I85PREP
⌘ K
IIBF IT Security study materials
IIBF IT Security study resources

IIBF IT Security practice questions

One question at a time. Build your IIBF IT Security understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Cyber Security

Under the IT Act, 2000, which section deals with tampering with computer source documents?

  1. Section 43
  2. Section 67
  3. Section 65 Correct answer.
  4. Section 66

Explanation

Section 65 of the IT Act, 2000 punishes knowingly or intentionally concealing, destroying, altering or causing another to conceal, destroy or alter computer source code used for a computer, computer programme, computer system or computer network, when the source code is required to be kept or maintained by law. The offence is punishable with imprisonment up to three years or a fine up to two lakh rupees, or both.

Question 2Cyber Security

In a bank's information security programme, which principle of the IT Act, 2000 is directly supported by maintaining accurate and complete records of electronic transactions?

  1. Attribution of electronic records
  2. Legal recognition of electronic records
  3. Retention of electronic records Correct answer.
  4. Authentication of electronic records

Explanation

Section 7 of the IT Act, 2000 deals with retention of electronic records and requires that records be retained in the format in which they were originally generated, sent or received, or in a format that can be demonstrated to represent accurately the information originally generated. Maintaining complete and accurate electronic transaction logs therefore supports the statutory retention requirement.

Question 3Cyber Security

Which type of malware is specifically designed to encrypt a victim's files and demand payment for the decryption key?

  1. Rootkit
  2. Trojan horse
  3. Ransomware Correct answer.
  4. Logic bomb

Explanation

Ransomware encrypts files or locks systems and demands payment, usually in cryptocurrency, in exchange for restoring access. Banking systems face this risk through phishing emails, unpatched vulnerabilities and exposed remote access services.

Question 4Cyber Security

A customer receives an SMS claiming to be from the bank asking them to click a link and re-enter net banking credentials. Which attack does this represent?

  1. Smishing Correct answer.
  2. Pharming
  3. Phishing
  4. Vishing

Explanation

Smishing is phishing conducted through SMS or text messaging, where the attacker sends a fraudulent link or message to harvest credentials or install malware. Because the lure arrives by text message rather than email or a phone call, it is classified as smishing.

Question 5Cyber Security

Which security control is most effective in mitigating the impact of a stolen customer database by rendering the data unreadable without the key?

  1. Security awareness training
  2. Data encryption at rest Correct answer.
  3. Intrusion detection system
  4. Network segmentation

Explanation

Encryption at rest protects stored data so that even if an attacker obtains the database files, the contents remain unreadable without the decryption key. It directly addresses confidentiality of data after a breach, whereas the other controls reduce the likelihood of intrusion rather than the impact of stolen data.

Question 6Cyber Security

In the CIA triad, which property ensures that data has not been altered by an unauthorised party?

  1. Integrity Correct answer.
  2. Non-repudiation
  3. Availability
  4. Confidentiality

Explanation

Integrity ensures that data remains accurate, complete and unaltered except by authorised parties. Hash functions and digital signatures are commonly used to detect unauthorised modification of transaction records.

Question 7Cyber Security

Which of the following is a strong authentication practice for privileged administrator accounts in a bank?

  1. Shared passwords stored in a spreadsheet
  2. Password reuse across systems
  3. Multi-factor authentication with hardware tokens Correct answer.
  4. Disabling audit logging for administrators

Explanation

Multi-factor authentication combining something the administrator knows with a hardware token or cryptographic device significantly reduces the risk of credential compromise for privileged accounts. Sharing credentials or reusing passwords undermines accountability and increases the blast radius of a breach.

Question 8Cyber Security

What is the primary purpose of a firewall in a bank's network architecture?

  1. To provide physical access control to the data centre
  2. To filter network traffic based on defined rules Correct answer.
  3. To encrypt backups stored offsite
  4. To detect malicious code inside email attachments

Explanation

A firewall enforces an access control policy by permitting or denying network traffic based on rules such as source address, destination address and port. It forms a boundary control between trusted internal networks and untrusted external networks.

Question 9Cyber Security

A security team wants to detect unauthorised changes to critical configuration files on a server. Which control best addresses this requirement?

  1. Data loss prevention
  2. File integrity monitoring Correct answer.
  3. Load balancing
  4. Virtual private network

Explanation

File integrity monitoring computes and compares cryptographic hashes of critical files to detect unauthorised modifications. It provides evidence of tampering with system and configuration files, which is a key requirement under security monitoring programmes.

Question 10Cyber Security

Which of the following best describes the principle of least privilege?

  1. Granting all administrators full access to every system
  2. Granting access based on seniority rather than job function
  3. Granting users the maximum access needed for future projects
  4. Granting users only the access required to perform their current duties Correct answer.

Explanation

Least privilege means each user, process or system is granted only the minimum access necessary to perform its authorised function. This limits the damage that can result from accidental error, credential compromise or insider misuse.

Question 11Cyber Security

A bank wants to ensure that a customer cannot deny having authorised an online fund transfer. Which control provides this assurance?

  1. Checksum on the transfer message
  2. Digital signature with a private key held by the customer Correct answer.
  3. Symmetric encryption of the transfer message
  4. Time-stamping of the transfer by the bank

Explanation

A digital signature created with the customer's private key can be verified by others using the corresponding public key, providing non-repudiation and integrity. The customer cannot credibly deny the transaction because only the holder of the private key could have produced the signature.

Question 12Cyber Security

Under a typical security incident response lifecycle, what should immediately follow the containment of a ransomware incident?

  1. Deletion of all backup copies
  2. Eradication of the malware and root cause removal Correct answer.
  3. Payment of ransom
  4. Public disclosure to media

Explanation

After containment limits the spread of the incident, the eradication phase removes the malware, closes the exploited vulnerability and eliminates the root cause before recovery begins. Public disclosure and ransom decisions are separate governance matters, and backups must be preserved.

Question 13Cyber Security

A bank's third-party payment processor suffers a data breach affecting customer records. What is the bank's most appropriate immediate action?

  1. Assess the impact, notify affected customers and report as required by regulation Correct answer.
  2. Ignore the incident because the processor is a separate entity
  3. Terminate all customer accounts without investigation
  4. Delete the processor's records from the bank's systems

Explanation

The bank remains accountable for customer data shared with a service provider, so it must assess the scope and impact, notify affected customers and report to regulators within prescribed timelines. Outsourcing does not transfer regulatory responsibility for the data.

Question 14Cyber Security

Which practice most effectively reduces the risk of SQL injection in a web application handling banking transactions?

  1. Storing database credentials in the application source code
  2. Relying solely on client-side input validation
  3. Displaying detailed database error messages to users
  4. Using parameterised queries with bound parameters Correct answer.

Explanation

Parameterised queries separate SQL code from user-supplied data, so input cannot alter the query structure. This is the primary defence against SQL injection and should be combined with server-side validation and least-privilege database accounts.

Question 15Cyber Security

What is the key distinction between symmetric and asymmetric encryption?

  1. Asymmetric encryption cannot provide confidentiality
  2. Symmetric is always slower than asymmetric encryption
  3. Symmetric uses a single shared key, while asymmetric uses a public and private key pair Correct answer.
  4. Symmetric encryption cannot be used with digital signatures

Explanation

Symmetric encryption uses one shared secret key for both encryption and decryption, while asymmetric encryption uses a mathematically related public and private key pair. Asymmetric algorithms are generally slower and are often used to exchange symmetric keys or to create digital signatures.

Question 16Cyber Security

A security analyst observes repeated failed login attempts from a single IP address against many user accounts. Which attack is most likely occurring?

  1. Man-in-the-middle
  2. Credential stuffing Correct answer.
  3. Denial of service
  4. Cross-site scripting

Explanation

Credential stuffing uses lists of compromised username and password pairs to attempt logins across many accounts, producing many failed attempts from a source. Rate limiting, multi-factor authentication and breached-credential detection are common mitigations.

Question 17Cyber Security

Which of the following is a key requirement for effective security logging in a regulated banking environment?

  1. Logging disabled for performance reasons
  2. Logs accessible only to the application vendor
  3. Logs stored only on the source server with no retention policy
  4. Synchronised time stamps and protected, centralised log storage Correct answer.

Explanation

Accurate correlation and forensic reconstruction require synchronised time across systems, and logs must be centralised and protected from tampering. Retention periods are usually prescribed by regulation and internal policy.

Question 18Cyber Security

A vulnerability scan reports a critical unpatched flaw on an internet-facing server. What is the most appropriate risk treatment?

  1. Apply the vendor patch after testing, or apply a compensating control until patching is possible Correct answer.
  2. Report the finding only at the next annual audit
  3. Accept the risk permanently because the server is business critical
  4. Remove the server from the asset inventory

Explanation

Critical internet-facing vulnerabilities should be remediated promptly through tested patching, or mitigated with compensating controls such as restricting access until patching can be completed. Permanent acceptance or deferral to an annual audit leaves the organisation exposed.

Question 19Cyber Security

What is the primary objective of a business impact analysis in a bank's business continuity planning?

  1. To test employee knowledge of security policies
  2. To determine the interest rate on customer deposits
  3. To identify critical business functions and their recovery time objectives Correct answer.
  4. To calculate the market value of the bank's share price

Explanation

A business impact analysis identifies critical business processes, quantifies the operational and financial impact of their disruption and establishes recovery time and recovery point objectives. These outputs drive the design of continuity and disaster recovery strategies.

Question 20Cyber Security

Which of the following best describes a zero-day vulnerability?

  1. A flaw discovered during a scheduled audit
  2. A flaw for which no vendor patch is yet available Correct answer.
  3. A flaw that has existed for exactly one day
  4. A flaw that affects only mobile devices

Explanation

A zero-day vulnerability is a software flaw unknown to or unpatched by the vendor, meaning defenders have no official fix at the time of exploitation. Organisations rely on compensating controls such as segmentation, monitoring and virtual patching to reduce exposure.

Question 21Cyber Security

A bank deploys a web application firewall in front of its internet banking portal. Which threat does this control most directly mitigate?

  1. Loss of power to the data centre
  2. Exploitation of web application attacks such as SQL injection and cross-site scripting Correct answer.
  3. Insider fraud in the loan approval process
  4. Physical theft of backup tapes

Explanation

A web application firewall inspects HTTP traffic and blocks known attack patterns targeting web applications, including SQL injection and cross-site scripting. It complements secure coding but does not address physical, insider or availability threats.

Question 22Cyber Security

An organisation implements tokenisation for card numbers in its payment systems. What is the main security benefit?

  1. Tokenisation eliminates the need for access control
  2. Tokenisation removes the need for encryption of any data
  3. The original card number is replaced by a surrogate value with no exploitable value if intercepted Correct answer.
  4. Tokenisation guarantees that transactions cannot be repudiated

Explanation

Tokenisation substitutes a sensitive card number with a surrogate token that is meaningless outside the tokenisation environment, reducing the scope of sensitive data exposure and PCI DSS obligations. Access control and encryption remain necessary for the token vault and other data.

Question 23Cyber Security

A security architect is designing defence in depth for a bank. Which combination best reflects the layered principle?

  1. Relying solely on perimeter firewalls for all protection
  2. Removing monitoring to reduce operational cost
  3. Granting administrators unrestricted access to simplify operations
  4. Combining preventive, detective and corrective controls across people, process and technology layers Correct answer.

Explanation

Defence in depth layers independent preventive, detective and corrective controls so that the failure of one control does not expose the organisation entirely. Coverage across people, process and technology ensures resilience against diverse threats.

Question 24Cyber Security

A bank detects anomalous large transfers from a dormant account to newly created beneficiary accounts. Which control combination is most appropriate for detecting and limiting such fraud?

  1. Increasing the daily transfer limit for all customers
  2. Disabling alerts for dormant accounts
  3. Behavioural transaction monitoring with maker-checker approval for beneficiary changes Correct answer.
  4. Periodic password changes for all staff

Explanation

Behavioural monitoring detects unusual transaction patterns, while maker-checker approval on beneficiary changes prevents a single compromised credential from redirecting funds. Together they provide both detection and a preventive barrier against account takeover fraud.

Question 25Cyber Security

Under the IT Act, 2000, which provision addresses unauthorised access, downloading, copying or extraction of data from a computer resource?

  1. Section 43 Correct answer.
  2. Section 65
  3. Section 67
  4. Section 72

Explanation

Section 43 provides civil liability for a person who accesses a computer, computer system or network without the permission of the owner, including downloading, copying or extracting data, and is liable to pay compensation. Criminal provisions such as Section 66 apply where dishonest or fraudulent intent is established.

Question 26Cyber Security

A bank's security policy requires that every employee be granted only the access rights needed to perform their current job, and that these rights be reviewed and revoked when they change roles. This requirement is a direct application of which security principle?

  1. Least privilege Correct answer.
  2. Defence in depth
  3. Separation of duties
  4. Need to know

Explanation

Least privilege means granting users the minimum access necessary for their job function and removing it when no longer required. Separation of duties divides a sensitive task among multiple people, defence in depth layers controls, and need to know restricts access to specific information rather than system permissions.

Question 27Cyber Security

A security administrator is configuring a system that must verify both the integrity and the origin of a software update package before installation. Which cryptographic mechanism directly provides this assurance?

  1. A digital signature created with the vendor's private key Correct answer.
  2. Symmetric encryption of the package with a shared secret key
  3. Hashing the package with SHA-256 and storing the hash locally
  4. Encoding the package in Base64 before transmission

Explanation

A digital signature is generated with the sender's private key and verified with the corresponding public key, so it proves both the origin of the package and that it has not been altered. Symmetric encryption alone does not prove origin, and a locally stored hash does not authenticate the source.

Question 28Cyber Security

A bank's incident response team is reviewing the phases of its incident handling process. After an incident has been contained and eradicated, which activity belongs to the recovery phase?

  1. Restoring affected systems from known-good backups and confirming normal service Correct answer.
  2. Preserving forensic images of compromised disks
  3. Notifying the regulator of the incident
  4. Identifying the vulnerability that was exploited

Explanation

Recovery focuses on returning systems to normal operation safely, typically by restoring from trusted backups and validating that service is restored. Identifying the exploited vulnerability belongs to investigation or eradication, forensic imaging to evidence collection, and regulatory notification to communication.

Question 29Cyber Security

A bank wants to reduce the risk that a single compromised administrator account can both create a new payee and approve a high-value payment. Which control most directly addresses this risk?

  1. Enforcing a minimum password length of twelve characters
  2. Installing an antivirus agent on the administrator workstation
  3. Requiring two administrators to act jointly for such payments Correct answer.
  4. Enabling verbose audit logging on the payment system

Explanation

Separation of duties ensures that no single account holds both the ability to set up a payee and the authority to approve the payment, so one compromised credential is insufficient. Password length, logging, and antivirus reduce other risks but do not split the transaction authority.

Question 30Cyber Security

A bank's security team is selecting controls for its internet banking application. Which combination best illustrates the concept of defence in depth?

  1. A single next-generation firewall protecting all application traffic
  2. Requiring a password and then a PIN at login
  3. A web application firewall, input validation in code, and database activity monitoring Correct answer.
  4. Encrypting the database and encrypting the backup tapes

Explanation

Defence in depth means layering independent controls at different points so that failure of one does not expose the whole system. A WAF, secure coding input validation, and database monitoring operate at separate layers, whereas the other options repeat controls of the same type.

Question 31Cyber Security

A security analyst notices that a workstation is making repeated DNS queries for randomly generated domain names that resolve to a small set of IP addresses. Which threat is most consistent with this pattern?

  1. An SQL injection attempt against the customer database
  2. A domain generation algorithm used by malware for command and control Correct answer.
  3. A distributed denial-of-service attack against the bank's website
  4. A phishing email campaign targeting customers

Explanation

Malware using a domain generation algorithm produces many pseudo-random domain lookups to locate its command-and-control server while evading blocklists. Phishing, DDoS, and SQL injection do not typically manifest as high-volume random DNS queries from an internal host.

Question 32Cyber Security

A bank stores card numbers in its payment database. To reduce the impact of a database breach while still allowing reconciliation, the bank replaces each card number with a non-reversible surrogate value and keeps the mapping in a separate hardened vault. Which technique is being used?

  1. Tokenisation Correct answer.
  2. Asymmetric encryption
  3. Data masking
  4. Steganography

Explanation

Tokenisation substitutes a sensitive value with a surrogate token and stores the mapping in a protected vault, so the database alone is useless to an attacker. Masking obscures data for display, encryption is reversible with a key, and steganography hides data in other media.

Question 33Cyber Security

An application development team at a bank wants to prevent attackers from injecting malicious SQL through login form fields. Which practice is the most effective primary control?

  1. Hiding detailed database error messages from users
  2. Restricting the database account to read-only access
  3. Escaping single quotes in user input on the client side
  4. Using parameterised queries with bound parameters Correct answer.

Explanation

Parameterised queries separate SQL code from data so that user input is never interpreted as SQL syntax, which eliminates the injection vector. Client-side escaping can be bypassed, error hiding only reduces information leakage, and read-only accounts still allow data theft.

Question 34Cyber Security

A bank's security operations centre receives an alert that a privileged service account has been used to log in from an overseas IP address at 3 a.m., outside its normal pattern. Which action best reflects the first containment step?

  1. Send a warning email to the account owner and wait for a reply
  2. Disable or lock the account and preserve session logs for investigation Correct answer.
  3. Immediately delete the service account from the directory
  4. Rebuild the entire data centre network from scratch

Explanation

Containment should stop the suspected unauthorised use quickly while preserving evidence, so disabling the account and retaining logs is appropriate. Deleting the account destroys evidence, waiting allows further damage, and rebuilding the network is disproportionate.

Question 35Cyber Security

A bank's vulnerability management team finds a critical remote code execution flaw on an internet-facing server for which no vendor patch exists. Which risk treatment is most appropriate in the short term?

  1. Transfer the risk by purchasing cyber insurance only
  2. Apply compensating controls such as network segmentation and virtual patching Correct answer.
  3. Accept the risk because no patch is available
  4. Ignore the finding until the next quarterly scan

Explanation

When no patch exists, compensating controls reduce exposure while the vendor develops a fix; segmentation limits reach and a virtual patch blocks known exploit patterns. Accepting or ignoring the risk leaves an internet-facing critical flaw exposed, and insurance alone does not reduce the likelihood of exploitation.

Question 36Cyber Security

A bank's identity team is implementing multifactor authentication for online banking customers. Which combination correctly represents two different authentication factors?

  1. A fingerprint and a facial scan
  2. A password and a one-time code generated by a hardware token Correct answer.
  3. A password and a secret question
  4. A PIN and a password

Explanation

Multifactor authentication requires factors from different categories: something you know, something you have, or something you are. A password is knowledge and a hardware token code is possession, so together they satisfy two categories.

Question 37Cyber Security

A security architect is reviewing network zones for a bank. The demilitarised zone hosts the internet-facing web servers, while the core banking database sits in an internal zone. Which control most directly limits lateral movement from a compromised web server into the internal zone?

  1. A stateful firewall rule set that permits only required application traffic between zones Correct answer.
  2. Daily full backups of the database
  3. A password complexity policy for database users
  4. Full-disk encryption on the web servers

Explanation

Zone-based firewalling restricts which hosts and ports can communicate between the DMZ and the internal network, limiting an attacker's ability to move laterally. Disk encryption, password policy, and backups address other risks and do not constrain network paths.

Question 38Cyber Security

A bank is designing logging for its core payment systems to meet regulatory expectations. Which property is most important for the audit trail to be reliable?

  1. Logs written to append-only storage with integrity protection and synchronised time Correct answer.
  2. Logs accessible to all administrators for convenience
  3. Logs stored only on the server that generates them
  4. Logs retained for a maximum of seven days to save space

Explanation

Reliable audit trails require that entries cannot be altered or deleted, that timestamps are consistent across systems, and that records are retained for the required period. Local-only, short-retention, or widely accessible logs undermine the evidential value of the trail.

Question 39Cyber Security

A bank's fraud monitoring system flags a dormant savings account that has suddenly transferred a large sum to three newly created beneficiary accounts in different branches. Which control combination most directly addresses this scenario?

  1. Antivirus scanning of the customer's mobile device
  2. Behavioural analytics with step-up authentication and beneficiary cooling periods Correct answer.
  3. Encrypting the account statement emails
  4. Stronger password hashing and session timeouts

Explanation

Detecting anomalous behaviour, requiring additional verification for unusual transactions, and delaying newly added beneficiaries together reduce the chance of a fraudulent transfer succeeding. Password hashing, antivirus, and email encryption address unrelated threats.

Question 40Cyber Security

A bank's security team discovers that an attacker exploited a previously unknown vulnerability in its internet banking portal before any patch was available. Which characteristic defines this as a zero-day vulnerability?

  1. The vulnerability affects only zero-day-old software installations
  2. The vulnerability was disclosed to the public before the vendor was notified
  3. The vulnerability requires zero user interaction to exploit
  4. The vulnerability was exploited before the vendor made a fix available Correct answer.

Explanation

A zero-day vulnerability is one that is exploited before the vendor has released a patch or before defenders are aware, leaving no available fix at the time of attack. Public disclosure timing, software age, and user interaction are separate characteristics.

Question 41Information Security

In an IT security policy for a bank, which principle states that a user should be granted only the access rights necessary to perform their assigned job functions?

  1. Principle of separation of duties
  2. Principle of dual control
  3. Principle of defence in depth
  4. Principle of least privilege Correct answer.

Explanation

Least privilege limits each account to the minimum permissions required for its tasks, reducing the impact of misuse or compromise. Separation of duties, defence in depth and dual control address different controls, so they do not define this minimum-access rule.

Question 42Information Security

A bank wants to confirm that a customer-initiated fund transfer was actually authorised by that customer and cannot be denied later. Which security service is being provided?

  1. Non-repudiation Correct answer.
  2. Availability
  3. Confidentiality
  4. Anonymity

Explanation

Non-repudiation provides evidence, typically through digital signatures and audit logs, that a specific party originated a transaction so they cannot later deny it. Confidentiality protects secrecy, availability protects timely access, and anonymity hides identity, so none of these prove origin.

Question 43Information Security

Which type of malware self-replicates across networks by exploiting vulnerabilities in other systems without requiring a user to open a file?

  1. Rootkit
  2. Logic bomb
  3. Worm Correct answer.
  4. Trojan horse

Explanation

A worm propagates automatically by exploiting network services or vulnerabilities, spreading without user interaction. A Trojan relies on disguising itself, a logic bomb triggers on a condition, and a rootkit hides an intruder's presence, so none of these describe autonomous network self-replication.

Question 44Information Security

What is the primary purpose of encrypting data at rest in a core banking database?

  1. To speed up database query performance
  2. To verify that transactions are complete and accurate
  3. To render stored data unreadable to anyone without the correct key Correct answer.
  4. To ensure the database remains online during hardware failure

Explanation

Encryption at rest converts stored data into ciphertext so that unauthorised readers, including someone who steals a disk or backup, cannot interpret it without the key. It does not improve query speed, prove transaction integrity, or provide high availability.

Question 45Information Security

In a public key infrastructure, which key is used by a sender to encrypt a message so that only the intended recipient can decrypt it?

  1. The recipient's public key Correct answer.
  2. The sender's private key
  3. The recipient's private key
  4. The sender's public key

Explanation

Encrypting with the recipient's public key means only the matching private key, held by the recipient, can decrypt it. The sender's private key is used for signing, and private keys are never shared with the sender.

Question 46Information Security

A phishing email impersonates the bank's IT helpdesk and asks an employee to confirm their password via a link. Which control most directly reduces the risk of credential compromise from this attack?

  1. Security awareness training with simulated phishing exercises Correct answer.
  2. Daily incremental database backups
  3. Full-disk encryption on employee laptops
  4. Network segmentation of the core banking zone

Explanation

Phishing exploits user behaviour, so recurring awareness training and simulated phishing tests teach staff to recognise and report fraudulent requests. Encryption, backups and segmentation address other threats and do not stop an employee from disclosing a password.

Question 47Information Security

Which of the following best describes a denial-of-service attack against a bank's internet banking portal?

  1. Flooding the service with traffic so that legitimate customers cannot access it Correct answer.
  2. Encrypting customer files and demanding payment
  3. Stealing customer credentials by impersonating the login page
  4. Altering transaction records to commit fraud

Explanation

A denial-of-service attack exhausts resources such as bandwidth or connections so that genuine users are denied service. Credential theft, record alteration and file encryption describe phishing, data tampering and ransomware respectively.

Question 48Information Security

What does the 'A' in the CIA triad of information security represent?

  1. Auditability
  2. Authentication
  3. Availability Correct answer.
  4. Authorisation

Explanation

The CIA triad stands for Confidentiality, Integrity and Availability. Availability ensures authorised users can access systems and data when required, while authentication, authorisation and auditability are separate security functions.

Question 49Information Security

A security team needs to detect unauthorised changes to critical system configuration files. Which control is most appropriate?

  1. Load balancing across multiple application servers
  2. File integrity monitoring that compares hashes against a known baseline Correct answer.
  3. Password complexity enforcement for administrators
  4. Data loss prevention applied to outgoing email

Explanation

File integrity monitoring computes cryptographic hashes and alerts when they diverge from an approved baseline, revealing unauthorised modification. DLP, load balancing and password rules address different risks and do not detect file changes.

Question 50Information Security

An organisation wants to verify that a downloaded software patch genuinely came from the vendor and was not altered in transit. Which mechanism should be used?

  1. Verifying the vendor's digital signature on the patch Correct answer.
  2. Scanning the patch with antivirus before installation
  3. Checking the file size matches the website listing
  4. Installing the patch only during non-business hours

Explanation

A digital signature created with the vendor's private key can be verified with their public key, confirming both origin and integrity of the patch. File size, antivirus scanning and timing do not prove authenticity or detect subtle tampering.