[Apr 30, 2022] ISFS Exam Brain Dumps – Study Notes and Theory [Q37-Q61]

ExamBoosts April 30, 2022 ISFS > EXIN 0

Rate this post

[Apr 30, 2022] ISFS Exam Brain Dumps – Study Notes and Theory

Pass EXIN ISFS Test Practice Test Questions Exam Dumps

NO.37 You are the owner of the courier company SpeeDelivery. You employ a few people who, while waiting to make a delivery, can carry out other tasks. You notice, however, that they use this time to send and read their private mail and surf the Internet. In legal terms, in which way can the use of the Internet and e-mail facilities be best regulated?

Installing an application that makes certain websites no longer accessible and that filters attachments in e-mails

Drafting a code of conduct for the use of the Internet and e-mail in which the rights and obligations of both the employer and staff are set down

Implementing privacy regulations

Installing a virus scanner

NO.38 What is an example of a physical security measure?

A code of conduct that requires staff to adhere to the clear desk policy, ensuring that confidential information is not left visibly on the desk at the end of the work day

An access control policy with passes that have to be worn visibly

The encryption of confidential information

Special fire extinguishers with inert gas, such as Argon

NO.39 Peter works at the company Midwest Insurance. His manager, Linda, asks him to send the terms and conditions for a life insurance policy to Rachel, a client. Who determines the value of the information in the insurance terms and conditions document?

The recipient, Rachel

The person who drafted the insurance terms and conditions

The manager, Linda

The sender, Peter

NO.40 Logging in to a computer system is an access-granting process consisting of three steps: identification, authentication and authorization.
What occurs during the first step of this process: identification?

The first step consists of checking if the user is using the correct certificate.

The first step consists of checking if the user appears on the list of authorized users.

The first step consists of comparing the password with the registered password.

The first step consists of granting access to the information to which the user is authorized.

NO.41 You are the owner of the courier company SpeeDelivery. On the basis of your risk analysis you have decided to take a number of measures. You have daily backups made of the server, keep the server room locked and install an intrusion alarm system and a sprinkler system. Which of these measures is a detective measure?

Backup tape

Intrusion alarm

Sprinkler installation

Access restriction to special rooms

NO.42 What is a risk analysis used for?

A risk analysis is used to express the value of information for an organization in monetary terms.

A risk analysis is used to clarify to management their responsibilities.

A risk analysis is used in conjunction with security measures to reduce risks to an acceptable level.

A risk analysis is used to ensure that security measures are deployed in a cost-effective and timely fashion.

NO.43 The company Midwest Insurance has taken many measures to protect its information. It uses an Information Security Management System, the input and output of data in applications is validated, confidential documents are sent in encrypted form and staff use tokens to access information systems. Which of these is not a technical measure?

Information Security Management System

The use of tokens to gain access to information systems

Validation of input and output data in applications

Encryption of information

NO.44 You own a small company in a remote industrial areA. Lately, the alarm regularly goes off in the middle of the night. It takes quite a bit of time to respond to it and it seems to be a false alarm every time. You decide to set up a hidden camerA. What is such a measure called?

Detective measure

Preventive measure

Repressive measure

NO.45 You are the owner of SpeeDelivery courier service. Because of your companys growth you have to think about information security. You know that you have to start creating a policy. Why is it so important to have an information security policy as a starting point?

The information security policy gives direction to the information security efforts.

The information security policy supplies instructions for the daily practice of information security.

The information security policy establishes which devices will be protected.

The information security policy establishes who is responsible for which area of information security.

NO.46 Midwest Insurance controls access to its offices with a passkey system. We call this a preventive measure.
What are some other measures?

Detective, repressive and corrective measures

Partial, adaptive and corrective measures

Repressive, adaptive and corrective measures

NO.47 A Dutch company requests to be listed on the American Stock Exchange. Which legislation within the scope of information security is relevant in this case?

Public Records Act

Dutch Tax Law

Sarbanes-Oxley Act

Security regulations for the Dutch government

NO.48 What is the greatest risk for an organization if no information security policy has been defined?

If everyone works with the same account, it is impossible to find out who worked on what.

Information security activities are carried out by only a few people.

Too many measures are implemented.

It is not possible for an organization to implement information security in a consistent manner.

NO.49 What is the definition of the Annual Loss Expectancy?

The Annual Loss Expectancy is the amount of damage that can occur as a result of an incident during the year.

The Annual Loss Expectancy is the size of the damage claims resulting from not having carried out risk analyses effectively.

The Annual Loss Expectancy is the average damage calculated by insurance companies for businesses in a country.

The Annual Loss Expectancy is the minimum amount for which an organization must insure itself.

NO.50 Some security measures are optional. Other security measures must always be implemented. Which measure(s) must always be implemented?

Clear Desk Policy

Physical security measures

Logical access security measures

Measures required by laws and regulations

NO.51 Some threats are caused directly by people, others have a natural cause. What is an example of an intentional human threat?

Lightning strike

Arson

Flood

Loss of a USB stick

NO.52 What action is an unintentional human threat?

Arson

Theft of a laptop

Social engineering

Incorrect use of fire extinguishing equipment

Explanation/Reference:

NO.53 What is the most important reason for applying segregation of duties?

Segregation of duties makes it clear who is responsible for what.

Segregation of duties ensures that, when a person is absent, it can be investigated whether he or she has been committing fraud.

Tasks and responsibilities must be separated in order to minimize the opportunities for business assets to be misused or changed, whether the change be unauthorized or unintentional.

Segregation of duties makes it easier for a person who is ready with his or her part of the work to take time off or to take over the work of another person.

NO.54 You have an office that designs corporate logos. You have been working on a draft for a large client. Just as you are going to press the <save> button, the screen goes blank. The hard disk is damaged and cannot be repaired. You find an early version of the design in your mail folder and you reproduce the draft for the customer. What is such a measure called?

Corrective measure

Preventive measure

Reductive measure

NO.55 Under which condition is an employer permitted to check if Internet and email services in the workplace are being used for private purposes?

The employer is permitted to check this if the employee is informed after each instance of checking.

The employer is permitted to check this if the employees are aware that this could happen.

The employer is permitted to check this if a firewall is also installed.

The employer is in no way permitted to check the use of IT services by employees.

NO.56 When we are at our desk, we want the information system and the necessary information to be available. We want to be able to work with the computer and access the network and our files. What is the correct definition of availability?

The degree to which the system capacity is enough to allow all users to work with it

The degree to which the continuity of an organization is guaranteed

The degree to which an information system is available for the users

The total amount of time that an information system is accessible to the users

NO.57 You have just started working at a large organization. You have been asked to sign a code of conduct as well as a contract. What does the organization wish to achieve with this?

A code of conduct helps to prevent the misuse of IT facilities.

A code of conduct is a legal obligation that organizations have to meet.

A code of conduct prevents a virus outbreak.

A code of conduct gives staff guidance on how to report suspected misuses of IT facilities.

NO.58 Why is air-conditioning placed in the server room?

In the server room the air has to be cooled and the heat produced by the equipment has to be extracted.
The air in the room is also dehumidified and filtered.

When a company wishes to cool its offices, the server room is the best place. This way, no office space needs to be sacrificed for such a large piece of equipment.

It is not pleasant for the maintenance staff to have to work in a server room that is too warm.

Backup tapes are made from thin plastic which cannot withstand high temperatures. Therefore, if it gets too hot in a server room, they may get damaged.

NO.59 My user profile specifies which network drives I can read and write to. What is the name of the type of logical access management wherein my access and rights are determined centrally?

Discretionary Access Control (DAC)

Mandatory Access Control (MAC)

Public Key Infrastructure (PKI)

NO.60 You apply for a position in another company and get the job. Along with your contract, you are asked to sign a code of conduct. What is a code of conduct?

A code of conduct specifies how employees are expected to conduct themselves and is the same for all companies.

A code of conduct is a standard part of a labor contract.

A code of conduct differs from company to company and specifies, among other things, the rules of behavior with regard to the usage of information systems.

NO.61 A non-human threat for computer systems is a flood. In which situation is a flood always a relevant threat?

If the risk analysis has not been carried out.

When computer systems are kept in a cellar below ground level.

When the computer systems are not insured.

When the organization is located near a river.

Loading …