Latest [Nov 03, 2021] ISACA CISA Exam Practice Test To Gain Brilliante Result
Take a Leap Forward in Your Career by Earning ISACA CISA
Prerequisites
The main requirement for earning the CISA certification is to pass one test. However, before you can take it, you are required to have at least five years of practical experience in the field of information security and information technology audit. The candidates should also have experience with control, assurance, and security. If you don’t have up to five years, you can also complete the exam with a minimum of two years of hands-on experience in the domain of the qualifying test.
Further Certification Path after Passing CISA Exam
Once IT specialists manage to get the passing score in the CISA certification exam they can move forward to leverage their skills with more advanced ISACA certificates. Therefore, they can take the CRISC certification exam that helps them become certified professionals in Risk and Information Systems Control. Another certification that successful ISACA CISA certified specialists can take is the CISM or Certified Information Security Manager.
Information Systems Acquisition, Development, & Implementation: This subject will measure the candidates’ skills in the following subtopics:
- Information system acquisition and development – project management and governance; control identification & design; system development methodologies; business case & feasibility analysis;
- Information systems implementation – testing methodologies; system migration, data conversion, and infrastructure deployment; post-implementation review.
NEW QUESTION 41
The PRIMARY reason for using digital signatures is to ensure data:
- A. integrity.
- B. timeliness.
- C. availability.
- D. confidentiality.
Answer: A
Explanation:
Section: Protection of Information Assets
Explanation:
Digital signatures provide integrity because the digital signature of a signed message (file, mail, document, etc.) changes every time a single bit of the document changes; thus, a signed document cannot be altered.
Depending on the mechanism chosen to implement a digital signature, the mechanism might be able to ensure data confidentiality or even timeliness, but this is not assured. Availability is not related to digital signatures.
NEW QUESTION 42
An IS auditor finds that corporate mobile devices used by employees have varying levels of password settings.
Which of the following would be the BEST recommendation?
- A. Notify employees to set passwords to a specified length
- B. Update the acceptable use policy for mobile devices.
- C. Encrypt data between corporate gateway and devices.
- D. Apply security policy to the mobile devices.
Answer: D
NEW QUESTION 43
To detect attack attempts that the firewall is unable to recognize, an IS auditor should recommend placing a network intrusion detection system (IDS) between the:
- A. Internet and the firewall.
- B. Internet and the web server.
- C. Firewall and the organization's network.
- D. Web server and the firewall.
Answer: C
Explanation:
Explanation/Reference:
Explanation:
Attack attempts that could not be recognized by the firewall will be detected if a network- based intrusion detection system is placed between the firewall and the organization's network. A network-based intrusion detection system placed between the internet and the firewall will detect attack attempts, whether they do or do not enter the firewall.
NEW QUESTION 44
For a company that outsources payroll processing, which of the following is the BEST way to ensure that only authorized employees are paid?
- A. Electronic payroll reports should be independently reviewed.
- B. Employees should receive pay statements showing gross pay, net pay. and deductions.
- C. The company's bank reconciliations should be independently prepared and checked.
- D. Only payroll employees should be given the password for data entry and report retrieval.
Answer: A
NEW QUESTION 45
Common implementations of strong authentication may use which of the following factors in their authentication efforts (choose all that apply):
- A. 'something you have'
- B. 'something you have done in the past on this same system'
- C. 'something you know'
- D. 'something you are'
- E. 'something you have installed on this same system'
- F. None of the choices.
Answer: A,C,D
Explanation:
Explanation/Reference:
Explanation:
Two-factor authentication (T-FA) refers to any authentication protocol that requires two independent ways to establish identity and privileges. Common implementations of two-factor authentication use 'something you know' as one of the two factors, and use either 'something you have' or 'something you are' as the other factor. In fact, using more than one factor is also called strong authentication. On the other hand, using just one factor is considered by some weak authentication.
NEW QUESTION 46
Which of the following would effectively verify the originator of a transaction?
- A. Using a secret password between the originator and the receiver
- B. Using a portable document format (PDF) to encapsulate transaction content
- C. Encrypting the transaction with the receiver's public key
- D. Digitally signing the transaction with the source's private key
Answer: D
Explanation:
A digital signature is an electronic identification of a person, created by using a public key algorithm, to verify to a recipient the identity of the source of a transaction and the integrity of its content. Since they are a 'shared secret' between the user and the system itself, passwords are considered a weaker means of authentication. Encrypting the transaction with the recipient's public key will provide confidentiality for the information, while using a portable document format(PDF) will probe the integrity of the content but not necessarily authorship.
NEW QUESTION 47
Which of the following is an IS auditor's BEST guidance regarding the use of IT frameworks?
- A. Frameworks encourage efficiency, provide a way to measure effectiveness, and allow for improvements
- B. Frameworks provide standards that enable management to benchmark against peer organizations.
- C. To ensure consistency throughout the organization, management should adopt a single comprehensive framework.
- D. Industry-specific frameworks, when available, are preferred over the more generic comprehensive frameworks.
Answer: A
NEW QUESTION 48
Which of the following intrusion detection systems (IDSs) monitors the general patterns of activity and traffic on a network and creates a database?
- A. Host-based
- B. Neural networks-based
- C. Statistical-based
- D. Signature-based
Answer: B
Explanation:
Explanation/Reference:
Explanation:
The neural networks-based IDS monitors the general patterns of activity and traffic on the network and creates a database. This is similar to the statistical model but has the added function of self-learning.
Signature-based systems are a type of IDS in which the intrusive patterns identified are stored in the form of signatures. These IDS systems protect against detected intrusion patterns. Statistical-based systems need a comprehensive definition of the known and expected behavior of systems. Host-based systems are not a type of IDS, but a category of IDS, and are configured for a specific environment. They will monitor various internal resources of the operating system to warn of a possible attack.
NEW QUESTION 49
Which of the following would be MOST useful for determining whether the goals of IT are aligned with the
organization's goals?
- A. Balanced scorecard
- B. Key performance indicators
- C. Enterprise dashboard
- D. Enterprise architecture
Answer: A
Explanation:
Section: Information System Acquisition, Development and Implementation
NEW QUESTION 50
A recent audit concluded that an organization's information security system was weak and that monitoring would likely fail to detect penetration. Which of the following would be the MOST appropriate recommendation?
- A. Establish a clear policy related to security and the handling of sensitive data
- B. Look continually for new criminal behavior and attacks on sensitive data
- C. Identify and periodically remove sensitive data that is no longer needed
- D. Encrypt sensitive data while strengthening the system
Answer: D
Explanation:
Section: Information System Operations, Maintenance and Support
NEW QUESTION 51
Digital signatures require the:
- A. signer and receiver to have a public key.
- B. signer to have a private key and the receiver to have a public key.
- C. signer to have a public key and the receiver to have a private key.
- D. signer and receiver to have a private key.
Answer: B
Explanation:
Section: Protection of Information Assets
Explanation:
Digital signatures are intended to verify to a recipient the integrity of the data and the identity of the sender.
The digital signature standard is a public key algorithm. This requires the signer to have a private key and
the receiver to have a public key.
NEW QUESTION 52
A hardware control that helps to detect errors when data are communicated from one computer to another is known as a:
- A. validity check.
- B. table lookup.
- C. duplicate check.
- D. parity check.
Answer: D
Explanation:
Explanation/Reference:
Explanation:
A parity check will help to detect data errors when data are read from memory or communicated from one computer to another. A one-bit digit (either 0 or 1) is added to a data item to indicate whether the sum of that data item's bit is odd or even. When the parity bit disagrees with the sum of the other bits, an error report is generated.
NEW QUESTION 53
Authentication techniques for sending and receiving data between EDI systems is crucial to prevent which of the following?
- A. Inaccurate transactions
- B. Unsynchronized transactions
- C. Unauthorized transactions
- D. Incomplete transactions
Answer: C
Explanation:
Explanation/Reference:
Explanation:
Authentication techniques for sending and receiving data between EDI systems are crucial to prevent unauthorized transactions.
NEW QUESTION 54
Which of the following is not a good tactic to use against hackers?
- A. Enticement
- B. Entrapment
Answer: B
Explanation:
Explanation/Reference:
Enticement occurs after somebody has gained unlawful access to a system and then subsequently lured to a honey pot. Entrapment encourages the commitment of unlawful access. The latter is not a good tactic to use as it involves encouraging someone to commit a crime.
NEW QUESTION 55
The record-locking option of a database management system (DBMS) serves to
- A. allow users to lock others out of their files
- B. allow database administrators (DBAs) to record the activities of users
- C. restrict users from changing certain values within records.
- D. eliminate the risk of concurrent updates to a record.
Answer: C
NEW QUESTION 56
.What can be implemented to provide the highest level of protection from external attack?
- A. Configuring the firewall as the protecting bastion host
- B. Layering perimeter network protection by configuring the firewall as a screened host in a screened subnet behind the bastion host
- C. Configuring two load-sharing firewalls facilitating VPN access from external hosts to internal hosts
- D. Configuring the firewall as a screened host behind a router
Answer: B
Explanation:
Layering perimeter network protection by configuring the firewall as a screened host in a screened subnet behind the bastion host provides a higher level of protection from external attack than all other answers.
NEW QUESTION 57
Which of the following would BEST help to support an auditor's conclusion about the effectiveness of an
implemented data classification program?
- A. Business use cases and scenarios
- B. Purchase of information management tools
- C. Detailed data classification scheme
- D. Access rights provisioned according to scheme
Answer: A
Explanation:
Section: Protection of Information Assets
NEW QUESTION 58
......
Authentic Best resources for CISA Online Practice Exam: https://www.examcost.com/CISA-practice-exam.html
Updates Up to 365 days On Developing CISA Braindumps: https://drive.google.com/open?id=1426SCo3h2GrRGwnVp_NgAgIcRpRNCRc-
