Lead Auditor Practice Test

Lead Auditor Practice Test practice questions, page 2 of 10, with answer review and explanations.

Question 6

After an information security incident, an organization created a comprehensive backup procedure involving regular, automated backups of all critical data to offsite storage locations. By doing so, which principle of information security is the organization applying in this case?

  1. Integrity
  2. Confidentiality
  3. Availability

Question 7

A data processing tool crashed when a user added more data to the buffer than its storage capacity allows. The incident was caused by the tool's inability to bound check arrays. What kind of vulnerability is this?

  1. Intrinsic vulnerability, i.e., inability to bound check arrays, is a characteristic of the data processing tool
  2. Extrinsic vulnerability, i.e., the exploit of the buffer overflow vulnerability, is caused by an external factor
  3. None; buffer overflow is not a vulnerability; it is a threat

Question 8

Which of the following best defines managerial controls?

  1. Controls related to the management of personnel, including training of employees, management reviews, and internal audits
  2. Controls related to organizational structure, such as segregation of duties, job rotations, job descriptions, and approval processes
  3. Controls related to the use of technical measures or technologies, such as firewalls, alarm systems, surveillance cameras, and IDSs

Question 9

What is the objective of penetration testing in the risk assessment process?

  1. To conduct thorough code reviews
  2. To identify potential failures in the ICT protection schemes
  3. To physically inspect hardware components

Question 10

Which controls are related to the Annex A controls of ISO/IEC 27001 and are often selected from other guides and standards or defined by the organization to meet its specific needs?

  1. General controls
  2. Strategic controls
  3. Specific controls