ISFS問題集、EXIN実際の試験問題

質問 1

A well executed risk analysis provides a great deal of useful information. A risk analysis has four main objectives. What is not one of the four main objectives of a risk analysis?

A. Determining the costs of threats

B. Establishing a balance between the costs of an incident and the costs of a security measure

C. Identifying assets and their value

D. Determining relevant vulnerabilities and threats

正解: A

質問 2

Midwest Insurance grades the monthly report of all claimed losses per insured as confidential. What is accomplished if all other reports from this insurance office are also assigned the appropriate grading?

A. A determination can be made as to which report should be printed first and which one can wait a little longer.

B. Reports can be developed more easily and with fewer errors.

C. Everyone can easiliy see how sensitive the reports' contents are by consulting the grading label.

D. The costs for automating are easier to charge to the responsible departments.

正解: C

質問 3

The consultants at Smith Consultants Inc. work on laptops that are protected by asymmetrical cryptography. To keep the management of the keys cheap, all consultants use the same key pair. What is the companys risk if they operate in this manner?

A. If the Public Key Infrastructure (PKI) becomes known all laptops must be supplied with new keys.

B. If the public key becomes known all laptops must be supplied with new keys.

C. If the private key becomes known all laptops must be supplied with new keys.

正解: C

質問 4

You are the owner of SpeeDelivery courier service. Because of your companys growth you have to think about information security. You know that you have to start creating a policy. Why is it so important to have an information security policy as a starting point?

A. The information security policy supplies instructions for the daily practice of information security.

B. The information security policy establishes which devices will be protected.

C. The information security policy gives direction to the information security efforts.

D. The information security policy establishes who is responsible for which area of information security.

正解: C

質問 5

You have an office that designs corporate logos. You have been working on a draft for a large client. Just as you are going to press the <save> button, the screen goes blank. The hard disk is damaged and cannot be repaired. You find an early version of the design in your mail folder and you reproduce the draft for the customer. What is such a measure called?

A. Preventive measure

B. Reductive measure

C. Corrective measure

正解: C

質問 6

In most organizations, access to the computer or the network is granted only after the user has entered a correct username and password. This process consists of 3 steps: identification, authentication and authorization. What is the purpose of the second step, authentication?

A. The authentication step checks the username against a list of users who have access to the system.

B. The system determines whether access may be granted by determining whether the token used is authentic.

C. During the authentication step, the system gives you the rights that you need, such as being able to read the data in the system.

D. In the second step, you make your identity known, which means you are given access to the system.

正解: B

質問 7

At Midwest Insurance, all information is classified. What is the goal of this classification of information?

A. To create a manual about how to handle mobile devices

B. Structuring information according to its sensitivity

C. Applying labels making the information easier to recognize

正解: B

質問 8

What is an example of a security incident?

A. A file is saved under an incorrect name.

B. You cannot set the correct fonts in your word processing software.

C. A member of staff loses a laptop.

D. The lighting in the department no longer works.

正解: C

EXIN Information Security Foundation based on ISO/IEC 27001 - ISFS 模擬練習