Which of the following is the MOST important consideration when securing customer credit card data acquired by a point-of-sale (POS) cash register?
Answer(s): C
Cardholder data should be encrypted using strong encryption techniques. Hardening would be secondary in importance, while nonrepudiation would not be as relevant. Authentication of the point-of-sale (POS) terminal is a previous step to acquiring the card information.
Which of the following practices is BEST to remove system access for contractors and other temporary userswhen it is no longer required?
Answer(s): B
Predetermined expiration dates are the most effective means of removing systems access for temporary users. Reliance on managers to promptly send in termination notices cannot always be counted on, while requiring each individual to sign a security acknowledgement would have little effect in this case.
Primary direction on the impact of compliance with new regulatory requirements that may lead to major application system changes should be obtained from the:
Business process owners are in the best position to understand how new regulatory requirements may affect their systems. Legal counsel and infrastructure management, as well as internal auditors, would not be in as good a position to fully understand all ramifications.
Which of the following is the MOST important item to consider when evaluating products to monitor security across the enterprise?
Answer(s): D
Monitoring products can impose a significant impact ON system overhead for servers and networks. Product documentation, telephone support and ease of installation, while all important, would be secondary.
Which of the following is the MOST important guideline when using software to scan for security exposures within a corporate network?
The first rule of scanning for security exposures is to not break anything. This includes the interruption of any running processes. Open source tools are an excellent resource for performing scans. Scans should focus on both the test and production environments since, if compromised, the test environment could be used as a platform from which to attack production servers. Finally, the process of scanning for exposures is more of a spiral process than a linear process.
Post your Comments and Discuss ISACA CISM exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CISM content, but please register or login to continue.