Free CYBERSECURITY-AUDIT-CERTIFICATE Practice Test

An incremental backup only saves data that has changed since the last backup of any type (full or incremental). To perform a full restoration, one must first restore the last full backup and then apply every subsequent incremental backup in the correct sequence. This multi-step process is more complex and time-consuming than restoring from a full backup (one step) or a differential backup (two steps: last full and last differential). The number of files to process and the dependency on a complete, uncorrupted chain of backups make it the longest restoration method.

B. Offsite backup: This describes the location of a backup, not the method. The time to restore depends on the backup method used (e.g., full, incremental) and the connection speed, not just its location.
C. Full backup: This method is the FASTEST for restoration. It requires only one backup set to be restored, as it contains all the data from a specific point in time.
D. Differential backup: Restoration requires only two sets: the last full backup and the most recent differential backup. This is faster than an incremental restore, which may require many sets.

1. National Institute of Standards and Technology (NIST). (2010). Special Publication 800-34 Rev. 1, Contingency Planning Guide for Federal Information Systems. Section 4.3.2, "Backup Types," p. 33. The guide explains that for incremental restores, "the full backup and all of the incremental backups would need to be restored," implying a longer process than other methods.

2. Patterson, D. A., & Hennessy, J. L. (2011). Computer Organization and Design: The Hardware/Software Interface. (Courseware basis for CS61C at UC Berkeley). Chapter 6 discusses storage and dependability, where backup strategies are detailed, highlighting the trade-offs between backup speed and restore speed for different methods.

Key Risk Indicators (KRIs) are metrics designed to be leading indicators, providing an early warning that a risk is emerging or that an organization's exposure to a given risk is increasing. Unlike Key Performance Indicators (KPIs), which are typically backward-looking (lag indicators) and measure historical performance against objectives, KRIs are forward-looking. They are predictive and signal a higher probability of a future risk event occurring, allowing management to take proactive measures before the risk materializes into a loss or incident.

A. Key performance indicators (KPIs) are lag indicators that measure historical performance against targets, not early warnings of increasing risk.
B. Risk management policies and procedures are static governance documents that define rules; they are not dynamic indicators of risk exposure.
D. Capability maturity model integration (CMMI) is a framework for assessing and improving process maturity, not for providing real-time risk signals.

1. ISACA, "Risk IT Framework, 2nd Edition," 2020, Page 43, Section 3.4.2 "Collect Risk Data," states, "Key risk indicators (KRIs) are leading indicators that allow for proactive management of risk."

2. ISACA, "Cybersecurity Audit Certificate Study Guide, 2nd Edition," 2022, Chapter 2, Section: "Risk Identification," explains that KRIs are used to signal increasing risk exposures and are a critical component of the risk identification process.

3. Fraser, J., & Simkins, B. J. (Eds.). (2010). Enterprise Risk Management: Today's Leading Research and Best Practices for Tomorrow's Executives. John Wiley & Sons. Chapter 11 discusses the design and implementation of KRIs as early warning systems.

The CIA triad—Confidentiality, Integrity, and Availability—is the foundational model for information security. When assessing an inadequately secured API, an auditor's primary concern should be its impact on these three pillars. A weak API can lead to unauthorized data disclosure (Confidentiality), unauthorized modification of data (Integrity), and service disruption through attacks like Denial of Service (Availability). Evaluating risks against this comprehensive framework is the most important and holistic approach, as other specific threats like DoS or spoofing are merely manifestations of failures within one or more pillars of the CIA triad.

A. Resource contention is a specific type of availability risk, which is already covered more broadly by the "Availability" component of the CIA triad.
B. Identity spoofing and phishing are attack vectors, not the fundamental risk categories an auditor would use for a comprehensive assessment.
D. Denial of service is a specific attack that impacts availability; it is a subset of the broader considerations within the CIA triad.

1. ISACA. (2019). COBIT 2019 Framework: Governance and Management Objectives. APO12 Manage Risk, discusses risk assessment in terms of impact, which is fundamentally measured against confidentiality, integrity, and availability objectives.

2. ISACA. (2020). Auditing APIs. ISACA Journal, Volume 5. This article discusses that API security vulnerabilities can "compromise the confidentiality, integrity and availability (CIA) of the data and the systems that the API connects."

3. National Institute of Standards and Technology (NIST). (2020). Special Publication 800-204A, Building Secure Microservices-based Applications Using Service-Mesh Architecture. Section 3.1, "API Security," emphasizes that APIs must be protected to ensure the confidentiality, integrity, and availability of the services they expose.

A purple team exercise focuses on fostering collaboration between the offensive (red team) and defensive (blue team) security functions. The purple team's primary role is to act as a facilitator, integrating the red team's attack techniques and identified vulnerabilities with the blue team's detection and response capabilities. This continuous feedback loop allows the defensive team to immediately tune their controls and tactics based on the simulated attacks, thereby maximizing the value of the exercise and improving the organization's overall security posture in real-time.

A. The yellow team typically refers to software developers and architects who focus on building secure applications from the ground up.
B. The red team is the offensive group that simulates attacks and attempts to identify vulnerabilities; they do not integrate defensive tactics.
D. Black team is not a standard, universally recognized term in the context of red/blue/purple teaming exercises.

1. Pardue, H. (2020). The Value of a Purple Team. ISACA Journal, Volume 5. This article details the function of a purple team as a collaborative bridge between red and blue teams to improve security.

2. National Institute of Standards and Technology (NIST). (2021). Guide to Cybersecurity Event Recovery (NIST Special Publication 1800-28). Section 4.3.1 discusses testing and exercises, where purple teaming is described as a method to test and validate defenses by combining red and blue team efforts.

3. MITRE Corporation. (2020). MITRE ATT&CK® for Industrial Control Systems. While focused on ICS, the documentation frequently discusses the use of red, blue, and purple teams for evaluating and improving defenses against known adversary tactics.

Standards are mandatory rules, actions, or controls established to support and enforce a high-level policy. They specify the "what" that is required for compliance. For example, if a policy states that "all sensitive data must be encrypted," a corresponding standard would define the minimum acceptable rule, such as "AES-256 must be used for all data-at-rest encryption." Standards translate the broad intent of a policy into specific, compulsory requirements, thereby setting the minimum level of compliance for technologies, processes, and personnel behavior across the organization.

A. Baselines are a specific type of standard that defines a minimum security configuration for a system, whereas standards is the broader term for all mandatory rules.
B. Guidelines are recommended best practices and are not mandatory; therefore, they do not define minimum acceptable rules for compliance.
D. Frameworks provide a high-level structure and collection of best practices (e.g., NIST CSF) but do not, by themselves, define specific mandatory rules for an organization.

1. ISACA, "Cybersecurity Audit Certificate Study Guide, 2nd Edition," 2022, Chapter 1, Section: "Cybersecurity Governance Components," defines standards as "Mandatory requirements that describe how policies will be implemented."

2. National Institute of Standards and Technology (NIST), "SP 800-12 Rev. 1, An Introduction to Information Security," October 2017, Section 4.2 "Policy, Standards, and Practices," states that standards are "mandatory activities, actions, rules or regulations."

3. Massachusetts Institute of Technology (MIT), "Information Security Policy (Policy 13.2)," defines standards as "mandatory requirements for hardware, software, technology, and process." This illustrates the common definition used in reputable academic institutions.

The primary benefit of ensuring timely and reliable access to information systems is increased data availability. Availability is one of the three core principles of the information security triad (Confidentiality, Integrity, and Availability - CIA). It is the guarantee that authorized users can access information and systems when needed for business purposes. This directly supports business operations, productivity, and continuity by preventing disruptions caused by inaccessible data or systems.

A. Improved data integrity refers to the accuracy and trustworthiness of data, which is a separate security goal from its accessibility.
B. Consistent reporting functionality is a specific outcome that depends on availability, but it is not the primary, foundational benefit itself.
C. Enhanced identity and access management (IAM) is the set of processes and technologies used to provide access, not the benefit of having that access.

1. ISACA, Cybersecurity Audit Certificate Study Guide, 2019, Chapter 1: Information Security and Cybersecurity Introduction, Section: The CIA Triad, p. 18. The guide explicitly defines availability as "ensuring timely and reliable access to and use of information."

2. ISACA, COBIT 2019 Framework: Governance and Management Objectives, 2018, APO13 Managed Security, p. 137. This section discusses the need to maintain the availability of information and services as a key security management practice.

3. Purdue University, The CERIAS TeXbook on Information Assurance and Security, Vol. 1, Chapter 1: Fundamental Concepts, 2017, p. 4. It defines availability as "the property of a system or a system resource being accessible and usable upon demand by an authorized system entity."

Evidence is primarily obtained and preserved during the Containment phase of the incident response lifecycle. The goal of this phase is to stop the incident from causing further damage. A critical activity is to create forensic images of affected systems (e.g., memory dumps, disk images) before taking any eradication actions. This preserves the state of the system and any volatile evidence that would be lost if the system were shut down or cleaned, ensuring it is available for later analysis.

A. The lessons learned phase is a post-incident review to improve future responses; evidence collection should be long completed by this stage.
C. Eradication involves removing the threat (e.g., malware). This action alters the system and can destroy evidence, which is why preservation must occur beforehand.
D. Recovery is the process of restoring systems to normal operation from clean backups, which would overwrite any remaining evidence on the affected systems.

1. Cichonski, P., Millar, T., Grance, T., & Scarfone, K. (2012). Computer Security Incident Handling Guide (NIST Special Publication 800-61 Rev. 2). National Institute of Standards and Technology. Section 3.3.2, "Containment," states: "At this point, it is also important to preserve evidence, which may be needed for legal action."

2. MIT Information Systems & Technology. (n.d.). Incident Response Plan. Section "Containment Strategy" outlines the need to "Preserve evidence from the compromised system(s) for prosecution." This is a standard university-level implementation of the NIST framework.

3. SANS Institute. (2020). The SANS Incident Handler's Handbook. The handbook details the six steps of incident handling, emphasizing that forensic data collection is a key part of the Containment, Eradication, and Recovery phase, with initial preservation being critical in Containment.

The failure to identify and formalize roles and responsibilities for cybersecurity creates a fundamental gap in governance. Without clear ownership, there is no accountability for performing critical tasks, including the systematic identification, analysis, and evaluation of risks. This lack of accountability is the most direct cause of risks going unidentified, as essential risk management processes are likely to be neglected or overlooked. A well-defined governance structure ensures that risk identification is an assigned, continuous activity rather than an ad-hoc effort.

A. Lack of procedures and guidelines is a failure in execution, but risks may still be identified, albeit managed inconsistently.
C. Disclosure protocols are a component of incident response, which occurs after a risk has materialized, not during risk identification.
D. Recovery processes are part of business continuity and disaster recovery, focusing on responding to events, not identifying risks beforehand.

1. ISACA, Cybersecurity Audit Certificate Program Study Guide, 2022, Domain 1: Cybersecurity and Audit's Role, Section 1.2.1, "Cybersecurity Governance." This section emphasizes that establishing and maintaining a governance framework, which includes defining roles and responsibilities, is essential for overseeing the cybersecurity risk management function.

2. ISACA, COBIT 2019 Framework: Governance and Management Objectives, 2018, APO01 Managed I&T Management Framework, states that a key practice is to "Define organizational structures, roles, and responsibilities," ensuring that all responsibilities, including risk management, are explicitly assigned.

3. De Haes, S., & Van Grembergen, W. (2015). Enterprise Governance of Information Technology: Achieving Alignment and Value, Featuring COBIT 5. Springer. Chapter 3 discusses the importance of structures, roles, and responsibilities as a primary enabler for effective IT governance and risk management.

Asymmetric (public-key) cryptography is significantly slower and more computationally expensive than symmetric cryptography. Therefore, it is inefficient for encrypting large volumes of data. Its most common and effective use is within a hybrid cryptosystem to securely exchange a smaller, single-use symmetric key (a session key). The sender encrypts the session key with the recipient's public key, and the recipient decrypts it with their private key. This fast symmetric key is then used to encrypt the bulk data for the remainder of the session.

A. Encrypting bulk data is the primary use case for faster symmetric algorithms like AES, not slower asymmetric ones.
B. Data streams, like bulk data, are too large to be efficiently encrypted using computationally intensive asymmetric algorithms.
D. Asymmetric public keys are designed to be public and are typically distributed through a trusted Public Key Infrastructure (PKI), not by being encrypted.

1. ISACA. (2019). Cybersecurity Audit Certificate Study Guide (2nd ed.). Chapter 3, "Cybersecurity Operations," p. 80. The guide states, "Asymmetric encryption is often used to encrypt symmetric keys for distribution."

2. Katz, J., & Lindell, Y. (2014). Introduction to Modern Cryptography (2nd ed.). CRC Press. Chapter 10.1, "Public-Key Encryption," pp. 330-332. The text explains the concept of hybrid encryption where a public-key system is used to encrypt a shared key for a symmetric cipher.

3. Stallings, W. (2017). Cryptography and Network Security: Principles and Practice (7th ed.). Pearson. Section 9.2, "The RSA Algorithm," p. 279. The text describes how RSA is often used for the distribution of session keys for symmetric ciphers.

The primary goal of a formal change management process is to ensure stability and continuity of business operations. Uncontrolled or poorly implemented changes are a leading cause of service disruptions, system outages, and security vulnerabilities. By requiring that all changes are properly planned, tested, reviewed, and approved, the process aims to minimize the risk of negative impacts on the production environment and, consequently, the business.

A. Communication is a crucial step within the process, but it is a means to an end, not the primary goal itself.
C. Adhering to a schedule is a project management aspect of the process, but the main goal is a successful, non-disruptive change, not just a timely one.
D. Validating return on investment is a business justification or project management goal, not the primary operational goal of the change management process.

1. ISACA. (2018). COBIT 2019 Framework: Governance and Management Objectives. Management Objective BAI06, "Manage IT Changes," p. 117. The stated purpose is to "enable fast and reliable delivery of change...while mitigating the risk of negatively impacting the stability or integrity of the changed environment."

2. ISACA. (2019). Cybersecurity Audit Certificate Study Guide (2nd ed.). Chapter 3, "Cybersecurity Operations," p. 88. The guide emphasizes that change management controls are implemented to prevent unauthorized changes that could disrupt services.

3. AXELOS. (2019). ITIL Foundation, ITIL 4 Edition. Section 5.2.5, "Change enablement." The purpose of the practice is "to maximize the number of successful IT changes," which inherently involves minimizing disruptions caused by failed changes.