ISFS sample questions

Question 1

You work in the IT department of a medium-sized company. Confidential information has got into the wrong hands several times. This has hurt the image of the company. You have been asked to propose organizational security measures for laptops at your company. What is the first step that you should take?

Accepted Answer

Formulate a policy regarding mobile media (PDAs, laptops, smartphones, USB sticks)

Answer

Appoint security personnel

Answer

Encrypt the hard drives of laptops and USB sticks

Answer

Set up an access control policy

Question 2

Your company has to ensure that it meets the requirements set down in personal data protection legislation. What is the first thing you should do?

Accepted Answer

Translate the personal data protection legislation into a privacy policy that is geared to the company and the contracts with the customers.

Answer

Make the employees responsible for submitting their personal data.

Answer

Appoint a person responsible for supporting managers in adhering to the policy.

Answer

Issue a ban on the provision of personal information.

Question 3

In most organizations, access to the computer or the network is granted only after the user has entered a correct username and password. This process consists of 3 steps: identification, authentication and authorization. What is the purpose of the second step, authentication?

Accepted Answer

The system determines whether access may be granted by determining whether the token used is authentic.

Answer

In the second step, you make your identity known, which means you are given access to the system.

Answer

The authentication step checks the username against a list of users who have access to the system.

Answer

During the authentication step, the system gives you the rights that you need, such as being able to read the data in the system.

Question 4

You work for a large organization. You notice that you have access to confidential information that you should not be able to access in your position. You report this security incident to the helpdesk. The incident cycle isinitiated. What are the stages of the security incident cycle?

Accepted Answer

Threat, Incident, Damage, Recovery

Answer

Threat, Damage, Incident, Recovery

Answer

Threat, Damage, Recovery, Incident

Answer

Threat, Recovery, Incident, Damage

Question 5

Midwest Insurance grades the monthly report of all claimed losses per insured as confidential.
What is accomplished if all other reports from this insurance office are also assigned the appropriate grading?

Accepted Answer

Everyone can easiliy see how sensitive the reports' contents are by consulting the grading label.

Answer

The costs for automating are easier to charge to the responsible departments.

Answer

A determination can be made as to which report should be printed first and which one can wait a little longer.

Answer

Reports can be developed more easily and with fewer errors.

Question 6

What is an example of a physical security measure?

Accepted Answer

Special fire extinguishers with inert gas, such as Argon

Answer

A code of conduct that requires staff to adhere to the clear desk policy, ensuring that confidential information is not left visibly on the desk at the end of the work day

Answer

An access control policy with passes that have to be worn visibly

Answer

The encryption of confidential information

Question 7

A data center uses a 'protection rings' model for physical security. An engineer needs to access a specific server rack located in the most secure zone. What is the typical sequence of security layers the engineer must pass through? ```mermaid graph TD subgraph Outer Ring [Perimeter] A[Fence & Gate] end subgraph Middle Ring [Building] B[Reception & Access Card Entry] end subgraph Inner Ring [Data Center Floor] C[Biometric Scan & Mantrap] end subgraph Core [Secure Zone] D[Cage Lock & Server Rack Lock] end A --> B --> C --> D ```

Accepted Answer

Perimeter fence, building entrance, biometric scan, cage lock.

Answer

Biometric scan, building entrance, cage lock, perimeter fence.

Answer

Reception, perimeter fence, cage lock, server rack lock.

Answer

Building entrance, cage lock, biometric scan, perimeter fence.

Question 8

Which is a legislative or regulatory act related to information security that can be imposed upon all organizations?

Accepted Answer

Personal data protection legislation

Answer

ISO/IEC 27001:2005

Answer

Intellectual Property Rights

Answer

ISO/IEC 27002:2005

Question 9

What is the best description of a risk analysis?

Accepted Answer

A risk analysis helps to estimate the risks and develop the appropriate security measures.

Answer

A risk analysis is a method of mapping risks without looking at company processes.

Answer

A risk analysis calculates the exact financial consequences of damages.

Question 10

What is the greatest risk for an organization if no information security policy has been defined?

Accepted Answer

It is not possible for an organization to implement information security in a consistent manner.

Answer

If everyone works with the same account, it is impossible to find out who worked on what.

Answer

Information security activities are carried out by only a few people.

Answer

Too many measures are implemented.

ISFS Practice Questions

Create an account to continue.

Create an account to continue.

Related exams