Premium Resources

U25160 - SECMAN - SECURITY MANAGEMENT 2018/2019 Past Paper Solution

SECTION A

You must answer ALL questions in this section

Question 1
Which of the following does not concern information integrity?

A. Unauthorised modifications to records
B. Accidental errors made during data entry

C. Corruption of digital data
D. Leaking of data to unauthorised individuals

Question 2

Which of the following is the most accurate definition of risk?

[3 Marks]

A. Risk is the combination of probability of an event and its consequences.

B. Risk is the product of a threat actor and a vulnerability.
C. Risk is the magnitude of impact to an organisation when under attack.

D. Risk is the aggregation of the likelihood of an incident and its frequency.

[2 Marks]

Question 3
Which of the following is not a valid response when managing risk?

A. Transfer risk - risk is shifted to or shared with a third party organisation.
B. Avoid risk - risk is terminated by stopping an overly risky business activity.

C. Postpone risk - risk is ignored until more quantitative data is available.
D. Accept risk - no action is taken to reduce risk if it is at a tolerable level.

[3 Marks]

Question 4

Which of the following is the correct equation for calculating Annualized Loss Expectancy?

A. ARO=SLE-ARO

B. ALE=SLE*ARO

C. ALE=ARO/SLE

D. SLE=ARO+SLE

[2 Marks]

Question 5
Which of the following is not an activity/phase expected to be included within an incident response plan?

A. Assessing Risk
B. Detection and Reporting
C. Containment, Eradication and Recovery

D. Lessons Learnt

 [3 Marks]

Question 6

Discussion-based exercises, Table top exercises and Live exercises are three common testing strategies for an incident response plan. Which of the following statements is not true?

1. Live exercises are particularly useful for testing logistics, communications and physical capabilities.
2. Table top exercises involve a realistic scenario and a time line (real time or accelerated).
3. Discussion-based exercises involve staff talking through their responses in turn as the scenario unfolds.
4. Live exercises are expensive to set up on the day and demand the most extensive preparation.

Question 7

Which statement correctly defines an internal control strategy?

1. Separation of duties - A task involving sensitive information is split into components each of which is carried out by the same person.
2. Job rotation - Two employees review and approve each other's work before the task is considered complete.
3. Mandatory Vacation - The company requires a minimum number of days to be taken as leave by an employee.
4. Need to Know - Maximum information access is granted just in case it is useful information to perform role.

[3 Marks]

Question 8

Which of the following accurately lists the three common factors used for authentication?

A. Something you are, something you were, something you do
B. Something you know, something you remember, something you calculate

C. Something you have, something you own, something you use
D. Something you are, something you have, something you know

 [2 Marks]

[Total marks for section A = 20 Marks]

 

 

SECTION B
You must answer TWO out of THREE questions in this section

Question 9
This question covers risk management.

a)  Given the KRIs “Mean Time to Deploy Critical Patches” measured in hour/patch, “Mean Cost to Patch” measured in £/patch and “Mean Time to Mitigate Vulnerabilities” measured in hour/vulnerability, give the mathematical formula for a new KRI that would reflect the cost of dealing with a single vulnerability measured in £/vulnerability. Define this formula in terms of the above three KRIs.

[10 marks]

Answer (Purchase the full solution by adding this document to the cart)

Average Cost of Mitigating a Single Vulnerability (CMSV) which is $/vulnerability

Steps involved in deriving the KRI is provided below:

• Step 1: Invert the Mean Time to Deploy Critical Patches which will make the unit to (patch/hour)
• Step 2: Calculate Mean Time to Deploy Critical Patches^-1 X Mean Cost to Patch which will make the unit to ($/hour)
• Step 3: Multiply the results of step 2 with Mean Time to Mitigate Vulnerabilities which will make the unit to ($vulnerability)

Therefore

The formula for CMSV = Mean Time to Deploy Critical Patches^-1 X Mean Cost to Patch X Mean Time to Mitigate Vulnerabilities

b)  Name, for each of the following two SQL commands, the type of the SQL injection attack the command is attempting to achieve.

1- SELECT * FROM Books WHERE ISBN = ‘0736252588’ AND 1=1
2- SELECT * FROM Statements WHERE
Date > ‘2013-07-01’ UNION SELECT * FROM cc WHERE CardNumber !=‘’

[10 marks]

Answer (Purchase the full solution by adding this document to the cart)

SELECT * FROM Books WHERE ISBN = ‘0736252588’ AND 1=1

1=1 is always true. Therefore, the above query will return all the rows from Books table which has the ISBN number ‘0736252588’.

SELECT * FROM Statements WHERE Date > ‘2013-07-01’ UNION SELECT * FROM cc WHERE CardNumber !=‘’

This is a UNION attack. the UNION keyword can be used to retrieve data from other tables within the database.

 

c)  According to a binary risk analysis, determine what  the overall risk value would be for the following four cases:

1- Threat likelihood = “Medium” and Threat Impact = “Low” 2- Threat likelihood = “Low” and Threat Impact = “High”
3- Threat likelihood = “Medium” and Threat Impact = “High” 4- Threat likelihood = “High” and Threat Impact = “Medium”

[20 marks] [Total marks for Question 9 = 40 Marks]

Question 10

This question covers policies, people and planning based security controls.

a)  Briefly describe the differences between an organisation's policies, procedures and guidelines. Provide examples of each to help differentiate them within your answer.

[18 marks]

b)  List FOUR actions that may be required to be undertaken when an employee leaves an organisation.

 [4 marks]

Question 11

This question covers technical security controls.

a)  Briefly explain the differing purposes of authentication, authorisation and accounting within the context of access control. Provide examples of each to help differentiate them within your answer.

[18 marks]

b)  Briefly describe the difference between a signature-based and statistical anomaly-based Intrusion Detection System (IDS)?

[10 marks]

c)  Briefly outline the advantages and disadvantages of symmetric and asymmetric cryptography and explain how a hybrid cryptosystem combines the benefits of each.

 [12 marks]

[Total marks for question 11 = 40 Marks]

[Total Marks for section B = 80 Marks] END OF EXAMINATION PAPER

Last updated: Mar 13, 2020 08:11 AM

add to cart ← Back