BCS Foundation Certificate in Information Security Management Principles V9.0 CISMP-V9 Exam Questions

Answer : C

In the context of information security vulnerabilities, we are typically referring to weaknesses that can be exploited by threats to compromise the confidentiality, integrity, or availability of an information system. Options A, B, and D all represent potential vulnerabilities:

A: Use of HTTP for an Apache web server could allow for interception of data due to lack of encryption.

B: An unpatched Windows operating system could have known security flaws that can be exploited.

D: An unlocked filing cabinet could lead to unauthorized physical access to sensitive documents.

Option C, however, refers to the storage of confidential data in a fire safe, which is a protective measure rather than a vulnerability. A fire safe is designed to protect physical assets from damage or destruction, particularly in the event of a fire, and does not inherently contain a weakness that could be exploited by a cyber threat. Therefore, it is not considered an information security specific vulnerability.

Answer : B

SABSA (Sherwood Applied Business Security Architecture) is a framework and methodology specifically designed for Enterprise Security Architecture and Service Management. It provides a layered approach to security architecture, ensuring that security is aligned with business goals and is driven by risk management principles.SABSA's methodology integrates with business and IT management processes, focusing on the design, delivery, and support of security services within the enterprise environment1.

TOGAF (The Open Group Architecture Framework) is also used in the context of enterprise architecture but is not solely focused on security.It provides a comprehensive approach to the design, planning, implementation, and governance of an enterprise information architecture2.

PCI DSS (Payment Card Industry Data Security Standard) is a set of security standards designed to ensure that all companies that accept, process, store, or transmit credit card information maintain a secure environment2.

OWASP (Open Web Application Security Project) is an online community that produces freely-available articles, methodologies, documentation, tools, and technologies in the field of web application security2.

Answer : B

The deployment of end-to-end Internet of Things (IoT) solutions significantly increases the attack surface compared to traditional IT systems. This is due to the vast number of connected devices, each potentially introducing new vulnerabilities. The heterogeneity of these devices, often with varying levels of security, can lead to more entry points for cyberattacks. Additionally, the complexity of managing and securing these numerous devices, especially when they use different communication protocols and standards, exacerbates the risk. Therefore, the expansion of the attack surface is considered the greatest risk because it amplifies the potential for unauthorized access and compromises the integrity, availability, and confidentiality of information systems.

Answer : B

The software program described is one that obfuscates the source code, making it difficult to inspect, manipulate, or reverse engineer. This is characteristic of proprietary source software, where the source code is not openly shared or available for public viewing or modification. Proprietary software companies often obfuscate their code to protect intellectual property and prevent unauthorized use or reproduction of their software. Unlike open-source software, where the source code is available for anyone to view, modify, and distribute, proprietary software keeps its source code a secret to maintain control over the software's functions and distribution.

Answer : A

Online retailers are the most at risk for the theft of electronic-based credit card data due to the nature of their business, which involves processing a large volume of transactions over the internet. This exposes them to various cyber threats, including hacking, phishing, and other forms of cyber-attacks that can compromise credit card information. Traditional market traders, mail delivery businesses, and agricultural producers typically do not handle credit card transactions to the same extent or in the same electronic manner as online retailers, making them less likely targets for this specific type of data theft.

The principles of Information Security Management emphasize the importance of protecting sensitive data, such as credit card information, through technical security controls and risk management practices.Online retailers must implement robust security measures, including encryption, secure payment gateways, and regular security audits, to mitigate the risks associated with electronic transactions12.

BCS Information Security Management Principles, particularly the sections on Technical Security Controls and Information Risk, provide guidance on protecting electronic data and managing the associated risks1.

Additional insights can be found in the Information Security Management Principles, 3rd Edition by Andy Taylor, David Alexander, Amanda Finch, David Sutton2.

Answer : D

The ISO/IEC 27000 series, particularly ISO/IEC 27001, provides a framework for information security management systems (ISMS) that helps organizations secure their information assets. This series covers various aspects of information security, including the protection of organizational records and data protection & privacy, which are legal compliance requirements in many jurisdictions. Intellectual Property Rights (IPR) are also considered within the scope of information security as they pertain to the protection of proprietary information and assets. Forensic recovery of data and data deduplication are technical and operational considerations but are not directly addressed as compliance legal requirements within the ISO/IEC 27000 series.

Answer : A

The delivery of online security training material offers several advantages over printed media. One of the key benefits is the ease of updating content. When updates are required, online materials can be edited quickly and efficiently, with changes being immediately available to all users.This contrasts with printed materials, which would require a new physical version to be produced and distributed, a process that is both time-consuming and resource-intensive1.

Furthermore, online training materials can be accessed from anywhere at any time, providing flexibility and convenience for learners.They also allow for interactive elements, such as quizzes and simulations, which can enhance the learning experience1.Additionally, online materials can be tracked for usage and completion, enabling organizations to monitor compliance with training requirements2.

While option C mentions a 'discoverable record,' this refers to the legal concept that materials may be used as evidence in litigation. However, this is not an advantage of online over printed media, as both can be discoverable. Option B's claim that online materials are intrinsically more accurate is not necessarily true, as accuracy depends on the content's quality, not the delivery method. Option D is incorrect because while online materials are protected by copyright laws, this is not an exclusive benefit over printed materials, which are also protected.