ITPEC FE Morning April 2020 Question 59
An information security audit was performed about the security when backup media that contain confidential information are handed over to a vendor for external storage. Among situations that are identified as a result of this audit, which of the following is a situation that the auditor should record in the audit report as a finding?
Explanation
Handing the backup media to the vendor in a cardboard box — confidential media leave the organization without physical protection against loss, theft or viewing.
Backup media with confidential information are most exposed while in transit. A proper control ships them in a locked or tamper-evident container, so that loss is less likely and any opening can be detected. A plain cardboard box offers neither, which is a weakness in the control the audit examines, so the auditor records it as a finding.
Answer (b)
Why not others:
- •(a) — logging the date and details of each handover and obtaining the vendor's receipt stamp creates the trail that shows where every medium is
- •(c) — a contract requiring periodic confirmation of the storage status lets the outsourcer check the media remain safe at the vendor
- •(d) — a contract with confidentiality provisions binds the vendor to protect the information before any media are handed over
Key rule: In finding questions, three options describe controls that are in place; the finding is the one that leaves a risk to the audited asset uncontrolled.
System Audit · AI-written, may contain errors
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official FE past-paper collection or Report an issue.