TestPDF CISA dumps & Isaca Certification Sure Practice with 440 Questions
New CISA Exam Questions| Real CISA Dumps
How to Schedule the ISACA CISA Exam?
After registration and paying the fee, you will get a confirmation email, you can schedule your exam by clicking that link in the email. You can also schedule by logging to your account. The CISA test is offered more than 50 times a year at various locations around the world, you can set time according to your ease, for example, Aug, Sep, Oct, Feb Apr, Jul whenever you want. You can also have a mid-year or quarterly break for better preparation for the exam. So it will not be much harder to find one that fits your schedule.
NEW QUESTION 83
Which of the following observations should be of GREATEST concern to an IS auditor performing a review of an organization's IT governance structure?
- A. There are no IT subject matter expects on the board of directors.
D18912E1457D5D1DDCBD40AB3BF70D5D - B. The chief information officer is prohibited from making capital decisions regarding IT.
- C. The chief risk officer is also the chief information officer.
- D. The IT steering committee has oversight of the IT budget.
Answer: C
NEW QUESTION 84
Normally, it would be essential to involve which of the following stakeholders in the initiation stage of a
project?
- A. System builders
- B. System owners
- C. System users
- D. System designers
Answer: B
Explanation:
Section: Protection of Information Assets
Explanation:
System owners are the information systems (project) sponsors or chief advocates. They normally are
responsible for initiating and funding projects to develop, operate and maintain information systems.
System users are the individuals who use or are affected by the information system.
Their requirements are crucial in the testing stage of a project. System designers translate business
requirements and constraints into technical solutions. System builders construct the system based on the
specifications from the systems designers. In most cases, the designers and builders are one and the
same.
NEW QUESTION 85
Sophisticated database systems provide many layers and types of security, including (choose all that apply):
- A. Access control
- B. Integrity controls
- C. Encryption
- D. Auditing
- E. Compression controls
Answer: A,B,C,D
Explanation:
Sophisticated database systems provide many layers and types of security, including Access control, Auditing, Authentication, Encryption and Integrity controls. An important procedure when evaluating database security is performing vulnerability assessments against the database. Database administrators or Information security administrators run vulnerability scans on databases to discover misconfiguration of controls within the layers mentioned above along with known vulnerabilities within the database software.
NEW QUESTION 86
With the objective of mitigating the risk and impact of a major business interruption, a disaster recovery
plan should endeavor to reduce the length of recovery time necessary, as well as costs associated with
recovery. Although DRP results in an increase of pre-and post-incident operational costs, the extra costs
are more than offset by reduced recovery and business impact costs. True or false?
- A. True
- B. False
Answer: A
Explanation:
Section: Protection of Information Assets
Explanation:
With the objective of mitigating the risk and impact of a major business interruption, a disaster- recovery
plan should endeavor to reduce the length of recovery time necessary and the costs associated with
recovery. Although DRP results in an increase of pre-and post-incident operational costs, the extra costs
are more than offset by reduced recovery and business impact costs.
NEW QUESTION 87
In RFID technology which of the following risk could represent a threat to non-RFID networked or collocated systems, assets, and people?
- A. Business Process Risk
- B. Privacy Risk
- C. Externality Risk
- D. Business Intelligence Risk
Answer: C
Explanation:
Explanation/Reference:
RFID technology potentially could represent a threat to non-RFID networked or collocated systems, assets, and people.
RFID systems typically are not isolated from other systems and assets in the enterprise. Every connection point between the RFID system and something outside the RFID system represents a potential vulnerability for the entity on the other side of the connection, whether that is an application process, a valued asset, or a person.
Externality risks are present for both the RF and enterprise subsystems of an RFID system.
The main externality risk for the RF subsystem is hazards resulting from electromagnetic radiation, which could possibly range from adverse human health effects to ignition of combustible material, such as fuel or ordnance.
The main externality risk for the enterprise subsystem is successful computer network attacks on networked devices and applications. Computer network attacks can involve malware (e.g., worms and viruses) or attack tools that exploit software vulnerabilities and configuration weaknesses to gain access to systems, perform a denial of service, or cause other damage.
The impact of computer network attacks can range from performance degradation to complete compromise of a mission-critical application. Because the externality risk by definition involves risks outside of the RFID system, it is distinct from both the business process and business intelligence risks; externality risks can be realized without having any effect on RFID-supported business processes or without revealing any information to adversaries.
For your exam you should know the information below:
Radio-frequency identification (RFID) is the wireless non-contact use of radio-frequency electromagnetic fields to transfer data, for the purposes of automatically identifying and tracking tags attached to objects.
The tags contain electronically stored information. Some tags are powered by and read at short ranges (a few meters) via magnetic fields (electromagnetic induction). Others use a local power source such as a battery, or else have no battery but collect energy from the interrogating EM field, and then act as a passive transponder to emit microwaves or UHF radio waves (i.e., electromagnetic radiation at high frequencies). Battery powered tags may operate at hundreds of meters. Unlike a barcode, the tag does not necessarily need to be within line of sight of the reader, and may be embedded in the tracked object.
RFID tags are used in many industries. An RFID tag attached to an automobile during production can be used to track its progress through the assembly line. Pharmaceuticals can be tracked through warehouses.
Livestock and pets may have tags injected, allowing positive identification of the animal.
RFID RISKS
RFID technology enables an organization to significantly change its business processes to:
Increase its efficiency, which results in lower costs, Increase its effectiveness, which improves mission performance and makes the implementing organization more resilient and better able to assign accountability, and Respond to customer requirements to use RFID technology to support supply chains and other applications.
The RFID technology itself is complex, combining a number of different computing and communications technologies to achieve the desired objectives. Unfortunately, both change and complexity generate risk.
For RFID implementations to be successful, organizations need to effectively manage that risk, which requires an understanding of its sources and its potential characteristics. This section reviews the major high-level business risks associated with RFID systems so that organizations planning or operating these systems can better identify, characterize, and manage the risk in their environments.
The risks are as follows:
Business Process Risk -Direct attacks on RFID system components potentially could undermine the business processes the RFID system was designed to enable.
Business Intelligence Risk- An adversary or competitor potentially could gain unauthorized access to RFID-generated information and use it to harm the interests of the organization implementing the RFID system.
Privacy Risk - Personal privacy rights or expectations may be compromised if an RFID system uses what is considered personally identifiable information for a purpose other than originally intended or understood.
The personal possession of functioning tags also is a privacy risk because it could enable tracking of those holding tagged items.
Externality Risk -RFID technology potentially could represent a threat to non-RFID networked or collocated systems, assets, and people. An important characteristic of RFID that impacts all of these risks is that RF communication is invisible to operators and users.
The following answers are incorrect:
Business Process Risk -Direct attacks on RFID system components potentially could undermine the business processes the RFID system was designed to enable.
Business Intelligence Risk- An adversary or competitor potentially could gain unauthorized access to RFID-generated information and use it to harm the interests of the organization implementing the RFID system.
Privacy Risk - Personal privacy rights or expectations may be compromised if an RFID system uses what is considered personally identifiable information for a purpose other than originally intended or understood.
The personal possession of functioning tags also is a privacy risk because it could enable tracking of those holding tagged items.
The following reference(s) were/was used to create this question:
CISA review manual 2014 page number 248
NIST SP 800-98 RFID 2007 - http://www.csrc.nist.gov/publications/nistpubs/800-98/SP800-98_RFID-
2007.pdf
NEW QUESTION 88
An IS auditor is evaluating management's risk assessment of information systems. The IS auditor should
FIRST review:
- A. the mechanism for monitoring the risks related to the assets.
- B. the controls already in place.
- C. the threats/vulnerabilities affecting the assets.
- D. the effectiveness of the controls in place.
Answer: C
Explanation:
Section: Protection of Information Assets
Explanation:
One of the key factors to be considered while assessing the risks related to the use of various information
systems is the threats and vulnerabilities affecting the assets. The risks related to the use of information
assets should be evaluated in isolation from the installed controls. Similarly, the effectiveness of the
controls should be considered during the risk mitigation stage and not during the risk assessment phase A
mechanism to continuously monitor the risks related to assets should be put in place during the risk
monitoring function that follows the risk assessment phase.
NEW QUESTION 89
Which of the following is often used as a detection and deterrent control against Internet attacks?
- A. CCTV
- B. VPN
- C. VLAN
- D. Honeypots
Answer: D
Explanation:
Explanation/Reference:
Honeypots are often used as a detection and deterrent control against Internet attacks.
NEW QUESTION 90
After initial investigation, an IS auditor has reasons to believe that fraud may be present. The IS auditor should:
- A. consult with external legal counsel to determine the course of action to be taken.
- B. expand activities to determine whether an investigation is warranted.
- C. report the possibility of fraud to top management and ask how they would like to proceed.
- D. report the matter to the audit committee.
Answer: B
Explanation:
Explanation/Reference:
Explanation:
An IS auditor's responsibilities for detecting fraud include evaluating fraud indicators and deciding whether any additional action is necessary or whether an investigation should be recommended. The IS auditor should notify the appropriate authorities within the organization only if it has determined that the indicators of fraud are sufficient to recommend an investigation. Normally, the IS auditor does not have authority to consult with external legal counsel.
NEW QUESTION 91
To determine who has been given permission to use a particular system resource, an IS auditor should review:
- A. password lists.
- B. activity lists.
- C. logon ID lists.
- D. access control lists.
Answer: D
Explanation:
Access control lists are the authorization tables that document the users who have been given permission to use a particular system resource and the types of access they have been granted. The other choices would not document who has been given permission to use (access) specific system resources.
NEW QUESTION 92
Which of the following should an IS auditor review to understand project progress in terms of time, budget
and deliverables for early detection of possible overruns and for projecting estimates at completion
(EACs)?
- A. Function point analysis
- B. Earned value analysis
- C. Cost budget
- D. Program Evaluation and Review Technique
Answer: B
Explanation:
Section: Protection of Information Assets
Explanation:
Earned value analysis (EVA) is an industry standard method for measuring a project's progress at any
given point in time, forecasting its completion date and final cost, and analyzing variances in the schedule
and budget as the project proceeds. It compares the planned amount of work with what has actually been
completed, to determine if the cost, schedule and work accomplished are progressing in accordance with
the plan. EVA works most effectively if a well-formed work breakdown structure exists. Function point
analysis (FPA) is an indirect measure of software size and complexity and, therefore, does not address the
elements of time and budget. Cost budgets do not address time. PERT aids in time and deliverables
management, but lacks projections for estimates at completion (EACs) and overall financial management.
NEW QUESTION 93
The IS management of a multinational company is considering upgrading its existing virtual private network (VPN) to support voice-over IP (VoIP) communications via tunneling. Which of the following considerations should be PRIMARILY addressed?
- A. Means of authentication
- B. Confidentiality of data transmissions
- C. Reliability and quality of service (QoS)
- D. Privacy of voice transmissions
Answer: C
Explanation:
Explanation/Reference:
Explanation:
The company currently has a VPN; issues such as authentication and confidentiality have been implemented by the VPN using tunneling. Privacy of voice transmissions is provided by the VPN protocol.
Reliability and QoS are, therefore, the primary considerations to be addressed.
NEW QUESTION 94
Which of the following term in business continuity defines the total amount of time that a business process can be disrupted without causing any unacceptable consequences?
- A. RTO
- B. MTD
- C. RPO
- D. WRT
Answer: B
Explanation:
Explanation/Reference:
The sum of RTO and WRT is defined as the Maximum Tolerable Downtime (MTD) which defines the total amount of time that a business process can be disrupted without causing any unacceptable consequences. This value should be defined by the business management team or someone like CTO, CIO or IT manager.
For your exam you should know below information about RPO, RTO, WRT and MTD:
Stage 1: Business as usual
Business as usual
Image Reference - http://defaultreasoning.files.wordpress.com/2013/12/bcdr-01.png At this stage all systems are running production and working correctly.
Stage 2: Disaster occurs
Disaster Occurs
Image Reference - http://defaultreasoning.files.wordpress.com/2013/12/bcdr-02.png On a given point in time, disaster occurs and systems needs to be recovered. At this point the Recovery Point Objective (RPO) determines the maximum acceptable amount of data loss measured in time. For example, the maximum tolerable data loss is 15 minutes.
Stage 3: Recovery
Recovery
Image Reference - http://defaultreasoning.files.wordpress.com/2013/12/bcdr-03.png At this stage the system are recovered and back online but not ready for production yet. The Recovery Time Objective (RTO) determines the maximum tolerable amount of time needed to bring all critical systems back online. This covers, for example, restore data from back-up or fix of a failure. In most cases this part is carried out by system administrator, network administrator, storage administrator etc.
Stage 4: Resume Production
Resume Production
Image Reference - http://defaultreasoning.files.wordpress.com/2013/12/bcdr-04.png At this stage all systems are recovered, integrity of the system or data is verified and all critical systems can resume normal operations. The Work Recovery Time (WRT) determines the maximum tolerable amount of time that is needed to verify the system and/or data integrity. This could be, for example, checking the databases and logs, making sure the applications or services are running and are available.
In most cases those tasks are performed by application administrator, database administrator etc. When all systems affected by the disaster are verified and/or recovered, the environment is ready to resume the production again.
MTD
Image Reference - http://defaultreasoning.files.wordpress.com/2013/12/bcdr-05.png The sum of RTO and WRT is defined as the Maximum Tolerable Downtime (MTD) which defines the total amount of time that a business process can be disrupted without causing any unacceptable consequences. This value should be defined by the business management team or someone like CTO, CIO or IT manager.
The following answers are incorrect:
RPO - Recovery Point Objective (RPO) determines the maximum acceptable amount of data loss measured in time. For example, the maximum tolerable data loss is 15 minutes.
RTO - The Recovery Time Objective (RTO) determines the maximum tolerable amount of time needed to bring all critical systems back online. This covers, for example, restore data from back-up or fix of a failure.
In most cases this part is carried out by system administrator, network administrator, storage administrator etc.
WRT - The Work Recovery Time (WRT) determines the maximum tolerable amount of time that is needed to verify the system and/or data integrity. This could be, for example, checking the databases and logs, making sure the applications or services are running and are available. In most cases those tasks are performed by application administrator, database administrator etc. When all systems affected by the disaster are verified and/or recovered, the environment is ready to resume the production again.
The following reference(s) were/was used to create this question:
CISA review manual 2014 page number 284
http://defaultreasoning.com/2013/12/10/rpo-rto-wrt-mtdwth/
NEW QUESTION 95
An IS auditor discovers that due to resource constraints a database administrator (DBA) is responsible for developing and executing changes into the production environment Which of the following should the auditor do FIRST?
- A. Identify whether any compensating controls exist
- B. Ensure a change management process is followed prior to implementation
- C. Determine whether another database administrator (DBA) could make the changes
- D. Report a potential segregation of duties (SoD) violation
Answer: A
NEW QUESTION 96
An IS auditor is reviewing a contract for the outsourcing of IT facilities. If missing, which of the following should present the GREATEST concern to the auditor?
- A. Access control requirements
- B. Hardware configurations
- C. Help desk availability
- D. Perimeter network security diagram
Answer: D
Explanation:
Section: Protection of Information Assets
NEW QUESTION 97
When should plans for testing for user acceptance be prepared?
- A. In the feasibility phase of the systems-development project
- B. In the requirements definition phase of the systems-development project
- C. In the development phase of the systems-development project
- D. In the design phase of the systems-development project
Answer: B
Explanation:
Explanation/Reference:
Explanation:
Plans for testing for user acceptance are usually prepared in the requirements definition phase of the systems-development project.
NEW QUESTION 98
Which of the following should be reviewed FIRST when assessing the effectiveness of an organization's network security procedures and controls?
- A. Malware defenses
- B. Inventory of authorized devices
- C. Vulnerability remediation
- D. Data recovery capability
Answer: B
Explanation:
Section: Information System Acquisition, Development and Implementation
NEW QUESTION 99
Which of the following functionality is NOT performed by the application layer of a TCP/IP model?
- A. End-to-end connection
- B. Dialog management
- C. Data encryption and compression
- D. Print service, application services
Answer: A
Explanation:
Section: Information System Operations, Maintenance and Support
Explanation/Reference:
The word NOT is the keyword used in the question. You need to find out a functionality which is not
performed by application layer of a TCP/IP model.
End-to-end connection is the Transport layer functionality in TCP/IP model.
For your exam you should know below information about TCP/IP model:
Network Models
Layer 4. Application Layer
Application layer is the top most layer of four layer TCP/IP model. Application layer is present on the top of
the Transport layer. Application layer defines TCP/IP application protocols and how host programs interface
with Transport layer services to use the network.
Application layer includes all the higher-level protocols like DNS (Domain Naming System), HTTP
(Hypertext Transfer Protocol), Telnet, SSH, FTP (File Transfer Protocol), TFTP (Trivial File Transfer
Protocol), SNMP (Simple Network Management Protocol), SMTP (Simple Mail Transfer Protocol) , DHCP
(Dynamic Host Configuration Protocol), X Windows, RDP (Remote Desktop Protocol) etc.
Layer 3. Transport Layer
Transport Layer is the third layer of the four layer TCP/IP model. The position of the Transport layer is
between Application layer and Internet layer. The purpose of Transport layer is to permit devices on the
source and destination hosts to carry on a conversation. Transport layer defines the level of service and
status of the connection used when transporting data.
The main protocols included at Transport layer are TCP (Transmission Control Protocol) and UDP (User
Datagram Protocol).
Layer 2. Internet Layer
Internet Layer is the second layer of the four layer TCP/IP model. The position of Internet layer is between
Network Access Layer and Transport layer. Internet layer pack data into data packets known as IP
datagram's, which contain source and destination address (logical address or IP address) information that
is used to forward the datagram's between hosts and across networks. The Internet layer is also
responsible for routing of IP datagram's.
Packet switching network depends upon a connectionless internetwork layer. This layer is known as
Internet layer. Its job is to allow hosts to insert packets into any network and have them to deliver
independently to the destination. At the destination side data packets may appear in a different order than
they were sent. It is the job of the higher layers to rearrange them in order to deliver them to proper network
applications operating at the Application layer.
The main protocols included at Internet layer are IP (Internet Protocol), ICMP (Internet Control Message
Protocol), ARP (Address Resolution Protocol), RARP (Reverse Address Resolution Protocol) and IGMP
(Internet Group Management Protocol).
Layer 1. Network Access Layer
Network Access Layer is the first layer of the four layer TCP/IP model. Network Access Layer defines
details of how data is physically sent through the network, including how bits are electrically or optically
signaled by hardware devices that interface directly with a network medium, such as coaxial cable, optical
fiber, or twisted pair copper wire.
The protocols included in Network Access Layer are Ethernet, Token Ring, FDDI, X.25, Frame Relay etc.
The most popular LAN architecture among those listed above is Ethernet. Ethernet uses an Access
Method called CSMA/CD (Carrier Sense Multiple Access/Collision Detection) to access the media, when
Ethernet operates in a shared media. An Access Method determines how a host will place data on the
medium.
IN CSMA/CD Access Method, every host has equal access to the medium and can place data on the wire
when the wire is free from network traffic. When a host wants to place data on the wire, it will check the
wire to find whether another host is already using the medium. If there is traffic already in the medium, the
host will wait and if there is no traffic, it will place the data in the medium. But, if two systems place data on
the medium at the same instance, they will collide with each other, destroying the data. If the data is
destroyed during transmission, the data will need to be retransmitted. After collision, each host will wait for
a small interval of time and again the data will be retransmitted.
Protocol Data Unit (PDU) :
Protocol Data Unit - PDU
The following answers are incorrect:
The other functionalities described in the options are performed by application layer in TCP/IP model.
The following reference(s) were/was used to create this question:
CISA review manual 2014 page number 272
NEW QUESTION 100
Ensuring that security and control policies support business and IT objectives is a primary objective of:
- A. A vulnerability assessment
- B. A software audit
- C. A processing audit
- D. An IT security policies audit
Answer: D
Explanation:
Explanation/Reference:
Explanation:
Ensuring that security and control policies support business and IT objectives is a primary objective of an IT security policies audit.
NEW QUESTION 101
A transaction journal provides the information necessary for detecting unauthorized ___________ (fill in the blank) from a terminal.
- A. Input
- B. Duplication
- C. Access
- D. Deletion
Answer: A
Explanation:
Explanation/Reference:
Explanation:
A transaction journal provides the information necessary for detecting unauthorized input from a terminal.
NEW QUESTION 102
A warehouse employee of a retail company has been able to conceal the theft of inventory items by entering adjustments of either damaged or lost stock items to the inventory system. Which control would have BEST prevented this type of fraud in a retail environment?
- A. Separate authorization for input of transactions
- B. An edit check for the validity of the inventory transaction
- C. Statistical sampling of adjustment transactions
- D. Unscheduled audits of lost stock lines
Answer: A
Explanation:
Section: Protection of Information Assets
NEW QUESTION 103
Which of the following should be the MOST important consideration when prioritizing the funding for competing IT projects?
- A. Senior management preferences
- B. Quality and accuracy of the IT project inventory
- C. Skill and capabilities within the project management team
- D. Criteria used to determine the benefits of projects
Answer: A
NEW QUESTION 104
Which of the following is the GREATEST risk of cloud computing?
- A. Reduced performance
- B. Lack of scalability
- C. Disclosure of data
- D. Inflexibility
Answer: C
Explanation:
Section: Information System Operations, Maintenance and Support
NEW QUESTION 105
What is the lowest level of the IT governance maturity model where an IT balanced scorecard exists?
- A. Optimized
- B. Managed and Measurable
- C. Defined
- D. Repeatable but Intuitive
Answer: C
Explanation:
Explanation/Reference:
Explanation:
Defined (level 3) is the lowest level at which an IT balanced scorecard is defined.
NEW QUESTION 106
......
CISA Braindumps – CISA Questions to Get Better Grades: https://www.testpdf.com/CISA-exam-braindumps.html
Get New CISA Certification – Valid Exam Dumps Questions: https://drive.google.com/open?id=1KpMpDLWJIsiVSJ6-K-58cCoJ1-ecIoSN
