ISFS Online Practice Questions and Answers

You are the owner of the courier company SpeeDelivery. You employ a few people who, while waiting to make a delivery, can carry out other tasks. You notice, however, that they use this time to send and read their private mail and surf the Internet. In legal terms, in which way can the use of the Internet and e-mail facilities be best regulated?

A. Installing an application that makes certain websites no longer accessible and that filters attachments in e-mails

B. Drafting a code of conduct for the use of the Internet and e-mail in which the rights and obligations of both the employer and staff are set down

C. Implementing privacy regulations

D. Installing a virus scanner

You have just started working at a large organization. You have been asked to sign a code of conduct as well as a contract. What does the organization wish to achieve with this?

A. A code of conduct helps to prevent the misuse of IT facilities.

B. A code of conduct is a legal obligation that organizations have to meet.

C. A code of conduct prevents a virus outbreak.

D. A code of conduct gives staff guidance on how to report suspected misuses of IT facilities.

What is the most important reason for applying segregation of duties?

A. Segregation of duties makes it clear who is responsible for what.

B. Segregation of duties ensures that, when a person is absent, it can be investigated whether he or she has been committing fraud.

C. Tasks and responsibilities must be separated in order to minimize the opportunities for business assets to be misused or changed, whether the change be unauthorized or unintentional.

D. Segregation of duties makes it easier for a person who is ready with his or her part of the work to take time off or to take over the work of another person.

What is the relationship between data and information?

A. Data is structured information.

B. Information is the meaning and value assigned to a collection of data.

Under which condition is an employer permitted to check if Internet and email services in the workplace are being used for private purposes?

A. The employer is permitted to check this if the employee is informed after each instance of checking.

B. The employer is permitted to check this if the employees are aware that this could happen.

C. The employer is permitted to check this if a firewall is also installed.

D. The employer is in no way permitted to check the use of IT services by employees.

You are the owner of a growing company, SpeeDelivery, which provides courier services. You decide that it is time to draw up a risk analysis for your information system. This includes an inventory of the threats and risks. What is the relation between a threat, risk and risk analysis?

A. A risk analysis identifies threats from the known risks.

B. A risk analysis is used to clarify which threats are relevant and what risks they involve.

C. A risk analysis is used to remove the risk of a threat.

D. Risk analyses help to find a balance between threats and risks.

You apply for a position in another company and get the job. Along with your contract, you are asked to sign a code of conduct. What is a code of conduct?

A. A code of conduct specifies how employees are expected to conduct themselves and is the same for all companies.

B. A code of conduct is a standard part of a labor contract.

C. A code of conduct differs from company to company and specifies, among other things, the rules of behavior with regard to the usage of information systems.

At Midwest Insurance, all information is classified. What is the goal of this classification of information?

A. To create a manual about how to handle mobile devices

B. Applying labels making the information easier to recognize

C. Structuring information according to its sensitivity

Which one of the threats listed below can occur as a result of the absence of a physical measure?

A. A user can view the files belonging to another user.

B. A server shuts off because of overheating.

C. A confidential document is left in the printer.

D. Hackers can freely enter the computer network.

What is the best description of a risk analysis?

A. A risk analysis is a method of mapping risks without looking at company processes.

B. A risk analysis helps to estimate the risks and develop the appropriate security measures.

C. A risk analysis calculates the exact financial consequences of damages.