New 2021 Guaranteed Success with PassLeaderVCE CISA Dumps ISACA PDF Questions
Exceptional Practice To Certified Information Systems Auditor Pass the First Time
NEW QUESTION 480
A live test of a mutual agreement for IT system recovery has been carried out, including a
four-hour test of intensive usage by the business units. The test has been successful, but gives only partial assurance that the:
- A. workflow of actual business operations can use the emergency system in case of a disaster.
- B. resources and the environment could sustain the transaction load.
- C. system and the IT operations team can sustain operations in the emergency environment.
- D. connectivity to the applications at the remote site meets response time requirements.
Answer: C
Explanation:
The applications have been intensively operated, therefore choices B, C and D have been actually tested, but the capability of the system and the IT operations team to sustain and support this environment (ancillary operations, batch closing, error corrections, output distribution, etc.) is only partially tested.
NEW QUESTION 481
An auditor needs to be aware of technical controls which are used to protect computer from malware.
Which of the following technical control interrupts DoS and ROM BIOS call and look for malware like action?
- A. Behavior blocker
- B. Scanners
- C. Immunizer
- D. Active Monitors
Answer: D
Explanation:
Section: Protection of Information Assets
Explanation
Explanation:
Active monitors interpret DoS and read-only memory (ROM) BIOS calls, looking for malware like actions.
Active monitors can be problematic because they can not distinguish between a user request and a program or a malware request. As a result, users are asked to confirm actions, including formatting a disk or deleting a file or set of files.
For CISA exam you should know below mentioned different kinds of malware Controls
A. Scanners Look for sequences of bit called signature that are typical malware programs.
The two primary types of scanner are
1. Malware mask or Signatures - Anti-malware scanners check files, sectors and system memory for known and new (unknown to scanner) malware, on the basis of malware masks or signatures. Malware masks or signature are specific code strings that are recognized as belonging to malware. For polymorphic malware, the scanner sometimes has algorithms that check for all possible combinations of a signature that could exist in an infected file.
2. Heuristic Scanner - Analyzes the instructions in the code being scanned and decide on the basis of statistical probabilities whether it could contain malicious code. Heuristic scanning result could indicate that malware may be present, that is possibly infected. Heuristic scanner tend to generate a high level false positive errors (they indicate that malware may be present when, in fact, no malware is present). Scanners examines memory disk- boot sector, executables, data files, and command files for bit pattern that match a known malware. Scanners, therefore, need to be updated periodically to remain effective.
B. Immunizers - Defend against malware by appending sections of themselves to files - sometime in the same way Malware append themselves. Immunizers continuously check a file for changes and report changes as possible malware behavior. Other types of Immunizers are focused to a specific malware and work by giving the malware the impression that the malware has already infected to the computer. This method is not always practical since it is not possible to immunize file against all known malware.
C. Behavior Blocker - Focus on detecting potential abnormal behavior such as writing to the boot sector or the master boot record, or making changes to executable files. Blockers can potentially detect malware at an early stage. Most hardware based anti-malware mechanism are based on this concept.
D. Integrity CRC checker - Compute a binary number on a known malware free program that is then stored in a database file. The number is called Cyclic Redundancy Check (CRC). On subsequent scans, when that program is called to execute, it checks for changes to the file as compare to the database and report possible infection if changes have occurred. A match means no infection; a mismatch means change in the program has occurred. A change in the program could mean malware within it. These scanners are effective in detecting infection; however, they can do so only after infection has occurred. Also, a CRC checker can only detect subsequent changes to files, because they assume files are malware free in the first place. Therefore, they are ineffective against new files that are malware infected and that are not recorded in the database. Integrity checker take advantage of the fact that executable programs and boot sectors do not change often, if at all.
The following were incorrect answers:
Scanners - Look for sequences of bit called signature that are typical malware programs.
Immunizers - Defend against malware by appending sections of themselves to files - sometime in the same way Malware append themselves. Immunizers continuously check a file for changes and report changes as possible malware behavior.
Behavior Blocker - Focus on detecting potential abnormal behavior such as writing to the boot sector or the master boot record, or making changes to executable files. Blockers can potentially detect malware at an early stage. Most hardware based anti-malware mechanism are based on this concept.
Reference:
CISA review manual 2014 Page number 354 and 355
NEW QUESTION 482
Which of the following is the PRIMARY purpose of conducting follow-up audits for material observations?
- A. To validate remediation efforts
- B. To validate the correctness of reported findings
- C. To assess evidence for management reporting
- D. To assess the risk of the audit environment
Answer: A
NEW QUESTION 483
An organization has created a policy that defines the types of web sites that users are forbidden to access. What is the MOST effective technology to enforce this policy?
- A. Stateful inspection firewall
- B. Web content filter
- C. Web cache server
- D. Proxy server
Answer: B
Explanation:
A web content filter accepts or denies web communications according to the configured rules. To help the administrator properly configure the tool, organizations and vendors have made available URL blacklists and classifications for millions of web sites. A stateful inspection firewall is of little help in filtering web traffic since it does not review the content of the web site nor does it take into consideration the sites classification. A web cache server is designed to improve the speed of retrieving the most common or recently visited web pages. A proxy server is incorrect because a proxy server is a server which services the request of its clients by forwarding requests to other servers. Many people incorrectly use proxy server as a synonym of web proxy server even though not all web proxy servers have content filtering capabilities.
NEW QUESTION 484
In which of the following RFID risks competitor potentially could gain unauthorized access to RFID- generated information and use it to harm the interests of the organization implementing the RFID system?
- A. Privacy Risk
- B. Externality Risk
- C. Business Intelligence Risk
- D. Business Process Risk
Answer: C
Explanation:
Section: Information System Operations, Maintenance and Support
Explanation:
An adversary or competitor potentially could gain unauthorized access to RFID-generated information and use it to harm the interests of the organization implementing the RFID system.
RFID is a powerful technology, in part, because it supports wireless remote access to information about assets and people that either previously did not exist or was difficult to create or dynamically maintain.
While this wireless remote access is a significant benefit, it also creates a risk that unauthorized parties could also have similar access to that information if proper controls are not in place. This risk is distinct from the business process risk because it can be realized even when business processes are functioning as intended.
A competitor or adversary can gain information from the RFID system in a number of ways, including eavesdropping on RF links between readers and tags, performing independent queries on tags to obtain relevant data, and obtaining unauthorized access to a back-end database storing information about tagged items. Supply chain applications may be particularly vulnerable to this risk because a variety of external entities may have read access to the tags or related databases.
The risk of unauthorized access is realized when the entity engaging in the unauthorized behavior does something harmful with that information. In some cases, the information may trigger an immediate response. For example, someone might use a reader to determine whether a shipping container holds expensive electronic equipment, and then break into the container when it gets a positive reading. This scenario is an example of targeting. In other cases, data might also be aggregated over time to provide intelligence regarding an organization's operations, business strategy, or proprietary methods.
For instance, an organization could monitor the number of tags entering a facility to provide a reasonable indication of its business growth or operating practices. In this case, if someone determined that a warehouse recently received a number of very large orders, then that might trigger an action in financial markets or prompt a competitor to change its prices or production schedule.
For your exam you should know the information below:
Radio-frequency identification (RFID) is the wireless non-contact use of radio-frequency electromagnetic fields to transfer data, for the purposes of automatically identifying and tracking tags attached to objects.
The tags contain electronically stored information. Some tags are powered by and read at short ranges (a few meters) via magnetic fields (electromagnetic induction). Others use a local power source such as a battery, or else have no battery but collect energy from the interrogating EM field, and then act as a passive transponder to emit microwaves or UHF radio waves (i.e., electromagnetic radiation at high frequencies).
Battery powered tags may operate at hundreds of meters. Unlike a barcode, the tag does not necessarily need to be within line of sight of the reader, and may be embedded in the tracked object.
RFID tags are used in many industries. An RFID tag attached to an automobile during production can be used to track its progress through the assembly line. Pharmaceuticals can be tracked through warehouses.
Livestock and pets may have tags injected, allowing positive identification of the animal.
RFID RISKS
RFID technology enables an organization to significantly change its business processes to:
Increase its efficiency, which results in lower costs, Increase its effectiveness, which improves mission performance and makes the implementing organization more resilient and better able to assign accountability, and Respond to customer requirements to use RFID technology to support supply chains and other applications.
The RFID technology itself is complex, combining a number of different computing and communications technologies to achieve the desired objectives. Unfortunately, both change and complexity generate risk.
For RFID implementations to be successful, organizations need to effectively manage that risk, which requires an understanding of its sources and its potential characteristics. This section reviews the major high-level business risks associated with RFID systems so that organizations planning or operating these systems can better identify, characterize, and manage the risk in their environments.
The risks are as follows:
Business Process Risk -Direct attacks on RFID system components potentially could undermine the business processes the RFID system was designed to enable.
Business Intelligence Risk- An adversary or competitor potentially could gain unauthorized access to RFID- generated information and use it to harm the interests of the organization implementing the RFID system.
Privacy Risk - Personal privacy rights or expectations may be compromised if an RFID system uses what is considered personally identifiable information for a purpose other than originally intended or understood.
The personal possession of functioning tags also is a privacy risk because it could enable tracking of those holding tagged items.
Externality Risk -RFID technology potentially could represent a threat to non-RFID networked or collocated systems, assets, and people.
An important characteristic of RFID that impacts all of these risks is that RF communication is invisible to operators and users.
The following answers are incorrect:
Business Process Risk -Direct attacks on RFID system components potentially could undermine the business processes the RFID system was designed to enable.
Externality Risk -RFID technology potentially could represent a threat to non-RFID networked or collocated systems, assets, and people.
Privacy Risk - Personal privacy rights or expectations may be compromised if an RFID system uses what is considered personally identifiable information for a purpose other than originally intended or understood.
The personal possession of functioning tags also is a privacy risk because it could enable tracking of those holding tagged items.
Reference:
CISA review manual 2014 page number 248
NEW QUESTION 485
In reviewing the IS short-range (tactical) plan, an IS auditor should determine whether:
- A. a strategic information technology planning methodology is in place.
- B. there is an integration of IS and business staffs within projects.
- C. there is a clear definition of the IS mission and vision.
- D. the plan correlates business objectives to IS goals and objectives.
Answer: B
Explanation:
The integration of IS and business staff in projects is an operational issue and should be considered while reviewing the short-range plan. A strategic plan would provide a framework for the IS short-range plan. Choices B, C and D are areas covered by a strategic plan.
NEW QUESTION 486
Which of the following is MOST directly affected by network performance monitoring tools?
- A. Integrity
- B. Availability
- C. Completeness
- D. Confidentiality
Answer: B
Explanation:
Section: Protection of Information Assets
Explanation:
In case of a disruption in service, one of the key functions of network performance monitoring tools is to ensure that the information has remained unaltered. It is a function of security monitoring to assure confidentiality by using such tools as encryption. However, the most important aspect of network performance is assuring the ongoing dependence on connectivity to run the business. Therefore, the characteristic that benefits the most from network monitoring is availability.
NEW QUESTION 487
Management disagrees with a finding in a draft audit report and provides supporting documentation. Which
of the following should be the IS auditor's NEXT course of action?
- A. Evaluate the supporting documentation
- B. Finalize the draft audit report without changes
- C. Document management's disagreement in the final report
- D. Escalate the issue with supporting documentation to senior management
Answer: A
Explanation:
Section: The process of Auditing Information System
NEW QUESTION 488
Failure in which of the following testing stages would have the GREATEST impact on the implementation of new application software?
- A. Unit testing
- B. Integration testing
- C. System testing
- D. Acceptance testing
Answer: D
Explanation:
Acceptance testing is the final stage before the software is installed and is available for use. The greatest impact would occur if the software fails at the acceptance testing level, as this could result in delays and cost overruns. System testing is undertaken by the developer team to determine if the software meets user requirements per specifications. Integration testing examines the units/modules as one integrated system and unit testing examines the individual units or components of the software. System, integration and unit testing are all performed by the developers at various stages of development; the impact of failure is comparatively less for each than failure at the acceptance testing stage.
NEW QUESTION 489
The use of symmetric key encryption controls to protect sensitive data transmitted over a communications
network requires that:
- A. encryption keys be changed only when a compromise is detected at both ends.
- B. public keys be stored in encrypted form.
- C. primary keys for encrypting the data be stored in encrypted form.
- D. encryption keys at one end be changed on a regular basis.
Answer: C
Explanation:
Section: Protection of Information Assets
NEW QUESTION 490
A vulnerability in which of the following virtual systems would be of GREATEST concern to the IS auditor?
- A. The virtual machine management server
- B. The virtual application server
- C. The virtual antivirus server
- D. The virtual file server
Answer: A
NEW QUESTION 491
Which of the following is a management technique that enables organizations to develop strategically important systems faster, while reducing development costs and maintaining quality?
- A. Critical path methodology
- B. Program evaluation review technique
- C. Function point analysis
- D. Rapid application development
Answer: D
Explanation:
Explanation/Reference:
Explanation:
Rapid application development is a management technique that enables organizations to develop strategically important systems faster, while reducing development costs and maintaining quality. The program evaluation review technique (PERT) and critical path methodology (CPM) are both planning and control techniques, while function point analysis is used for estimating the complexity of developing business applications.
NEW QUESTION 492
Test and development environments should be separated. True or false?
- A. True
- B. False
Answer: A
Explanation:
Section: Protection of Information Assets
Explanation:
Test and development environments should be separated, to control the stability of the test environment.
NEW QUESTION 493
IS management is considering a Voice-over Internet Protocol (VoIP) network to reduce
telecommunication costs and management asked the IS auditor to comment on appropriate security controls. Which of the following security measures is MOST appropriate?
- A. Redirect all VoIP traffic to allow clear text logging of authentication credentials
- B. Review and, where necessary, upgrade firewall capabilities
- C. Install modems to allow remote maintenance support access
- D. Create a physically distinct network to handle VoIP traffic
Answer: B
Explanation:
Firewalls used as entry points to a Voice-over Internet Protocol (VoIP) network should be VoIPcapable. VoIP network services such as H.323 introduce complexities that are likely to strain the capabilities of older firewalls. Allowing for remote support access is an important consideration. However, a virtual private network (VPN) would offer a more secure means of enabling this access than reliance on modems. Logically separating the VoIP and data network is a good ideA. Options such as virtualLANS (VLA.NS), traffic shaping, firewalls and network address translation (NAT) combined with private IP addressing can be used; however, physically separating the networks will increase both cost and administrative complexity. Transmitting or storing clear text information, particularly sensitive information such as authentication credentials, will increase network vulnerability. When designing a VoIP network, it is important to avoid introducing any processing that will unnecessarily in crease latency since this will adversely impact VoIP quality.
NEW QUESTION 494
An IS auditor is conducting a post-implementation review of an enterprise resource planning (ERP) system End users indicated concerns with the accuracy of critical automatic calculations made by the system. The auditor's FIRST course of action should be to:
- A. review recent changes to the system
- B. verify results to determine validity of user concerns
- C. verify completeness of user acceptance testing
- D. review initial business requirements
Answer: D
NEW QUESTION 495
What is often assured through table link verification and reference checks?
- A. Database synchronization
- B. Database accuracy
- C. Database normalcy
- D. Database integrity
Answer: D
Explanation:
Section: Protection of Information Assets
Explanation:
Database integrity is most often ensured through table link verification and reference checks.
NEW QUESTION 496
Which of the following is the MOST effective way to verify an organization's ability to continue its essential business operations after a disruption event?
- A. Analysis of business impact
- B. Analysis of end-to-end recovery flow
- C. Analysis of recovery point objectives (RPOs)
- D. Analysis of call trees
Answer: C
NEW QUESTION 497
What is the BEST action to prevent loss of data integrity or confidentiality in the case of
an e-commerce application running on a LAN, processing electronic fund transfers (EFT) and orders?
- A. Auditing the access control to the network
- B. Logging all changes to access lists
- C. Using virtual private network (VPN) tunnels for data transfer
- D. Enabling data encryption within the application
Answer: C
Explanation:
The best way to ensure confidentiality and integrity of data is to encrypt it using virtual private network (VPN) tunnels. This is the most common and convenient way to encrypt the data traveling over the network. Data encryption within the application is less efficient than VPN. The other options are good practices, but they do not directly prevent the loss of data Integrity and confidentiality during communication through a network.
NEW QUESTION 498
An IS auditor reviewing the key roles and responsibilities of the database administrator (DBA) is LEAST likely to expect the job description of the DBA to include:
- A. mapping data model with the internalschemA.
- B. liaising with users in developing data model.
- C. defining the conceptualschem
- D. defining security and integrity checks.
Answer: A
Explanation:
A DBA only in rare instances should be mapping data elements from the data model to the internal schema (physical data storage definitions). To do so would eliminate data independence for application systems. Mapping of the data model occurs with the conceptual schema since the conceptual schema represents the enterprisewide view of data within an organization and is the basis for deriving an end-user department data model.
NEW QUESTION 499
A bank is relocating its servers to a vendor that provides data center hosting services to multiple clients. Which of the following controls would restrict other clients from physical access to the bank servers?
- A. 24-hour security guards
- B. Locking server cages
- C. Biometric access at all data center entrances
- D. Closed-circuit television camera
Answer: B
NEW QUESTION 500
Which of the following would an IS auditor consider a weakness when performing an audit of an organization that uses a public key infrastructure with digital certificates for its business-to- consumer transactions via the internet?
- A. Customers can make their transactions from any computer or mobile device.
- B. The certificate authority has several data processing subcenters to administer certificates.
- C. The organization is the owner of the certificate authority.
- D. Customers are widely dispersed geographically, but the certificate authorities are not.
Answer: C
Explanation:
Section: Protection of Information Assets
Explanation: If the certificate authority belongs to the same organization, this would generate a conflict of interest. That is, if a customer wanted to repudiate a transaction, they could allege that because of the shared interests, an unlawful agreement exists between the parties generating the certificates, if a customer wanted to repudiate a transaction, they could argue that there exists a bribery between the parties to generate the certificates, as shared interests exist. The other options are not weaknesses.
NEW QUESTION 501
When reviewing backup policies, an IS auditor MUST verify that backup intervals of critical systems do not exceed which of the following?
- A. Maximum acceptable outage (MAO)
- B. Recovery point objective (RPO)
- C. Recovery time objective (RTO)
- D. Service level objective (SLO)
Answer: B
NEW QUESTION 502
Failure in which of the following testing stages would have the GREATEST impact on the implementation of
new application software?
- A. Unit testing
- B. Integration testing
- C. System testing
- D. Acceptance testing
Answer: D
Explanation:
Section: Protection of Information Assets
Explanation:
Acceptance testing is the final stage before the software is installed and is available for use. The greatest
impact would occur if the software fails at the acceptance testing level, as this could result in delays and
cost overruns. System testing is undertaken by the developer team to determine if the software meets user
requirements per specifications. Integration testing examines the units/modules as one integrated system
and unit testing examines the individual units or components of the software. System, integration and unit
testing are all performed by the developers at various stages of development; the impact of failure is
comparatively less for each than failure at the acceptance testing stage.
NEW QUESTION 503
The IS auditor learns that when equipment was brought into the data center by a vendor, the emergency power shutoff switch was accidentally pressed and the UPS was engaged. Which of the following audit recommendations should the IS auditor suggest?
- A. Relocate the shut off switch.
- B. Install protective covers.
- C. Log environmental failures.
- D. Escort visitors.
Answer: B
Explanation:
A protective cover over the switch would allow it to be accessible and visible, but would prevent accidental activation.
NEW QUESTION 504
......
CISA EXAM DUMPS WITH GUARANTEED SUCCESS: https://www.passleadervce.com/Isaca-Certification/reliable-CISA-exam-learning-guide.html
Best Quality ISACA CISA Exam Questions: https://drive.google.com/open?id=1c2bD2nW2lDxAvWILBxeSAfi26MHMtbI_