Free ISACA CISA Exam Questions and Answer from Training Expert TestKingFree
Top ISACA CISA Courses Online
NEW QUESTION 107
Which testing approach is MOST appropriate to ensure that internal application interface errors are identified as soon as possible?
- A. System test
- B. Bottom up
- C. Top-down
- D. Sociability testing
Answer: C
Explanation:
The top-down approach to testing ensures that interface errors are detected early and that testing of major functions is conducted early. A bottom-up approach to testing begins with atomic units, such as programs and modules, and works upward until acomplete system test has taken place. Sociability testing and system tests take place at a later stage in the development process.
NEW QUESTION 108
Which of the following is used to evaluate biometric access controls?
- A. FAR
- B. EER
- C. FRR
- D. ERR
Answer: B
Explanation:
Explanation/Reference:
Explanation:
When evaluating biometric access controls, a low equal error rate (EER) is preferred. EER is also called the crossover error rate (CER).
NEW QUESTION 109
At the end of the testing phase of software development, an IS auditor observes that an intermittent software error has not been corrected. No action has been taken to resolve the error. The IS auditor should:
- A. recommend that problem resolution be escalated.
- B. attempt to resolve the error.
- C. ignore the error, as it is not possible to get objective evidence for the software error.
- D. report the error as a finding and leave further exploration to the auditee's discretion.
Answer: A
Explanation:
Explanation/Reference:
Explanation:
When an IS auditor observes such conditions, it is best to fully apprise the auditee and suggest that further problem resolutions be attempted. Recording it as a minor error and leaving it to the auditee's discretion would be inappropriate, and neglecting the error would indicate that the auditor has not taken steps to further probe the issue to its logical end.
NEW QUESTION 110
Which of the following would provide the BEST evidence for use in a forensic investigation of an employee's hard drive?
- A. Prior backups
- B. Memory dump to an external hard drive
- C. A file level copy of the hard drive
- D. Bit-stream copy of the hard drive
Answer: D
NEW QUESTION 111
Which of the following represents the HIGHEST level of maturity of an information security program?
- A. Information security policies and procedures are established
- B. The program meets regulatory and compliance requirements
- C. A training program is in place to promote information security awareness
- D. A framework is in place to measure risks and track effectiveness.
Answer: D
NEW QUESTION 112
Which of the following would BEST help management maintain a current and effective business continuity plan (BCP)?
- A. Verify vendor restore requirements are consistent with the recovery plan.
- B. Perform a periodic recovery test and include a lessons-learned summary.
- C. Update the critical business software list on an annual basis.
- D. Perform an annual walk-through and verify resources at the recovery site.
Answer: B
NEW QUESTION 113
Which of the following term in business continuity defines the total amount of time that a business process can be disrupted without causing any unacceptable consequences?
- A. WRT
- B. MTD
- C. RPO
- D. RTO
Answer: B
Explanation:
Section: Information System Operations, Maintenance and Support
Explanation:
The sum of RTO and WRT is defined as the Maximum Tolerable Downtime (MTD) which defines the total amount of time that a business process can be disrupted without causing any unacceptable consequences.
This value should be defined by the business management team or someone like CTO, CIO or IT manager.
For your exam you should know below information about RPO, RTO, WRT and MTD:
Stage 1: Business as usual
Business as usual
At this stage all systems are running production and working correctly.
Stage 2: Disaster occurs
Disaster Occurs
On a given point in time, disaster occurs and systems needs to be recovered. At this point the Recovery Point Objective (RPO) determines the maximum acceptable amount of data loss measured in time. For example, the maximum tolerable data loss is 15 minutes.
Stage 3: Recovery
Recovery
At this stage the system are recovered and back online but not ready for production yet. The Recovery Time Objective (RTO) determines the maximum tolerable amount of time needed to bring all critical systems back online. This covers, for example, restore data from back-up or fix of a failure. In most cases this part is carried out by system administrator, network administrator, storage administrator etc.
Stage 4: Resume Production
Resume Production
At this stage all systems are recovered, integrity of the system or data is verified and all critical systems can resume normal operations. The Work Recovery Time (WRT) determines the maximum tolerable amount of time that is needed to verify the system and/or data integrity. This could be, for example, checking the databases and logs, making sure the applications or services are running and are available. In most cases those tasks are performed by application administrator, database administrator etc. When all systems affected by the disaster are verified and/or recovered, the environment is ready to resume the production again.
MTD
The sum of RTO and WRT is defined as the Maximum Tolerable Downtime (MTD) which defines the total amount of time that a business process can be disrupted without causing any unacceptable consequences.
This value should be defined by the business management team or someone like CTO, CIO or IT manager.
The following answers are incorrect:
RPO - Recovery Point Objective (RPO) determines the maximum acceptable amount of data loss measured in time. For example, the maximum tolerable data loss is 15 minutes.
RTO - The Recovery Time Objective (RTO) determines the maximum tolerable amount of time needed to bring all critical systems back online. This covers, for example, restore data from back-up or fix of a failure.
In most cases this part is carried out by system administrator, network administrator, storage administrator etc.
WRT - The Work Recovery Time (WRT) determines the maximum tolerable amount of time that is needed to verify the system and/or data integrity. This could be, for example, checking the databases and logs, making sure the applications or services are running and are available. In most cases those tasks are performed by application administrator, database administrator etc. When all systems affected by the disaster are verified and/or recovered, the environment is ready to resume the production again.
Reference:
CISA review manual 2014 page number 284
http://defaultreasoning.com/2013/12/10/rpo-rto-wrt-mtdwth/
NEW QUESTION 114
An organization s audit charter PRIMARILY:
- A. formally records the annual and quarterly audit plans
- B. documents the audit process and reporting standards
- C. describes the auditors' authority to conduct audits
- D. defines the auditors' code of conduct
Answer: C
NEW QUESTION 115
Which of the following physical access controls effectively reduces the risk of piggybacking?
- A. Deadman doors
- B. Combination door locks
- C. Bolting door locks
- D. Biometric door locks
Answer: A
Explanation:
Explanation/Reference:
Explanation:
Deadman doors use a pair of doors. For the second door to operate, the first entry door must close and lock with only one person permitted in the holding area. This effectively reduces the risk of piggybacking.
An individual's unique body features such as voice, retina, fingerprint or signature activate biometric door locks; however, they do not prevent or reduce the risk of piggybacking. Combination door locks, also known as cipher locks, use a numeric key pad or dial to gain entry. They do not prevent or reduce the risk of piggybacking since unauthorized individuals may still gain access to the processing center. Bolting door locks require the traditional metal key to gain entry. Unauthorized individuals could still gain access to the processing center along with an authorized individual.
NEW QUESTION 116
An organization issues digital certificates to employees to enable connectivity to a web-based application. Which of the following public key infrastructure (PKI) components MUST be included in the application architecture for determining the on-going validity of connections?
- A. Secure hash algorithm (SHA)
- B. Certificate authority (CA)
- C. Certificate revocation list (CRL)
- D. Registration authority (RA)
Answer: A
NEW QUESTION 117
Which of the following is MOST critical when creating data for testing the logic in a new or modified application system?
- A. Data representing conditions that are expected in actual processing
- B. A random sample of actual data
- C. Completing the test on schedule
- D. A sufficient quantity of data for each test case
Answer: A
Explanation:
Selecting the right kind of data is key in testing a computer system. The data should not only include valid and invalid data but should be representative of actual processing; quality is more important than quantity. It is more important to have adequate test data than to complete the testing on schedule. It is unlikely that a random sample of actual data would cover all test conditions and provide a reasonable representation of actual data.
NEW QUESTION 118
Cisco IOS based routers perform basic traffic filtering via which of the following mechanisms?
- A. datagram scanning
- B. access lists
- C. stateful inspection
- D. None of the choices.
- E. state checking
- F. link progressing
Answer: B
Explanation:
Explanation/Reference:
Explanation:
In addition to deploying stateful firewall, you may setup basic traffic filtering on a more sophisticated router.
As an example, on a Cisco IOS based router you may use ip access lists (ACL) to perform basic filtering on the network edge. Note that if they have denied too much traffic, something is obviously being too restrictive and you may want to reconfigure them.
NEW QUESTION 119
An IS auditor finds an organization is unable to effectively review the activity logs for an accounts receivable application due to the large amount of activity recorded. When of the following is the auditor's BEST recommendation?
- A. Utilize business intelligence.
- B. Encrypt the activity logs
- C. Limit accounts receivable transactions.
- D. Hire additional staff to review logs.
Answer: A
NEW QUESTION 120
Which of the following BEST enables timely detection of changes in the IT environment to support informed decision making by management?
- A. Continuous monitoring
- B. Sampling checks on high risk areas
- C. Established key risk indicators (KRI)
- D. Change management reports
Answer: A
NEW QUESTION 121
Which of the following would an IS auditor consider the MOST relevant to short-term planning for an IS department?
- A. Evaluating hardware needs
- B. Keeping current with technology advances
- C. Conducting control self-assessment
- D. Allocating resources
Answer: D
Explanation:
Section: Protection of Information Assets
Explanation:
The IS department should specifically consider the manner in which resources are allocated in the short term. Investments in IT need to be aligned with top management strategies, rather than focusing on technology for technology's sake. Conducting control self-assessments and evaluating hardware needs are not as critical as allocating resources during short-term planning for the IS department.
NEW QUESTION 122
Who is responsible for implementing cost-effective controls in an automated system?
- A. Business unit management
- B. Senior management
- C. Security policy administrators
- D. Board of directors
Answer: A
Explanation:
Explanation/Reference:
Explanation:
Business unit management is responsible for implementing cost-effective controls in an automated system.
NEW QUESTION 123
An organization's IT security policy states that user ID's must uniquely identify individual's and that user should not disclose their passwords. An IS auditor discovers that several generic user ID's are being used. Which of the following is the MOST appropriate course of action for the auditor/
- A. Investigate the noncompliance.
- B. Recommend disciplinary action.
- C. Include the finding in the final audit report.
- D. Recommend a change in security policy.
Answer: A
NEW QUESTION 124
An IS audit concludes that entry to the computer room is appropriately controlled. The audit result provides assurance that:
- A. data leakage is prevented.
- B. the confidentiality of data is protected.
- C. unauthorized access is prevented.
- D. the theft of hardware is prevented.
Answer: C
Explanation:
Section: Protection of Information Assets
NEW QUESTION 125
E-mail traffic from the Internet is routed via firewall-1 to the mail gateway. Mail is routed from the mail gateway, via firewall-2, to the mail recipients in the internal network. Other traffic is not allowed. For example, the firewalls do not allow direct traffic from the Internet to the internal network.
The intrusion detection system (IDS) detects traffic for the internal network that did not originate from the mail gateway. The FIRST action triggered by the IDS should be to:
- A. close firewall-1.
- B. close firewall-2.
- C. alert the appropriate staff.
- D. create an entry in the log.
Answer: B
Explanation:
Section: Protection of Information Assets
Explanation/Reference:
Explanation:
Traffic for the internal network that did not originate from the mail gateway is a sign that firewall-1 is not functioning properly. This may have been caused by an attack from a hacker. Closing firewall-2 is the first thing that should be done, thus preventing damage to the internal network.
After closing firewall-2, the malfunctioning of firewall-1 can be investigated. The IDS should trigger the closing of firewall-2 either automatically or by manual intervention. Between the detection by the IDS and a response from the system administrator valuable time can be lost, in which a hacker could also compromise firewall-2. An entry in the log is valuable for later analysis, but before that, the IDS should close firewall-2. If firewall-1 has already been compromised by a hacker, it might not be possible for the IDS to close it.
NEW QUESTION 126
How do modems (modulation/demodulation) function to facilitate analog transmissions to enter a digital network?
- A. Modems encapsulate digital transmissions within analog, and analog transmissions within digital.
- B. Modems convert digital transmissions to analog, and analog transmissions to digital.
- C. Modems encapsulate analog transmissions within digital, and digital transmissions within analog.
- D. Modems convert analog transmissions to digital, and digital transmission to analog.
Answer: D
Explanation:
Explanation/Reference:
Modems (modulation/demodulation) convert analog transmissions to digital, and digital transmissions to analog, and are required for analog transmissions to enter a digital network.
NEW QUESTION 127
Which of the following is MOST helpful for an IS auditor to review when determining the appropriateness of controls relevant to a specific audit area?
- A. Control self-assessment (CSA)
- B. Business impact analysis (BIA)
- C. Control implementation methods
- D. Enterprise architecture (EA) design
Answer: D
NEW QUESTION 128
Which of the following security mechanisms should be used to prevent disclosures of personally identifiable information (PH) when performing data analytics?
- A. Segmentation
- B. Encryption
- C. Tokenization
- D. Anonymization
Answer: D
NEW QUESTION 129
Electromagnetic emissions from a terminal represent an exposure because they:
- A. can be detected and displayed.
- B. produce dangerous levels of electric current.
- C. affect noise pollution.
- D. disrupt processor functions.
Answer: A
Explanation:
Emissions can be detected by sophisticated equipment and displayed, thus giving unauthorized persons access to datA . They should not cause disruption of CPUs or effect noise pollution.
NEW QUESTION 130
An internal review reveals an out-of-support human resources system. Which of the following is MOST important to determine when evaluating the associated risk?
- A. Exposure of the out-of-support system outside of the network
- B. Timeline to replace the out-of-support system
- C. The number of people accessing the out-of-support system
- D. Frequency of outages associated with the out-of-support system
Answer: A
NEW QUESTION 131
Which of the following satisfies a two-factor user authentication?
- A. A smart card requiring the user's PIN
- B. Iris scanning plus fingerprint scanning
- C. Terminal ID plus global positioning system (GPS)
- D. User ID along with password
Answer: A
Explanation:
A smart card addresses what the user has. This is generally used in conjunction with testing what the user knows, e.g., a keyboard password or personal identification number (PIN). Proving who the user is usually requires a biometrics method, such as fingerprint, iris scan or voice verification, to prove biology. This is not a two-factor user authentication, because it proves only who the user is. A global positioning system (GPS) receiver reports on where the user is. The use of an ID and password (what the user knows) is a single-factor user authentication.
NEW QUESTION 132
......
New (2022) ISACA CISA Exam Dumps: https://www.testkingfree.com/ISACA/CISA-practice-exam-dumps.html
CISA Practice Dumps - Verified By TestKingFree Updated 361 Questions: https://drive.google.com/open?id=1Z8hM6Eh61LQyBzPq46DmxjCPwgBdC6Ia