CISA Free Update With 100% Exam Passing Guarantee [2024]
[Feb-2024] Verified ISACA Exam Dumps with CISA Exam Study Guide
The CISA certification exam covers a broad range of topics related to information systems auditing, control, and security. CISA exam focuses on five domains: Information Systems Auditing Process, Governance and Management of IT, Information Systems Acquisition, Development and Implementation, Information Systems Operations, Maintenance and Service Management, and Protection of Information Assets. CISA exam is a four-hour, computer-based test consisting of 150 multiple-choice questions.
NEW QUESTION # 422
The MOST important difference between hashing and encryption is that hashing:
- A. is irreversible.
- B. output is the same length as the original message.
- C. is the same at the sending and receiving end.
- D. is concerned with integrity and security.
Answer: A
Explanation:
Explanation/Reference:
Explanation:
Hashing works one way; by applying a hashing algorithm to a message, a message hash/digest is created.
If the same hashing algorithm is applied to the message digest, it will not result in the original message. As such, hashing is irreversible, while encryption is reversible. This is the basic difference between hashing and encryption. Hashing creates an output that is smaller than the original message, and encryption creates an output of the same length as the original message. Hashing is used to verify the integrity of the message and does not address security. The same hashing algorithm is used at the sending and receiving ends to generate and verify the message hash/digest. Encryption will not necessarily use the same algorithm at the sending and receiving and to encrypt and decrypt.
NEW QUESTION # 423
Which of the following is the MOST likely reason why e-mail systems have become a useful source of evidence for litigation?
- A. Data classification regulates what information should be communicated via e-mail.
- B. Within the enterprise, a clear policy for using e-mail ensures that evidence is available.
- C. Multiple cycles of backup files remain available.
- D. Access controls establish accountability for e-mail activity.
Answer: C
Explanation:
Explanation/Reference:
Explanation:
Backup files containing documents that supposedly have been deleted could be recovered from these files. Access controls may help establish accountability for the issuance of a particular document, but this does not provide evidence of the e-mail. Data classification standards may be in place with regards to what should be communicated via e-mail, but the creation of the policy does not provide the information required for litigation purposes.
NEW QUESTION # 424
An IS audit of an organization's data classification policies finds some areas of the policies may not be up-
to-date with new data privacy regulations. What should management do FIRST to address the risk of
noncompliance?
- A. Conduct a privacy impact assessment to identify gaps
- B. Mandate training on the new privacy regulations
- C. Reclassify information based on revised information classification labels
- D. Perform a data discovery exercise to identify all personal data
Answer: A
Explanation:
Section: Governance and Management of IT
NEW QUESTION # 425
Which of the following BEST describes a common risk in implementing a new application software
package?
- A. Parameter settings are incorrect
- B. Transaction volume is excessive
- C. Sensitivity of transactions is high
- D. The application lacks audit trails
Answer: D
Explanation:
Section: Information System Acquisition, Development and Implementation
NEW QUESTION # 426
As an IS auditor, it is very important to make sure all storage media are well protected. Which of the following is the LEAST important factor for protecting CDs and DVDs?
- A. Avoid long term exposure to bright light
- B. Handle by edges or by the hole in the middle
- C. Store in anti-static bag
- D. Store in a hard jewel case, not in soft sleeves
Answer: C
Explanation:
Explanation/Reference:
CDs and DVDs are least affected by static current so it is not as important to store them into anti-static bags.
CDs and DVDs Storage protection recommendations:
Handle by edges or by hole in the middle
Be careful not to bend the CD or DVD
Avoid long term exposure to bright light
Store in a hard jewel case, not is soft sleeves
Also, you should know the media storage precautions listed below in preparation for the CISA exam:
USB and portable hard drive
Avoid high temperature, humidity extremes and strong magnetic field
Tape Cartridges
Store Cartridges vertically
Store cartridges in a protective container for transport
Write-protect cartridges immediately
Hard Drive
Store hard drives in anti-static bags, and be sure that person removing them from bag is static free If the original box and padding for the hard drive is available, use it for shipping If the hard drive has been in a cold environment, bring it to room temperature prior to installing and using it The following reference(s) were/was used to create this question:
Reference used - CISA review manual 2014. Page number 338
NEW QUESTION # 427
Which of the following would BEST ensure that a backup copy is available for restoration of mission critical data after a disaster''
- A. Use an electronic vault for incremental backups
- B. Use both tape and disk backup systems
- C. Deploy a fully automated backup maintenance system.
- D. Periodically test backups stored in a remote location
Answer: D
NEW QUESTION # 428
.When should plans for testing for user acceptance be prepared? Choose the BEST answer.
- A. In the development phase of the systems-development project
- B. In the feasibility phase of the systems-development project
- C. In the requirements definition phase of the systems-development project
- D. In the design phase of the systems-development project
Answer: C
Explanation:
Plans for testing for user acceptance are usually prepared in the requirements definition phase of the systems-development project.
NEW QUESTION # 429
What type of cryptosystem is characterized by data being encrypted by the sender using the recipient's public key, and the data then being decrypted using the recipient's private key?
- A. With shared-key encryption, or asymmetric encryption
- B. With shared-key encryption, or symmetric encryption
- C. With public-key encryption, or symmetric encryption
- D. With public-key encryption, or asymmetric encryption
Answer: D
Explanation:
Explanation/Reference:
Explanation:
With public key encryption or asymmetric encryption, data is encrypted by the sender using the recipient's public key; the data is then decrypted using the recipient's private key.
NEW QUESTION # 430
You should know the difference between an exploit and a vulnerability. Which of the following refers to a
weakness in the system?
- A. vulnerability
- B. both
- C. exploit
Answer: A
Explanation:
Section: Protection of Information Assets
Explanation:
You should know the difference between an exploit and a vulnerability. An exploit refers to software, data,
or commands capable of taking advantage of a bug, glitch or vulnerability in order to cause unintended
behavior. Vulnerability in this sense refers to a weakness in the system.
NEW QUESTION # 431
Which of the following is MOST likely to be a project deliverable of an agile software development methodology?
- A. Rapidly created working prototypes
- B. Strictly managed software requirements baselines
- C. Automated software programming routines
- D. Extensive Project documentation
Answer: D
NEW QUESTION # 432
Identify the network topology from below diagram presented below:
Network Topology
- A. Ring
- B. Star
- C. Mesh
- D. Bus
Answer: B
Explanation:
Explanation/Reference:
For your exam you should know the information below related to LAN topologies:
LAN Topologies
Network topology is the physical arrangement of the various elements (links, nodes, etc.) of a computer network.
Essentially, it is the topological structure of a network, and may be depicted physically or logically. Physical topology refers to the placement of the network's various components, including device location and cable installation, while logical topology shows how data flows within a network, regardless of its physical design.
Distances between nodes, physical interconnections, transmission rates, and/or signal types may differ between two networks, yet their topologies may be identical.
Bus
In local area networks where bus topology is used, each node is connected to a single cable. Each computer or server is connected to the single bus cable. A signal from the source travels in both directions to all machines connected on the bus cable until it finds the intended recipient. If the machine address does not match the intended address for the data, the machine ignores the data. Alternatively, if the data matches the machine address, the data is accepted. Since the bus topology consists of only one wire, it is rather inexpensive to implement when compared to other topologies. However, the low cost of implementing the technology is offset by the high cost of managing the network. Additionally, since only one cable is utilized, it can be the single point of failure. If the network cable is terminated on both ends and when without termination data transfer stop and when cable breaks, the entire network will be down.
Bus topology
Graphic from:
http://www.technologyuk.net/telecommunications/networks/images/bus_topology.gif Linear bus The type of network topology in which all of the nodes of the network are connected to a common transmission medium which has exactly two endpoints (this is the 'bus', which is also commonly referred to as the backbone, or trunk) - all data that is transmitted between nodes in the network is transmitted over this common transmission medium and is able to be received by all nodes in the network simultaneously.
Distributed bus
The type of network topology in which all of the nodes of the network are connected to a common transmission medium which has more than two endpoints that are created by adding branches to the main section of the transmission medium - the physical distributed bus topology functions in exactly the same fashion as the physical linear bus topology (i.e., all nodes share a common transmission medium).
Star
In local area networks with a star topology, each network host is connected to a central point with a point- to-point connection. In Star topology every node (computer workstation or any other peripheral) is connected to central node called hub or switch.
The switch is the server and the peripherals are the clients. The network does not necessarily have to resemble a star to be classified as a star network, but all of the nodes on the network must be connected to one central device.
All traffic that traverses the network passes through the central point. The central point acts as a signal repeater.
The star topology is considered the easiest topology to design and implement. An advantage of the star topology is the simplicity of adding additional nodes. The primary disadvantage of the star topology is that the central point represents a single point of failure.
Star Topology
Image from: http://fcit.usf.edu/network/chap5/pics/star.gif
Ring
A network topology that is set up in a circular fashion in which data travels around the ring in one direction and each device on the ring acts as a repeater to keep the signal strong as it travels. Each device incorporates a receiver for the incoming signal and a transmitter to send the data on to the next device in the ring.
The network is dependent on the ability of the signal to travel around the ring. When a device sends data, it must travel through each device on the ring until it reaches its destination. Every node is a critical link. If one node goes down the whole link would be affected.
Ring Topology
Image from: https://forrester-infosystems.wikispaces.com/
Mesh
The value of a fully meshed networks is proportional to the exponent of the number of subscribers, assuming that communicating groups of any two endpoints, up to and including all the endpoints, is approximated by Reed's Law.
A mesh network provides for high availability and redundancy. However, the cost of such network could be very expensive if dozens of devices are in the mesh.
Mesh Topology
Image from: http://www.technologyuk.net/telecommunications/networks/images/mesh_topology.gif Fully connected mesh topology A fully connected network is a communication network in which each of the nodes is connected to each other. In graph theory it known as a complete graph. A fully connected network doesn't need to use switching nor broadcasting. However, its major disadvantage is that the number of connections grows quadratic ally with the number of nodes, so it is extremely impractical for large networks. A two-node network is technically a fully connected network.
Partially connected mesh topology
The type of network topology in which some of the nodes of the network are connected to more than one other node in the network with a point-to-point link - this makes it possible to take advantage of some of the redundancy that is provided by a physical fully connected mesh topology without the expense and complexity required for a connection between every node in the network.
The following answers are incorrect:
The other options presented are not valid.
The following reference(s) were/was used to create this question:
CISA review manual 2014, Page number 262
NEW QUESTION # 433
Which of the following will MOST likely compromise the control provided By a digital signature created using RSA encryption?
- A. Obtaining the sender's private key
- B. Reversing the hash function using the digest
- C. Altering the plaintext message
- D. Deciphering the receiver's public key
Answer: A
Explanation:
Explanation
A digital signature is a cryptographic technique that verifies the authenticity and integrity of a message or document, by using a hash function and an asymmetric encryption algorithm. A hash function is a mathematical function that transforms any input data into a fixed-length output value called a digest, which is unique for each input. An asymmetric encryption algorithm uses two keys: a public key and a private key. The public key can be shared with anyone, while the private key must be kept secret by the owner. To create a digital signature, the sender first applies a hash function to the plaintext message to generate a digest. Then, the sender encrypts the digest with their private key to produce the digital signature. To verify the digital signature, the receiver decrypts the digital signature with the sender's public key to obtain the digest. Then, the receiver applies the same hash function to the plaintext message to generate another digest. If the two digests match, it means that the message has not been altered and that it came from the sender. The security of a digital signature depends on the secrecy of the sender's private key. If an attacker obtains the sender's private key, they can create fake digital signatures for any message they want, thus compromising the control provided by the digital signature. Reversing the hash function using the digest is not possible, as hash functions are designed to be one-way functions that cannot be inverted. Altering the plaintext message will result in a different digest after applying the hash function, which will not match with the decrypted digest from the digital signature, thus invalidating the digital signature. Deciphering the receiver's public key is not relevant, as public keys are meant to be publicly available and do not affect the security of digital signatures.
NEW QUESTION # 434
Which of the following application input controls would MOST likoly detect data input errors in the customer account number field during the processing of an accounts receivable transaction?
- A. Limit check
- B. Parity check
- C. Validity check
- D. Reasonableness check
Answer: D
NEW QUESTION # 435
To gain an understanding of the effectiveness of an organization's planning and management of investments in IT assets, an IS auditor should review the:
- A. historical financial statements.
- B. IT balanced scorecard (BSC).
- C. IT organizational structure.
- D. enterprise data model.
Answer: B
Explanation:
The IT balanced scorecard (BSC) is a tool that provides the bridge between IT objectives and business objectives by supplementing the traditional financial evaluation with measures to evaluate customer satisfaction, internal processes and the abilityto innovate. An enterprise data model is a document defining the data structure of an organization and how data interrelate. It is useful, but it does not provide information on investments. The IT organizational structure provides an overview of the functional and reporting relationships in an IT entity. Historical financial statements do not provide information about planning and lack sufficient detail to enable one to fully understand management's activities regarding IT assets. Past costs do not necessarily reflect value, and assets such as data are not represented on the books of accounts.
NEW QUESTION # 436
Which of the following is a rewrite of ipfwadm?
- A. None of the choices.
- B. iptables
- C. Netfilter
- D. ipchains
- E. ipcook
Answer: D
Explanation:
Section: Protection of Information Assets
Explanation:
ipchains is a free software based firewall running on earlier Linux. It is a rewrite of ipfwadm but is superseded by iptables in Linux 2.4 and above. Iptables controls the packet filtering and NAT components within the Linux kernel. It is based on Netfilter, a framework which provides a set of hooks within the Linux kernel for intercepting and manipulating network packets.
NEW QUESTION # 437
The results of an IS audit indicating the need to strengthen controls has oeen communicated to the appropriate stakeholders Which of the following is the BEST way for management to enforce Implementation of the recommendations?
- A. Request auditors to design a roadmap for closure
- B. Have stakeholders developer a business case for control changes
- C. Assign ownership to each remediation activity
- D. Copy senior management on communications related to the audit
Answer: C
NEW QUESTION # 438
An IS auditor is reviewing access to an application to determine whether the 10 most recent "new user" forms were correctly authorized. This is an example of:
- A. stop-or-go sampling.
- B. compliance testing.
- C. variable sampling.
- D. substantive testing.
Answer: B
Explanation:
Compliance testing determines whether controls are being applied in compliance with policy. This includes tests to determine whether new accounts were appropriately authorized. Variable
sampling is used to estimate numerical values, such as dollar values. Substantive testing substantiates the integrity of actual processing, such as balances on financial statements. The development of substantive tests is often dependent on the outcome of compliance tests. If compliance tests indicate that there are adequate internal controls, then substantive tests can be minimized. Stop-or-go sampling allows a test to be stopped as early as possible and is not appropriate for checking whether procedures have been followed.
NEW QUESTION # 439
Which audit approach is MOST helpful in optimizing the use of IS audit resources?
- A. Outsourced auditing
- B. Risk-based auditing
- C. Agile auditing
- D. Continuous auditing
Answer: B
NEW QUESTION # 440
Which of the following do digital signatures provide?
- A. Authentication and integrity of data
- B. Authentication and availability of data
- C. Confidentiality and integrity of data
- D. Authentication and confidentiality of data
Answer: A
Explanation:
Section: Protection of Information Assets
Explanation:
The primary purpose of digital signatures is to provide authentication and integrity of data.
NEW QUESTION # 441
An IS auditor reviewing a new application for compliance with information privacy principles should be MOST concerned with:
- A. collection limitation.
- B. nonrepudiation.
- C. awareness.
- D. availability.
Answer: A
NEW QUESTION # 442
Which of the following is the PRIMARY objective of using a capability maturity model as a tool to communicate audit results to senior management?
- A. To evaluate management's action plan
- B. To confirm audit findings
- C. To prioritize remediation efforts
- D. To illustrate improvement opportunities
Answer: D
NEW QUESTION # 443
When reviewing an organization's logical access security, which of the following should be of MOST concern to an IS auditor?
- A. Passwords are not shared.
- B. Redundant logon IDs are deleted.
- C. The allocation of logon IDs is controlled.
- D. Password files are not encrypted.
Answer: D
Explanation:
Explanation/Reference:
Explanation:
When evaluating the technical aspects of logical security, unencrypted files represent the greatest risk.
The sharing of passwords, checking for the redundancy of logon IDs and proper logon ID procedures are essential, but they are less important than ensuring that the password files are encrypted.
NEW QUESTION # 444
Which of the following is the MOST important consideration when designing information security architecture?
- A. The information security architecture is aligned with industry standards.
- B. The level of security supported is based on business decisions.
- C. The existing threat landscape is monitored.
- D. Risk management parameters for the organization are defined.
Answer: B
Explanation:
Section: Protection of Information Assets
NEW QUESTION # 445
Which of the following can help detect transmission errors by appending specially calculated bits onto the end of each segment of data?
- A. Accuracy check
- B. Redundancy check
- C. Parity check
- D. Completeness check
Answer: B
Explanation:
Explanation/Reference:
Explanation:
A redundancy check can help detect transmission errors by appending especially calculated bits onto the end of each segment of data.
NEW QUESTION # 446
A company has located its computer center on a moderate earthquake fault. Which of the following is the MOST important consideration in establishing a contingency plan and an alternate processing site?
- A. The alternative site is a hot site with equipment ready to resume processing immediately.
- B. The contingency plan provides for backup tapes to be taken to the alternative site.
- C. The alternative site does not reside on the same fault no matter how far the distance apart.
- D. The contingency plan for high priority applications does not involve a shared cold site.
Answer: C
Explanation:
Section: Protection of Information Assets
NEW QUESTION # 447
......
Authentic Best resources for CISA Online Practice Exam: https://ensurepass.testkingfree.com/ISACA/CISA-practice-exam-dumps.html