Study sets
English

Information Security Management Examination (SG) | Section B Risk Assessment and Access Management 01

1 / 100.0s

Problem 1 ・ Question 1 / 10

At Company A, a distributor, the sales staff use a customer management system in the cloud. It has recently come to light that employees who moved to another department still have viewing rights for their old one. The sales staff can also save the customer list in CSV form onto their own personal devices, and the administrators had not been checking what was being downloaded. Company A has decided to carry out a risk assessment and consider improvements.

Which information asset should be identified first?

View explanation

Customer information has a large impact if it leaks, so it must be identified as something to be protected.

Problem 1 ・ Question 2 / 10

At Company A, a distributor, the sales staff use a customer management system in the cloud. It has recently come to light that employees who moved to another department still have viewing rights for their old one. The sales staff can also save the customer list in CSV form onto their own personal devices, and the administrators had not been checking what was being downloaded. Company A has decided to carry out a risk assessment and consider improvements.

Which measure addresses the cause of rights for the old department remaining after a transfer?

View explanation

A mechanism is needed to re-check and remove rights whenever someone transfers or leaves.

Problem 1 ・ Question 3 / 10

At Company A, a distributor, the sales staff use a customer management system in the cloud. It has recently come to light that employees who moved to another department still have viewing rights for their old one. The sales staff can also save the customer list in CSV form onto their own personal devices, and the administrators had not been checking what was being downloaded. Company A has decided to carry out a risk assessment and consider improvements.

Which is the most appropriate measure to stop CSV files being saved onto personal devices?

View explanation

Controlling the routes out technically and allowing the data to be handled only on managed devices is effective.

Problem 1 ・ Question 4 / 10

At Company A, a distributor, the sales staff use a customer management system in the cloud. It has recently come to light that employees who moved to another department still have viewing rights for their old one. The sales staff can also save the customer list in CSV form onto their own personal devices, and the administrators had not been checking what was being downloaded. Company A has decided to carry out a risk assessment and consider improvements.

Which measure helps detect suspicious bulk downloads early?

View explanation

Monitor things such as download volume and raise an alert when something abnormal is detected.

Problem 1 ・ Question 5 / 10

At Company A, a distributor, the sales staff use a customer management system in the cloud. It has recently come to light that employees who moved to another department still have viewing rights for their old one. The sales staff can also save the customer list in CSV form onto their own personal devices, and the administrators had not been checking what was being downloaded. Company A has decided to carry out a risk assessment and consider improvements.

Which is the appropriate principle for granting rights?

View explanation

Apply the principle of least privilege, limiting rights to the scope needed to carry out the work.

Problem 1 ・ Question 6 / 10

At Company A, a distributor, the sales staff use a customer management system in the cloud. It has recently come to light that employees who moved to another department still have viewing rights for their old one. The sales staff can also save the customer list in CSV form onto their own personal devices, and the administrators had not been checking what was being downloaded. Company A has decided to carry out a risk assessment and consider improvements.

What should be checked in assessing the impact of a leak of customer information?

View explanation

The scale of the leak and the nature of the information determine the impact on the individuals and on the organisation.

Problem 1 ・ Question 7 / 10

At Company A, a distributor, the sales staff use a customer management system in the cloud. It has recently come to light that employees who moved to another department still have viewing rights for their old one. The sales staff can also save the customer list in CSV form onto their own personal devices, and the administrators had not been checking what was being downloaded. Company A has decided to carry out a risk assessment and consider improvements.

What should be done after the risk has been treated?

View explanation

Assess the risk that remains after treatment and judge it against the acceptance criteria.

Problem 1 ・ Question 8 / 10

At Company A, a distributor, the sales staff use a customer management system in the cloud. It has recently come to light that employees who moved to another department still have viewing rights for their old one. The sales staff can also save the customer list in CSV form onto their own personal devices, and the administrators had not been checking what was being downloaded. Company A has decided to carry out a risk assessment and consider improvements.

What is the main reason for not sharing an account between several people?

View explanation

Individual IDs make it possible to hold people accountable for what they do.

Problem 1 ・ Question 9 / 10

At Company A, a distributor, the sales staff use a customer management system in the cloud. It has recently come to light that employees who moved to another department still have viewing rights for their old one. The sales staff can also save the customer list in CSV form onto their own personal devices, and the administrators had not been checking what was being downloaded. Company A has decided to carry out a risk assessment and consider improvements.

What should be confirmed in the contract with the cloud provider?

View explanation

Make clear in advance the notification deadline, the response and the boundary of responsibility when an incident occurs.

Problem 1 ・ Question 10 / 10

At Company A, a distributor, the sales staff use a customer management system in the cloud. It has recently come to light that employees who moved to another department still have viewing rights for their old one. The sales staff can also save the customer list in CSV form onto their own personal devices, and the administrators had not been checking what was being downloaded. Company A has decided to carry out a risk assessment and consider improvements.

Which activity continuously confirms that the improvements are being carried out?

View explanation

Regular reviews keep on finding unnecessary rights and gaps in the procedures.