Validate your Skills with Updated CISA Exam Questions & Answers and Test Engine
Tested & Approved CISA Study Materials Download Free Updated 1535 Questions
The CISA certification is awarded by the Information Systems Audit and Control Association (ISACA) and is recognized globally. Certified Information Systems Auditor certification exam is rigorous and challenging, requiring significant preparation and study. CISA exam covers five domains of knowledge, including auditing processes, IT governance, information systems acquisition, development, and implementation, information systems operations, maintenance, and service management, and protection of information assets.
Which skills and knowledge are required for passing the ISACA CISA Exam?
A person would have sufficient knowledge in how to perform systems analysis, documentation of security policy implementation including full life cycle assessment from design and development through maintenance and compliance monitoring as well as designing system architectures with an emphasis on safeguarding information assets both physical and virtual. CISA certification validates that an individual has the competence, sufficient knowledge, skill, experience, and training to do these tasks. It is an important credential for individuals seeking entry-level employment in IT auditing or assurance. Individuals who are already employed in the IT industry may choose to pursue CISA Certification to improve job opportunities or increase their salaries.
NEW QUESTION # 342
Which of the following observations should be of GREATEST concern to an IS auditor reviewing a large organization's IT steering committee?
- A. Resource and priority conflict resolution has been delegated to the project management office
- B. The committee has not formally approved the enterprise's IT architecture.
- C. Business executives are not represented on the committee.
- D. The committee does not include any current system administrators.
Answer: C
NEW QUESTION # 343
An organization has just completed their annual risk assessment. Regarding the business continuity plan, what should an IS auditor recommend as the next step for the organization?
- A. Train and educate employees regarding the business continuity plan
- B. Notify critical contacts in the business continuity plan
- C. Review and evaluate the business continuity plan for adequacy
- D. Perform a full simulation of the business continuity plan
Answer: C
Explanation:
Explanation/Reference:
Explanation:
The business continuity plan should be reviewed every time a risk assessment is completed for the organization. Training of the employees and a simulation should be performed after the business continuity plan has been deemed adequate for the organization. There is no reason to notify the business continuity plan contacts at this time.
NEW QUESTION # 344
Which of the following are examples of tools for launching Distributed DoS Attack (choose all that apply):
- A. Tripwire
- B. TFN2K
- C. TFN
- D. Stacheldracht
- E. Trin00
Answer: B,C,D,E
Explanation:
Explanation/Reference:
Explanation:
Distributed DoS Attack is a network-based attack from many servers used remotely to send packets.
Examples of tools for conducting such attack include TFN, TFN2K, Trin00, Stacheldracht, and variants.
The best defense is to make sure all systems patches are up-to-date. Also make sure your firewalls are configured appropriately.
NEW QUESTION # 345
What is the recommended initial step for an IS auditor to implement continuous-monitoring systems?
- A. Establish a controls-monitoring steering committee
- B. Perform compliance testing on internal controls
- C. Document existing internal controls
- D. Identify high-risk areas within the organization
Answer: D
Explanation:
Section: Protection of Information Assets
Explanation:
When implementing continuous-monitoring systems, an IS auditor's first step is to identify high-risk areas
within the organization.
NEW QUESTION # 346
Which of the following controls BEST ensures appropriate segregation of duties within an accounts payable
department?
- A. Ensuring that audit trails exist for transactions
- B. Restricting access to update programs to accounts payable staff only
- C. Restricting program functionality according to user security profiles
- D. Including the creator's user ID as a field in every transaction record created
Answer: C
Explanation:
Section: Protection of Information Assets
NEW QUESTION # 347
Which of the following will prevent dangling tuples in a database?
- A. Domain integrity
- B. Relational integrity
- C. Referential integrity
- D. Cyclic integrity
Answer: C
Explanation:
Referential integrity ensures that a foreign key in one table will equal null or the value of a primary in the other table. For every tuple in a table having a referenced/foreign key, there should be a corresponding tuple in another table, i.e., forexistence of all foreign keys in the original tables, if this condition is not satisfied, then it results in a dangling tuple. Cyclical checking is the control technique for the regular checking of accumulated data on a file against authorized sourcedocumentation. There is no cyclical integrity testing. Domain integrity testing ensures that a data item has a legitimate value in the correct range or set. Relational integrity is performed at the record level and is ensured by calculating and verifying specific fields.
NEW QUESTION # 348
During a security audit, an IS auditor is tasked with reviewing log entries obtained from an enterprise
intrusion prevention system (IPS). Which type of risk would be associated with the potential for the auditor
to miss a sequence of logged events that could indicate an error in the IPS configuration?
- A. Detection risk
- B. Sampling risk
- C. Inherent risk
- D. Control risk
Answer: A
Explanation:
Section: The process of Auditing Information System
NEW QUESTION # 349
The PRIMARY purpose for meeting with auditees prior to formally closing a review is to:
- A. test the structure of the final presentation.
- B. receive feedback on the adequacy of the audit procedures.
- C. confirm that the auditors did not overlook any important issues.
- D. gain agreement on the findings.
Answer: D
Explanation:
Section: Protection of Information Assets
Explanation:
The primary purpose for meeting with auditees prior to formally closing a review is to gain agreement on the findings. The other choices, though related to the formal closure of an audit, are of secondary importance.
NEW QUESTION # 350
What should an organization do before providing an external agency physical access to its information processing facilities (IPFs)?
- A. Any access by an external agency should be limited to the demilitarized zone (DMZ).
- B. The organization should conduct a risk assessment and design and implement appropriate controls.
- C. The processes of the external agency should be subjected to an IS audit by an independent agency.
- D. Employees of the external agency should be trained on the security procedures of the organization.
Answer: B
Explanation:
Explanation/Reference:
Explanation:
Physical access of information processing facilities (IPFs) by an external agency introduces additional threats into an organization. Therefore, a risk assessment should be conducted and controls designed accordingly. The processes of the external agency are not of concern here. It is the agency's interaction with the organization that needs to be protected. Auditing their processes would not be relevant in this scenario. Training the employees of the external agency may be one control procedure, but could be performed after access has been granted. Sometimes an external agency may require access to the processing facilities beyond the demilitarized zone (DMZ). For example, an agency which undertakes maintenance of servers may require access to the main server room. Restricting access within the DMZ will not serve the purpose.
NEW QUESTION # 351
Which of the following is the BEST way to enforce the principle of least privilege on a server containing data with different security classifications?
- A. Using scripted access control lists to prevent unauthorized access to the server
- B. Limiting access to the data files based on frequency of use
- C. Applying access controls determined by the data owner
- D. Obtaining formal agreement by users to comply with the data classification policy
Answer: C
Explanation:
Explanation
The best way to enforce the principle of least privilege on a server containing data with different security classifications is to apply access controls determined by the data owner. The principle of least privilege states that users should only have the minimum level of access required to perform their tasks. The data owner is the person who has the authority and responsibility to classify, label, and protect the data according to its sensitivity and value. The data owner can define the access rights and permissions for each user or role based on the data classification policy and the business needs. This will ensure that only authorized and appropriate users can access the data and prevent unauthorized or excessive access that could compromise the confidentiality, integrity, or availability of the data. References:
CISA Review Manual (Digital Version)
CISA Questions, Answers & Explanations Database
NEW QUESTION # 352
Which of the following is a social engineering attack method?
- A. An intruder eavesdrops and collects sensitive information flowing through the network and sells it to third parties.
- B. An employee is induced to reveal confidential IP addresses and passwords by answering questions over the phone.
- C. A hacker walks around an office building using scanning tools to search for a wireless network to gain access.
- D. An unauthorized person attempts to gam access to secure premises by following an authonzed person through a secure door.
Answer: B
NEW QUESTION # 353
Which of the following are often considered as the first defensive line in protecting a typical data and information environment?
- A. certificates
- B. biometrics
- C. None of the choices.
- D. password
- E. security token
Answer: D
Explanation:
Explanation/Reference:
Explanation:
Passwords are the first defensive line in protecting your data and information. Your users need to be made aware of what a password provides them and what can be done with their password. They also need to be made aware of the things that make up a good password versus a bad password.
NEW QUESTION # 354
During an integrated audit at a retail bank, an IS auditor is evaluating whether monthly service fees are appropriately charged for business accounts and waived for individual consumer accounts. Which of the following test approaches would utilize data analytics to facilitate the testing?
- A. Review customer accounts over the last year to determine whether appropriate charges were applied.
- B. Evaluate whether user acceptance testing plans were designed and executed appropriately.
- C. Compare the system configuration settings with the business requirements document.
- D. Attempt to charge a monthly service fee to an individual consumer account.
Answer: A
Explanation:
Section: The process of Auditing Information System
NEW QUESTION # 355
An IS auditor is evaluating a virtual server environment and learns that the production server, development server, and management console are housed in the same physical host. What should be the auditor's PRIMARY concern?
- A. The physical host is a single point of failure
- B. The management console is a single point of failure.
- C. The development server and management console share the same host
- D. The development and production servers share the same host
Answer: B
NEW QUESTION # 356
During a software acquision review, an IS auditor should recommend that there be a software escrow agreement when:
- A. The estimated life for the product is less than 3 years
- B. The deliverables do not include the source code
- C. There is no service level agreement (SLA)
- D. The product is new in the market
Answer: B
NEW QUESTION # 357
During the planning stage of a compliance audit an IS auditor discovers that a bank's Inventory of compliance requirements does not include recent regulatory changes related to managing data risk. What should the auditor do FIRST?
- A. Exclude recent regulatory changes from the audit scope
- B. Discuss potential regulatory issues with the legal department.
- C. Report the missing regulatory updates to the chief information officer (CIO)
- D. Ask management why the regulatory changes have not been included
Answer: D
NEW QUESTION # 358
Which of the following would BEST ensure continuity of a wide area network (WAN) across the organization?
- A. A repair contract with a service provider
- B. Completing full system backup daily
- C. Built-in alternative routing
- D. A duplicate machine alongside each server
Answer: C
Explanation:
Alternative routing would ensure the network would continue if a server is lost or if a link is severed as message rerouting could be automatic. System backup will not afford immediate protection. The repair contract is not as effective as perm a nentalte (native routing. Standby servers will not provide continuity if a link is severed.
NEW QUESTION # 359
Which of the following BEST describes a common risk in implementing a new application software package?
- A. Transaction volume is excessive
- B. Sensitivity of transactions is high
- C. Parameter settings are incorrect
- D. The application lacks audit trails
Answer: D
Explanation:
Section: Information System Acquisition, Development and Implementation
NEW QUESTION # 360
________________ should be implemented as early as data preparation to support data integrity at the earliest point possible.
- A. Authorization controls
- B. Control totals
- C. Authentication controls
- D. Parity bits
Answer: B
Explanation:
Section: Protection of Information Assets
Explanation
Explanation:
Control totals should be implemented as early as data preparation to support data integrity at the earliest point possible.
NEW QUESTION # 361
Which type of control is in place when an organization requires new employees to complete training on applicable privacy and data protection regulations?
- A. Preventive control
- B. Detective control
- C. Directive control
- D. Corrective control
Answer: C
NEW QUESTION # 362
When evaluating information security governance within an organization, which of the following findings should be of MOST concern to an IS auditor?
- A. The information security department has difficulty filling vacancies
- B. The data center manager has final sign-off on security projects
- C. An information security governance audit was not conducted within the past year
- D. Information security policies are updated annually
Answer: B
Explanation:
Explanation
The finding that should be of most concern to an IS auditor when evaluating information security governance within an organization is that the data center manager has final sign-off on security projects. This indicates a lack of segregation of duties and a potential conflict of interest between the operational and security roles. The data center manager may have access to sensitive information or systems that should be protected by security controls, or may influence or override security decisions that are not in the best interest of the organization.
This finding also suggests that there is no clear accountability or authority for information security governance at a higher level, such as senior management or board of directors. The other findings are not as concerning as this one, although they may indicate some areas for improvement or monitoring. References:
ISACA, CISA Review Manual, 27th Edition, chapter 5, section 5.11
ISACA, IT Governance Using COBIT and Val IT: Student Booklet - 2nd Edition4
NEW QUESTION # 363
The decision to accept an IT control risk related to data quality should be the responsibility of the:
- A. IS audit manager.
- B. business owner.
- C. information security team.
- D. chief information officer (CIO).
Answer: C
NEW QUESTION # 364
Which of the following BEST facilitates the management of assets during the implementation of an information system?
- A. Decision support system
- B. Asset procurement system
- C. Quality management controls
- D. Configuration management database (CMDB)
Answer: D
NEW QUESTION # 365
......
How to maintain certification:
The CISA certification is a difficult achievement to obtain. In order to maintain a high level of certification, one must complete a minimum of 20 EC-Council CEUs. Each e-learning course provides 10 credits toward the 20 CEUs essential to be certified for two annuals. Majority of the candidates have found that it is also helpful to take multiple courses at a time so as not to forget any knowledge learned from these courses and exercises. The ISACA CISA Dumps can also provide you well organized practice exams that will eventually help you in maintaining your certification.
Regular Free Updates CISA Dumps Real Exam Questions Test Engine: https://www.freepdfdump.top/CISA-valid-torrent.html
Practice Test Questions Verified Answers As Experienced in the Actual Test!: https://drive.google.com/open?id=1VpFup5NW3LRxAzyS0K0rGJnGtm2nXhDK
