Pass ISACA CISA Exam With Practice Test Questions Dumps Bundle
2023 Valid CISA test answers & ISACA Exam PDF
NEW QUESTION # 46
Inherent risk rating are determined by assessing the impact and likelihood of a threat or vulnerability occurring:
- A. After internal controls are taken into account.
- B. Before the risk appetite Is established
- C. After compensating have been applied
- D. Before internal controls are taken into account.
Answer: D
NEW QUESTION # 47
During the design of a business continuity plan, the business impact analysis (BIA) identifies critical
processes and supporting applications. This will PRIMARILY influence the:
- A. responsibility for maintaining the business continuity plan.
- B. criteria for selecting a recovery site provider.
- C. responsibilities of key personnel.
- D. recovery strategy.
Answer: D
Explanation:
Section: Protection of Information Assets
Explanation:
The most appropriate strategy is selected based on the relative risk level and criticality identified in the
business impact analysis (BIA.) The other choices are made after the selection or design of the appropriate
recovery strategy.
NEW QUESTION # 48
Which of the following would be an appropriate role of internal audit in helping to establish an organization's privacy program?
- A. Designing controls to protect personal data
- B. Analyzing risks posed by new regulations
- C. Defining roles within the organization related to privacy
- D. Developing procedures to monitor the use of personal data
Answer: B
NEW QUESTION # 49
An organization having a number of offices across a wide geographical area has developed a disaster recovery plan. Using actual resources, which of the following is the MOST cost-effective test of the disaster recovery plan?
- A. Preparedness test
- B. Regression test
- C. Paper test
- D. Full operational test
Answer: A
Explanation:
A preparedness test is performed by each local office/area to test the adequacy of the preparedness of local operations for disaster recovery. A paper test is a structured walk-through of the disaster recovery plan and should be conducted before a preparedness test. A full operational test is conducted after the paper and preparedness test. A regression test is not a disaster recovery planning (DRP) test and is used in software maintenance.
NEW QUESTION # 50
A bank recently experienced fraud where unauthorized payments were inserted into the payments transaction process. An IS auditor has reviewed the application systems and databases along the processing chain but has not identified the entry point of the fraudulent transactions. Where should the auditor look NEXT?
- A. Operating system patch levels
- B. System backup and archiving
- C. Change management repository
- D. Interfaces between systems
Answer: D
NEW QUESTION # 51
Which of the following findings would be of GREATEST concern when auditing an organization's end-user computing (EUC)?
- A. Inconsistency of patching processes being followed
- B. Errors flowed through to financial statements
- C. Reduced oversight by the IT department
- D. Inability to monitor EUC audit logs and activities
Answer: B
NEW QUESTION # 52
An IS auditor observes a weakness in the tape management system at a data center in that some parameters are set to bypass or ignore tape header records. Which of the following is the MOST effective compensating control for this weakness?
- A. Staging and job set up
- B. Regular back-up of tapes
- C. Offsite storage of tapes
- D. Supervisory review of logs
Answer: A
Explanation:
Section: Protection of Information Assets
Explanation:
If the IS auditor finds that there are effective staging and job set up processes, this can be accepted as a compensating control. Choice B is a detective control while choices C and D are corrective controls, none of which would serve as good compensating controls.
NEW QUESTION # 53
What should regression testing use to obtain accurate conclusions regarding the effects of changes or corrections to a program, and ensuring that those changes and corrections have not introduced new errors?
- A. Contrived data
- B. Live data
- C. Data from previous tests
- D. Independently created data
Answer: C
Explanation:
Explanation/Reference:
Regression testing should use data from previous tests to obtain accurate conclusions regarding the effects of changes or corrections to a program, and ensuring that those changes and corrections have not introduced new errors.
NEW QUESTION # 54
Which of the following provide(s) near-immediate recoverability for time-sensitive systems and transaction processing?
- A. Automated electronic journaling and parallel processing
- B. Parallel processing
- C. Data mirroring and parallel processing
- D. Data mirroring
Answer: C
Explanation:
Explanation/Reference:
Data mirroring and parallel processing are both used to provide near-immediate recoverability for time- sensitive systems and transaction processing.
NEW QUESTION # 55
Effective IT governance requires organizational structures and processes to ensure that:
- A. the business strategy is derived from an IT strategy.
- B. IT governance is separate and distinct from the overall governance.
- C. the organization's strategies and objectives extend the IT strategy.
- D. the IT strategy extends the organization's strategies and objectives.
Answer: D
Explanation:
Effective IT governance requires that board and executive management extend governance to IT and provide the leadership, organizational structures and processes that ensure that the organization's IT sustains and extends the organization's strategiesand objectives, and that the strategy is aligned with business strategy. Choice A is incorrect because it is the IT strategy that extends the organizational objectives, not the opposite. IT governance is not an isolated discipline; it must become anintegral part of the overall enterprise governance.
NEW QUESTION # 56
When storing data archives off-site, what must be done with the data to ensure data completeness?
- A. The data must be synchronized.
- B. The data must be validated.
- C. The data must be parallel-tested.
- D. The data must be normalized.
Answer: A
Explanation:
Explanation/Reference:
Explanation:
When storing data archives off-site, data must be synchronized to ensure data completeness
NEW QUESTION # 57
Which of the following process consist of identification and selection of data from the imaged data set in computer forensics?
- A. Extraction
- B. Reporting
- C. Interrogation
- D. Investigation
Answer: A
Explanation:
Section: Protection of Information Assets
Explanation:
Extraction is the process of identification and selection of data from the imaged data set. This process should include standards of quality, integrity and reliability. The extraction process includes software used and media where an image was made. The extraction process could include different sources such as system logs, firewall logs, audit trails and network management information.
For CISA exam you should know below mentioned key elements of computer forensics during audit planning.
Data Protection -To prevent sought-after information from being altered, all measures must be in place. It is important to establish specific protocol to inform appropriate parties that electronic evidence will be sought and not destroy it by any means.
Data Acquisition - All information and data required should transferred into a controlled location; this includes all types of electronic media such as fixed disk drives and removable media. Each device must be checked to ensure that it is write protected. This may be achieved by using device known as write blocker.
Imaging -The Imaging is a process that allows one to obtain bit-for bit copy of a data to avoid damage of original data or information when multiple analyses may be performed. The imaging process is made to obtain residual data, such as deleted files, fragments of deleted files and other information present, from the disk for analysis. This is possible because imaging duplicates the disk surface, sector by sector.
Extraction - This process consists of identification and selection of data from the imaged data set. This process should include standards of quality, integrity and reliability. The extraction process includes software used and media where an image was made. The extraction process could include different sources such as system logs, firewall logs, audit trails and network management information.
Interrogation -Integration is used to obtain prior indicators or relationships, including telephone numbers, IP addresses, and names of individuals from extracted data.
Investigation/ Normalization -This process converts the information extracted to a format that can be understood by investigator. It includes conversion of hexadecimal or binary data into readable characters or a format suitable for data analysis tool.
Reporting- The information obtained from computer forensic has limited value when it is not collected and reported in proper way. When an IS auditor writes report, he/she must include why the system was reviewed, how the computer data were reviewed and what conclusion were made from analysis. The report should achieve the following goals Accurately describes the details of an incident.
Be understandable to decision makers.
Be able to withstand a barrage of legal security
Be unambiguous and not open to misinterpretation.
Be easily referenced
Contains all information required to explain conclusions reached
Offer valid conclusions, opinions or recommendations when needed
Be created in timely manner.
The following were incorrect answers:
Investigation/ Normalization -This process converts the information extracted to a format that can be understood by investigator. It includes conversion of hexadecimal or binary data into readable characters or a format suitable for data analysis tool.
Interrogation -Integration is used to obtain prior indicators or relationships, including telephone numbers, IP addresses, and names of individuals from extracted data.
Reporting -The information obtained from computer forensic has limited value when it is not collected and reported in proper way. When an IS auditor writes report, he/she must include why the system was reviewed, how the computer data were reviewed and what conclusion were made from analysis.
Explanation:
CISA review manual 2014 Page number 367 and 368
NEW QUESTION # 58
A database administrator has detected a performance problem with some tables which could be solved through denormalization. This situation will increase the risk of:
- A. a loss of data integrity.
- B. deadlocks.
- C. concurrent access.
- D. unauthorized access to data.
Answer: A
Explanation:
Section: Protection of Information Assets
Explanation:
Normalization is the removal of redundant data elements from the database structure. Disabling normalization in relational databases will create redundancy and a risk of not maintaining consistency of data, with the consequent loss of data integrity. Deadlocks are not caused by denormalization. Access to data is controlled by defining user rights to information, and is not affected by denormalization.
NEW QUESTION # 59
An organization is considering whether to allow employees to use personal computing devices for business
purposes. To BEST facilitate senior management's decision, the information security manager should:
- A. develop a business case
- B. conduct a risk assessment
- C. perform a cost-benefit analysis
- D. map the strategy to business objectives
Answer: D
Explanation:
Section: Governance and Management of IT
NEW QUESTION # 60
Which of the following would an IS auditor consider the MOST relevant to short-term planning for an IS department?
- A. Evaluating hardware needs
- B. Allocating resources
- C. Conducting control self-assessment
- D. Keeping current with technology advances
Answer: B
Explanation:
Section: Protection of Information Assets
Explanation:
The IS department should specifically consider the manner in which resources are allocated in the short term. Investments in IT need to be aligned with top management strategies, rather than focusing on technology for technology's sake. Conducting control self-assessments and evaluating hardware needs are not as critical as allocating resources during short-term planning for the IS department.
NEW QUESTION # 61
Which of the following statement is NOT true about Voice-Over IP (VoIP)?
VoIP uses circuit switching technology
Lower cost per call or even free calls, especially for long distance call
Lower infrastructure cost
VoIP is a technology where voice traffic is carried on top of existing data infrastructure
- A. VoIP uses circuit switching technology
- B. Lower cost per call or even free calls, especially for long distance call
- C. VoIP is a technology where voice traffic is carried on top of existing data infrastructure
- D. Lower infrastructure cost
Answer: A
Explanation:
Section: Protection of Information Assets
Explanation/Reference:
The NOT is a keyword used in the question. You need to find out invalid statement about VoIP. VoIP uses
packet switching and not circuit switching.
For your exam you should know below information about VoIP:
Voice-Over-IP
IP telephony, internet telephony, is the technology that makes it possible to have a voice conversation over
the Internet or over any dedicated IP network instead of dedicated transmission lines. The protocol is used
to carry the signal over the IP network are commonly referred as Voice-Over-IP (VoIP).VoIP is a technology
where voice traffic is carried on top of existing data infrastructure. Sounds are digitalized into IP packets
and transferred through the network layer before being decode back into the original voice.
VoIP allows the elimination of circuit switching and the associated waste of bandwidth. Instead, packet
switching is used, where IP packets with voice data are sent over the network only when data needs to be
sent.
It has advantages over traditional telephony:
Unlike traditional telephony, VoIP innovation progresses at market rates rather than at the rates of
multilateral committee process of the International Telecommunication Union (ITU)
Lower cost per call or even free calls, especially for long distance call
Lower infrastructure costs. Once IP infrastructure is installed, no or little additional telephony infrastructure
is needed
VoIP Security Issues
With the introduction of VoIP, the need for security is more important because it is needed to protect two
assets - the data and the voice.
Protecting the security of conversation is vital now.
In VoIP, packets are sent over the network from the user's computer or VoIP phone to similar equipment at
other end. Packets may pass through several intermediate systems that are not under the control of the
user's ISP.The current Internet architecture does not provide same physical wire security as phone line.
The main concern of VoIP solution is that while, in the case of traditional telephones, if data system is
disrupted, then the different sites of the organization could still be reached via telephone. Thus a backup
communication facility should be planned for if the availability of communication is vital to organization.
Another issue might arise with the fact that IP telephones and their supporting equipment require the same
care and maintenance as computer system do.
To enhance the protection of the telephone system and data traffic, the VoIP infrastructure should be
segregated using Virtual Local Area Network (VLAN).
In many cases, session border controllers (SBCs) are utilized to provide security features for VoIP traffic
similar to that provided by firewalls.
The following were incorrect answers:
Lower cost per call or even free calls, especially for long distance call - This is a valid statement about
VoIP. In fact it is an advantage of VoIP.
Lower infrastructure cost - This is a valid statement and advantage of using VoIP as compare to traditional
telephony system.
VoIP is a technology where voice traffic is carried on top of existing data infrastructure - This is also valid
statement about VoIP.
The following reference(s) were/was used to create this question:
CISA review manual 2014 Page number355
NEW QUESTION # 62
......
Career opportunities after getting ISACA CISA Certification
An individual who has an ISACA CISA Certification is able to climb up the corporate ladder and get a better position. The salary for this type of person is considerably higher than the others because of his qualifications and work experience. The person can also have a self-controlled career and can join consultancy firms where he will be helping clients meet their objectives by providing expert advice on CISA Certification. The ISACA CISA Certification is a valuable certification for a variety of professionals. It can be a valuable contribution to an individual's resume and change his worth. The ISACA CISA certification highlights the individual's knowledge base in assurance, security and controls, and information technology.
The ISACA CISA Certification is obtained through passing the CISA exam that covers the general knowledge required to provide assurance-related assistance to organizations, developing and operating security-related policies, procedures, techniques, and tools, or managing IT tasks within an organization. You can get an idea of actualexam by solving the Simulator authorized by ISACA CISA Dumps. Mark my words, printable PDF files of these exam dumps will help you in your study well. You can get PDF files by clicking download links.
Top ISACA CISA Courses Online: https://www.practicetorrent.com/CISA-practice-exam-torrent.html
Free ISACA CISA Exam Questions and Answer from Training Expert PracticeTorrent: https://drive.google.com/open?id=1eajhHtiqAV_KpAliz-aDZ1zr42x8GbYU