is that it can:
Correct Answer: C
Explanation/Reference: A primary benefit derived from an organization employing control self-assessment (CSA) techniques is that it can identify high-risk areas that might need a detailed review later.
Question 495
In a client-server system, which of the following control techniques is used to inspect activity from known or unknown users?
Correct Answer: C
Section: Protection of Information Assets Explanation: Network monitoring devices may be used to inspect activities from known or unknown users and can identify client addresses, which may assist in finding evidence of unauthorized access. This serves as a detective control. Diskless workstations prevent access control software from being bypassed. Data encryption techniques can help protect sensitive or propriety data from unauthorized access, thereby serving as a preventive control. Authentication systems may provide environment wide, logical facilities that can differentiate among users, before providing access to systems.
