[Dec-2021] ISACA CISA Test Engine PDF - All Free Dumps from ExamCost
Get New CISA Certification – Valid Exam Dumps Questions
ISACA CISA Exam Certification Details:
| Number of Questions | 150 |
| Books / Training | Virtual Instructor-Led Training In-Person Training & Conferences Customized, On-Site Corporate Training CISA Planning Guide |
| Exam Code | CISA |
| Duration | 240 mins |
| Exam PriceISACA Member | $575(USD) |
| Sample Questions | ISACA CISA Sample Questions |
| Exam Price ISACA Nonmember | $760(USD) |
| Passing Score | 450/800 |
| Exam Name | ISACA Certified Information Systems Auditor (CISA) |
| Schedule Exam | Exam Registration |
ISACA Certified Information Systems Auditor CISA Exam
ISACA Certified Information Systems Auditor CISA Exam is related to Certified Information Systems Auditor CISA certification. This CISA Exam validates the ability to determine whether information systems are protected, controlled and provide value to the organization, conduct audits in accordance with its IT Standards and achieve planned audit objectives. It also deals with the ability to provide assurance that the necessary leadership and organizational structures and processes are in place to achieve objectives and to support the organizations strategy determine whether the business case meets business objectives and evaluate change and release management practices to determine whether the changes made to the systems and applications are adequately controlled and documented. New IT Auditors Operational Auditors and IT Professionals usually hold or pursue this certification and you can expect the same job roles after completion of this certification.
NEW QUESTION 124
The quality assurance (QA) function should be prevented from
- A. Amending review procedures
- B. Establishing analysis techniques
- C. Developing naming conventions
- D. Changing programs for business functions
Answer: A
NEW QUESTION 125
Which of the following types of data validation editing checks is used to determine if a field contains data, and not zeros or blanks?
- A. Completeness check
- B. Reasonableness check
- C. Check digit
- D. Existence check
Answer: A
Explanation:
Explanation/Reference:
Explanation:
A completeness check is used to determine if a field contains data and not zeros or blanks. A check digit is a digit calculated mathematically to ensure original data were not altered. An existence check also checks entered data for agreement to predetermined criteriA. A reasonableness check matches input to predetermined reasonable limits or occurrence rates.
NEW QUESTION 126
What is the purpose of a hypervisor?
- A. Running the virtual machine environment
- B. Cloning virtual machines
- C. Monitoring the performance of virtual machines
- D. Deploying settings to multiple machines simultaneously
Answer: A
Explanation:
Section: Information System Operations, Maintenance and Support
NEW QUESTION 127
An organization has implemented a disaster recovery plan. Which of the following steps should be carried out next?
- A. Obtain senior management sponsorship.
- B. Identify business needs.
- C. Perform a system restore test.
- D. Conduct a paper test.
Answer: D
Explanation:
Explanation/Reference:
Explanation:
A best practice would be to conduct a paper test. Senior management sponsorship and business needs identification should have been obtained prior to implementing the plan. A paper test should be conducted first, followed by system or full testing.
NEW QUESTION 128
Which of the following is often used as a detection and deterrent control against Internet attacks?
- A. CCTV
- B. VPN
- C. Honeypots
- D. VLAN
Answer: C
Explanation:
Section: Protection of Information Assets
Explanation:
Honeypots are often used as a detection and deterrent control against Internet attacks.
NEW QUESTION 129
Which of the following BEST describes the role of a directory server in a public key infrastructure (PKI)?
- A. Stores certificate revocation lists (CRLs)
- B. Facilitates the implementation of a password policy
- C. Encrypts the information transmitted over the network
- D. Makes other users' certificates available to applications
Answer: D
Explanation:
Explanation/Reference:
Explanation:
A directory server makes other users' certificates available to applications. Encrypting the information transmitted over the network and storing certificate revocation lists (CRLs) are roles performed by a security server. Facilitating the implementation of a password policy is not relevant to public key infrastructure (PKl).
NEW QUESTION 130
An organization has outsourced its wide area network (WAN) to a third-party service provider. Under these circumstances, which of the following is the PRIMARY task the IS auditor should perform during an audit of business continuity (BCP) and disaster recovery planning (DRP)?
- A. Review whether the service provider's BCP process is aligned with the organization's BCP and contractual obligations.
- B. Review the accreditation of the third-party service provider's staff.
- C. Review the methodology adopted by the organization in choosing the service provider.
- D. Review whether the service level agreement (SLA) contains a penalty clause in case of failure to meet the level of service in case of a disaster.
Answer: A
Explanation:
Explanation/Reference:
Explanation:
Reviewing whether the service provider's business continuity plan (BCP) process is aligned with the organization's BCP and contractual obligations is the correct answer since an adverse effect or disruption to the business of the service provider has a direct bearing on the organization and its customers.
Reviewing whether the service level agreement (SLA) contains a penalty clause in case of failure to meet the level of service in case of a disaster is not the correct answer since the presence of penalty clauses, although an essential element of a SLA, is not a primary concern. Choices C and D are possible concerns, but of lesser importance.
NEW QUESTION 131
An IS auditor Is reviewing a complete population of incidents to assess an organization's incident management process. Which of the following observations should be the IS auditor's GREATEST concern?
- A. All incidents are assigned the same priority.
- B. Some incidents do not have a root cause defined.
- C. All incidents were initially assigned to the queue manager
- D. Some incidents were not subject to secondary review
Answer: A
NEW QUESTION 132
In an organization, the responsibilities for IT security are clearly assigned and enforced and an IT security risk and impact analysis is consistently performed. This represents which level of ranking in the information security governance maturity model?
- A. Repeatable
- B. Defined
- C. Optimized
- D. Managed
Answer: D
Explanation:
Section: Protection of Information Assets
Explanation:
Boards of directors and executive management can use the information security governance maturity model to establish rankings for security in their organizations. The ranks are nonexistent, initial, repeatable, defined, managed and optimized. When the responsibilities for IT security in an organization are clearly assigned and enforced and an IT security risk and impact analysis is consistently performed, it is said to be
'managed and measurable.'
NEW QUESTION 133
Post-implementation testing is an example of which of the following control types?
- A. Directive
- B. Deterrent
- C. Detective
- D. Preventive
Answer: C
NEW QUESTION 134
Which of the following is MOST important to verify when implementing an organization's information security program?
- A. The security program has been benchmarked to industry standards.
- B. The IT department has developed and implemented training programs.
- C. The security program is adequately funded in the budget.
- D. The organization's security strategy is documented and approved.
Answer: D
NEW QUESTION 135
In which of the following database model is the data organized into a tree-like structure, implying a single
parent for each record?
- A. Object-relational database model
- B. Relational database model
- C. Hierarchical database model
- D. Network database model
Answer: C
Explanation:
Section: Information System Operations, Maintenance and Support
Explanation/Reference:
In a hierarchical model, data is organized into a tree-like structure, implying a single parent for each record.
A sort field keeps sibling records in a particular order.
For your exam you should know below information about database models:
A database model is a type of data model that determines the logical structure of a database and
fundamentally determines in which manner data can be stored, organized, and manipulated. The most
popular example of a database model is the relational model, which uses a table-based format.
Common logical data models for databases include:
Hierarchical database model
Network model
Relational model
Object-relational database models
Hierarchical database model
In a hierarchical model, data is organized into a tree-like structure, implying a single parent for each record.
A sort field keeps sibling records in a particular order. Hierarchical structures were widely used in the early
mainframe database management systems, such as the Information Management System (IMS) by IBM,
and now describe the structure of XML documents. This structure allows one one-to-many relationship
between two types of data. This structure is very efficient to describe many relationships in the real world;
recipes, table of contents, ordering of paragraphs/verses, any nested and sorted information.
This hierarchy is used as the physical order of records in storage. Record access is done by navigating
through the data structure using pointers combined with sequential accessing. Because of this, the
hierarchical structure is inefficient for certain database operations when a full path (as opposed to upward
link and sort field) is not also included for each record. Such limitations have been compensated for in later
IMS versions by additional logical hierarchies imposed on the base physical hierarchy.
Hierarchical database model
Network database model
The network model expands upon the hierarchical structure, allowing many-to-many relationships in a
tree-like structure that allows multiple parents. It was the most popular before being replaced by the
relational model, and is defined by the CODASYL specification.
The network model organizes data using two fundamental concepts, called records and sets. Records
contain fields (which may be organized hierarchically, as in the programming language COBOL). Sets (not
to be confused with mathematical sets) define one-to-many[disambiguation needed] relationships between
records: one owner, many members. A record may be an owner in any number of sets, and a member in
any number of sets.
A set consists of circular linked lists where one record type, the set owner or parent, appears once in each
circle, and a second record type, the subordinate or child, may appear multiple times in each circle. In this
way a hierarchy may be established between any two record types, e.g., type A is the owner of
B. At the
same time another set may be defined where B is the owner of
A. Thus all the sets comprise a general
directed graph (ownership defines a direction), or network construct. Access to records is either sequential
(usually in each record type) or by navigation in the circular linked lists.
The network model is able to represent redundancy in data more efficiently than in the hierarchical model,
and there can be more than one path from an ancestor node to a descendant. The operations of the
network model are navigational in style: a program maintains a current position, and navigates from one
record to another by following the relationships in which the record participates. Records can also be
located by supplying key values.
Network Database model
Relational database model
In the relational model of a database, all data is represented in terms of tulles, grouped into relations. A
database organized in terms of the relational model is a relational database.
In the relational model, related records are linked together with a "key".
The purpose of the relational model is to provide a declarative method for specifying data and queries:
users directly state what information the database contains and what information they want from it, and let
the database management system software take care of describing data structures for storing the data and
retrieval procedures for answering queries.
Most relational databases use the SQL data definition and query language; these systems implement what
can be regarded as an engineering approximation to the relational model. A table in an SQL database
schema corresponds to a predicate variable; the contents of a table to a relation; key constraints, other
constraints, and SQL queries correspond to predicates. However, SQL databases, including DB2, deviate
from the relational model in many details, and Cod fiercely argued against deviations that compromise the
original principles.
Relational database model
Object-relational database Model
An object-relational database (ORD), or object-relational database management system (ORDBMS), is a
database management system (DBMS) similar to a relational database, but with an object-oriented
database model: objects, classes and inheritance are directly supported in database schemas and in the
query language. In addition, just as with pure relational systems, it supports extension of the data model
with custom data-types and methods.
Example of an object-oriented database model
An object-relational database can be said to provide a middle ground between relational databases and
object-oriented databases (OODBMS). In object-relational databases, the approach is essentially that of
relational databases: the data resides in the database and is manipulated collectively with queries in a
query language; at the other extreme are OODBMSes in which the database is essentially a persistent
object store for software written in an object-oriented programming language, with a programming API for
storing and retrieving objects, and little or no specific support for querying.
The following were incorrect answers:
Network model-The network model expands upon the hierarchical structure, allowing many-to-many
relationships in a tree-like structure that allows multiple parents.
Relational model- In the relational model of a database, all data is represented in terms of tulles, grouped
into relations. A database organized in terms of the relational model is a relational database. In the
relational model, related records are linked together with a "key".
Object-relational database models- An object-relational database can be said to provide a middle ground
between relational databases and object-oriented databases (OODBMS). In object-relational databases,
the approach is essentially that of relational databases: the data resides in the database and is manipulated
collectively with queries in a query language; at the other extreme are OODBMSes in which the database is
essentially a persistent object store for software written in an object-oriented programming language, with a
programming API for storing and retrieving objects, and little or no specific support for querying.
The following reference(s) were/was used to create this question:
CISA review manual 2014 Page number 254
NEW QUESTION 136
Which of the following findings would have the GREATEST impact on the objective of a business intelligence system?
- A. Key control have not been tested in a year.
- B. The hot site for disaster recovery does not include the decision support system.
- C. Decision support queries use database functions proprietary to the vendor.
- D. Management reports have not been evaluated since implementation.
Answer: D
Explanation:
Section: Governance and Management of IT
NEW QUESTION 137
The MOST important reason for an IS auditor to obtain sufficient and appropriate audit evidence is to:
- A. provide a basis for drawing reasonable conclusions.
- B. ensure complete audit coverage.
- C. comply with regulatory requirements.
- D. perform the audit according to the defined scope.
Answer: A
Explanation:
Section: Protection of Information Assets
Explanation:
The scope of an IS audit is defined by its objectives. This involves identifying control weaknesses relevant to the scope of the audit. Obtaining sufficient and appropriate evidence assists the auditor in not only identifying control weaknesses but also documenting and validating them.
Complying with regulatory requirements, ensuring coverage and the execution of audit are all relevant to an audit but are not the reason why sufficient and relevant evidence is required.
NEW QUESTION 138
During a review of information security procedures for disabling user accounts, an IS auditor discovers that IT is only disabling network access for terminated employees IT management maintains if terminated users cannot access the network, they will not be able to access any applications Which of the following is the GREATEST risk associated with application access?
- A. Lack of segregation of duties
- B. Inability to access data
- C. Unauthorized access to data
- D. Loss of non-repudiation
Answer: C
NEW QUESTION 139
Which of the following key performance indicators (KPIs) provide stakeholders with the MOST useful information about whether information security risk is being managed?
- A. The number of security controls implemented
- B. The number of entries in the security risk register
- C. Time from identifying security threats to implementing solutions
- D. Time from security log capture to log analysis
Answer: A
NEW QUESTION 140
In a public key infrastructure, a registration authority:
- A. verifies information supplied by the subject requesting a certificate.
- B. issues the certificate after the required attributes are verified and the keys are generated.
- C. digitally signs a message to achieve nonrepudiation of the signed message.
- D. registers signed messages to protect them from future repudiation.
Answer: A
Explanation:
Explanation/Reference:
Explanation:
A registration authority is responsible for verifying information supplied by the subject requesting a certificate, and verifies the requestor's right to request certificate attributes and that the requestor actually possesses the private key corresponding to the public key being sent.
Certification authorities, not registration authorities, actually issue certificates once verification of the information has been completed; because of this, choice B is incorrect. On the other hand, the sender who has control of their private key signs the message, not the registration authority. Registering signed messages is not a task performed by registration authorities.
NEW QUESTION 141
When using a digital signature, the message digest is computed:
- A. only by the sender.
- B. by both the sender and the receiver.
- C. by the certificate authority (CA).
- D. only by the receiver.
Answer: B
Explanation:
Explanation/Reference:
Explanation:
A digital signature is an electronic identification of a person or entity. It is created by using asymmetric encryption. To verify integrity of data, the sender uses a cryptographic hashing algorithm against the entire message to create a message digest to be sent along with the message. Upon receipt of the message, the receiver will recompute the hash using the same algorithm and compare results with what was sent to ensure the integrity of the message.
NEW QUESTION 142
When conducting a follow-up of previous audit findings, an IS auditor is told by management that a recommendation to make security changes to an application has not been implemented. The IS auditor should FIRST determine whether:
- A. the issue should be escalated.
- B. the associated risk is still relevant.
- C. the recommendation should be re-issued.
- D. additional time to implement changes is needed.
Answer: D
Explanation:
Section: Protection of Information Assets
NEW QUESTION 143
An example of a direct benefit to be derived from a proposed IT-related business investment is:
- A. the use of new technology.
- B. increased market penetration.
- C. enhanced reputation.
- D. enhanced staff morale.
Answer: B
Explanation:
Section: Protection of Information Assets
Explanation:
A comprehensive business case for any proposed IT-related business investment should have clearly
defined business benefits to enable the expected return to be calculated. These benefits usually fall into
two categories: direct and indirect, or soft. Direct benefits usually comprise the quantifiable financial
benefits that the new system is expected to generate. The potential benefits of enhanced reputation and
enhanced staff morale are difficult to quantify, but should be quantified to the extent possible. IT
investments should not be made just for the sake of new technology but should be based on a quantifiable
business need.
NEW QUESTION 144
A local area network (LAN) administrator normally would be restricted from:
- A. reporting to the end-user manager.
- B. having programming responsibilities.
- C. having end-user responsibilities.
- D. being responsible for LAN security administration.
Answer: B
Explanation:
A LAN administrator should not have programming responsibilities but may have end-user responsibilities. The LAN administrator may report to the director of the IPF or, in a decentralized operation, to the end-user manager. In small organizations, the LAN administrator may also be responsible for security administration over the LAN.
NEW QUESTION 145
Labeling information according to its security classification:
- A. enhances the likelihood of people handling information securely.
- B. reduces the need to identify baseline controls for each classification.
- C. reduces the number and type of countermeasures required.
- D. affects the consequences if information is handled insecurely.
Answer: D
Explanation:
Section: Information System Operations, Maintenance and Support
NEW QUESTION 146
Which of the following is normally a responsibility of the chief security officer (CSO)?
- A. Approving access to data and applications
- B. Granting and revoking user access to IT resources
- C. Executing user application and software testing and evaluation
- D. Periodically reviewing and evaluating the security policy
Answer: D
Explanation:
Section: Protection of Information Assets
Explanation:
The role of a chief security officer (CSO) is to ensure that the corporate security policy and controls are adequate to prevent unauthorized access to the company assets, including data, programs and equipment.
User application and other software testing and evaluation normally are the responsibility of the staff assigned to development and maintenance. Granting and revoking access to IT resources is usually a function of network or database administrators. Approval of access to data and applications is the duty of the data owner.
NEW QUESTION 147
Which of the following sampling methods is MOST useful when testing for compliance?
- A. Difference estimation
- B. Variable sampling
- C. Attribute sampling
- D. Stratified mean per unit
Answer: C
Explanation:
Section: Protection of Information Assets
Explanation:
Attribute sampling is the primary sampling method used for compliance testing. Attribute sampling is a
sampling model that is used to estimate the rate of occurrence of a specific quality (attribute) in a
population and is used in compliance testing to confirm whether the quality exists. The other choices are
used in substantive testing, which involves testing of details or quantity.
NEW QUESTION 148
......
Salient Features of CISA That You Need to Know Ahead
Completion of the Isaca CISA signifies that you can expertly work with the aspects related to an organization’s business systems and information technology. With the nature of its certification coverage, such a test is highly recommended to specialists with at least 5 years of background in IT/IS audit, security, assurance, and control. Your prior experience will help in achieving a success rate in the 240-minute evaluation that contains a total of 150 multiple-choice questions.
100% Passing Guarantee - Brilliant CISA Exam Questions PDF: https://www.examcost.com/CISA-practice-exam.html
CISA Dumps 2021 - NewISACA Exam Questions: https://drive.google.com/open?id=1426SCo3h2GrRGwnVp_NgAgIcRpRNCRc-
