Updated Jan 14, 2024 Verified CISA dumps Q&As - 100% Pass
New 2024 Latest Questions CISA Dumps - Use Updated ISACA Exam
The CISA certification is a highly credible and recognized certification in the IT industry. It offers a comprehensive knowledge of information systems auditing, control, and security. Passing the CISA exam and obtaining the certification can open up many opportunities for IT audit, security, and governance professionals.
ISACA CISA certification exam is an internationally recognized certification exam for information systems auditors. CISA exam is designed to test the knowledge and skills of individuals in the field of information systems auditing, control, and security. The CISA certification is highly valued by employers and can open up career opportunities for individuals in the field of information technology.
NEW QUESTION # 483
During audit follow-up, an IS auditor finds that a control has been implemented differently than
recommended. The auditor should:
- A. verify whether the control objectives are adequately addressed.
- B. inform management about incorrect implementation.
- C. compare the control to the action plan.
- D. report as a repeat finding.
Answer: C
Explanation:
Section: Protection of Information Assets
NEW QUESTION # 484
As part of the IEEE 802.11 standard ratified in September 1999, WEP uses which stream cipher for confidentiality?
- A. CRC-64
- B. None of the choices.
- C. DES
- D. CRC-32
- E. 3DES
- F. RC4
- G. RC5
Answer: F
Explanation:
Explanation/Reference:
Explanation:
As part of the IEEE 802.11 standard ratified in September 1999, WEP uses the stream cipher RC4 for confidentiality and the CRC-32 checksum for integrity.
NEW QUESTION # 485
Which of the following system deployments requires the cloud provider to assume the widest range of responsibilities for data protection?
- A. Platform as a Service (PaaS)
- B. Software as a Service (SaaS)
- C. Database as a Service (DBaaS)
- D. Infrastructure as a Service (IasSI
Answer: B
NEW QUESTION # 486
Which of the following is the BEST detective control for a job scheduling process involving data transmission?
- A. Job failure alerts are automatically generated and routed to support personnel
- B. Metrics denoting the volume of monthly job failures are reported and reviewed by senior management
- C. Jobs are scheduled to be completed daily end data is transmitted using a secure Fife Transfer Protocol (SFTP)
- D. Jobs are scheduled and a log of this activity n retained for subsequent review
Answer: C
NEW QUESTION # 487
During a routine internal software licensing review, an IS auditor discovers instances where employees shared license keys to critical pieces of business software. Which of the following would be the auditor's BEST course of action?
- A. Recommend the purchase of additional software license keys
- B. Verify whether the licensing agreement allows shared use
- C. Validate user need for shared software licenses
- D. Recommend the utilization of software licensing monitoring tools
Answer: B
NEW QUESTION # 488
Which of the following is the GREATEST concern associated with control self-assessments (CSAs)?
- A. Communication between operational management and senior management may not be effective.
- B. Employees may have insufficient awareness of controls.
- C. Controls may not be assessed objectively.
- D. The assessment may not provide sufficient assurance to stakeholders.
Answer: D
NEW QUESTION # 489
Which of the following threats is MOST effectively controlled by a firewall?
- A. Password cracking
- B. Network sniffing
- C. Network congestion
- D. Denial of service (DoS) attack
Answer: C
NEW QUESTION # 490
An IS auditor is performing a consulting engagement and needs to make a recommendation for securing all doors to a data center to prevent unauthorized access. Which of the following access control techniques would be MOST difficult for an intruder to compromise?
- A. Dead-man door and swipe card
- B. Biometrics and PIN
- C. USB token and password
- D. Smart card and numeric keypad
Answer: B
Explanation:
Section: Protection of Information Assets
NEW QUESTION # 491
Which of the following is an estimation technique where the results can be measure by the functional size of an information system based on the number and complexity of input, output, interface and queries?
- A. Critical path methodology
- B. Time box management
- C. Gantt Chart
- D. Functional Point analysis
Answer: D
Explanation:
Explanation/Reference:
For CISA exam you should know below information about Functional Point Analysis:
Function Point Analysis (FPA) is an ISO recognized method to measure the functional size of an information system. The functional size reflects the amount of functionality that is relevant to and recognized by the user in the business. It is independent of the technology used to implement the system.
The unit of measurement is "function points". So, FPA expresses the functional size of an information system in a number of function points (for example: the size of a system is 314 fop's).
The functional size may be used:
To budget application development or enhancement costs
To budget the annual maintenance costs of the application portfolio
To determine project productivity after completion of the project
To determine the Software Size for cost estimating
All software applications will have numerous elementary processes or independent processes to move data. Transactions (or elementary processes) that bring data from outside the application domain (or application boundary) to inside that application boundary are referred to as external inputs. Transactions (or elementary processes) that take data from a resting position (normally on a file) to outside the application domain (or application boundary) are referred as either an external outputs or external inquiries. Data at rest that is maintained by the application in question is classified as internal logical files.
Data at rest that is maintained by another application in question is classified as external interface files.
Types of Function Point Counts:
Development Project Function Point Count
Function Points can be counted at all phases of a development project from requirements up to and including implementation. This type of count is associated with new development work. Scope creep can be tracked and monitored by understanding the functional size at all phase of a project. Frequently, this type of count is called a baseline function point count.
Enhancement Project Function Point Count
It is common to enhance software after it has been placed into production. This type of function point count tries to size enhancement projects. All production applications evolve over time. By tracking enhancement size and associated costs a historical database for your organization can be built. Additionally, it is important to understand how a Development project has changed over time.
Application Function Point Count
Application counts are done on existing production applications. This "baseline count" can be used with overall application metrics like total maintenance hours. This metric can be used to track maintenance hours per function point. This is an example of a normalized metric. It is not enough to examine only maintenance, but one must examine the ratio of maintenance hours to size of the application to get a true picture.
Productivity:
The definition of productivity is the output-input ratio within a time period with due consideration for quality.
Productivity = outputs/inputs (within a time period, quality considered) The formula indicates that productivity can be improved by (1) by increasing outputs with the same inputs, (2) by decreasing inputs but maintaining the same outputs, or (3) by increasing outputs and decreasing inputs change the ratio favorably.
Software Productivity = Function Points / Inputs
Effectiveness vs. Efficiency:
Productivity implies effectiveness and efficiency in individual and organizational performance.
Effectiveness is the achievement of objectives. Efficiency is the achievement of the ends with least amount of resources.
Software productivity is defined as hours/function points or function points/hours. This is the average cost to develop software or the unit cost of software. One thing to keep in mind is the unit cost of software is not fixed with size. What industry data shows is the unit cost of software goes up with size.
Average cost is the total cost of producing a particular quantity of output divided by that quantity. In this case to Total Cost/Function Points. Marginal cost is the change in total cost attributable to a one-unit change in output.
There are a variety of reasons why marginal costs for software increase as size increases. The following is a list of some of the reasons As size becomes larger complexity increases.
As size becomes larger a greater number of tasks need to be completed.
As size becomes larger there is a greater number of staff members and they become more difficult to manage.
Function Points are the output of the software development process. Function points are the unit of software. It is very important to understand that Function Points remain constant regardless who develops the software or what language the software is developed in. Unit costs need to be examined very closely.
To calculate average unit cost all items (units) are combined and divided by the total cost. On the other hand, to accurately estimate the cost of an application each component cost needs to be estimated.
Determine type of function point count
Determine the application boundary
Identify and rate transactional function types to determine their contribution to the unadjusted function point count.
Identify and rate data function types to determine their contribution to the unadjusted function point count.
Determine the value adjustment factor (VAF)
Calculate the adjusted function point count.
To complete a function point count knowledge of function point rules and application documentation is needed. Access to an application expert can improve the quality of the count. Once the application boundary has been established, FPA can be broken into three major parts FPA for transactional function types FPA for data function types
FPA for GSCs
Rating of transactions is dependent on both information contained in the transactions and the number of files referenced, it is recommended that transactions are counted first. At the same time a tally should be kept of all FTR's (file types referenced) that the transactions reference. Every FTR must have at least one or more transactions. Each transaction must be an elementary process. An elementary process is the smallest unit of activity that is meaningful to the end user in the business. It must be self-contained and leave the business in consistent state The following were incorrect answers:
Critical Path Methodology - The critical path method (CPM) is an algorithm for scheduling a set of project activities Gantt Chart - A Gantt chart is a type of bar chart, developed by Henry Gantt in the 1910s, that illustrates a project schedule. Gantt charts illustrate the start and finish dates of the terminal elements and summary elements of a project. Terminal elements and summary elements comprise the work breakdown structure of the project. Modern Gantt charts also show the dependency (i.e. precedence network) relationships between activities. Gantt charts can be used to show current schedule status using percent-complete shadings and a vertical "TODAY" line as shown here.
Time box Management - In time management, a time boxing allocates a fixed time period, called a time box, to each planned activity. Several project management approaches use time boxing. It is also used for individual use to address personal tasks in a smaller time frame. It often involves having deliverables and deadlines, which will improve the productivity of the user.
The following reference(s) were/was used to create this question:
CISA review manual 2014 Page number 154
NEW QUESTION # 492
Which of the following is a software application that pretend to be a server on the Internet and is not set up purposely to actively protect against break-ins?
- A. Honey pot
- B. Dual Homed
- C. Bastion host
- D. Demilitarize Zone (DMZ)
Answer: A
Explanation:
Section: Protection of Information Assets
Explanation:
A Honey pot is a software application or system that pretends to be a normal server on the internet and it is not set up actively protect against all break-ins. In purpose, some of the updates, patches, or upgrades are missing.
You then monitor the honey pot to learn from the offensive side.
There are two types of honey pot:
High-interaction Honey pots - Essentially gives hacker a real environment to attack. High-interaction honey pots imitate the activities of the production systems that host a variety of services and, therefore, an attacker may be allowed a lot of services to waste his time. According to recent research into high- interaction honey pot technology, by employing virtual machines, multiple honey pots can be hosted on a single physical machine. Therefore, even if the honey pot is compromised, it can be restored more quickly.
In general, high-interaction honey pots provide more security by being difficult to detect, but they are highly expensive to maintain. If virtual machines are not available, one honey pot must be maintained for each physical computer, which can be exorbitantly expensive. Example: Honey net.
Low interaction - Emulate production environment and therefore, provide more limited information. Low- interaction honey pots simulate only the services frequently requested by attackers. Since they consume relatively few resources, multiple virtual machines can easily be hosted on one physical system, the virtual systems have a short response time, and less code is required, reducing the complexity of the virtual system's security. Example: Honeyed.
The following were incorrect answers:
Bastion host - On the Internet, a bastion host is the only host computer that a company allows to be addressed directly from the public network and that is designed to screen the rest of its network from security exposure. DMZ or Demilitarize Zone In computer networks, a DMZ (demilitarized zone) is a computer host or small network inserted as a "neutral zone" between a company's private network and the outside public network. It prevents outside users from getting direct access to a server that has company data. Dual Homed - Dual-homed or dual-homing can refer to either an Ethernet device that has more than one network interface, for redundancy purposes, or in firewall technology, dual-homed is one of the firewall architectures for implementing preventive security.
Dual-Homed - An example of dual-homed devices are enthusiast computing motherboards that incorporate dual Ethernet network interface cards or a firewall with two network interface cards. One facing the external network and one facing the internal network.
Reference:
CISA review manual 2014 Page number 348
http://searchsecurity.techtarget.com/definition/bastion-host http://searchsecurity.techtarget.com/definition/ DMZ
http://en.wikipedia.org/wiki/Honeypot_%28computing%29
http://en.wikipedia.org/wiki/Dual-homed
NEW QUESTION # 493
Which of the following would be of MOST concern for an IS auditor evaluating the design of an organization's incident management processes?
- A. Prioritization criteria are not defined.
- B. Expected time to resolve incidents is not specified.
- C. Metrics are not reported to senior management.
- D. Service management standards are not followed.
Answer: B
NEW QUESTION # 494
There are several types of penetration tests depending upon the scope, objective and nature of a test.
Which of the following describes a penetration test where you attack and attempt to circumvent the controls of the targeted network from the outside, usually the Internet?
- A. Blind Testing
- B. Internal Testing
- C. Targeted Testing
- D. External Testing
Answer: D
Explanation:
Explanation/Reference:
External testing refers to attack and control circumvention attempts on a target's network perimeter from outside the target's system, usually the Internet.
For the CISA exam you should know penetration test types listed below:
External Testing -Refers to attack and control circumvention attempts on a target's network perimeter from outside the target's system, usually the Internet Internal Testing - Refers to attack and control circumvention attempt on target from within the perimeter.
The objective is to identify what would occur if the external perimeter was successfully compromised and/ or an authorized user from within the network wanted to compromise security of a specific resource on a network.
Blind Testing -Refers to the condition of testing when the penetration tester is provided with limited or no knowledge of the target's information systems. Such testing is expensive, since penetration tester have to research the target and profile it based on publicly available information.
Double Blind Testing -It is an extension of blind testing, since the administrator and security staff at the target are also not aware of test. Such a testing can effectively evaluate the incident handling and response capability of the target and how well managed the environment is.
Targeted Testing - Refers to attack and control circumvention attempts on the target, while both the target's IT team and penetration tester are aware of the testing activities. Penetration testers are provided with information related to target and network design. Additionally, they are also provided with a limited privilege user account to be used as a starting point to identify privilege escalation possibilities in the system.
The following were incorrect answers:
Internal Testing - Refers to attack and control circumvention attempt on target from within the perimeter.
The objective is to identify what would occur if the external perimeter was successfully compromised and/ or an authorized user from within the network wanted to compromise security of a specific resource on a network.
Blind Testing -Refers to the condition of testing when the penetration tester is provided with limited or no knowledge of the target's information systems. Such a testing is expensive, since penetration tester have to research the target and profile it based on publicly available information.
Targeted Testing - Refers to attack and control circumvention attempts on the target, while both the target's IT team and penetration tester are aware of the testing activities. Penetration testers are provided with information related to target and network design. Additionally, they are also provided with a limited privilege user account to be used as a starting point to identify privilege escalation possibilities in the system.
Following reference(s) were/was used to create this question:
CISA review manual 2014 Page number 369
NEW QUESTION # 495
Following an internal audit of a database, management has committed to enhance password management controls. Which of the following provides the BEST evidence that management has remediated the audit finding?
- A. Interviews with management about remediation completion
- B. Change tickets of recent password configuration updates
- C. Observation of updated password settings with database administrators (DBAs)
- D. Screenshots from end users showing updated password settings
Answer: B
NEW QUESTION # 496
A critical function of a firewall is to act as a:
- A. device for preventing authorized users from accessing the LAN.
- B. server used to connect authorized users to private trusted network resources.
- C. special router that connects the Internet to a LAN.
- D. proxy server to increase the speed of access to authorized users.
Answer: A
Explanation:
A firewall is a set of related programs, located at a network gateway server, that protects the resources of a private network from users of other networks. An enterprise with an intranet that allows its workers access to the wider Internet installs a firewall to prevent outsiders from accessing its own private data resources and for controlling the outside resources to which its own users have access. Basically, a firewall, working closely with a router program, filters all network packets to determine whether or not to forward them toward their destination. A firewall includes or works with a proxy server that makes network requests on behalf of workstation users. A firewall is often installed in a specially designated computer separate from the rest of the network so no incoming request can get directed to private network resources.
NEW QUESTION # 497
Which of the following is the MOST effective type of antivirus software?
- A. Active monitors
- B. Vaccines
- C. integrity checkers
- D. Scanners
Answer: C
Explanation:
Explanation/Reference:
Explanation:
Integrity checkers compute a binary number on a known virus-free program that is then stored in a database file. This number is called a cyclical redundancy check (CRC). When that program is called to execute, the checker computes the CRC on the program about to be executed and compares it to the number in the database. A match means no infection; a mismatch means that a change in the program has occurred. A change in the program could mean a virus. Scanners look for sequences of bits called signatures that are typical of virus programs. They examine memory, disk boot sectors, executables and command files for bit patterns that match a known virus. Therefore, scanners need to be updated periodically to remain effective. Active monitors interpret DOS and ROM basic input-output system (BIOS) calls, looking for virus-like actions.
Active monitors can be misleading, because they cannot distinguish between a user request and a program or virus request. As a result, users are asked to confirm actions like formatting a disk or deleting a file or set of files. Vaccines are known to be good antivirus software. However, they also need to be updated periodically to remain effective.
NEW QUESTION # 498
An IS auditor notes that several users have not logged into an application for more than one year. Which of the following would be the BEST audit recommendation?
- A. Periodically review the information security policy.
- B. Update the termination procedures.
- C. Delete the affected users' IDs.
- D. Periodically review user access.
Answer: D
Explanation:
Section: The process of Auditing Information System
NEW QUESTION # 499
What is the BEST approach to mitigate the risk of a phishing attack?
- A. User education
- B. Assess web site security
- C. Strong authentication
- D. implement an intrusion detection system (IDS)
Answer: A
Explanation:
Section: Protection of Information Assets
Explanation:
Phishing attacks can be mounted in various ways; intrusion detection systems (IDSs) and strong authentication cannot mitigate most types of phishing attacks. Assessing web site security does not mitigate the risk. Phishing uses a server masquerading as a legitimate server. The best way to mitigate the risk of phishing is to educate users to take caution with suspicious internet communications and not to trust them until verified. Users require adequate training to recognize suspicious web pages and e-mail.
NEW QUESTION # 500
Which of the following should be the FIRST step in a data migration project?
- A. Completing data cleanup in the current database to eliminate inconsistencies
- B. Creating data conversion scripts.
- C. Reviewing decisions on how processes should be conducted in the new system
- D. Understanding the new system's data structure
Answer: D
NEW QUESTION # 501
What kind of protocols does the OSI Transport Layer of the TCP/IP protocol suite provide to ensure reliable communication?
- A. Nonconnection-oriented protocols
- B. Session-oriented protocols
- C. Connection-oriented protocols
- D. Nonsession-oriented protocols
Answer: C
Explanation:
Explanation/Reference:
The transport layer of the TCP/IP protocol suite provides for connection-oriented protocols to ensure reliable communication.
NEW QUESTION # 502
IS management has decided to install a level 1 Redundant Array of Inexpensive Disks (RAID) system in all servers to compensate for the elimination of offsite backups. The IS auditor should recommend:
- A. increasing the frequency of onsite backups.
- B. upgrading to a level 5 RAID.
- C. reinstating the offsite backups.
- D. establishing a cold site in a secure location.
Answer: C
Explanation:
A RAID system, at any level, will not protect against a natural disaster. The problem will not be alleviated without offsite backups, more frequent onsite backups or even setting up a cold site. Choices A, B and D do not compensate for the lack of offsite backup.
NEW QUESTION # 503
Corrective action has been taken by an auditee immediately after the identification of a reportable finding.
The auditor should:
- A. not include the finding in the final report, because the audit report should include only unresolved findings.
- B. not include the finding in the final report, because corrective action can be verified by the IS auditor during the audit.
- C. include the finding in the closing meeting for discussion purposes only.
- D. include the finding in the final report, because the IS auditor is responsible for an accurate report of all findings.
Answer: D
Explanation:
Explanation/Reference:
Explanation:
Including the finding in the final report is a generally accepted audit practice. If an action is taken after the audit started and before it ended, the audit report should identify the finding and describe the corrective action taken. An audit report should reflect the situation, as it existed at the start of the audit. All corrective actions taken by the auditee should be reported in writing.
NEW QUESTION # 504
......
Latest CISA Exam Dumps ISACA Exam from Training: https://www.itcertmagic.com/ISACA/real-CISA-exam-prep-dumps.html
Pass ISACA CISA PDF Dumps Recently Updated 886 Questions: https://drive.google.com/open?id=1cipJTaOSU7lEdnidjxITMXtAXnlISSgn