Most Recent Isaca Cybersecurity-Audit-Certificate Exam Questions & Answers

The BEST basis for allocating proportional protection activities when comprehensive classification is not feasible is a business dependency assessment. This is because a business dependency assessment helps to identify the criticality and sensitivity of business processes and their supporting assets, based on their contribution to the organization's objectives and value proposition. This allows for prioritizing protection activities according to the level of risk and impact. The other options are not as effective as a business dependency assessment, because they either use a single classification level allocation (A), which does not account for different levels of risk and impact; require a significant amount of time and resources to perform a business process re-engineering (B); or rely on external parties to cover potential losses without reducing the likelihood or impact of incidents (D).

The responsibility of an organization to protect its assets, including IT infrastructure and information, falls under the broader umbrella of governance, risk management, and compliance (GRC). Governance ensures that organizational activities, like managing IT operations, are aligned with the business's goals, risk management involves identifying, assessing, and mitigating risks, and compliance ensures that the organization adheres to laws, regulations, and policies.

Reference= While I can't provide direct references from the Cybersecurity Audit Manual, the concept of GRC is widely recognized in cybersecurity frameworks and best practices, such as those outlined by ISACA and other industry standards.

The BEST indication that an organization's vulnerability management process is operating effectively is that remediation efforts are prioritized. This is because prioritizing remediation efforts helps to ensure that the most critical and urgent vulnerabilities are addressed first, based on their severity, impact, and exploitability. Prioritizing remediation efforts also helps to optimize the use of resources and time for mitigating vulnerabilities and reducing risks. The other options are not as indicative of an effective vulnerability management process, because they either involve communicating (A), approving (B), or reviewing C aspects that are not directly related to remediating vulnerabilities.

An example of an attack attribute of an advanced persistent threat (APT) that is designed to remove data from systems and networks is anexfiltration attack vector. An exfiltration attack vector is a method or channel that an APT uses to transfer data from a compromised system or network to an external location. Examples of exfiltration attack vectors include email, FTP, DNS, HTTP, or covert channels.

The MOST important thing for an IS auditor to consider in an assessment of the potential risk factors when a cloud service provider has not adequately secured its application programming interface (API) is the impact on theconfidentiality, integrity, and availabilityof the cloud service. An API is a set of rules and protocols that allows communication and interaction between different software components or systems. An API is often used by cloud service providers to enable customers to access and manage their cloud resources and services. However, if an API is not adequately secured, it can expose the cloud service provider and its customers to various threats, such as unauthorized access, data breaches, tampering, denial-of-service attacks, or malicious code injection.