EXIN EX0-105 問題集

質問 1：
You are a consultant and are regularly hired by the Ministry of Defense to perform analyses.
Since the assignments are irregular, you outsource the administration of your business to temporary workers. You don't want the temporary workers to have access to your reports. Which reliability aspect of the information in your reports must you protect?
A. Integrity
B. Availability
C. Confidentiality
正解：C

質問 2：
After a thorough risk analysis and the identification of appropriate security controls, the management team decides that for one specific threat the impact should be covered by insurance.
Which kind of risk treatment control is described here?
A. Reduce
B. Avoid
C. Accept
D. Transfer
正解：D

質問 3：
A couple of years ago you started your company which has now grown from 1 to 20 employees.
Your company's information is worth more and more and gone are the days when you could keep it all in hand yourself. You are aware that you have to take measures, but what should they be?
You hire a consultant who advises you to start with a qualitative risk analysis. What is a qualitative risk analysis?
A. This analysis follows a precise statistical probability calculation in order to calculate exact loss caused by damage.
B. This analysis is based on scenarios and situations and produces a subjective view of the possible threats.
正解：B

質問 4：
The consultants at Smith Consultants Inc. work on laptops that are protected by asymmetrical cryptography. To keep the management of the keys cheap, all consultants use the same key pair.
What is the company's risk if they operate in this manner?
A. If the public key becomes known all laptops must be supplied with new keys.
B. If the private key becomes known all laptops must be supplied with new keys.
C. If the Public Key Infrastructure (PKI) becomes known all laptops must be supplied with new keys.
正解：B

質問 5：
The company Midwest Insurance has taken many measures to protect its information. It uses an
Information Security Management System, the input and output of data in applications is validated, confidential documents are sent in encrypted form and staff use tokens to access information systems. Which of these is not a technical measure?
A. The use of tokens to gain access to information systems
B. Validation of input and output data in applications
C. Encryption of information
D. Information Security Management System
正解：D

質問 6：
During a risk analysis a system administrator mentions that due to the lack of communication between Human recourses management (HRM) and system administrators, employees can still access the company server from home even if they are no longer employed by the company.
Which characteristic of a risk is missing here?
A. Business impact
B. Vulnerability
C. Threat agent
D. Security control
正解：A

質問 7：
Which of the following measures is a corrective measure?
A. Restoring a backup of the correct database after a corrupt copy of the database was written over the original
B. Making a backup of the data that has been created or altered that day
C. Incorporating an Intrusion Detection System (IDS) in the design of a computer centre
D. Installing a virus scanner in an information system
正解：A

質問 8：
You work for a flexible employer who doesn't mind if you work from home or on the road. You regularly take copies of documents with you on a USB memory stick that is not secure. What are the consequences for the reliability of the information if you leave your USB memory stick behind on the train?
A. The confidentiality of the data on the USB memory stick is no longer guaranteed.
B. The integrity of the data on the USB memory stick is no longer guaranteed.
C. The availability of the data on the USB memory stick is no longer guaranteed.
正解：A