Section: Protection of Information Assets

Explanation/Reference:
Explanation:
Network monitoring devices may be used to inspect activities from known or unknown users and can identify client addresses, which may assist in finding evidence of unauthorized access. This serves as a detective control. Diskless workstations prevent access control software from being bypassed. Data encryption techniques can help protect sensitive or propriety data from unauthorized access, thereby serving as a preventive control. Authentication systems may provide environment wide, logical facilities that can differentiate among users, before providing access to systems.

Section: Protection of Information Assets
Explanation:
Functionality is the set of attributes that bears on the existence of a set of functions and their specified properties. The functions are those that satisfy stated or implied needs. Choice B refers to portability; choice C refers to reliability and choice D refers to efficiency.

A network vulnerability assessment is a process of identifying and evaluating the weaknesses and exposures in a network that could be exploited by attackers to compromise the confidentiality, integrity, or availability of the network or its resources. A network vulnerability assessment typically involves scanning the network devices, such as routers, switches, firewalls, servers, and workstations, using automated tools that compare the device configurations, software versions, and patch levels against a database of known vulnerabilities. A network vulnerability assessment can also include manual testing and verification of the network architecture, design, policies, and procedures. One of the main objectives of a network vulnerability assessment is to detect and report any misconfiguration and missing updates in the network devices that could pose a security risk1.
Misconfiguration refers to any deviation from the recommended or best practice settings for the network devices, such as weak passwords, open ports, unnecessary services, default accounts, or incorrect permissions. Missing updates refer toany outdated or unsupported software or firmware that has not been patched with the latest security fixes or enhancements from the vendors2. Misconfiguration and missing updates are common sources of network vulnerabilities that can be exploited by attackers to gain unauthorized access, executemalicious code, causedenial of service, or escalate privileges on the network devices3.
Therefore, an IS auditor should expect to see misconfiguration and missing updates in a network vulnerability assessment. The other options are less relevant or incorrect because:
* B. Malicious software and spyware are not usually detected by a network vulnerability assessment, as they are more related to the content and behavior of the network traffic rather than the configuration and patch level of the network devices. Malicious software and spyware are programs that infect or monitor the network devices or their users for malicious purposes, such as stealing data, displaying ads, or performing remote commands. Malicious software and spyware can be detected by other security tools, such as antivirus software, firewalls, or intrusion detection systems4.
* C. Zero-day vulnerabilities are not usually detected by a network vulnerability assessment, as they are unknown or undisclosed vulnerabilities that have not been reported or patched by the vendors or the security community. Zero-day vulnerabilities are rare and difficult to discover, as they require advanced techniques and skills to exploit them. Zero-day vulnerabilities can be detected by other security tools, such as intrusion prevention systems, anomaly detection systems, or artificial intelligence systems5.
* D. Security design flaws are not usually detected by a network vulnerability assessment, as they are more related to the logic and functionality of the network rather than the configuration and patch level of the network devices. Security design flaws are errors or weaknesses in the network architecture, design, policies, or procedures that could compromise the security objectives of the network. Securitydesign flaws can be detected by other security methods, such as security reviews, audits, or assessments6. References: Network VulnerabilityAssessment - ISACA, Network Vulnerability Scanning - NIST, Network Vulnerabilities - SANS, Malware - ISACA, Zero-Day Attacks
- ISACA, Security Design Principles - NIST

Section: Information System Acquisition, Development and Implementation
Explanation/Reference:
Electronic systems are simplest of three payment models. The payer simply creates a payment transfer
instructions, sign it digitally and send it to issuer. The issuer then verifies the signature on the request and
performs the transfer. This type of systems requires payer to be on-line and not payee.
For CISA exam you should know below information about payment systems
There are two types of parties involved in all payment systems - the issuer and the user. An issuer is an
entity that operates the payment service. An issuer holds the items that the payment represents. The user
of the payment service performs two main functions- making payments and receiving payments - and
therefore can be described as a payer or payee receptively.
Electronic Money Model -The objective of electronic money systems is emulating physical cash. An issuer
attempts to do this by creating digital certificates, which are then purchased by users who redeem them
with the issuer at a later date. In the interim, certificates can be transferred among users to trade for goods
or services. For the certificate to take on some of the attributes of physical cash, certain techniques are
used so that when a certificate is deposited, the issuer can not determine the original withdrawer of the
certificate. This provides an electronic certificate with unconditional uncertainty.
Electronic Check Model -Electronic check system model real-world checks quite well and thus relatively
simple to understand and implement. A users write an electronic check, which is digitally signed instruction
to pay. This is transferred to another user, who then deposits the electronic check with the issuer. The
issuer will verify payer's signature on the payment and transfer the fund from the payer's account to the
payee's account.
Electronic Transfer Model -Electronic systems are simplest of three payment models. The payer simply
creates a payment transfer instructions, sign it digitally and send it to issuer. The issuer then verifies the
signature on the request and performs the transfer. This type of systems requires payer to be on-line and
not payee.
The following were incorrect answers:
Electronic Money Model -The objective of electronic money systems is emulating physical cash. An issuer
attempts to do this by creating digital certificates, which are then purchased by users who redeem them
with the issuer at a later date. In the interim, certificates can be transferred among users to trade for goods
or services. For the certificate to take on some of the attributes of physical cash, certain techniques are
used so that when a certificate is deposited, the issuer can not determine the original withdrawer of the
certificate. This provides an electronic certificate with unconditional uncertainty.
Electronic Check Model -Electronic check system model real-world checks quite well and thus relatively
simple to understand and implement. A users write an electronic check, which is digitally signed instruction
to pay. This is transferred to another user, who then deposits the electronic check with the issuer. The
issuer will verify payer's signature on the payment and transfer the fund from the payer's account to the
payee's account.
Electronic Withdraw Model - Not a valid type of payment system.
The following reference(s) were/was used to create this question:
CISA review manual 2014 Page number 183