[2021] CISA Actual Exam Dumps, CISA Practice Test
FreePdfDump CISA dumps & Isaca Certification sure practice dumps
What Are Topics Tested in ISACA CISA Certification Exam?
The skills tested in the CISA exam include the following domains:
- IT Governance and Management (17%);
- Information Assets Protection (27%).
- Business Resilience and Operation of Information Systems (23%);
- Auditing Process of Information System (21%);
- Information Systems Implementation, Development, and Acquisition (12%);
The first topic is split into two parts. Therefore, candidates will need to demonstrate their skills in planning and executing the IS auditing process. The first subsection includes questions that will test the candidates' ability to manage IS audit standards, and apply the ISACA code of ethics. Also, they will need to show their experience in developing business processes and choose the right types of controls to improve business performance. Besides, they should be experts in risk-based audit planning and develop the right types of audits and assessments. The second subtopic focuses on concepts like audit project management and sampling methodology. Also, examinees should know how to audit evidence collection techniques and work with data analytics, as well as reporting and communication techniques.
Within the second domain, examinees will need to ensure IT governance and IT management. This means that they should be proficient in developing a coherent IT strategy and governance. Also, they should develop IT-related frameworks, standards, procedures, and policies. Candidates should be skilled in ensuring a correct organizational structure and enterprise architecture. They should also show maturity in handling enterprise risk management features and comply with the laws and the organization's standards. When it comes to IT management, applicants should know how to manage IT resources and manage IT service provider acquisition. Last but not least, they should ensure correct monitoring and reporting of IT performance and focus on IT quality assurance and management.
The third chapter focuses on information systems acquisition and development. Candidates should demonstrate their ability to govern and manage projects as well as develop a correct business case and feasibility analysis. Examinees will be required to answer questions related to system development methodologies and control design and identification features. The second subtopic included in this section handles Information Systems implementation. Thus, applicants will need to master testing methodologies and know how to configure and release the right management tools. Candidates should also focus on infrastructure deployment, data conversion, and system migration. The post-implementation review is also an important topic included here.
The fourth chapter concentrates on business resilience and information systems operations. Examinees will need to demonstrate how familiar they are with Business Impact Analysis, system resiliency, Business Continuity Plans, and Disaster Recovery Plans. These skills show the candidates' expertise in coming up with solutions that ensure business continuity in case something doesn't work as planned. This chapter also asks candidates to demonstrate that they know how to manage Common Technology components, master data governance, and end-user computing. Besides, they should be experienced in handling IT Service Level Agreements and Database Management. Applicants should also find the correct answer to questions related to Problem and Incident as well as Systems Performance Management.
The final topic handles information asset protection. Exam-takers should demonstrate that they understand how privacy principles work or if they are able to ensure network and end-point security. Also, they should be experienced in managing virtualization environments and work with Public Key Infrastructure. It is also essential that examinees understand how to manage Physical Access and Environmental controls as well as manage information asset security frameworks, guidelines, and standards. They should also know how to handle different security techniques dedicated to testing and monitoring. Besides, candidates should be proficient in managing incident response and handle evidence collection & forensics.
NEW QUESTION 29
Naming conventions for system resources are important for access control because they:
- A. ensure that internationally recognized names are used to protect resources.
- B. ensure that resource names are not ambiguous.
- C. reduce the number of rules required to adequately protect resources.
- D. ensure that user access to resources is clearly and uniquely identified.
Answer: C
Explanation:
Section: Protection of Information Assets
Explanation: Naming conventions for system resources are important for the efficient administration of
security controls. The conventions can be structured, so resources beginning with the same high-level
qualifier can be governed by one or more generic rules. This reduces the number of rules required to
adequately protect resources, which in turn facilitates security administration and maintenance efforts.
Reducing the number of rules required to protect resources allows for the grouping of resources and files
by application, which makes it easier to provide access. Ensuring that resource names are not ambiguous
cannot be achieved through the use of naming conventions. Ensuring the clear and unique identification of
user access to resources is handled by access control rules, not naming conventions. Internationally
recognized names are not required to control access to resources. Naming conventions tend to be based
on how each organization wants to identify its resources.
NEW QUESTION 30
Identify the network topology from below diagram presented below:
Network Topology
- A. Star
- B. Bus
- C. Mesh
- D. Ring
Answer: A
Explanation:
Section: Information System Operations, Maintenance and Support
Explanation/Reference:
For your exam you should know the information below related to LAN topologies:
LAN Topologies
Network topology is the physical arrangement of the various elements (links, nodes, etc.) of a computer
network.
Essentially, it is the topological structure of a network, and may be depicted physically or logically. Physical
topology refers to the placement of the network's various components, including device location and cable
installation, while logical topology shows how data flows within a network, regardless of its physical design.
Distances between nodes, physical interconnections, transmission rates, and/or signal types may differ
between two networks, yet their topologies may be identical.
Bus
In local area networks where bus topology is used, each node is connected to a single cable. Each
computer or server is connected to the single bus cable. A signal from the source travels in both directions
to all machines connected on the bus cable until it finds the intended recipient. If the machine address does
not match the intended address for the data, the machine ignores the data. Alternatively, if the data
matches the machine address, the data is accepted. Since the bus topology consists of only one wire, it is
rather inexpensive to implement when compared to other topologies. However, the low cost of
implementing the technology is offset by the high cost of managing the network. Additionally, since only one
cable is utilized, it can be the single point of failure. If the network cable is terminated on both ends and
when without termination data transfer stop and when cable breaks, the entire network will be down.
Bus topology
Graphic from:
Linear bus
The type of network topology in which all of the nodes of the network are connected to a common
transmission medium which has exactly two endpoints (this is the 'bus', which is also commonly referred to
as the backbone, or trunk) - all data that is transmitted between nodes in the network is transmitted over
this common transmission medium and is able to be received by all nodes in the network simultaneously.
Distributed bus
The type of network topology in which all of the nodes of the network are connected to a common
transmission medium which has more than two endpoints that are created by adding branches to the main
section of the transmission medium - the physical distributed bus topology functions in exactly the same
fashion as the physical linear bus topology (i.e., all nodes share a common transmission medium).
Star
In local area networks with a star topology, each network host is connected to a central point with a point-
to-point connection. In Star topology every node (computer workstation or any other peripheral) is
connected to central node called hub or switch.
The switch is the server and the peripherals are the clients. The network does not necessarily have to
resemble a star to be classified as a star network, but all of the nodes on the network must be connected to
one central device.
All traffic that traverses the network passes through the central point. The central point acts as a signal
repeater.
The star topology is considered the easiest topology to design and implement. An advantage of the star
topology is the simplicity of adding additional nodes. The primary disadvantage of the star topology is that
the central point represents a single point of failure.
Star Topology
Ring
A network topology that is set up in a circular fashion in which data travels around the ring in one direction
and each device on the ring acts as a repeater to keep the signal strong as it travels. Each device
incorporates a receiver for the incoming signal and a transmitter to send the data on to the next device in
the ring.
The network is dependent on the ability of the signal to travel around the ring. When a device sends data, it
must travel through each device on the ring until it reaches its destination. Every node is a critical link. If
one node goes down the whole link would be affected.
Ring Topology
Mesh
The value of a fully meshed networks is proportional to the exponent of the number of subscribers,
assuming that communicating groups of any two endpoints, up to and including all the endpoints, is
approximated by Reed's Law.
A mesh network provides for high availability and redundancy. However, the cost of such network could be
very expensive if dozens of devices are in the mesh.
Mesh Topology
Fully connected mesh topology
A fully connected network is a communication network in which each of the nodes is connected to each
other. In graph theory it known as a complete graph. A fully connected network doesn't need to use
switching nor broadcasting. However, its major disadvantage is that the number of connections grows
quadratic ally with the number of nodes, so it is extremely impractical for large networks. A two-node
network is technically a fully connected network.
Partially connected mesh topology
The type of network topology in which some of the nodes of the network are connected to more than one
other node in the network with a point-to-point link - this makes it possible to take advantage of some of
the redundancy that is provided by a physical fully connected mesh topology without the expense and
complexity required for a connection between every node in the network.
The following answers are incorrect:
The other options presented are not valid.
The following reference(s) were/was used to create this question:
CISA review manual 2014, Page number 262
NEW QUESTION 31
Invoking a business continuity plan (BCP) is demonstrating which type of control?
- A. Preventive
- B. Directive
- C. Corrective
- D. Detective
Answer: B
NEW QUESTION 32
Which of the following is the BEST point in time to conduct a post-implementation review (PIR)?
- A. After a full processing cycle
- B. To coincide with annual PIR cycle
- C. Immediately after deployment
- D. Six weeks after deployment
Answer: D
NEW QUESTION 33
An IS auditor reviewing the risk assessment process of an organization should FIRST:
- A. identify and rank the information assets.
- B. evaluate the effect of a potential security breach.
- C. identify the reasonable threats to the information assets.
- D. analyze the technical and organizational vulnerabilities.
Answer: A
Explanation:
Identification and ranking of information assets-e.g., data criticality, locations of assets-will set the tone or scope of how to assess risk in relation to the organizational value of the asset. Second, the threats facing each of the organization's assets should be analyzed according to their value to the organization. Third, weaknesses should be identified so that controls can be evaluated to determine if they mitigate the weaknesses. Fourth, analyze how these weaknesses, in absence of given controls, would impact the organization information assets.
NEW QUESTION 34
Which of the following is the MOST effective way to reduce risk to an organization from widespread use of
web-based communication technologies?
- A. Block access from user devices to unauthorized pages that allow web-based communication.
- B. Publish an enterprise-wide policy outlining acceptance use of web-based communication technologies.
- C. Incorporate risk awareness training for web-based communications into the IT security program.
- D. Monitor staff usage of web-based communication and notify the IT security department of violations.
Answer: C
Explanation:
Section: Protection of Information Assets
Explanation/Reference:
NEW QUESTION 35
The goal of an information system is to achieve integrity, authenticity and non-repudiation of information's sent across the network. Which of the following statement correctly describe the steps to address all three?
- A. Encrypt message digest using sender's private key and then send the encrypted digest to the receiver along with original message. Receiver can decrypt the same using sender's public key.
- B. Encrypt the message digest using symmetric key and then send the encrypted digest to receiver along with original message.
- C. Encrypt the message digest using receiver's public key and then send the encrypted digest to receiver along with original message. The receiver can decrypt the message digest using his own private key.
- D. Encrypt the message digest using sender's public key and then send the encrypted digest to the receiver along with original message. The receiver can decrypt using his own private key.
Answer: A
Explanation:
Explanation/Reference:
The digital signature is used to achieve integrity, authenticity and non-repudiation. In a digital signature, the sender's private key is used to encrypt the message digest of the message. Encrypting the message digest is the act of Signing the message. The receiver will use the matching public key of the sender to decrypt the Digital Signature using the sender's public key.
A digital signature (not to be confused with a digital certificate) is an electronic signature that can be used to authenticate the identity of the sender of a message or the signer of a document, and possibly to ensure that the original content of the message or document that has been sent is unchanged. Digital signatures cannot be forged by someone else who does not possess the private key, it can also be automatically time-stamped. The ability to ensure that the original signed message arrived means that the sender cannot easily repudiate it later.
A digital signature can be used with any kind of message, whether it is encrypted or not, simply so that the receiver can be sure of the sender's identity and that the message arrived intact. A digital certificate contains the digital signature of the certificate-issuing authority so that anyone can verify that the certificate is real and has not been modified since the day it was issued.
How Digital Signature Works
Assume you were going to send the draft of a contract to your lawyer in another town. You want to give your lawyer the assurance that it was unchanged from what you sent and that it is really from you.
You copy-and-paste the contract (it's a short one!) into an e-mail note.
Using special software, you obtain a message hash (mathematical summary) of the contract.
You then use a private key that you have previously obtained from a public-private key authority to encrypt the hash.
The encrypted hash becomes your digital signature of the message. (Note that it will be different each time you send a message.)
At the other end, your lawyer receives the message.
To make sure it's intact and from you, your lawyer makes a hash of the received message.
Your lawyer then uses your public key to decrypt the message hash or summary.
If the hashes match, the received message is valid.
Below are some common reasons for applying a digital signature to communications:
Authentication
Although messages may often include information about the entity sending a message, that information may not be accurate. Digital signatures can be used to authenticate the source of messages. The importance of high assurance in the sender authenticity is especially obvious in a financial context. For example, suppose a bank's branch office sends instructions to the central office requesting a change in the balance of an account. If the central office is not convinced that such a message is truly sent from an authorized source, acting on such a request could be a serious mistake.
Integrity
In many scenarios, the sender and receiver of a message may have a need for confidence that the message has not been altered during transmission. Although encryption hides the contents of a message, it may be possible to change an encrypted message without understanding it.(Some encryption algorithms, known as nonmalleable ones, prevent this, but others do not.) However, if a message is digitally signed, any change in the message after the signature has been applied would invalidates the signature.
Furthermore, there is no efficient way to modify a message and its signature to produce a new message with a valid signature, because this is still considered to be computationally infeasible by most cryptographic hash functions (see collision resistance).
Non-repudiation
Non-repudiation, or more specifically non-repudiation of origin, is an important aspect of digital signatures.
By this property, an entity that has signed some information cannot at a later time deny having signed it.
Similarly, access to the public key only does not enable a fraudulent party to fake a valid signature.
Note that authentication, non-repudiation, and other properties rely on the secret key not having been revoked prior to its usage. Public revocation of a key-pair is a required ability, else leaked secret keys would continue to implicate the claimed owner of the key-pair. Checking revocation status requires an
"online" check, e.g. checking a "Certificate Revocation List" or via the "Online Certificate Status Protocol".
This is analogous to a vendor who receives credit-cards first checking online with the credit-card issuer to find if a given card has been reported lost or stolen.
Tip for the exam
Digital Signature does not provide confidentiality. It provides only authenticity and integrity. The sender's private key is used to encrypt the message digest to calculate the digital signature Encryption provides only confidentiality. The receiver's public key or symmetric key is used for encryption The following were incorrect answers:
Encrypt the message digest using symmetric key and then send the encrypted digest to receiver along with original message - Symmetric key encryption does not provide non-repudiation as symmetric key is shared between users
Encrypt the message digest using receiver's public key and then send the encrypted digest to receiver along with original message. The receiver can decrypt the message digest using his own private key - Receiver's public key is known to everyone. This will not address non-repudiation Encrypt the message digest using sender's public key and then send the encrypted digest to the receiver along with original message. The receiver can decrypt using his own private key -The sender public key is known to everyone. If sender's key is used for encryption then sender's private key is required to decrypt data. The receiver will not be able to decrypt the digest as receiver will not have sender's private key.
The following reference(s) were/was used to create this question:
CISA review manual 2014 Page number 331
http://upload.wikimedia.org/wikipedia/commons/2/2b/Digital_Signature_diagram.svg
http://en.wikipedia.org/wiki/Digital_signature
http://searchsecurity.techtarget.com/definition/digital-signature
NEW QUESTION 36
A successful risk-based IT audit program should be based on:
- A. an effective scoring system.
- B. None of the choices.
- C. an effective PERT diagram.
- D. an effective organization-wide brainstorm session.
- E. an effective yearly budget.
- F. an effective departmental brainstorm session.
Answer: A
Explanation:
Explanation/Reference:
Explanation:
A successful risk-based IT audit program could be based on an effective scoring system. In establishing a scoring system, management should consider all relevant risk factors and avoid subjectivity. Auditors should develop written guidelines on the use of risk assessment tools and risk factors and review these guidelines with the audit committee.
NEW QUESTION 37
An IS auditor performing a review of an application's controls would evaluate the:
- A. impact of any exposures discovered.
- B. efficiency of the application in meeting the business processes.
- C. application's optimization.
- D. business processes served by the application.
Answer: A
Explanation:
Section: Protection of Information Assets
Explanation:
An application control review involves the evaluation of the application's automated controls and an
assessment of any exposures resulting from the control weaknesses. The other choices may be objectives
of an application audit but are not part of an audit restricted to a review of controls.
NEW QUESTION 38
Which of the following fourth generation language depends on self-contained database management
systems?
- A. Query and report generator
- B. Embedded database 4GLs
- C. Application generators
- D. Relational database 4GL
Answer: B
Explanation:
Section: Information System Acquisition, Development and Implementation
Explanation/Reference:
Embedded database 4GLsare depend on self-contained database management systems. These
characteristics often makes them more user-friendly but also may lead to applications that are not
integrated well with other product applications. Example includes FOCUS, RAMIS II and NOMAD 2.
For CISA exam you should know below mentioned types of 4GLs
Query and report generator - These specialize language can extract and produce reports. Recently more
powerful language has been produced that can access database records, produce complex on-line output
and be developed in an almost natural language.
Embedded database 4GLs - These depend on self-contained database management systems. These
characteristics often makes them more user-friendly but also may lead to applications that are not
integrated well with other product applications. Example includes FOCUS, RAMIS II and NOMAD 2.
Relational database 4GLs - These high level language products are usually an optional feature on vendor's
DBMS product line. These allow the application developer to make better use of DBMS product, but they
often are not end-user-oriented. Example include SQL+ MANTIS and NATURAL.
Application generators - These development tools generate lower level programming languages(3GL) such
as COBOL and
C. The application can be further tailored and customized. Data processing development
personnel, not end user, use application generators.
The following were incorrect answers:
Query and report generator - These specialize language can extract and produce reports.
Relational database 4GLs - These high level language products are usually an optional feature on vendor's
DBMS product line.
Application generators - These development tools generate lower level programming languages(3GL) such
as COBOL and C.
The following reference(s) were/was used to create this question:
CISA review manual 2014 Page number 209
NEW QUESTION 39
Which of the following would help to ensure the portability of an application connected to a database?
- A. Verification of database import and export procedures
- B. Synchronization of the entity-relation model with the database physical schema
- C. Usage of a structured query language (SQL)
- D. Analysis of stored procedures/triggers
Answer: C
Explanation:
Section: Protection of Information Assets
Explanation:
The use of SQL facilitates portability. Verification of import and export procedures with other systems ensures better interfacing with other systems, analyzing stored procedures/triggers ensures proper access/ performance, and reviewing the design entity- relation model will be helpful, but none of these contribute to the portability of an application connecting to a database.
NEW QUESTION 40
After implementation of a disaster recovery plan, pre-disaster and post-disaster operational costs for an organization will:
- A. increase.
- B. increase or decrease depending upon the nature of the business.
- C. decrease.
- D. not change (remain the same).
Answer: A
Explanation:
Explanation/Reference:
Explanation:
There are costs associated with all activities and disaster recovery planning (DRP) is not an exception.
Although there are costs associated with a disaster recovery plan, there are unknown costs that are incurred if a disaster recovery plan is not implemented.
NEW QUESTION 41
When reviewing access controls, an internal auditor discovers unauthorized access rights to confidential network folders. What is the auditor's FIRST action?
- A. Report to the data owner and recommend remediation
- B. Contact the network administrator and require access be disabled
- C. Review access control policies and procedures.
- D. Report to the audit committee and suggest further Investigation.
Answer: A
NEW QUESTION 42
An IS auditor reviewing an accounts payable system discovers that audit logs are not being reviewed.
When this issue is raised with management the response is that additional controls are not necessary
because effective system access controls are in place. The BEST response the auditor can make is to:
- A. review the background checks of the accounts payable staff.
- B. accept management's statement that effective access controls are in place.
- C. stress the importance of having a system control framework in place.
- D. review the integrity of system access controls.
Answer: C
Explanation:
Section: Protection of Information Assets
Explanation:
Experience has demonstrated that reliance purely on preventative controls is dangerous. Preventative
controls may not prove to be as strong as anticipated or their effectiveness can deteriorate over time.
Evaluating the cost of controls versus the quantum of risk is a valid management concern. However, in a
high-risk system a comprehensive control framework is needed, intelligent design should permit additional
detective and corrective controls to be established that don't have high ongoing costs, e.g., automated
interrogation of logs to highlight suspicious individual transactions or data patterns. Effective access
controls are, in themselves, a positive but, for reasons outlined above, may not sufficiently compensate for
other control weaknesses. In this situation the IS auditor needs to be proactive. The IS auditor has a
fundamental obligation to point out control weaknesses that give rise to unacceptable risks to the
organization and work with management to have these corrected. Reviewing background checks on
accounts payable staff does not provide evidence that fraud will not occur.
NEW QUESTION 43
When an IS auditor evaluates key performance indicators (KPls) (or IT initiatives, it is MOST important that the KPIs indicate.
- A. IT resources are fully utilized
- B. IT objectives are measured
- C. IT solutions are within budget
- D. IT deliverables are process driven.
Answer: B
NEW QUESTION 44
......
CISA Actual Questions and Braindumps: https://www.freepdfdump.top/CISA-valid-torrent.html
Pass CISA Exam with Updated CISA Exam Dumps PDF 2021: https://drive.google.com/open?id=1AscPdKQUWJ1zuRquvOsRUlBFVPP318gi
