EXIN EXIN Certifications ISFS Questions & Answers

• Question 21:

  Midwest Insurance controls access to its offices with a passkey system. We call this a preventive measure. What are some other measures?

  A. Detective, repressive and corrective measures

  B. Partial, adaptive and corrective measures

  C. Repressive, adaptive and corrective measures

  Correct Answer: A

• Question 22:

  Some security measures are optional. Other security measures must always be implemented. Which measure(s) must always be implemented?

  A. Clear Desk Policy

  B. Physical security measures

  C. Logical access security measures

  D. Measures required by laws and regulations

  Correct Answer: D

• Question 23:

  My user profile specifies which network drives I can read and write to. What is the name of the type of logical access management wherein my access and rights are determined centrally?

  A. Discretionary Access Control (DAC)

  B. Mandatory Access Control (MAC)

  C. Public Key Infrastructure (PKI)

  Correct Answer: B

• Question 24:

  You apply for a position in another company and get the job. Along with your contract, you are asked to sign a code of conduct. What is a code of conduct?

  A. A code of conduct specifies how employees are expected to conduct themselves and is the same for all companies.

  B. A code of conduct is a standard part of a labor contract.

  C. A code of conduct differs from company to company and specifies, among other things, the rules of behavior with regard to the usage of information systems.

  Correct Answer: C

• Question 25:

  You are the owner of a growing company, SpeeDelivery, which provides courier services. You decide that it is time to draw up a risk analysis for your information system. This includes an inventory of the threats and risks. What is the relation between a threat, risk and risk analysis?

  A. A risk analysis identifies threats from the known risks.

  B. A risk analysis is used to clarify which threats are relevant and what risks they involve.

  C. A risk analysis is used to remove the risk of a threat.

  D. Risk analyses help to find a balance between threats and risks.

  Correct Answer: B

• Question 26:

  The consultants at Smith Consultants Inc. work on laptops that are protected by asymmetrical cryptography. To keep the management of the keys cheap, all consultants use the same key pair. What is the companys risk if they operate in this manner?

  A. If the private key becomes known all laptops must be supplied with new keys.

  B. If the Public Key Infrastructure (PKI) becomes known all laptops must be supplied with new keys.

  C. If the public key becomes known all laptops must be supplied with new keys.

  Correct Answer: A

• Question 27:

  What is a repressive measure in the case of a fire?

  A. Taking out fire insurance

  B. Putting out a fire after it has been detected by a fire detector

  C. Repairing damage caused by the fire

  Correct Answer: B

• Question 28:

  You are the owner of SpeeDelivery courier service. Because of your companys growth you have to think about information security. You know that you have to start creating a policy. Why is it so important to have an information security policy as a starting point?

  A. The information security policy gives direction to the information security efforts.

  B. The information security policy supplies instructions for the daily practice of information security.

  C. The information security policy establishes which devices will be protected.

  D. The information security policy establishes who is responsible for which area of information security.

  Correct Answer: A

• Question 29:

  The act of taking organizational security measures is inextricably linked with all other measures that have to be taken. What is the name of the system that guarantees the coherence of information security in the organization?

  A. Information Security Management System (ISMS)

  B. Rootkit

  C. Security regulations for special information for the government

  Correct Answer: A

• Question 30:

  In the organization where you work, information of a very sensitive nature is processed. Management is legally obliged to implement the highest-level security measures. What is this kind of risk strategy called?

  A. Risk bearing

  B. Risk avoiding

  C. Risk neutral

  Correct Answer: B