[Sep-2021] ISACA CISA Dumps – Reduce Your Chance of Failure in CISA Exam
To help you achieve your ultimate goal, we suggest the actual ISACA CISA dumps for your Certified Information Systems Auditor exam preparation to use as your guideline.
NEW QUESTION 450
What supports data transmission through split cable facilities or duplicate cable facilities?
- A. Dual routing
- B. Diverse routing
- C. Alternate routing
- D. Redundant routing
Answer: B
Explanation:
Explanation/Reference:
Explanation: Diverse routing supports data transmission through split cable facilities, or duplicate cable facilities.
NEW QUESTION 451
Which of the following should an IS auditor review FIRST when planning a customer data privacy audit?
- A. Legal and compliance requirements
- B. Organizational policies and procedures
- C. Data classification
- D. Customer agreements
Answer: B
NEW QUESTION 452
In reviewing the IS short-range (tactical) plan, an IS auditor should determine whether:
- A. a strategic information technology planning methodology is in place.
- B. there is an integration of IS and business staffs within projects.
- C. there is a clear definition of the IS mission and vision.
- D. the plan correlates business objectives to IS goals and objectives.
Answer: B
Explanation:
Explanation/Reference:
Explanation:
The integration of IS and business staff in projects is an operational issue and should be considered while reviewing the short-range plan. A strategic plan would provide a framework for the IS short-range plan.
Choices B, C and D are areas covered by a strategic plan.
NEW QUESTION 453
Relatively speaking, firewalls operated at the physical level of the seven-layer OSI model are:
- A. almost always less effective.
- B. almost always less costly to setup.
- C. almost always less secure.
- D. None of the choices.
- E. almost always less efficient.
Answer: D
Explanation:
Section: Protection of Information Assets
Explanation:
Early attempts at producing firewalls operated at the application level of the seven-layer OSI model but this
required too much CPU processing power.
Packet filters operate at the network layer and function more efficiently because they only look at the
header part of a packet. NO FIREWALL operates at the physical level.
NEW QUESTION 454
Which of the following should an IS auditor review FIRST during the audit of an organization's business continuity plan (BCP)?
- A. List of critical business processes
- B. Frequency of business database replication
- C. System recovery lime objectives (RTOs)
- D. System recovery manuals and documentation
Answer: A
NEW QUESTION 455
Which of the following attack redirects outgoing message from the client back onto the client, preventing
outside access as well as flooding the client with the sent packets?
- A. Brute force attack
- B. Buffer overflow
- C. Banana attack
- D. Pulsing Zombie
Answer: C
Explanation:
Section: Protection of Information Assets
Explanation/Reference:
A "banana attack" is another particular type of DoS. It involves redirecting outgoing messages from the
client back onto the client, preventing outside access, as well as flooding the client with the sent packets.
The Banana attack uses a router to change the destination address of a frame. In the Banana attack:
A compromised router copies the source address on an inbound frame into the destination address.
The outbound frame bounces back to the sender.
This sender is flooded with frames and consumes so many resources that valid service requests can no
longer be processed.
The following answers are incorrect:
Brute force attack - Brute force (also known as brute force cracking) is a trial and error method used by
application programs to decode encrypted data such as passwords or Data Encryption Standard (DES)
keys, through exhaustive effort (using brute force) rather than employing intellectual strategies. Just as a
criminal might break into, or "crack" a safe by trying many possible combinations, a brute force cracking
application proceeds through all possible combinations of legal characters in sequence. Brute force is
considered to be an infallible, although time-consuming, approach.
Buffer overflow - A buffer overflow occurs when a program or process tries to store more data in a buffer
(temporary data storage area) than it was intended to hold. Since buffers are created to contain a finite
amount of data, the extra information - which has to go somewhere - can overflow into adjacent buffers,
corrupting or overwriting the valid data held in them. Although it may occur accidentally through
programming error, buffer overflow is an increasingly common type of security attack on data integrity.
Pulsing Zombie - A Dos attack in which a network is subjected to hostile pinging by different attacker
computer over an extended time period.
Following reference(s) were/was used to create this question:
CISA review manual 2014 Page number 321
NEW QUESTION 456
Which of the following should be the PRIMARY consideration for IT management when selecting a new information security tool that monitors suspicious file access patterns?
- A. Integration with existing architecture
- B. Ease of support and troubleshooting
- C. Data correlation and visualization capabilities
- D. Ability to contribute to key performance indicator data
Answer: D
Explanation:
Section: Information System Operations, Maintenance and Support
NEW QUESTION 457
An organization's software develops need access to personally identifiable information (PII) stored in a
particular data format. Which of the following would be the BEST way to protect this sensitive information
while allowing the developers to use it in development and test environments?
- A. Data encryption
- B. Data masking
- C. Data abstraction
- D. Data tokenization
Answer: D
Explanation:
Section: Protection of Information Assets
NEW QUESTION 458
Which of the following append themselves to files as a protection against viruses?
- A. Immunizers
- B. Behavior blockers
- C. Active monitors
- D. Cyclical redundancy checkers (CRCs)
Answer: A
Explanation:
I mmunizers defend against viruses by appending sections of themselves to files. They continuously check the file for changes and report changes as possible viral behavior. Behavior blockers focus on detecting potentially abnormal behavior, such as writing to the boot sector or the master boot record, or making changes to executable files. Cyclical redundancy checkers compute a binary number on a known virus-free program that is then stored in a database file. When that program is subsequently called to be executed, the checkers look for changes to the files, compare it to the database and report possible infection if changes have occurred. Active monitors interpret DOS and ROM basic input-output system (BIOS) calls, looking for virus-like actions.
NEW QUESTION 459
What should an organization do before providing an external agency physical access to its
information processing facilities (IPFs)?
- A. Any access by an external agency should be limited to the demilitarized zone (DMZ).
- B. The processes of the external agency should be subjected to an IS audit by an independent agency.
- C. Employees of the external agency should be trained on the security procedures of the organization.
- D. The organization should conduct a risk assessment and design and implement appropriate controls.
Answer: D
Explanation:
Physical access of information processing facilities (IPFs) by an external agency introduces additional threats into an organization. Therefore, a risk assessment should be conducted and controls designed accordingly. The processes of the external agency are not of concern here. It is the agency's interaction with the organization that needs to be protected. Auditing their processes would not be relevant in this scenario. Training the employees of the external agency may be one control procedure, but could be performed after access has been granted. Sometimes an external agency may require access to the processing facilities beyond the demilitarized zone (DMZ). For example, an agency which undertakes maintenance of servers may require access to the main server room. Restricting access within the DMZ will not serve the purpose.
NEW QUESTION 460
The PRIMARY reason for using digital signatures is to ensure data:
- A. confidentiality.
- B. availability.
- C. timeliness.
- D. integrity.
Answer: D
Explanation:
Explanation/Reference:
Explanation:
Digital signatures provide integrity because the digital signature of a signed message (file, mail, document, etc.) changes every time a single bit of the document changes; thus, a signed document cannot be altered.
Depending on the mechanism chosen to implement a digital signature, the mechanism might be able to ensure data confidentiality or even timeliness, but this is not assured. Availability is not related to digital signatures.
NEW QUESTION 461
An IS auditor is conducting a pre-implementation review to determine a new system's production
readiness. The auditor's PRIMARY concern should be whether:
- A. there are unresolved high-risk items
- B. benefits realization has been evidenced
- C. the project adhered to the budget and target date
- D. users were involved in the quality assurance (QA) testing
Answer: A
Explanation:
Section: The process of Auditing Information System
NEW QUESTION 462
During the planning stage of an IS audit, the PRIMARY goal of an IS auditor is to:
- A. specify appropriate tests.
- B. collect sufficient evidence.
- C. address audit objectives.
- D. minimize audit resources.
Answer: C
Explanation:
Explanation/Reference:
Explanation:
ISACA auditing standards require that an IS auditor plan the audit work to address the audit objectives.
Choice B is incorrect because the auditor does not collect evidence in the planning stage of an audit.
Choices C and D are incorrect because theyare not the primary goals of audit planning. The activities described in choices B, C and D are all undertaken to address audit objectives and are thus secondary to choice A.
NEW QUESTION 463
Which of the following type of a computer network covers a limited area such as a home, office or campus?
- A. SAN
- B. LAN
- C. PAN
- D. WAN
Answer: B
Explanation:
Explanation/Reference:
A local area network (LAN) is a computer network that interconnects computers within a limited area such as a home, school, computer laboratory, or office building using network media.
For your exam you should know below information about computer networks:
Local Area Network (LAN)
A local area network (LAN) is a computer network that interconnects computers within a limited area such as a home, school, computer laboratory, or office building using network media.
Local Area Network
Click HERE for original source of image
Wide Area Network
A wide area network (WAN) is a network that covers a broad area (i.e., any telecommunications network that links across metropolitan, regional, national or international boundaries) using leased telecommunication lines.
Wide Area Network
Source of image: http://www.netprivateer.com/images/lanwan.gif
Metropolitan Area Network
A metropolitan area network (MAN) is a computer network in which two or more computers or communicating devices or networks which are geographically separated but in same metropolitan city and are connected to each other are said to be connected on MAN. Metropolitan limits are determined by local municipal corporations; the larger the city, the bigger the MAN, the smaller a metro city, smaller the MAN Metropolitan Area Network
Source of image: http://cis.msjc.edu/courses/images/MAN.jpg
Personal Area Network
A personal area network (PAN) is a computer network used for data transmission among devices such as computers, telephones and personal digital assistants. PANs can be used for communication among the personal devices themselves (intrapersonal communication), or for connecting to a higher level network and the Internet (an uplink).
Personal Area Network
Click HERE for original image
Storage Area Network
A storage area network (SAN) is a dedicated network that provides access to consolidated, block level data storage. SANs are primarily used to enhance storage devices, such as disk arrays, tape libraries, and optical jukeboxes, accessible to servers so that the devices appear like locally attached devices to the operating system. A SAN typically has its own network of storage devices that are generally not accessible through the local area network (LAN) by other devices.
Storage Area Network
Source of image: http://www.imexresearch.com/images/sasnassan-3.gif
The following were incorrect answers:
PAN - A personal area network (PAN) is a computer network used for data transmission among devices such as computers, telephones and personal digital assistants. PANs can be used for communication among the personal devices themselves (intrapersonal communication), or for connecting to a higher level network and the Internet (an uplink).
WAN - A wide area network (WAN) is a network that covers a broad area (i.e., any telecommunications network that links across metropolitan, regional, national or international boundaries) using leased telecommunication lines.
SAN - A storage area network (SAN) is a dedicated network that provides access to consolidated, block level data storage. SANs are primarily used to enhance storage devices, such as disk arrays, tape libraries, and optical jukeboxes, accessible to servers so that the devices appear like locally attached devices to the operating system. A SAN typically has its own network of storage devices that are generally not accessible through the local area network (LAN) by other devices.
The following reference(s) were/was used to create this question:
CISA review manual 2014 Page number 258
NEW QUESTION 464
Which of the following would be MOST important for an IS auditor to verify when conducting a business continuity audit?
- A. Human safety procedures are in place
- B. insurance coverage is adequate and premiums are current
- C. A recovery site is contracted for and available as needed
- D. Data backups are performed on a timely basis
Answer: A
Explanation:
The most important element in any business continuity process is the protection of human life. This takes precedence over all other aspects of the plan.
NEW QUESTION 465
Which of the following is a mechanism for mitigating risks?
- A. Security and control practices
- B. Contracts and service level agreements (SLAs)
- C. Property and liability insurance
- D. Audit and certification
Answer: A
Explanation:
Section: Protection of Information Assets
Explanation:
Risks are mitigated by implementing appropriate security and control practices. Insurance is a mechanism for transferring risk. Audit and certification are mechanisms of risk assurance, while contracts and SLAs are mechanisms of risk allocation.
NEW QUESTION 466
Which of the following weaknesses would have the GREATEST impact on the effective operation of a perimeter firewall?
- A. Ad-hoc monitoring of firewall activity
- B. Misconfiguration on the firewall rules
- C. Potential back doors to the firewall software
- D. Use of stateful firewalls with default configuration
Answer: B
Explanation:
Section: Information System Operations, Maintenance and Support
NEW QUESTION 467
......
100% Free CISA Demo-Trial [Pdf], get it now: https://drive.google.com/open?id=1cHkZdmXTo2pNbI0BDQ7TDQPs5FAIHIpQ
Accurate & Verified Answers As Seen in the Real Exam here: https://www.getvalidtest.com/CISA-exam.html