[Q17-Q35] Free ISFS Exam Files Downloaded Instantly UPDATED [2023]

4/5 - (1 vote)

Free ISFS Exam Files Downloaded Instantly UPDATED [2023]

100% Pass Guaranteed Free ISFS Exam Dumps

EXIN Information Security Foundation based on ISO/IEC 27001 (ISFS) certification exam is a globally recognized credential that validates a comprehensive understanding of information security management fundamentals. The technical qualification is suitable for professionals with little or no prior knowledge of information security management systems (ISMSs). It helps in making a candidate well-versed with the concepts of information security management, information security control, and risk management. Information Security Foundation based on ISO/IEC 27001 certification confirms their ability to comprehend the standard terminology used in the industry.

NO.17 Which of the following measures is a corrective measure?

Incorporating an Intrusion Detection System (IDS) in the design of a computer centre

Installing a virus scanner in an information system

Making a backup of the data that has been created or altered that day

Restoring a backup of the correct database after a corrupt copy of the database was written over the original

NO.18 What is the best description of a risk analysis?

A risk analysis is a method of mapping risks without looking at company processes.

A risk analysis helps to estimate the risks and develop the appropriate security measures.

A risk analysis calculates the exact financial consequences of damages.

NO.19 When we are at our desk, we want the information system and the necessary information to be available. We want to be able to work with the computer and access the network and our files.
What is the correct definition of availability?

The degree to which the system capacity is enough to allow all users to work with it

The degree to which the continuity of an organization is guaranteed

The degree to which an information system is available for the users

The total amount of time that an information system is accessible to the users

Explanation/Reference:

NO.20 What is the relationship between data and information?

Data is structured information.

Information is the meaning and value assigned to a collection of data.

NO.21 The company Midwest Insurance has taken many measures to protect its information. It uses an Information Security Management System, the input and output of data in applications is validated, confidential documents are sent in encrypted form and staff use tokens to access information systems. Which of these is not a technical measure?

Information Security Management System

The use of tokens to gain access to information systems

Validation of input and output data in applications

Encryption of information

NO.22 There is a network printer in the hallway of the company where you work. Many employees dont pick up their printouts immediately and leave them in the printer. What are the consequences of this to the reliability of the information?

The integrity of the information is no longer guaranteed.

The availability of the information is no longer guaranteed.

The confidentiality of the information is no longer guaranteed.

NO.23 What do employees need to know to report a security incident?

How to report an incident and to whom.

Whether the incident has occurred before and what was the resulting damage.

The measures that should have been taken to prevent the incident in the first place.

Who is responsible for the incident and whether it was intentional.

NO.24 You work in the IT department of a medium-sized company. Confidential information has got into the wrong hands several times. This has hurt the image of the company. You have been asked to propose organizational security measures for laptops at your company. What is the first step that you should take?

Formulate a policy regarding mobile media (PDAs, laptops, smartphones, USB sticks)

Appoint security personnel

Encrypt the hard drives of laptops and USB sticks

Set up an access control policy

Explanation/Reference:

NO.25 Which is a legislative or regulatory act related to information security that can be imposed upon all organizations?

ISO/IEC 27001:2005

Intellectual Property Rights

ISO/IEC 27002:2005

Personal data protection legislation

NO.26 At Midwest Insurance, all information is classified. What is the goal of this classification of information?

To create a manual about how to handle mobile devices

Applying labels making the information easier to recognize

Structuring information according to its sensitivity

NO.27 What is the best way to comply with legislation and regulations for personal data protection?

Performing a threat analysis

Maintaining an incident register

Performing a vulnerability analysis

Appointing the responsibility to someone

NO.28 You are the owner of the courier company SpeeDelivery. You employ a few people who, while waiting to make a delivery, can carry out other tasks. You notice, however, that they use this time to send and read their private mail and surf the Internet. In legal terms, in which way can the use of the Internet and e-mail facilities be best regulated?

Installing an application that makes certain websites no longer accessible and that filters attachments in e-mails

Drafting a code of conduct for the use of the Internet and e-mail in which the rights and obligations of both the employer and staff are set down

Implementing privacy regulations

Installing a virus scanner

NO.29 In the organization where you work, information of a very sensitive nature is processed. Management is legally obliged to implement the highest-level security measures. What is this kind of risk strategy called?

Risk bearing

Risk avoiding

Risk neutral

NO.30 You work in the office of a large company. You receive a call from a person claiming to be from the Helpdesk.
He asks you for your password. What kind of threat is this?

Natural threat

Organizational threat

Social Engineering

NO.31 The act of taking organizational security measures is inextricably linked with all other measures that have to be taken. What is the name of the system that guarantees the coherence of information security in the organization?

Information Security Management System (ISMS)

Rootkit

Security regulations for special information for the government

NO.32 Some threats are caused directly by people, others have a natural cause. What is an example of an intentional human threat?

Lightning strike

Arson

Flood

Loss of a USB stick

NO.33 What is an example of a security incident?

The lighting in the department no longer works.

A member of staff loses a laptop.

You cannot set the correct fonts in your word processing software.

A file is saved under an incorrect name.

NO.34 Midwest Insurance controls access to its offices with a passkey system. We call this a preventive measure.
What are some other measures?

Detective, repressive and corrective measures

Partial, adaptive and corrective measures

Repressive, adaptive and corrective measures

NO.35 A couple of years ago you started your company which has now grown from 1 to 20 employees. Your companys information is worth more and more and gone are the days when you could keep it all in hand yourself. You are aware that you have to take measures, but what should they be? You hire a consultant who advises you to start with a qualitative risk analysis. What is a qualitative risk analysis?

This analysis follows a precise statistical probability calculation in order to calculate exact loss caused by damage.

This analysis is based on scenarios and situations and produces a subjective view of the possible threats.

Loading …