練習できるCybersecurity-Audit-Certificate問題には認定ガイド問題と解答とトレーニングを提供しています
無料ISACA Cybersecurity-Audit-Certificateテスト練習問題試験問題集
質問 # 45
Which of the following is the GREATEST risk pertaining to sensitive data leakage when users set mobile devices to "always on" mode?
- A. Authorization tokens could be exploited.
- B. An adversary can predict a user's login credentials.
- C. Mobile connectivity could be severely weakened.
- D. A user's behavior pattern can be predicted.
正解：A
解説：
The GREATEST risk pertaining to sensitive data leakage when users set mobile devices to "always on" mode is that authorization tokens could be exploited. Authorization tokens are pieces of data that are used to authenticate users and grant them access to certain resources or services. Authorization tokens are often stored on mobile devices to enable seamless and convenient access without requiring users to enter their credentials repeatedly. However, if users set their mobile devices to "always on" mode, they increase the risk of losing their devices or having them stolen by attackers. Attackers can then access the authorization tokens stored on the devices and use them to impersonate the users or access their sensitive data.
質問 # 46
A cybersecurity audit reveals that an organization's risk management function has the right to overrule business management decisions. Would the IS auditor find this arrangement acceptable?
- A. No, because the risk management's oversight function would potentially lose its ability to objectively monitor and measure the business.
- B. Yes, because this arrangement ensures adequate oversight and enforcement of risk management in the organization.
- C. Yes, because the second line of defense is generally on a higher organizational level than the first line.
- D. No, because the risk management function should be the body that makes risk-related decisions for the organization.
正解：A
解説：
The role of risk management is to provide an oversight function, ensuring that the business management's decisions align with the organization's risk appetite and strategy. If the risk management function were to overrule business management decisions, it could compromise its objectivity. This could lead to a conflict of interest and diminish the function's ability to provide unbiased oversight and measurement of business activities.
質問 # 47
Within the NIST core cybersecurity framework, which function is associated with using organizational understanding to minimize risk to systems, assets, and data?
- A. Detect
- B. Recover
- C. Identify
- D. Respond
正解：C
解説：
Explanation
Within the NIST core cybersecurity framework, the identify function is associated with using organizational understanding to minimize risk to systems, assets, and data. This is because the identify function helps organizations to develop an organizational understanding of their cybersecurity risk management posture, as well as the threats, vulnerabilities, and impacts that could affect their business objectives. The other functions are not directly related to using organizational understanding, but rather focus on detecting (A), recovering C, or responding (D) to cybersecurity events.
質問 # 48
Which of the following is the MOST important consideration when choosing between different types of cloud services?
- A. Security features available on demand
- B. Emerging risk and infrastructure scalability
- C. Reputation of the cloud providers
- D. Overall risk and benefits
正解：D
解説：
Explanation
The MOST important consideration when choosing between different types of cloud services is the overall risk and benefits. This is because choosing between different types of cloud services involves weighing the trade-offs between the risk and benefits of each type of cloud service, such as Software as a Service (SaaS), Platform as a Service (PaaS), or Infrastructure as a Service (IaaS). For example, SaaS may offer more benefits in terms of cost savings, scalability, and usability, but also more risks in terms of security, privacy, and compliance. On the other hand, IaaS may offer more benefits in terms of flexibility, customization, and control, but also more risks in terms of complexity, management, and maintenance. The other options are not the most important consideration when choosing between different types of cloud services, but rather different aspects or factors that affect the choice of cloud services, such as emerging risk and infrastructure scalability (A), security features available on demand (B), or reputation of the cloud providers (D).
質問 # 49
Which of the following is an example of an application security control?
- A. User security awareness training
- B. Intrusion detection
- C. Secure coding
- D. Security operations center
正解：C
解説：
Explanation
An example of an application security control is secure coding. Secure coding is the practice of developing software applications that follow security principles and standards to prevent or mitigate common vulnerabilities and risks. Secure coding involves applying techniques such as input validation, output encoding, error handling, encryption, and testing.
質問 # 50
Which of the following contains the essential elements of effective processes and describes an improvement path considering quality and effectiveness?
- A. 60 270042009
- B. COBIT 5
- C. Balanced scorecard
- D. Capability maturity model integration
正解：D
解説：
The document that contains the essential elements of effective processes and describes an improvement path considering quality and effectiveness is Capability Maturity Model Integration (CMMI). This is because CMMI is a framework that defines five levels of process maturity, from initial to optimized, and provides best practices and guidelines for improving the quality and effectiveness of processes across different domains, such as software development, service delivery, or cybersecurity. The other options are not documents that contain the essential elements of effective processes and describe an improvement path considering quality and effectiveness, but rather different types of documents or tools that provide guidance or recommendations for implementing policies or controls, such as Balanced Scorecard (B), ISO 27004:2009 C, or COBIT 5 (D).
質問 # 51
Which of the following is a passive activity that could be used by an attacker during reconnaissance to gather information about an organization?
- A. Crafting counterfeit websites
- B. Social engineering
- C. Scanning the network perimeter
- D. Using open source discovery
正解：D
解説：
A passive activity that could be used by an attacker during reconnaissance to gather information about an organization is using open source discovery. This is because open source discovery is a technique that involves collecting and analyzing publicly available information about an organization, such as its website, social media, press releases, annual reports, etc. Open source discovery does not require any direct interaction or communication with the target organization or its systems or network, and therefore does not generate any traffic or alerts that could be detected by the organization's security controls. The other options are not passive activities that could be used by an attacker during reconnaissance to gather information about an organization, but rather active activities that involve direct or indirect interaction or communication with the target organization or its systems or network, such as scanning the network perimeter (B), social engineering C, or crafting counterfeit websites (D).
質問 # 52
Which of the following contains the essential elements of effective processes and describes an improvement path considering quality and effectiveness?
- A. 60 270042009
- B. COBIT 5
- C. Balanced scorecard
- D. Capability maturity model integration
正解：D
解説：
Explanation
The document that contains the essential elements of effective processes and describes an improvement path considering quality and effectiveness is Capability Maturity Model Integration (CMMI). This is because CMMI is a framework that defines five levels of process maturity, from initial to optimized, and provides best practices and guidelines for improving the quality and effectiveness of processes across different domains, such as software development, service delivery, or cybersecurity. The other options are not documents that contain the essential elements of effective processes and describe an improvement path considering quality and effectiveness, but rather different types of documents or tools that provide guidance or recommendations for implementing policies or controls, such as Balanced Scorecard (B), ISO 27004:2009 C, or COBIT 5 (D).
質問 # 53
Which of the following is MOST critical to guiding and managing security activities throughout an organization to ensure objectives are met?
- A. Adopting industry security standards and frameworks
- B. Establishing metrics to measure and monitor security performance
- C. Conducting annual security awareness training for all employees
- D. Allocating a significant amount of budget to security investments
正解：B
解説：
Explanation
The MOST critical thing to guiding and managing security activities throughout an organization to ensure objectives are met is establishing metrics to measure and monitor security performance. This is because metrics provide quantifiable and objective data that can be used to evaluate the effectiveness and efficiency of security activities, as well as identify gaps and areas for improvement. Metrics also enable communication and reporting of security performance to stakeholders, such as senior management, board members, auditors, regulators, customers, etc. The other options are not as critical as establishing metrics, because they either involve spending money without knowing the return on investment (A), adopting standards without customizing them to fit the organization's context and needs (B), or conducting training without assessing its impact on behavior change (D).
質問 # 54
The protection of information from unauthorized access or disclosure is known as:
- A. cryptograph
- B. media protect on.
- C. confidentiality.
- D. access control.
正解：C
解説：
Explanation
The protection of information from unauthorized access or disclosure is known as confidentiality. This is because confidentiality is one of the three main objectives of information security, along with integrity and availability. Confidentiality ensures that information is accessible and readable only by those who are authorized and intended to do so, and prevents unauthorized or accidental exposure of information to unauthorized parties. The other options are not the protection of information from unauthorized access or disclosure, but rather different concepts or techniques that are related to information security, such as access control (A), cryptography (B), or media protection C.
質問 # 55
What is the FIRST activity associated with a successful cyber attack?
- A. Creating attack tools
- B. Exploitation
- C. Maintaining a presence
- D. Reconnaissance
正解：D
解説：
Explanation
The FIRST activity associated with a successful cyber attack is reconnaissance. This is because reconnaissance is a phase of the cyber attack lifecycle that involves gathering information about the target organization or system, such as its network topology, IP addresses, open ports, services, vulnerabilities, etc. Reconnaissance helps to identify potential entry points and weaknesses that can be exploited by the attackers in later phases of the attack. The other options are not the first activity associated with a successful cyber attack, but rather follow after reconnaissance in the cyber attack lifecycle, such as exploitation (A), maintaining a presence C, or creating attack tools (D).
質問 # 56
he MOST significant limitation of vulnerability scanning is the fact that modern scanners only detect:
- A. common vulnerabilities.
- B. unknown vulnerabilities.
- C. zero-day vulnerabilities.
- D. known vulnerabilities.
正解：D
解説：
The MOST significant limitation of vulnerability scanning is the fact that modern scanners only detect known vulnerabilities. This is because vulnerability scanners rely on databases or repositories of known vulnerabilities, such as CVE (Common Vulnerabilities and Exposures), to compare and identify the weaknesses or flaws in systems or applications. Vulnerability scanners cannot detect unknown vulnerabilities, such as zero-day vulnerabilities, that have not been reported or disclosed yet, and may be exploited by attackers before they are patched or fixed. The other options are not the most significant limitation of vulnerability scanning, because they either involve detecting common (A), unknown (B), or zero-day (D) vulnerabilities, which are not the capabilities or limitations of modern scanners.
質問 # 57
Which of the following controls BEST prevents users from intentionally or unintentionally accessing data they are not authorized to view?
- A. Passwords
- B. Information security policy
- C. Encryption
- D. Least privilege
正解：D
解説：
The principle of least privilege is a security concept that restricts users' access rights to only what is strictly necessary for their job functions. This control is the most effective in preventing unauthorized data access because it minimizes the chances of users, either intentionally or unintentionally, accessing data they are not authorized to view. It ensures that users are granted the minimum levels of access - or permissions - needed to perform their work. This reduces the risk of accidental or deliberate access to sensitive information.
質問 # 58
The second line of defense in cybersecurity includes:
- A. risk management monitoring, and measurement of controls.
- B. conducting organization-wide control self-assessments.
- C. performing attack and breach penetration testing.
- D. separate reporting to the audit committee within the organization.
正解：A
解説：
Explanation
The second line of defense in cybersecurity includes risk management monitoring, and measurement of controls. This is because the second line of defense is responsible for ensuring that the first line of defense (the operational managers and staff who own and manage risks) is effectively designed and operating as intended.
The second line of defense also provides guidance, oversight, and challenge to the first line of defense. The other options are not part of the second line of defense, but rather belong to the first line of defense (A), the third line of defense C, or an external service provider (D).
質問 # 59
One way to control the integrity of digital assets is through the use of:
- A. policies.
- B. hashing.
- C. frameworks.
- D. caching
正解：B
解説：
One way to control the integrity of digital assets is through the use of hashing. This is because hashing is a technique that applies a mathematical function to a digital asset, such as a file or a message, and produces a unique and fixed-length value, known as a hash or a digest. Hashing helps to verify the integrity of digital assets, by comparing the hash values before and after transmission or storage, and detecting any changes or modifications to the original asset. The other options are not ways to control the integrity of digital assets, but rather different concepts or techniques that are related to information security, such as policies (A), frameworks (B), or caching C.
質問 # 60
Cyber threat intelligence aims to research and analyze trends and technical developments in which of the following areas?
- A. Cybersecurity risk scenarios
- B. Cybersecurity operations management
- C. Industry-specific security regulator
- D. Cybercrime, hacktism. and espionage
正解：D
解説：
Cyber threat intelligence aims to research and analyze trends and technical developments in the areas of cybercrime, hacktivism, and espionage. These are the main sources of malicious cyber activities that pose risks to organizations and individuals. Cyber threat intelligence helps to understand the motivations, capabilities, tactics, techniques, and procedures of various threat actors and groups.
質問 # 61
Which intrusion detection system component is responsible for collecting data in the form of network packets, log files, or system call traces?
- A. Packet filters
- B. Analyzers
- C. Sensors
- D. Administration modules
正解：C
解説：
Explanation
The intrusion detection system component that is responsible for collecting data in the form of network packets, log files, or system call traces is sensors. This is because sensors are components of an intrusion detection system that are deployed on various locations or points of the network or system, such as routers, switches, servers, etc., and that capture and collect data from the network traffic or system activities. Sensors then forward the collected data to another component of the intrusion detection system, such as analyzers, for further processing and analysis. The other options are not components of an intrusion detection system that are responsible for collecting data in the form of network packets, log files, or system call traces, but rather different components or techniques that are related to intrusion detection or prevention, such as packet filters (A), analyzers (B), or administration modules C.
質問 # 62
A data loss prevention (DLP) program helps protect an organization from:
- A. unauthorized access to servers and applications.
- B. unauthorized data modification.
- C. crypto ransomware infection.
- D. exfiltration of sensitive data.
正解：D
解説：
Explanation
A data loss prevention (DLP) program helps protect an organization from exfiltration of sensitive data. This is because exfiltration of sensitive data is a type of cyberattack that involves stealing or leaking sensitive or confidential information from an organization's systems or networks to an external destination or party.
Exfiltration of sensitive data can cause serious harm to an organization's reputation, operations, finances, legal compliance, etc. A DLP program helps to prevent exfiltration of sensitive data by detecting and blocking any unauthorized or suspicious attempts to access, copy, transfer, or share sensitive data by users or applications.
The other options are not cyberattacks that a DLP program helps protect an organization from, but rather different types of cyberattacks that affect other aspects or objectives of information security, such as crypto ransomware infection (A), unauthorized access to servers and applications (B), or unauthorized data modification C.
質問 # 63
Which of the following is a more efficient form of public key cryptography as it demands less computational power and offers more security per bit?
- A. Digital Signature Standard
- B. Diffie-Hellman Key Agreement
- C. Secret Key Cryptography
- D. Elliptic Curve Cryptography
正解：D
解説：
Elliptic curve cryptography (ECC) is a more efficient form of public key cryptography as it demands less computational power and offers more security per bit. ECC is based on the mathematical properties of elliptic curves, which are curves that have a special shape that makes them suitable for cryptography. ECC can achieve the same level of security as other public key algorithms with much smaller key sizes, which reduces storage and bandwidth requirements.
質問 # 64
The second line of defense in cybersecurity includes:
- A. risk management monitoring, and measurement of controls.
- B. conducting organization-wide control self-assessments.
- C. performing attack and breach penetration testing.
- D. separate reporting to the audit committee within the organization.
正解：A
解説：
The second line of defense in cybersecurity includes risk management monitoring, and measurement of controls. This is because the second line of defense is responsible for ensuring that the first line of defense (the operational managers and staff who own and manage risks) is effectively designed and operating as intended. The second line of defense also provides guidance, oversight, and challenge to the first line of defense. The other options are not part of the second line of defense, but rather belong to the first line of defense (A), the third line of defense C, or an external service provider (D).
質問 # 65
Which of the following injects malicious scripts into a trusted website to infect a target?
- A. Structure query language attack
- B. Denial-of-service attack
- C. Cross-site scripting
- D. Malicious code
正解：C
解説：
Cross-site scripting (XSS) is a security vulnerability typically found in web applications. XSS enables attackers to inject malicious scripts into otherwise benign and trusted websites. When other users load the infected pages, the malicious scripts execute, which can lead to unauthorized access, data theft, and a variety of other malicious outcomes.
Reference = While I can't provide direct references from the Cybersecurity Audit Manual, the concept of XSS and its implications are well-documented in cybersecurity literature, including resources provided by ISACA1. For a detailed understanding, you may refer to the ISACA Cybersecurity Audit Certificate resources or other ISACA study materials.
質問 # 66
......
試験準備には欠かさない！トップクラスのISACA Cybersecurity-Audit-Certificate試験アプリ学習ガイドで練習問題最新版：https://jp.fast2test.com/Cybersecurity-Audit-Certificate-premium-file.html