Provide ISACA CISA Dumps Updated Oct 15, 2024 With 1151 QA's
Latest CISA Dumps for Success in Actual ISACA Certified
The Certified Information Systems Auditor (CISA) certification is a globally recognized professional certification for information technology audit professionals. Certified Information Systems Auditor certification is offered by ISACA, a global association that provides IT governance, security, audit and assurance education, training and certification. The CISA certification offers a comprehensive knowledge of information systems auditing, control and security. It is considered as one of the most respected and credible certifications in the IT industry.
ISACA CISA Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
| Topic 5 |
|
| Topic 6 |
|
| Topic 7 |
|
| Topic 8 |
|
The CISA exam is a comprehensive exam that covers a wide range of topics related to information systems auditing. CISA exam consists of four domains: The Process of Auditing Information Systems, Governance and Management of IT, Information Systems Acquisition, Development, and Implementation, and Information Systems Operations, Maintenance, and Service Management. Each domain covers a specific set of knowledge and skills that are essential for effective information systems auditing.
NEW QUESTION # 84
During an internal audit of an organization's information security program, the IS auditor observes a number of security incidents nave remained open over an extended period of time What is the IS auditor's BEST course of action?
- A. Recommend the open incidents be closed immediately.
- B. Review status of open incidents to determine why they remain open
- C. Discuss the issue with the chief information security officer (CISO)
- D. Review staffing levels for the security incident handling team.
Answer: B
NEW QUESTION # 85
Which of the following is the BEST recommendation to prevent fraudulent electronic funds transfers by accounts payable employees?
- A. Periodic vendor reviews
- B. Dual control
- C. Independent reconciliation
- D. Re-keying of monetary amounts
Answer: B
NEW QUESTION # 86
When an organization is outsourcing their information security function, which of the following should be kept in the organization?
- A. Accountability for the corporate security policy
- B. Implementing the corporate security policy
- C. Defining the corporate security policy
- D. Defining security procedures and guidelines
Answer: A
Explanation:
Explanation/Reference:
Explanation:
Accountability cannot be transferred to external parties. Choices B, C and D can be performed by outside entities as long as accountability remains within the organization.
NEW QUESTION # 87
Which of the following ACID property in DBMS means that once a transaction has been committed, it will remain so, even in the event of power loss, crashes, or errors?
- A. Consistency
- B. Atomicity
- C. Durability
- D. Isolation
Answer: C
Explanation:
Section: Information System Acquisition, Development and Implementation Explanation:
Durability - Durability means that once a transaction has been committed, it will remain so, even in the event of power loss, crashes, or errors.
For CISA exam you should know below information about ACID properties in DBMS:
Atomicity - Atomicity requires that each transaction is "all or nothing": if one part of the transaction fails, the entire transaction fails, and the database state is left unchanged. An atomic system must guarantee atomicity in each and every situation, including power failures, errors, and crashes. To the outside world, a committed transaction appears (by its effects on the database) to be indivisible ("atomic"), and an aborted transaction does not happen.
Consistency - The consistency property ensures that any transaction will bring the database from one valid state to another. Any data written to the database must be valid according to all defined rules, including but not limited to constraints, cascades, triggers, and any combination thereof. This does not guarantee correctness of the transaction in all ways the application programmer might have wanted (that is the responsibility of application-level code) but merely that any programming errors do not violate any defined rules.
Isolation - The isolation property ensures that the concurrent execution of transactions results in a system state that would be obtained if transactions were executed serially, i.e. one after the other. Providing isolation is the main goal of concurrency control. Depending on concurrency control method, the effects of an incomplete transaction might not even be visible to another transaction. [citation needed] Durability - Durability means that once a transaction has been committed, it will remain so, even in the event of power loss, crashes, or errors. In a relational database, for instance, once a group of SQL statements execute, the results need to be stored permanently (even if the database crashes immediately thereafter). To defend against power loss, transactions (or their effects) must be recorded in a non-volatile memory.
The following were incorrect answers:
Consistency - The consistency property ensures that any transaction will bring the database from one valid state to another. Any data written to the database must be valid according to all defined rules, including but not limited to constraints, cascades, triggers, and any combination thereof. This does not guarantee correctness of the transaction in all ways the application programmer might have wanted (that is the responsibility of application-level code) but merely that any programming errors do not violate any defined rules.
Isolation - The isolation property ensures that the concurrent execution of transactions results in a system state that would be obtained if transactions were executed serially, i.e. one after the other.
Atomicity requires that each transaction is "all or nothing": if one part of the transaction fails, the entire transaction fails, and the database state is left unchanged.
Reference:
CISA review manual 2014 Page number 218
NEW QUESTION # 88
In a client-server architecture, a domain name service (DNS) is MOST important because it provides the:
- A. resolution service for the name/address.
- B. address of the domain server.
- C. IP addresses for the internet.
- D. domain name system.
Answer: A
Explanation:
Section: Protection of Information Assets
Explanation:
DNS is utilized primarily on the Internet for resolution of the name/address of the web site. It is an Internet service that translates domain names into IP addresses. As names are alphabetic, they are easier to remember. However, the Internet is based on IP addresses. Every time a domain name is used, a DNS service must translate the name into the corresponding IP address. The DNS system has its own network, if one DNS server does not know how to translate a particular domain name, it asks another one, and so on, until the correct IP address is returned.
NEW QUESTION # 89
An organization recently decided to send the backup of its customer relationship management (CRM) system to its cloud provider for recovery. Which of the following should be of GREATEST concern to an IS auditor reviewing this process?
- A. Validation of backup data has not been performed.
- B. The cloud provider is located in a different country.
- C. Testing of restore data has not been performed.
- D. Backups are sent and stored in unencrypted format.
Answer: D
NEW QUESTION # 90
Which of the following method of expressing knowledge base consist of a graph in which nodes represent physical or conceptual objects and the arcs describes the relationship between nodes?
- A. Semantic nets
- B. Decision tree
- C. Knowledge interface
- D. Rules
Answer: A
Explanation:
Section: Information System Acquisition, Development and Implementation Explanation:
Semantic nets consist of a graph in which the node represent physical or conceptual object and the arcs describe the relationship between the nodes.
For CISA Exam you should know below information about Artificial Intelligence and Expert System Artificial intelligence is the study and application of the principles by which:
Knowledge is acquired and used
Goals are generated and achieved
Information is communicated
Collaboration is achieved
Concepts are formed
Languages are developed
Two main programming languages that have been developed for artificial intelligence are LISP and PROLOG.
Expert system are compromised primary components, called shells, when they are not populated with particular data, and the shells are designed to host new expert system.
Keys to the system is the knowledge base (KB), which contains specific information or fact patterns associated with a particular subject matter and the rule for interpreting these facts. The KB interface with a database in obtaining data to analyze a particular problem in deriving an expert conclusion. The information in the KB can be expressed in several ways:
Decision Tree - Using questionnaires to lead the user through a series of choices, until a conclusion is reached. Flexibility is compromised because the user must answer the questions in an exact sequence.
Rule - Expressing declarative knowledge through the use of if-then relationships. For example, if a patient's body temperature is over 39 degrees Celsius and their pulse is under 60, then they might be suffering from a certain disease.
Semantic nets - Consist of a graph in which the node represent physical or conceptual object and the arcs describe the relationship between the nodes. Semantic nets resemble a data flow diagram and make use of an inheritance mechanism to prevent duplication of a data.
Additionally, the inference engine shown is a program that uses the KB and determines the most appropriate outcome based on the information supplied by the user. In addition, an expert system includes the following components Knowledge interface - Allows the expert to enter knowledge into the system without the traditional mediation of a software engineer.
Data Interface - Enables the expert system to collect data from nonhuman sources, such as measurement instruments in a power plant.
The following were incorrect answers:
Decision Tree - Using questionnaires to lead the user through a series of choices, until a conclusion is reached. Flexibility is compromised because the user must answer the questions in an exact sequence.
Rule - Expressing declarative knowledge through the use of if-then relationships.
Semantic nets - Semantic nets consist of a graph in which the node represent physical or conceptual object and the arcs describe the relationship between the nodes.
Reference:
CISA review manual 2014 Page number 187
NEW QUESTION # 91
If senior management is not committed to strategic planning, how likely is it that a company's implementation of IT will be successful?
- A. Strategic planning does not affect the success of a company's implementation of IT.
- B. Less likely.
- C. IT cannot be implemented if senior management is not committed to strategic planning.
- D. More likely.
Answer: B
Explanation:
Explanation/Reference:
A company's implementation of IT will be less likely to succeed if senior management is not committed to strategic planning.
NEW QUESTION # 92
A team conducting a risk analysis is having difficulty projecting the financial losses that could result from a risk. To evaluate the potential losses, the team should:
- A. compute the amortization of the related assets.
- B. apply a qualitative approach.
- C. calculate a return on investment (ROI).
- D. spend the time needed to define exactly the loss amount.
Answer: B
Explanation:
The common practice, when it is difficult to calculate the financial losses, is to take a qualitative approach, in which the manager affected by the risk defines the financial loss in terms of a weighted factor {e.g., one is a very low impact to thebusiness and five is a very high impact). An ROI is computed when there is predictable savings or revenues that can be compared to the investment needed to realize the revenues. Amortization is used in a profit and loss statement, not in computing potential losses. Spending the time needed to define exactly the total amount is normally a wrong approach. If it has been difficult to estimate potential losses (e.g., losses derived from erosion of public image due to a hack attack), that situation is not likely to change, and at the end of the day, the result will be a not well-supported evaluation.
NEW QUESTION # 93
An IS auditor discovers that a developer has used the same key to grant access to multiple applications making calls to an application programming interface (API). Which of the following is the BEST recommendation to address this situation?
- A. Implement a process to expire the API key after a previously agreed-upon period of time.
- B. Coordinate an API key rotation exercise with all impacted application owners.
- C. Authorize the API key to allow read-only access by all applications.
- D. Replace the API key with time-limited tokens that grant least privilege access.
Answer: D
NEW QUESTION # 94
An organization is using symmetric encryption. Which of the following would be a valid reason for moving to asymmetric encryption? Symmetric encryption:
- A. requires a relatively simple algorithm.
- B. can cause key management to be difficult.
- C. provides authenticity.
- D. is faster than asymmetric encryption.
Answer: B
Explanation:
Explanation/Reference:
Explanation:
In a symmetric algorithm, each pair of users needs a unique pair of keys, so the number of keys grows and key management can become overwhelming. Symmetric algorithms do not provide authenticity, and symmetric encryption is faster than asymmetric encryption. Symmetric algorithms require mathematical calculations, but they are not as complex as asymmetric algorithms.
NEW QUESTION # 95
Which of the following will invalidate the authenticity of digital evidence in a forensic investigation?
- A. The investigator collected the evidence while the machine was still powered on.
- B. A software write blocker was used in the collection of the evidence.
- C. The investigator installed forensic software on the original drive that contained the evidence.
- D. The evidence was collected from analysis of a copy of the disk data.
Answer: C
NEW QUESTION # 96
Which of the following testing method examines the functionality of an application without peering into its internal structure or knowing the details of it's internals?
- A. Black-box testing
- B. Regression Testing
- C. Parallel Test
- D. Pilot Testing
Answer: A
Explanation:
Explanation/Reference:
Black-box testing is a method of software testing that examines the functionality of an application (e.g.
what the software does) without peering into its internal structures or workings (see white-box testing).
This method of test can be applied to virtually every level of software testing: unit, integration, system and acceptance. It typically comprises most if not all higher level testing, but can also dominate unit testing as well.
For your exam you should know the information below:
Alpha and Beta Testing - An alpha version is early version is an early version of the application system submitted to the internal user for testing. The alpha version may not contain all the features planned for the final version. Typically, software goes to two stages testing before it consider finished. The first stage is called alpha testing is often performed only by the user within the organization developing the software.
The second stage is called beta testing, a form of user acceptance testing, generally involves a limited number of external users. Beta testing is the last stage of testing, and normally involves real world exposure, sending the beta version of the product to independent beta test sites or offering it free to interested user.
Pilot Testing -A preliminary test that focuses on specific and predefined aspect of a system. It is not meant to replace other testing methods, but rather to provide a limited evaluation of the system. Proof of concept are early pilot tests - usually over interim platform and with only basic functionalities.
White box testing - Assess the effectiveness of a software program logic. Specifically, test data are used in determining procedural accuracy or conditions of a program's specific logic path. However, testing all possible logical path in large information system is not feasible and would be cost prohibitive, and therefore is used on selective basis only.
Black Box Testing - An integrity based form of testing associated with testing components of an information system's "functional" operating effectiveness without regards to any specific internal program structure. Applicable to integration and user acceptance testing.
Function/validation testing - It is similar to system testing but it is often used to test the functionality of the system against the detailed requirements to ensure that the software that has been built is traceable to customer requirements.
Regression Testing -The process of rerunning a portion of a test scenario or test plan to ensure that changes or corrections have not introduced new errors. The data used in regression testing should be same as original data.
Parallel Testing - This is the process of feeding test data into two systems - the modified system and an alternative system and comparing the result.
Sociability Testing -The purpose of these tests is to confirm that new or modified system can operate in its target environment without adversely impacting existing system. This should cover not only platform that will perform primary application processing and interface with other system but, in a client server and web development, changes to the desktop environment. Multiple application may run on the user's desktop, potentially simultaneously, so it is important to test the impact of installing new dynamic link libraries (DLLs), making operating system registry or configuration file modification, and possibly extra memory utilization.
The following answers are incorrect:
Parallel Testing - This is the process of feeding test data into two systems - the modified system and an alternative system and comparing the result.
Regression Testing -The process of rerunning a portion of a test scenario or test plan to ensure that changes or corrections have not introduced new errors. The data used in regression testing should be same as original data.
Pilot Testing -A preliminary test that focuses on specific and predefined aspect of a system. It is not meant to replace other testing methods, but rather to provide a limited evaluation of the system. Proof of concept are early pilot tests - usually over interim platform and with only basic functionalities The following reference(s) were/was used to create this question:
CISA review manual 2014 Page number 167
Official ISC2 guide to CISSP CBK 3rd Edition Page number 176
NEW QUESTION # 97
Which of the following would contribute MOST to an effective business continuity plan (BCP)?
- A. Approval by senior management
- B. Document is circulated to all interested parties
- C. Planning involves all user departments
- D. Audit by an external IS auditor
Answer: C
Explanation:
Explanation/Reference:
Explanation:
The involvement of user departments in the BCP is crucial for the identification of the business processing priorities. The BCP circulation will ensure that the BCP document is received by all users. Though essential, this does not contribute significantly to the success of the BCP. A BCP approved by senior management would not ensure the quality of the BCP, nor would an audit necessarily improve the quality of the BCP.
NEW QUESTION # 98
An IS auditor is conducting a post-implementation review of an enterprise resource planning (ERP) system. End users indicated concerns with the accuracy of critical automatic calculations made by the system. The auditor's FIRST course of action should be to:
- A. verify results to determine validity of user concerns.
- B. review initial business requirements.
- C. verify completeness of user acceptance testing (UAT).
- D. review recent changes to the system.
Answer: A
NEW QUESTION # 99
Which of the following findings from an II governance review should be of GREATEST concern?
- A. IT value analysis has not been completed
- B. IT supports two different operating systems
- C. All IT services are provided by third parties
- D. The IT budget is not monitored
Answer: A
NEW QUESTION # 100
A business has requested an audit to determine whether information stored in an application is adequately protected. Which of the following is the MOST important action before the audit work begins?
- A. Assess the threat landscape.
- B. Perform penetration testing.
- C. Review remediation reports
- D. Establish control objectives.
Answer: D
Explanation:
The most important action before the audit work begins is to establish control objectives. Control objectives are the specific goals or outcomes that the audit intends to achieve or verify in relation to the information protection in the application1. Control objectives provide the basis for designing and performing the audit procedures, evaluating the audit evidence, and reporting the audit findings and recommendations2. Control objectives also help to align the audit scope and criteria with the business needs and expectations, and to ensure that the audit is relevant, reliable, and efficient3.
Some examples of control objectives for an information protection audit are:
* To ensure that the information stored in the application is classified according to its sensitivity, value, and regulatory requirements
* To ensure that the information stored in the application is encrypted, masked, or anonymized as appropriate
* To ensure that the information stored in the application is accessible only by authorized users and processes
* To ensure that the information stored in the application is backed up, restored, and retained according to the business continuity and retention policies
* To ensure that the information stored in the application is monitored, logged, and audited for any unauthorized or anomalous activities Therefore, option B is the correct answer.
Option A is not correct because reviewing remediation reports is not the most important action before the audit work begins. Remediation reports are documents that describe how previous audit findings or issues have been resolved or addressed by the auditee4. While reviewing remediation reports may be useful for understanding the current state of information protection in the application, it is not a prerequisite for defining the control objectives of the audit.
Option C is not correct because assessing the threat landscape is not the most important action before the audit work begins. The threat landscape is the set of potential sources, methods, and impacts of cyberattacks or data breaches that may affect the information stored in the application5. While assessing the threat landscape may be helpful for identifying and prioritizing the risks and vulnerabilities of information protection in the application, it is not a prerequisite for defining the control objectives of the audit.
Option D is not correct because performing penetration testing is not the most important action before the audit work begins. Penetration testing is a technique that simulates real-world cyberattacks or data breaches to test the security and resilience of information systems or applications.
NEW QUESTION # 101
During an audit, an IS auditor notes that an organization's business continuity plan (BCP) does not adequately address information confidentiality during a recovery process. The IS auditor should recommend that the plan be modified to include:
- A. change management procedures for information security that could affect business continuity arrangements.
- B. the level of information security required when business recovery procedures are invoked.
- C. information security resource requirements.
- D. information security roles and responsibilities in the crisis management structure.
Answer: B
Explanation:
Explanation/Reference:
Explanation:
Business should consider whether information security levels required during recovery should be the same, lower or higher than when business is operating normally. In particular, any special rules for access to confidential data during a crisis need to be identified. The other choices do not directly address the information confidentiality issue.
NEW QUESTION # 102
One advantage of monetary unit sampling is the fact that
- A. it increases the likelihood of selecting material items from the population
- B. results are stated m terms of the frequency of items in error
- C. it can easily be applied manually when computer resources are not available
- D. large-value population items are segregated and audited separately
Answer: A
Explanation:
Explanation
Monetary unit sampling (MUS) is a statistical sampling method that is used to determine if the account balances or monetary amounts in a population contain any misstatements. MUS treats each individual dollar in the population as a separate sampling unit, so that larger balances or amounts have a higher probability of being selected than smaller ones. MUS then projects the results of testing the sample to the entire population in terms of dollar values, rather than error rates.
One advantage of MUS is that it increases the likelihood of selecting material items from the population.
Material items are those that have a significant impact on the financial statements and could influence the decisions of users. By giving more weight to larger items, MUS ensures that material misstatements are more likely to be detected and reported. MUS also reduces the sample size required to achieve a desired level of confidence and precision, as compared to other sampling methods that do not consider the value of items.
References:
4: Monetary unit sampling definition - AccountingTools
5: How Does Monetary Unit Sampling Work? - dummies
6: Audit sampling | ACCA Qualification | Students | ACCA Global
NEW QUESTION # 103
An advantage of using sanitized live transactions in test data is that:
- A. no special routines are required to assess the results.
- B. every error condition is likely to be tested.
- C. all transaction types will be included.
- D. test transactions are representative of live processing.
Answer: D
Explanation:
Test data will be representative of live processing; however, it is unlikely that all transaction types or error conditions will be tested in this way.
NEW QUESTION # 104
An IS auditor observes that a business-critical application does not currently have any level of fault tolerance.
Which of the following is the GREATEST concern with this situation?
- A. Limited tolerance for damage
- B. Single point of failure
- C. Decreased mean time between failures (MTBF)
- D. Degradation of services
Answer: B
Explanation:
Explanation
The greatest concern with this situation is that a business-critical application does not currently have any level of fault tolerance and thus has a single point of failure. A single point of failure is a component or element of a system that, if it fails, will cause the entire system to stop functioning. Fault tolerance is the ability of a system to continue operating without interruption or degradation in the event of a failure of one or more of its components or elements. Fault tolerance can be achieved by using techniques such as redundancy, replication, backup, or failover. A business-critical application should have a high level of fault tolerance to ensure its availability, reliability, and continuity. References:
CISA Review Manual (Digital Version), Chapter 5, Section 5.51
CISA Online Review Course, Domain 3, Module 3, Lesson 22
NEW QUESTION # 105
Which of the following forms of evidence for the auditor would be considered the MOST reliable?
- A. An internally generated computer accounting report
- B. The results of a test performed by an IS auditor
- C. A confirmation letter received from an outside source
- D. An oral statement from the auditee
Answer: C
Explanation:
Explanation/Reference:
Explanation:
Evidence obtained from outside sources is usually more reliable than that obtained from within the organization. Confirmation letters received from outside parties, such as those used to verify accounts receivable balances, are usually highly reliable. Testing performed by an auditor may not be reliable, if the auditor did not have a good understanding of the technical area under review.
NEW QUESTION # 106
An IS auditor is evaluating a corporate network for a possible penetration by employees. Which of the following findings should give the IS auditor the GREATEST concern?
- A. Users can install software on their desktops.
- B. There are a number of external modems connected to the network.
- C. Many user IDs have identical passwords.
- D. Network monitoring is very limited.
Answer: C
Explanation:
Explanation/Reference:
Explanation:
Exploitation of a known user ID and password requires minimal technical knowledge and exposes the network resources to exploitation. The technical barrier is low and the impact can be very high; therefore, the fact that many user IDs have identical passwords represents the greatest threat. External modems represent a security risk, but exploitation still depends on the use of a valid user account. While the impact of users installing software on their desktops can be high {for example, due to the installation of Trojans or key-logging programs), the likelihood is not high due to the level of technical knowledge required to successfully penetrate the network. Although network monitoring can be a useful detective control, it will only detectabuse of user accounts in special circumstances and is, therefore, not a first line of defense.
NEW QUESTION # 107
Which of the following is the BEST indicator of the effectiveness of signature-based intrusion detection
systems?
- A. An increase in the number of detected incidents not previously identified
- B. An increase in the number of internally reported critical incidents
- C. An increase in the number of identified false positives
- D. An increase in the number of unfamiliar sources of intruders
Answer: A
Explanation:
Section: Protection of Information Assets
NEW QUESTION # 108
An IS audit manager is reviewing workpapers for a recently completed audit of the corporate disaster recovery test. Which of the following should the IS audit manager specifically review to substantiate the conclusions?
- A. Detailed evidence of the successes and weaknesses of all contingency testing
- B. Prior audit reports involving other corporate disaster recovery audits
- C. Summary memos reflecting audit opinions regarding noted weaknesses
- D. Overviews of interviews between data center personnel and the auditor
Answer: A
Explanation:
The IS audit manager should specifically review the detailed evidence of the successes and weaknesses of all contingency testing to substantiate the conclusions of the audit of the corporate disaster recovery test. This is because the detailed evidence can provide the audit manager with a clear and objective picture of how well the disaster recovery plan was executed, what issues or gaps were encountered, and what recommendations or actions were taken to address them. The detailed evidence can also help the audit manager to verify the accuracy, completeness, and validity of the audit findings, as well as to evaluate the adequacy and effectiveness of the disaster recovery controls.
The other options are not as specific or relevant as the detailed evidence of all contingency testing. Overviews of interviews between data center personnel and the auditor may provide some useful information, but they are not sufficient to substantiate the conclusions without supporting evidence from the actual testing. Prior audit reports involving other corporate disaster recovery audits may provide some benchmarking or comparison data, but they are not directly related to the current audit scope and objectives. Summary memos reflecting audit opinions regarding noted weaknesses may provide some high-level insights, but they are not enough to substantiate the conclusions without detailed evidence to back them up.
References:
* ISACA, CISA Review Manual, 27th Edition, 2019, p. 2411
* Disaster Recovery Audit Work Program2
NEW QUESTION # 109
......
Changing the Concept of CISA Exam Preparation 2024: https://www.passleadervce.com/Certified-Information-Systems-Auditor/reliable-CISA-exam-learning-guide.html
Getting CISA Certification Made Easy: https://drive.google.com/open?id=1-VnyxPc8zSXmZdl461JSRmiSgj-tJvHe