1.0 Information Systems and Data Management ISC Practice Quiz

• A. Network infrastructure encompasses the hardware and software components, including routers, switches, firewalls, and cabling, that enable communication and data transfer between devices and systems within the organization
• B. Network infrastructure consists solely of end-user devices such as laptops and smartphones that employees use to access organizational data
• C. Network infrastructure refers exclusively to the organization's internet service provider connection and has no internal components managed by the organization itself
• D. Network infrastructure is limited to the organization's wireless access points and does not include wired components such as switches or routers

Network infrastructure is the foundational communications layer of IT architecture, encompassing routers (directing traffic between networks), switches (connecting devices within a network), firewalls (controlling traffic flow based on security rules), cabling/wireless systems (physical/wireless transmission media), and supporting software and protocols. Together, these components enable all data communication between servers, end-user devices, cloud resources, and external networks. Understanding network infrastructure is essential for evaluating IT general controls, system availability, and cybersecurity posture.

• A. Software as a Service (SaaS), because the company is accessing software functionality provided by the vendor over the internet
• B. Platform as a Service (PaaS), because the vendor provides a platform on which the company deploys its applications
• C. Function as a Service (FaaS), because the company uses discrete computing functions hosted by the vendor without managing servers
• D. Infrastructure as a Service (IaaS), because the vendor provides the underlying hardware infrastructure while the company manages the software stack above it

Infrastructure as a Service (IaaS) provides virtualized computing resources, servers (compute), storage, and networking, as a service. The vendor manages the physical hardware and virtualization layer. The customer is responsible for everything above: installing the OS, configuring middleware, deploying applications, and managing data. This model provides the most customer control and is used when organizations want to 'lift and shift' their existing on-premises systems to the cloud while maintaining control over their software configurations.

• A. The database server, because it stores the actual financial data and therefore represents the highest concentration of data confidentiality and integrity risk
• B. Network switches, because compromising a switch gives an attacker the ability to intercept all traffic traversing the network
• C. End-user workstations, because employees with local access to their own devices represent the highest insider threat risk in all environments
• D. Web servers, because they are the entry point for all internet traffic and therefore represent the greatest overall risk to the organization

The database server contains the financial data itself, general ledger balances, transaction records, customer information, payroll data. Any unauthorized access, modification, or exfiltration directly affects data confidentiality, integrity, and availability. For an IS auditor evaluating IT general controls, the database server warrants the most stringent access controls: role-based access, privileged access management, database activity monitoring, and separation of duties between DBAs and end users.

• A. Infrastructure as a Service (IaaS), because the cloud provider is supplying computing resources that the development firm uses to build its application
• B. Software as a Service (SaaS), because the cloud provider is delivering a complete software environment that enables the firm's application development work
• C. Desktop as a Service (DaaS), because the developers access virtual development workstations provided and managed by the cloud vendor
• D. Platform as a Service (PaaS), because the cloud provider manages the underlying infrastructure and platform components while the firm focuses on writing and deploying application code

Platform as a Service (PaaS) provides a managed development and deployment environment, including OS, language runtimes, databases, integration services, and deployment pipelines, so that developers can focus entirely on writing application code. Examples include AWS Elastic Beanstalk, Google App Engine, Microsoft Azure App Service, and Heroku. The provider manages all infrastructure and platform layers; the customer manages application code and data. This model maximizes developer productivity while eliminating infrastructure management overhead.

• A. Public cloud with enhanced encryption, adding encryption to a public cloud deployment provides sufficient isolation to meet government sharing restrictions
• B. Private cloud, the agency should deploy its own dedicated infrastructure to avoid any sharing with external parties
• C. Community cloud, cloud infrastructure shared exclusively among organizations with common regulatory requirements (in this case, federal agencies meeting FedRAMP standards)
• D. Hybrid cloud, combining the agency's existing on-premises systems with a commercial public cloud creates the required isolation from non-government tenants

A community cloud is infrastructure shared among organizations with common characteristics, regulatory requirements, or missions. In the federal government context, community clouds like AWS GovCloud or Microsoft Azure Government restrict tenancy to US government entities and contractors meeting FedRAMP requirements. This exactly matches the scenario: shared infrastructure, restricted to a defined community (federal agencies), meeting specific compliance standards. FedRAMP itself was designed to enable this community cloud model for government.

• A. Vulnerability to exploits targeting known security weaknesses in the unpatched operating system, which could allow unauthorized access, privilege escalation, or malware installation on the accounting server
• B. Availability risk only, unpatched systems may experience performance degradation and slowdowns that reduce processing speed for financial transactions
• C. Compliance risk only, the primary consequence of an unpatched operating system is regulatory non-compliance with accounting standards such as GAAP
• D. Data integrity risk only, unpatched operating systems corrupt financial data stored in application databases due to memory management errors in the OS kernel

When an operating system goes 18 months without security patches, all vulnerabilities discovered and disclosed during that period remain unaddressed. Attackers can use publicly available exploit code targeting these known vulnerabilities to: gain unauthorized access to the accounting server, escalate privileges to administrator level, install malware or ransomware, exfiltrate financial data, or establish persistent backdoors. This is among the most common attack vectors in real-world breaches and represents a critical IT general control deficiency that would concern an IS auditor.

• A. IaaS, the company retains responsibility for configuring the operating system and installing security patches on the cloud servers
• B. PaaS, the company retains responsibility for deploying and maintaining the application code on the vendor's platform
• C. SaaS, the company retains no responsibilities because the vendor manages all aspects of the system under a full-service agreement
• D. SaaS, the company retains responsibility for managing user access, ensuring appropriate data is entered, and verifying that the output produced by the software is accurate and complete

Software as a Service (SaaS) delivers a fully managed application over the internet. The vendor manages everything: infrastructure, OS, database, application code, security patches, and updates. Under the shared responsibility model for SaaS, the customer's retained responsibilities are: (1) Identity and access management, provisioning users, assigning appropriate roles, revoking access when employees leave; (2) Data quality, ensuring transactions are entered accurately and that the data processed represents the organization's actual activity; (3) Output verification, reviewing reports and financial statements produced by the software for reasonableness and accuracy; (4) Contractual and compliance requirements, ensuring the SaaS arrangement meets data residency, privacy, and audit rights requirements.

• A. The three-tier architecture has been bypassed, direct web-to-database connectivity eliminates the application server's role as a security control layer; remediation requires firewall rules blocking direct web-to-database connections and routing all database queries through the application server tier
• B. This is an acceptable architecture because the DMZ provides sufficient isolation; no remediation is needed since the web server is behind a firewall
• C. The finding indicates the application server is misconfigured; the web server should always communicate directly with the database to reduce latency, and the application server tier should be removed
• D. The finding only matters if the web server has been compromised; since the web server is not compromised, no remediation is necessary until an actual attack occurs

Three-tier architecture separates presentation (web), logic (application), and data (database) layers specifically to contain the blast radius of a compromise and enforce separation of duties among tiers. The application server should be the only component authorized to query the database. A direct web-to-database connection means: (1) A compromised web server gives an attacker immediate SQL Server access; (2) The application server's input validation and business logic controls can be bypassed; (3) Database credentials may be stored in web tier configuration rather than safely in the application tier. Remediation: firewall rules explicitly denying direct TCP 1433 from the DMZ to the database zone, permitting only the application server's IP to reach the database on that port.