Latest Jan 14, 2022 Real CISA Exam Dumps Questions Valid CISA Dumps PDF
ISACA CISA Exam Dumps - PDF Questions and Testing Engine
Exam Details
The exam for the ISACA CISA certification is available in English, French, Italian, Turkish, Korean, German, Japanese, Spanish, Simplified Chinese, and Traditional Chinese. The test is made up of 150 multiple-choice questions covering five domains of the exam content. The time allocated for the completion is 240 minutes. The passing score is 450/800 points. To register, the applicants are expected to pay the fee. For the ISACA members, it is $575, while the non members should pay $760.
The CISA exam is computer-based and administered at the authorized PSI testing centers across the world. You can schedule your appointment for 48 hours after the payment. You can find the complete details of the test-taking process on the certification webpage. You will also find links to different preparation resources, including virtual or in-person training and practice tests. There is no penalty for incorrect answers, and your grades are determined by the number of questions you answered correctly.
The benefit in Obtaining the CISA Exam Certification
- Allows candidate capability in IS audit, control and security profession.
- Candidates with this certification for the best part they earn 47.54% higher pay.
- CISA can likewise offer a profession jump as an advancement by separating candidates from different people who are not CISA confirmed
- CISA supports candidate knowledge and experience in the assigned region and shows their capacity for responding to any challenge.
- A internationally accepted as the characteristic of excellence for the IS audit professional.
NEW QUESTION 106
If a programmer has update access to a live system, IS auditors are more concerned with the programmer's ability to initiate or modify transactions and the ability to access production than with the programmer's ability to authorize transactions. True or false?
- A. True
- B. False
Answer: A
Explanation:
Explanation/Reference:
If a programmer has update access to a live system, IS auditors are more concerned with the programmer's ability to initiate or modify transactions and the ability to access production than with the programmer's ability to authorize transactions.
NEW QUESTION 107
An IS auditor is reviewing a project that is using an Agile software development approach. Which of the following should the IS auditor expect to find?
- A. Regular monitoring of task-level progress against schedule
- B. Use a process-based maturity model such as the capability maturity model (CMM)
- C. Postiteration reviews that identify lessons learned for future use in the project
- D. Extensive use of software development tools to maximize team productivity
Answer: C
Explanation:
Explanation/Reference:
Explanation:
A key tenet of the Agile approach to software project management is team learning and the use of team learning to refine project management and software development processes as the project progresses.
One of the best ways to achieve this is that, at the end of each iteration, the team considers and documents what worked well and what could have worked better, and identifies improvements to be implemented in subsequent iterations. CMM and Agile really sit at opposite poles. CMM places heavy emphasis on predefined formal processes and formal project management and software development deliverables. Agile projects, by contrast, rely on refinement of process as dictated by the particular needs of the project and team dynamics.
Additionally, less importance is placed on formal paper- based deliverables, with the preference being effective informal communication within the team and with key outside contributors. Agile projects produce releasable software in short iterations, typically ranging from 4 to 8 weeks. This, in itself, instills considerable performance discipline within the team. This, combined with short daily meetings to agree on what the team is doing and the identification of any impediments, renders task-level tracking against a schedule redundant. Agile projects do make use of suitable development tools; however, tools are not seen as the primary means of achieving productivity. Team harmony, effective communications and collective ability to solve challenges are of greater importance.
NEW QUESTION 108
Which of the following is the BEST way to address potential data privacy concerns associated with inadvertent disclosure of machine identifier information contained within security logs?
- A. Only collect logs from servers classified as business critical.
- B. Restrict the transfer of log files from host machine to online storage.
- C. Limit log collection to only periods of increased security activity.
- D. Limit the use of logs to only those purposes for which they were collected.
Answer: D
NEW QUESTION 109
Which of the following is MOST likely to be included in a post-implementation review?
- A. Development methodology
- B. Results of live processing
- C. Test results
- D. Current sets of test data
Answer: B
Explanation:
Section: Information System Acquisition, Development and Implementation
NEW QUESTION 110
Which of the following attack occurs when a malicious action is performed by invoking the operating
system to execute a particular system call?
- A. Traffic analysis
- B. Interrupt attack
- C. Masquerading
- D. Eavesdropping
Answer: B
Explanation:
Section: Protection of Information Assets
Explanation/Reference:
An Interrupt attack occurs when a malicious action is performed by invoking the operating system to
execute a particular system call.
Example: A boot sector virus typically issues an interrupt to execute a write to the boot sector.
The following answers are incorrect:
Eavesdropping - is the act of secretly listening to the private conversation of others without their consent,
as defined by Black's Law Dictionary. This is commonly thought to be unethical and there is an old adage
that "eavesdroppers seldom hear anything good of themselves...eavesdroppers always try to listen to
matters that concern them."
Traffic analysis - is the process of intercepting and examining messages in order to deduce information
from patterns in communication. It can be performed even when the messages are encrypted and cannot
be decrypted. In general, the greater the number of messages observed, or even intercepted and stored,
the more can be inferred from the traffic. Traffic analysis can be performed in the context of military
intelligence, counter-intelligence, or pattern-of-life analysis, and is a concern in computer security.
Masquerading - A masquerade attack is an attack that uses a fake identity, such as a network identity, to
gain unauthorized access to personal computer information through legitimate access identification. If an
authorization process is not fully protected, it can become extremely vulnerable to a masquerade attack.
Masquerade attacks can be perpetrated using stolen passwords and logons, by locating gaps in programs,
or by finding a way around the authentication process. The attack can be triggered either by someone
within the organization or by an outsider if the organization is connected to a public network. The amount of
access masquerade attackers get depends on the level of authorization they've managed to attain. As
such, masquerade attackers can have a full smorgasbord of cyber crime opportunities if they've gained the
highest access authority to a business organization. Personal attacks, although less common, can also be
harmful.
Following reference(s) were/was used to create this question:
CISA review manual 2014 Page number 322
NEW QUESTION 111
An organization is developing data classification standards and has asked internal audit for advice on aligning the standards with best practices. Internal audit would MOST likely recommend the standards should be:
- A. based on the business requirements for confidentiality of the information.
- B. based on the results of an organization-wide risk assessment
- C. aligned with the organization's segregation of duties requirements
- D. based on the business requirements for authentication of the information.
Answer: A
NEW QUESTION 112
An IS auditor discovers instances where software with the same license key is deployed to multiple workstations, in breach of the licensing agreement. Which of the following is the auditor's BEST recommendation?
- A. Implement software licensing monitoring to manage duplications.
- B. Remove embedded keys from offending packages.
- C. Evaluate the business case for funding of additional licenses.
- D. Require business owner approval before granting software access.
Answer: A
Explanation:
Section: The process of Auditing Information System
NEW QUESTION 113
The IS auditor's PRIMARY role in control self-assessment (CSA) is to:
- A. facilitate the process.
- B. evaluate the controls.
- C. draw up an action plan.
- D. identify weaknesses
Answer: A
NEW QUESTION 114
An organization performs both full and incremental database backups Which of the following will BEST enable full restoration in the event of the destruction of the data center?
- A. Move full backups to an offsite location weekly
- B. Maintain full and incremental backups in a secure server room
- C. Transmit incremental backups to an offsite location daily.
- D. Rotate all backups to an offsite location daily
Answer: D
NEW QUESTION 115
An IS auditor has assessed a payroll service provider's security policy and finds significant topics are
missing. Which of the following is the auditor's BEST course of action?
- A. Report the risk to internal management.
- B. Notify the service provider of the discrepancies.
- C. Recommend replacement of the service provider.
- D. Recommend the service provider update their policy.
Answer: A
Explanation:
Section: The process of Auditing Information System
Explanation
NEW QUESTION 116
Broadly speaking, a Trojan horse is any program that invites the user to run it, but conceals a harmful or malicious payload. The payload may take effect immediately and can lead to immediate yet undesirable effects, or more commonly it may install further harmful software into the user's system to serve the creator's longer-term goals. A Trojan horse's payload would almost always take damaging effect immediately.
- A. True
- B. False
Answer: B
Explanation:
Broadly speaking, a Trojan horse is any program that invites the user to run it, but conceals a harmful or malicious payload. The payload may take effect immediately and can lead to immediate yet undesirable effects, or more commonly it may install further harmful software into the user's system to serve the creator's longer-term goals.
NEW QUESTION 117
Upon completion of audit work, an IS auditor should:
- A. distribute a summary of general findings to the members of the auditing team
- B. review the working papers with the auditee.
- C. provide a report to senior management prior to discussion with the auditee.
- D. provide a report to the auditee stating the initial findings.
Answer: B
NEW QUESTION 118
A characteristic of a digital signature is that it:
- A. unique to the message
- B. Is validated when data are changed.
- C. is under control of the receiver.
- D. has a reproducible hashing algorithm
Answer: A
NEW QUESTION 119
Java applets and ActiveX controls are distributed executable programs that execute in the background of a web browser client. This practice is considered reasonable when:
- A. the host web site is part of the organization.
- B. a firewall exists.
- C. the source of the executable file is certain.
- D. a secure web connection is used.
Answer: C
Explanation:
Acceptance of these mechanisms should be based on established trust. The control is provided by only knowing the source and then allowing the acceptance of the applets. Hostile applets can be received from anywhere. It is virtually impossible at thistime to filter at this level. A secure web connection or firewall is considered an external defense. A firewall will find it more difficult to filter a specific file from a trusted source. A secure web connection provides confidentiality. Neither asecure web connection nor a firewall can identify an executable file as friendly. Hosting the web site as part of the organization is impractical. Enabling the acceptance of Java applets and/or Active X controls is an all-or-nothing proposition. Theclient will accept the program if the parameters are established to do so.
NEW QUESTION 120
.Test and development environments should be separated. True or false?
- A. True
- B. False
Answer: A
Explanation:
Test and development environments should be separated, to control the stability of the test environment.
NEW QUESTION 121
The control that MOST effectively addresses the risk of piggybacking/tailgating into a restricted area without a dead man door is:
- A. using two-factor authentication.
- B. requiring employees to wear ID badges.
- C. security awareness training.
- D. using biometric door locks.
Answer: C
Explanation:
Section: Protection of Information Assets
NEW QUESTION 122
Which of the following is the MOST reliable sender authentication method?
- A. Digital signatures
- B. Message authentication code
- C. Asymmetric cryptography
- D. Digital certificates
Answer: D
Explanation:
Section: Protection of Information Assets
Explanation:
Digital certificates are issued by a trusted third party. The message sender attaches the certificate and the
recipient can verify authenticity with the certificate repository. Asymmetric cryptography, such as public key
infrastructure (PKl), appears to authenticate the sender but is vulnerable to a man-in-the-middle attack.
Digital signatures are used for both authentication and confidentiality, but the identity of the sender would
still be confirmed by the digital certificate. Message authentication code is used for message integrity
verification.
NEW QUESTION 123
Which of the following is an implementation risk within the process of decision support systems?
- A. Management control
- B. Changes in decision processes
- C. Semistructured dimensions
- D. inability to specify purpose and usage patterns
Answer: D
Explanation:
Explanation/Reference:
Explanation:
The inability to specify purpose and usage patterns is a risk that developers need to anticipate while implementing a decision support system (DSS). Choices A, B and D are not risks, but characteristics of a DSS.
NEW QUESTION 124
An IS auditor has been asked to audit the proposed acquisition of new computer hardware. The auditor's PRIMARY concern is that:
- A. a clear business case has been established,
- B. the implementation plan meets user requirements.
- C. the new hardware meets established security standards.
- D. a full visible audit trail will be included
Answer: A
NEW QUESTION 125
Post-implementation testing is an example of which of the following control types?
- A. Preventive
- B. Directive
- C. Deterrent
- D. Detective
Answer: D
NEW QUESTION 126
Which of the following approaches would BEST ensure that data protection controls are embedded into software being developed?
- A. Deriving data protection requirements from key stakeholders
- B. Implementing a quality assurance (QA) process during the development phase
- C. Utilizing a data protection template for user acceptance testing (UAT)
- D. Tracking data protection requirements throughout the SDLC
Answer: D
NEW QUESTION 127
Which of the following is the BEST method to delete sensitive information from storage media that will be reused?
- A. Multiple-overwriting
- B. Crypto-shredding
- C. Re-partitioning
- D. Reformatting
Answer: B
NEW QUESTION 128
Which of the following BEST describes the role of a directory server in a public key infrastructure (PKI)?
- A. Stores certificate revocation lists (CRLs)
- B. Encrypts the information transmitted over the network
- C. Makes other users' certificates available to applications
- D. Facilitates the implementation of a password policy
Answer: C
Explanation:
A directory server makes other users' certificates available to applications. Encrypting the information transmitted over the network and storing certificate revocation lists (CRLs) are roles performed by a security server. Facilitating the implementation of a password policy is not relevant to public key infrastructure ( PKl ).
NEW QUESTION 129
......
Reliable Isaca Certification CISA Dumps PDF Jan 14, 2022 Recently Updated Questions: https://www.testinsides.top/CISA-dumps-review.html
Latest CISA Exam Dumps for Pass Guaranteed: https://drive.google.com/open?id=1TpBDWvecZaZ4W3p9G-CbsMRR_Y4SXavX