Question 1

Identify a party below who was involved with developing the Trust Services Framework.
A) FASB
B) United States Congress
C) AICPA
D) IMA

Accepted Answer

The Trust Services Framework was developed by the AICPA (American Institute of Certified Public Accountants) in partnership with various stakeholders, including industry experts and regulators.

Question 2

Identify one aspect of systems reliability that is not a source of concern with regards to a public cloud.
A) confidentiality
B) privacy
C) efficiency
D) availability

Accepted Answer

Efficiency is typically not a source of concern with public cloud systems as they are designed to be highly efficient and scalable in order to handle varying levels of demand. Confidentiality and privacy may be concerns depending on the security measures in place, and availability may also be a concern in the event of downtime or service interruptions.

Question 3

There are "white hat" hackers and "black hat" hackers.Cowboy451 was one of the "black hat" hackers.He had researched an exploit and determined that he could penetrate the target system,download a file containing valuable data,and cover his tracks in eight minutes.Six minutes into the attack he was locked out of the system.Using the notation of the time-based model of security,which of the following must be true?
A) P < 6
B) D = 6
C) P = 6
D) P > 6

Accepted Answer

According to the time-based model of security, an attack will be successful if the time it takes for the attacker to penetrate the target system (P) is less than the time it takes for the defender to detect the attack and respond (D). 
In this scenario, since Cowboy451 was locked out of the system after 6 minutes of the attack, we can conclude that the time it took for the defender to detect the attack and respond (D) is less than 6 minutes. 
Therefore, the only option that satisfies the time-based model of security is P > 6, meaning that Cowboy451 took more than 6 minutes to penetrate the target system.

Question 4

The Trust Services Framework reliability principle that states that users must be able to enter,update,and retrieve data during agreed-upon times is known as
A) availability.
B) security.
C) maintainability.
D) integrity.

Accepted Answer

The reliability principle that focuses on the ability of users to access data during agreed-upon times is availability. This principle ensures that systems are available and functioning as required by users when required.

Question 5

Verifying the identity of the person or device attempting to access the system is an example of
A) authentication.
B) authorization.
C) identification.
D) threat monitoring.

Accepted Answer

Verifying the identity of the person or device attempting to access the system is an example of authentication. Authentication is the process of verifying the identity of a user or device to confirm that they are who they claim to be. This is typically done by requiring the user to provide a username and password, or other form of credentials, before allowing access to the system.

Question 6

Cloud computing can potentially generate significant cost savings for an organization.

Accepted Answer

Cloud computing allows organizations to pay only for the resources they use, rather than investing in expensive infrastructure and maintaining it themselves. This can result in significant cost savings for organizations, particularly those with fluctuating or unpredictable computing needs.

Question 7

Which of the following is not one of the essential criteria for successfully implementing each of the principles that contribute to systems reliability,as discussed in the Trust Services Framework?
A) developing and documenting policies
B) effectively communicating policies to all outsiders
C) designing and employing appropriate control procedures to implement policies
D) monitoring the system and taking corrective action to maintain compliance with policies

Accepted Answer

While effectively communicating policies is important, it is not listed as an essential criteria for implementing each of the principles that contribute to systems reliability in the Trust Services Framework. The essential criteria include developing and documenting policies, designing and employing appropriate control procedures to implement policies, and monitoring the system and taking corrective action to maintain compliance with policies.

Question 8

The Trust Services Framework reliability principle that states sensitive information be protected from unauthorized disclosure is known as
A) availability.
B) security.
C) confidentiality.
D) integrity.

Accepted Answer

The Trust Services Framework reliability principle that refers to sensitive information being protected from unauthorized disclosure is confidentiality. Availability refers to ensuring timely and reliable access to information and systems, security refers to protecting information and systems from unauthorized access, and integrity refers to maintaining the accuracy and completeness of information.

Question 9

Kuzman Jovan called a meeting of the top management at Jovan Capital Management.Number one on the agenda was computer system security."The risk of security breach incidents has become unacceptable," he said,and turned to the Chief Information Officer."What do you intend to do?" Which of the following is the best answer?
A) Evaluate and modify the system using COBOL.
B) Evaluate and modify the system using the CTC checklist.
C) Evaluate and modify the system using the Trust Services framework
D) Evaluate and modify the system using the COSO Internal Control Framework.

Accepted Answer

The Trust Services framework is specifically designed for evaluating and improving information system security and is widely recognized and accepted in the industry. COBOL and CTC checklist are programming languages and do not address security concerns directly. COSO Internal Control Framework is more focused on financial reporting rather than information system security.

Question 10

Cloud computing is generally more secure than traditional computing.

Accepted Answer

Cloud computing faces similar security challenges as traditional computing, such as data breaches and cyber attacks. The security of cloud services depends on the measures implemented by the provider and the user, not the computing model itself.

Question 11

The Trust Services Framework reliability principle that states personal information should be protected from unauthorized disclosure is known as
A) availability.
B) security.
C) privacy.
D) integrity.

Accepted Answer

The Trust Services Framework reliability principle that states personal information should be protected from unauthorized disclosure is the privacy principle. The privacy principle requires organizations to protect personal information from unauthorized disclosure to maintain the privacy of their customers and other individuals whose information they hold.

Question 12

Information security procedures protect information integrity by
A) preventing fictitious transactions.
B) reducing the system cost.
C) making the system more efficient.
D) making it impossible for unauthorized users to access the system.

Accepted Answer

The answer of Information security procedures protect information integrity by
A)...

Question 13

Virtualization refers to the ability of
A) running multiple systems simultaneously on one physical computer.
B) eliminating the need for a physical computer.
C) using the Internet to perform all needed system functions.
D) using web-based security to protect an organization.

Accepted Answer

Virtualization allows multiple operating systems to run simultaneously on one physical computer by creating virtual machines. It's not about eliminating the need for a physical computer, using the internet for all system functions, or using web-based security.

Question 14

If the time an attacker takes to break through the organization's preventive controls is greater than the sum of the time required to detect the attack and the time required to respond to the attack,then security is
A) effective.
B) ineffective.
C) overdone.
D) undermanaged.

Accepted Answer

If an attacker takes more time to break through preventive measures than the time it takes to detect and respond to the attack, then the security is effective. This means that the preventive controls are strong enough to deter the attacker for a significant amount of time and the organization has a timely response plan in place, which ultimately reduces the impact of the attack.

Question 15

The Trust Services Framework reliability principle that states access to the system and its data should be controlled and restricted to legitimate users is known as
A) availability.
B) security.
C) privacy.
D) integrity.

Accepted Answer

The reliability principle that states access to the system and its data should be controlled and restricted to legitimate users is known as security. Availability refers to the system being operational and accessible to users when needed. Privacy refers to the protection of personal information. Integrity refers to the accuracy and completeness of information.

Question 16

Identify the statement below which is not a useful control procedure regarding access to system outputs.
A) restricting access to rooms with printers
B) coding reports to reflect their importance
C) allowing visitors to move through the building without supervision
D) requiring employees to log out of applications when leaving their desk

Accepted Answer

All of the other options are effective in controlling access to system outputs. Restricting access to rooms with printers ensures that confidential information is not printed where unauthorized individuals can see it. Coding reports to reflect their importance can help ensure that only individuals with the appropriate level of clearance can access certain reports. Requiring employees to log out of applications when leaving their desk ensures that no one can access sensitive information without authorization. Allowing visitors to move through the building without supervision leaves the possibility for them to access or view sensitive information, making it an ineffective control procedure.

Question 17

According to the Trust Services Framework,the reliability principle of integrity is achieved when the system produces data that
A) is available for operation and use at times set forth by agreement.
B) is protected against unauthorized physical and logical access.
C) can be maintained as required without affecting system availability, security, and integrity.
D) is complete, accurate, and valid.

Accepted Answer

The reliability principle of integrity is achieved when the system produces data that is complete, accurate, and valid. This means that the data is not compromised or corrupted in any way and can be trusted for its accuracy and completeness. Option D is the best choice as it specifically mentions these three criteria for data integrity.

Question 18

Identify the primary means of protecting data stored in a cloud from unauthorized access.
A) authentication
B) authorization
C) virtualization
D) securitization

Accepted Answer

The answer of Identify the primary means of protecting data...

Question 19

It was 8:03 A.M.when Jiao Jan,the Network Administrator for South Asian Technologies,was informed that the intrusion detection system had identified an ongoing attempt to breach network security.By the time that Jiao had identified and blocked the attack,the hacker had accessed and downloaded several files from the company's server.Using the notation for the time-based model of security,in this case
A) D > P
B) P > D
C) P > C
D) C > P

Accepted Answer

The answer of It was 8:03 A.M.when Jiao Jan,the Network...

Question 20

Which of the following is not one of the three fundamental information security concepts?
A) Information security is a technology issue based on prevention.
B) Security is a management issue, not a technology issue.
C) The idea of defense-in-depth employs multiple layers of controls.
D) The time-based model of security focuses on the relationship between preventive, detective and corrective controls.

Accepted Answer

The fundamental information security concepts are confidentiality, integrity, and availability. Option A is not one of the fundamental concepts.

Quiz 8: Controls for Information Security

Identify a party below who was involved with developing the Trust Services Framework.

Identify one aspect of systems reliability that is not a source of concern with regards to a public cloud.

The Trust Services Framework reliability principle that states that users must be able to enter,update,and retrieve data during agreed-upon times is known as

Verifying the identity of the person or device attempting to access the system is an example of

Cloud computing can potentially generate significant cost savings for an organization.

Which of the following is not one of the essential criteria for successfully implementing each of the principles that contribute to systems reliability,as discussed in the Trust Services Framework?

The Trust Services Framework reliability principle that states sensitive information be protected from unauthorized disclosure is known as

Cloud computing is generally more secure than traditional computing.

The Trust Services Framework reliability principle that states personal information should be protected from unauthorized disclosure is known as

Information security procedures protect information integrity by

Virtualization refers to the ability of

If the time an attacker takes to break through the organization's preventive controls is greater than the sum of the time required to detect the attack and the time required to respond to the attack,then security is

The Trust Services Framework reliability principle that states access to the system and its data should be controlled and restricted to legitimate users is known as

Identify the statement below which is not a useful control procedure regarding access to system outputs.

According to the Trust Services Framework,the reliability principle of integrity is achieved when the system produces data that

Identify the primary means of protecting data stored in a cloud from unauthorized access.

Which of the following is not one of the three fundamental information security concepts?