Released ISACA CISA Updated Questions PDF
CISA Dumps and Practice Test (440 Exam Questions)
NEW QUESTION 82
select a sample for testing, which must include the 80 largest client balances and a random sample of the rest, the IS auditor should recommend:
- A. use of generalized audit software.
- B. applying attribute sampling using software.
- C. sorting the file with a utility Release management
- D. development of an integrated test facility (ITF).
Answer: A
NEW QUESTION 83
What should an organization do before providing an external agency physical access to its information
processing facilities (IPFs)?
- A. Employees of the external agency should be trained on the security procedures of the organization.
- B. Any access by an external agency should be limited to the demilitarized zone (DMZ).
- C. The processes of the external agency should be subjected to an IS audit by an independent agency.
- D. The organization should conduct a risk assessment and design and implement appropriate controls.
Answer: D
Explanation:
Section: Protection of Information Assets
Explanation:
Physical access of information processing facilities (IPFs) by an external agency introduces additional
threats into an organization. Therefore, a risk assessment should be conducted and controls designed
accordingly. The processes of the external agency are not of concern here. It is the agency's interaction
with the organization that needs to be protected. Auditing their processes would not be relevant in this
scenario. Training the employees of the external agency may be one control procedure, but could be
performed after access has been granted. Sometimes an external agency may require access to the
processing facilities beyond the demilitarized zone (DMZ). For example, an agency which undertakes
maintenance of servers may require access to the main server room. Restricting access within the DMZ
will not serve the purpose.
NEW QUESTION 84
Which of the following ACID property in DBMS means that once a transaction has been committed, it will remain so, even in the event of power loss, crashes, or errors?
- A. Isolation
- B. Consistency
- C. Durability
- D. Atomicity
Answer: C
Explanation:
Explanation/Reference:
Durability - Durability means that once a transaction has been committed, it will remain so, even in the event of power loss, crashes, or errors.
For CISA exam you should know below information about ACID properties in DBMS:
Atomicity - Atomicity requires that each transaction is "all or nothing": if one part of the transaction fails, the entire transaction fails, and the database state is left unchanged. An atomic system must guarantee atomicity in each and every situation, including power failures, errors, and crashes. To the outside world, a committed transaction appears (by its effects on the database) to be indivisible ("atomic"), and an aborted transaction does not happen.
Consistency - The consistency property ensures that any transaction will bring the database from one valid state to another. Any data written to the database must be valid according to all defined rules, including but not limited to constraints, cascades, triggers, and any combination thereof. This does not guarantee correctness of the transaction in all ways the application programmer might have wanted (that is the responsibility of application-level code) but merely that any programming errors do not violate any defined rules.
Isolation - The isolation property ensures that the concurrent execution of transactions results in a system state that would be obtained if transactions were executed serially, i.e. one after the other. Providing isolation is the main goal of concurrency control. Depending on concurrency control method, the effects of an incomplete transaction might not even be visible to another transaction. [citation needed] Durability - Durability means that once a transaction has been committed, it will remain so, even in the event of power loss, crashes, or errors. In a relational database, for instance, once a group of SQL statements execute, the results need to be stored permanently (even if the database crashes immediately thereafter). To defend against power loss, transactions (or their effects) must be recorded in a non-volatile memory.
The following were incorrect answers:
Consistency - The consistency property ensures that any transaction will bring the database from one valid state to another. Any data written to the database must be valid according to all defined rules, including but not limited to constraints, cascades, triggers, and any combination thereof. This does not guarantee correctness of the transaction in all ways the application programmer might have wanted (that is the responsibility of application-level code) but merely that any programming errors do not violate any defined rules.
Isolation - The isolation property ensures that the concurrent execution of transactions results in a system state that would be obtained if transactions were executed serially, i.e. one after the other.
Atomicity requires that each transaction is "all or nothing": if one part of the transaction fails, the entire transaction fails, and the database state is left unchanged.
The following reference(s) were/was used to create this question:
CISA review manual 2014 Page number 218
NEW QUESTION 85
An organization with extremely high security requirements is evaluating the effectiveness of biometric systems. Which of the following performance indicators is MOST important?
- A. False-identification rate (FIR)
- B. Equal-error rate (EER)
- C. False-acceptance rate (FAR)
- D. False-rejection rate (FRR)
Answer: C
Explanation:
Explanation/Reference:
Explanation:
FAR is the frequency of accepting an unauthorized person as authorized, thereby granting access when it should be denied, in an organization with high security requirements, user annoyance with a higher FRR is less important, since it is better to deny access to an authorized individual than to grant access to an unauthorized individual. EER is the point where the FAR equals the FRR; therefore, it does not minimize the FAR. FIR is the probability that an authorized person is identified, but is assigned a false ID.
NEW QUESTION 86
A company is planning to implement a new administrative system at many sites. The new system contains four integrated modules. Which of the following implementation approaches would be MOST appropriate?
- A. Pilot run of the new system
- B. Full implementation of the new system
- C. Parallel implementation module by module
- D. Parallel run at all locations
Answer: A
Explanation:
Section: Information System Acquisition, Development and Implementation Explanation
NEW QUESTION 87
Which of the following is a good time frame for making changes to passwords?
- A. every 90 to 120 days
- B. every 30 to 45 days
- C. None of the choices.
- D. every 10 to 20 days
- E. every 180 to 365 days
Answer: A
Explanation:
Section: Protection of Information Assets
Explanation:
"Passwords are the first defensive line in protecting your data and information. Your users need to be made
aware of what a password provides them and what can be done with their password. They also need to be
made aware of the things that make up a good password versus a bad password. A good password has
mixed-case alphabetic characters, numbers, and symbols. Do use a password that is at least eight or more
characters. You may want to run a "password cracker" program periodically, and require users to
immediately change any easily cracked passwords. In any case ask them to change their passwords every
90 to 120 days."
NEW QUESTION 88
An integrated test facility is not considered a useful audit tool because it cannot compare processing output with independently calculated data. True or false?
- A. False
- B. True
Answer: A
Explanation:
Section: Protection of Information Assets
Explanation:
An integrated test facility is considered a useful audit tool because it compares processing output with independently calculated data.
NEW QUESTION 89
Which of the following is the GREATEST concern when an organization's backup facility is at a warm site?
- A. Timely availability of hardware
- B. Availability of heat, humidity and air conditioning equipment
- C. Effectiveness of the telecommunications network
- D. Adequacy of electrical power connections
Answer: A
Explanation:
Section: Protection of Information Assets
Explanation:
A warm site has the basic infrastructure facilities implemented, such as power, air conditioning and
networking, but is normally lacking computing equipment. Therefore, the availability of hardware becomes
a primary concern.
NEW QUESTION 90
Due to limited storage capacity, an organization has decided to reduce the actual retention period for media containing completed low-value transactions. Which of the following is MOST important for the organization to ensure?
- A. The retention period allows for review during the year-end audit.
- B. The retention period complies with data owner responsibilities.
- C. The total transaction amount has no impact on financial reporting.
- D. The policy includes a strong risk-based approach.
Answer: D
NEW QUESTION 91
An IS auditor notes that IDS log entries related to port scanning are not being analyzed. This lack of analysis will MOST likely increase the risk of success of which of the following attacks?
- A. Social engineering
- B. Denial-of-service
- C. Replay
- D. Buffer overflow
Answer: B
Explanation:
Explanation/Reference:
Explanation:
Prior to launching a denial-of-service attack, hackers often use automatic port scanning software to acquire information about the subject of their attack. A replay attack is simply sending the same packet again.
Social engineering exploits end-user vulnerabilities, and buffer overflow attacks exploit poorly written code.
NEW QUESTION 92
A firm is considering using biometric fingerprint identification on all PCs that access critical datA. This requires:
- A. the usage of the fingerprint reader be accessed by a separate password.
- B. the full elimination of the risk of a false acceptance.
- C. assurance that it will be impossible to gain unauthorized access to critical data.
- D. that a registration process is executed for all accredited PC users.
Answer: D
Explanation:
Explanation/Reference:
Explanation:
The fingerprints of accredited users need to be read, identified and recorded, i.e., registered, before a user may operate the system from the screened PCs. Choice B is incorrect, as the false-acceptance risk of a biometric device may be optimized, but will never be zero because this would imply an unacceptably high risk of false rejection. Choice C is incorrect, as the fingerprint device reads the token (the user's fingerprint) and does not need to be protected in itself by a password. Choice Dis incorrect because the usage of biometric protection on PCs does not guarantee that other potential security weaknesses in the system may not be exploited to access protected data.
NEW QUESTION 93
The CIO of an organization is concerned that the information security policies may not be comprehensive. Which of the following should an IS auditor recommend be performed FIRST?
- A. Obtain a copy of their competitor's policies
- B. Compare the policies against an industry framework.
- C. Establish a governance board to track compliance with the policies
- D. Determine if there is j process to handle exceptions to the policies
Answer: C
NEW QUESTION 94
Which of the following is the PRIMARY advantage of using an automated security log monitoring tool over a manual review to monitor the use
- A. Improved incident response time
- B. Reduced manual effort of reviewing logs
- C. Reduced costs associated with automating the review
- D. Increased likelihood of detecting suspicious activity
Answer: A
NEW QUESTION 95
An organization using instant messaging to communicate with customers prevent legitimate customers from being impersonated by:
- A. Authentication users before conversation are initiated.
- B. Logging conversation.
- C. Using firewall to limit network traffic to authorized ports.
- D. Using call monitoring.
Answer: A
NEW QUESTION 96
In the context of effective information security governance, the primary objective of value delivery is to:
- A. implement a continuous improvement culture.
- B. optimize security investments in support of business objectives.
- C. implement a standard set of security practices.
- D. institute a standards-based solution.
Answer: B
Explanation:
Explanation/Reference:
Explanation:
In the context of effective information security governance, value delivery is implemented to ensure optimization of security investments in support of business objectives. The tools and techniques for implementing value delivery include implementation of a standard set of security practices, institutionalization and commoditization of standards-based solutions, and implementation of a continuous improvement culture considering security as a process, not an event.
NEW QUESTION 97
A data breach has occurred at a third-party vendor used by an organization to outsource the processing of
its customer data. What should be management's FIRST course of action?
- A. Activate the incident management process
- B. Take legal action against the service provider for reputation damage
- C. Notify the insurance company of the potential claim
- D. Activate the disaster recovery plan
Answer: A
Explanation:
Section: Information System Operations, Maintenance and Support
NEW QUESTION 98
Which of the following is the MAIN risk associated with adding a new system functionality during the development phase without following a project change management process?
- A. The new functionality may not meet requirements
- B. The project may fail to meet the established deadline
- C. The added functionality has not been documented
- D. The project may go over budget.
Answer: A
NEW QUESTION 99
......
Useful Isaca CISA Exam Prep Resources
With the above-mentioned details about the certification exam, are you ready to act upon the next step? The test preparation is, of course, a gruelling process of intense studying and extensive honing of skills. So, right here and now, we’ll make it much easier for you. We will serve as your eyes and ears in catching the finest resources in the market:
- CISA Review Manual (27th Edition) by Isaca
Accompany the self-paced course with one of the selected books for your CISA test. The CISA Review Manual is an official reference guide that is handpicked by the experts because of its all-inclusive test coverage that is designed to help you stay on track with the main exam objectives. This book discusses the vital roles of an information systems auditor, giving you a glimpse of the technical skillset you have to develop before the certification evaluation. Also, such a manual has been restructured in accordance with the official 2019 CISA Job Practice, hence the most recent and relevant coverage of the exam domains. More so, it brings out the critical concepts and terminologies of IS and IT for proper documentation of your abilities. And by mastering both the fundamentals as well as the technical roles, you won’t have a hard time handling audit tasks required by organizations of different sizes and types.
- CISA Review Questions, Answers & Explanations Manual (12th Edition) by Isaca
Another top-notch book suggested by the vendor is this practice test manual that has 1,000 questions in multiple-choice style. The questions listed here are in accordance with the latest CISA Job Practice (2019). Therefore, most of these are already revised and upgraded, providing more up-to-date coverage of the exam. Another thing is the detailed explanation of the answers, which is a great help in correcting your mistakes and ensuring that you don’t make the same error twice. And of course, the questions are structured in a way that mimics the official CISA test. Though not exactly the same in terms of order and context, practicing with such items is very beneficial in strengthening your adeptness in the crucial test domains.
- CISA Exam Prep Course
Are you the type of learner who gets more insights if you’re with an instructor? If yes, enroll in the expert-led course and join other exam candidates in learning the CISA job practice in a more in-depth manner. The instructor will guide you in sorting out the core requirements that you need to master, which is done through comprehensive modules and case study activities. Likewise, there will be a revisit of the fundamental concepts to ensure that you master the basics and core responsibilities of an IS auditor. The course won’t be complete without some practice tests, which are thoroughly assessed by the instructor. The trial questions are further elaborated through an extensive explanation of the answers. Along with the lectures and quizzes, the instructor also shares a lot of useful techniques, particularly in terms of time management and better knowledge retention. Do take note that time is very important if you avail of this virtual material. Compared to the self-paced course, this one has a limited timeline. It’s only a 60-day subscription that is divided into 4 sessions. Therefore, you have to check the schedule posted on the official site first so you can allocate your time properly and attend the training with ease.
- CISA Online Review Course
The best online prep tool comes from the certification vendor itself. Isaca has prepared a comprehensive package that you can use to study efficiently for the CISA test. Equipped with instructional strategies and interactive lessons, this course has been proven and tested by thousands of exam candidates. More importantly, it details the five major domains of the CISA, which include the auditing process, governance, operations, implementation, and the protection of information systems. The eLearning modules are also created in relation to the CISA job practice so you’ll develop a working knowledge of the key subject areas. This means that your comprehension is not just about the theoretical aspect of the domains but also its technical features. In addition, the context of the materials guarantees you up-to-date guidelines of IT audit as well as assurance. As a result, you will gain an understanding of the latest industry standards, which are relevant among businesses. Along with the interactive lessons, you’ll also get some downloadable materials to further aid your topic mastery. And to complete the set of training resources, you’ll get a self-assessment (50 questions) and a practice test (75 questions) that check on your knowledge before and after the training. And before we forget, this online course provides you with the opportunity to navigate through the lessons at your own pace. Also, you can take advantage of the structured guideline and create your preferred learning schedule and style. The total training duration lasts for up to 22 hours, with a 365-day subscription.
CISA Exam Dumps Pass with Updated 2022 Certified Exam Questions: https://passking.actualtorrent.com/CISA-exam-guide-torrent.html