Protection of Information Assets practice questions

Only some security frameworks are certifiable.

ISO/IEC 27001 is a requirements standard: it states what an ISMS must contain (context, leadership, risk assessment and treatment, Statement of Applicability, internal audit, management review, improvement), so an accredited body can audit and certify against it. ISO/IEC 27002 supports 27001 with control guidance but is not itself certifiable. NIST CSF and COBIT are valuable frameworks but do not lead to third-party certification of an ISMS.

1. Identify the requirement: third-party certification.
2. Separate requirements standards from guidance and frameworks.
3. Recall that 27002 is guidance supporting 27001.
4. Choose ISO/IEC 27001.

Exam tip: Certify against ISO/IEC 27001; use 27002 for control guidance.

Owners authorize access; custodians implement it.

The data owner is accountable for the data and so decides who may access it and at what level. The security administrator is a custodian who implements the owner's decision. When the administrator both decides and grants, there is no segregation and no accountable authorization. A periodic review by the security manager is useful but detective and still lacks owner approval, moving the task to the DBA team keeps the same flaw, and audit approving requests would make the auditor part of the control it later audits.

1. Identify who decided access: a custodian, not the owner.
2. Recall that authorization belongs to the data owner.
3. Reject options that keep a custodian deciding.
4. Reject audit taking on an operational control.

Exam tip: The data owner authorizes; the administrator implements; the auditor reviews.

Mantraps prevent piggybacking.

Piggybacking or tailgating defeats a badge reader because the door opens for one authenticated person and others walk in behind. A mantrap (two interlocking doors, often with a weight or presence sensor) admits one person per authentication, so it prevents the act. Cameras and logs only help investigate afterwards, and a register review is after the fact and relies on the intruder signing in.

1. Note the word prevent.
2. Identify which options only detect.
3. Recognise that badge logs record only the card used.
4. Choose the mantrap.

Exam tip: Mantrap = one authentication, one person; cameras and logs only detect tailgating.

Gather evidence of impact before reporting or recommending.

Active badges for former contractors are a control gap. The auditor's first step is to determine whether the gap was exploited by checking the access system for entries on those badges after the contract end dates; that evidence drives severity, reporting and the recommendation. Fixing the badges is management's job, reporting now would be premature, and biometrics do not fix the deprovisioning process.

1. Recognise the weakness: badges not removed at contract end.
2. Ask what evidence decides severity: actual use.
3. Leave corrective action to management.
4. Review the access logs first.

Exam tip: Find out whether a weakness was exploited before deciding how to report it.

Water-based suppression types differ in when water enters the pipes.

A wet-pipe system keeps water in the pipes, so a leak or broken head releases it at once. A dry-pipe system holds pressurized air; when a head opens, from heat or from damage, the air escapes and water follows, so it removes the leak risk but not the damaged-head risk. A pre-action system needs a separate detection event (smoke or heat detector) before water is admitted, and the heads must then open; a damaged head with no detection only raises a supervisory alarm. That makes pre-action the usual choice for computer rooms that keep water suppression.

1. Note two failure cases: a pipe leak and a damaged head.
2. Eliminate wet-pipe (water always present) and deluge (floods the room).
3. Ask what happens in a dry-pipe system when a head breaks.
4. Choose the system that needs a separate detector first.

Exam tip: Pre-action: detector first, then water; dry-pipe still discharges when a head is damaged.

Life safety comes before asset protection.

Every option is a genuine environmental weakness, but the auditor ranks them by consequence, and human safety outranks equipment and availability. Carbon dioxide at the concentration needed to extinguish a fire is lethal, so total-flooding CO2 in an occupied space needs a pre-discharge alarm and a delay that allows evacuation (and is often avoided in normally occupied rooms). The extinguisher inspection, uncovered power-off switch and missing water sensors put equipment or availability at risk, not lives.

1. Notice that the room is staffed.
2. Rank each weakness by its worst consequence.
3. Recognise that a CO2 discharge without warning endangers people.
4. Choose the life-safety issue.

Exam tip: When several environmental findings compete, the one that endangers people comes first.