IIA-CIA-Part3 Exam Dumps : Internal Audit Function

A help desk function is responsible for providing technical support and maintenance services to end users. This includes troubleshooting issues, production support, and system maintenance rather than managing infrastructure or security architecture.

Let’s analyze each option:

Option A: Maintenance service items such as production support.

Correct. The help desk primarily provides user support, including:

Troubleshooting software and hardware issues

Resolving technical support requests

Assisting users with system access and operational questions

IIA Reference: Internal auditors assess IT service management, including help desk functions, to ensure efficient IT support and incident response. (IIA GTAG: Auditing IT Service Management)

Option B: Management of infrastructure services, including network management.

Incorrect. Infrastructure services (such as network and server management) fall under IT operations or network administration, not the help desk.

Option C: Physical hosting of mainframes and distributed servers

Incorrect. Hosting and maintaining physical servers is the responsibility of data center operations, not the help desk.

Option D: End-to-end security architecture design.

Incorrect. Security architecture design is handled by the IT security team or cybersecurity department, not the help desk.

Thus, the verified answer is A. Maintenance service items such as production support.

Ransomware is a type of cyberattack where malicious software encrypts an organization ' s data, making it inaccessible until a ransom is paid to the attacker. This aligns with the question’s scenario, where denial-of-service is caused by malicious data encryption.

Let ' s analyze the options:

A. Phishing:

Phishing is a social engineering attack that tricks individuals into providing sensitive information, such as usernames, passwords, or credit card numbers. It does not involve encryption or direct denial-of-service.

B. Ransomware (✅ Correct Answer):

Ransomware encrypts critical data and demands a ransom for its release, effectively causing a denial-of-service scenario since the victim cannot access their own systems.

Some well-known ransomware attacks include WannaCry and NotPetya.

C. Hacking:

Hacking is a broad term for unauthorized access to systems but does not specifically refer to denial-of-service through encryption. Ransomware is a specific type of hacking attack.

D. Malware:

Malware (malicious software) is a general category that includes viruses, trojans, worms, spyware, and ransomware. While ransomware is a type of malware, not all malware encrypts data to demand ransom.

IIA Global Technology Audit Guide (GTAG) – Auditing Cybersecurity Risks – Discusses various cyber threats, including ransomware.

NIST Cybersecurity Framework (CSF) – Defines ransomware as a major threat that disrupts business continuity.

COBIT Framework (Control Objectives for Information and Related Technologies) – Addresses risks associated with ransomware and how internal auditors should assess controls.

ISO/IEC 27001 – Information Security Management Systems (ISMS) – Identifies the importance of cybersecurity measures to prevent ransomware attacks.

IIA References:

A firewall is a network security device that monitors and controls incoming and outgoing network traffic based on predefined security rules. It is the primary control for preventing unauthorized external access to an organization ' s network, making it the best answer.

A. Firewall (Correct Answer) – Firewalls prevent unauthorized access by filtering traffic, blocking malicious connections, and securing the network perimeter.

B. Encryption – While encryption protects data confidentiality, it does not actively prevent unauthorized access to a network.

C. Antivirus – Antivirus software protects against malware and viruses but does not prevent unauthorized network access.

D. Biometrics – Biometrics controls physical or logical access (e.g., fingerprint authentication) but does not secure a network from external threats.

IIA GTAG 15 – Information Security Governance highlights firewalls as a critical security control for network protection.

IIA IPPF Standard 2110 – Governance emphasizes the need for network security policies that include firewalls.

NIST SP 800-41 Rev. 1 – Guidelines on Firewalls and Firewall Policy states that firewalls are the first line of defense in securing organizational networks.

Explanation of Each Option:IIA References: