CISA Dumps 2022 - New ISACA CISA Exam Questions
Free CISA braindumps download (CISA exam dumps Free Updated)
NEW QUESTION 69
Which of the following controls will MOST effectively detect the presence of bursts of errors in network transmissions?
- A. Echo check
- B. Cyclic redundancy check
- C. Block sum check
- D. Parity check
Answer: B
Explanation:
Explanation/Reference:
Explanation:
The cyclic redundancy check (CRC) can check for a block of transmitted data. The workstations generate the CRC and transmit it with the data. The receiving workstation computes a CRC and compares it to the transmitted CRC. if both of them are equal.then the block is assumed error free, in this case (such as in parity error or echo check), multiple errors can be detected. In general, CRC can detect all single-bit and bubble-bit errors. Parity check (known as vertical redundancy check) also involves adding a bit (known as the parity bit) to each character during transmission. In this case, where there is a presence of bursts of errors (i.e., impulsing noise during high transmission rates), it has a reliability of approximately 50 percent.
In higher transmission rates, this limitation is significant. Echo checks detect line errors by retransmitting data to the sending device for comparison with the original transmission.
NEW QUESTION 70
To protect a VoIP infrastructure against a denial-of-service (DoS) attack, it is MOST important to secure the:
- A. session border controllers.
- B. intrusion detection system (IDS).
- C. backbone gateways.
- D. access control servers.
Answer: A
Explanation:
Session border controllers enhance the security in the access network and in the core. In the access network, they hide a user's real address and provide a managed public address. This public address can be monitored, minimizing the opportunities forscanning and denial-of-service ( DoS ) attacks. Session border controllers permit access to clients behind firewalls while maintaining the firewall's effectiveness. In the core, session border controllers protect the users and the network. They hide network topology and users' real addresses. They can also monitor bandwidth and quality of service. Securing the access control server, backbone gateways and intrusion detection systems (IDSs) does not effectively protect against DoS attacks.
NEW QUESTION 71
Which of the following should an IS auditor review to determine user permissions that have been granted for a particular resource?
- A. Application logs
- B. Systems logs
- C. Error logs
- D. Access control lists (ACL)
Answer: D
Explanation:
Section: Protection of Information Assets
Explanation:
IS auditors should review access-control lists (ACL) to determine user permissions that have been granted for a particular resource.
NEW QUESTION 72
An IS auditor reviewed the business case for a proposed investment to virtualize an organization's server infrastructure. Which of the following is MOST likely to be included among the benefits in the project proposal?
- A. Reduced hardware footprint
- B. Fewer operating system licenses
- C. Better efficiency of logical resources
- D. Less memory and storage space
Answer: A
NEW QUESTION 73
From a control perspective, the key element in job descriptions is that they:
- A. communicate management's specific job performance expectations.
- B. are current, documented and readily available to the employee.
- C. establish responsibility and accountability for the employee's actions.
- D. provide instructions on how to do the job and define authority.
Answer: C
Explanation:
Explanation/Reference:
Explanation:
From a control perspective, a job description should establish responsibility and accountability. This will aid in ensuring that users are given system access in accordance with their defined job responsibilities. The other choices are not directly related to controls. Providing instructions on how to do the job and defining authority addresses the managerial and procedural aspects of the job. It is important that job descriptions are current, documented and readily available to the employee, but this in itself is not a control.
Communication of management's specific expectations for job performance outlines the standard of performance and would not necessarily include controls.
NEW QUESTION 74
Which of the following BEST restricts users to those functions needed to perform their duties?
- A. Disabling floppy disk drives
- B. Data encryption
- C. Network monitoring device
- D. Application level access control
Answer: D
Explanation:
Explanation/Reference:
Explanation:
The use of application-level access control programs is a management control that restricts access by limiting users to only those functions needed to perform their duties. Data encryption and disabling floppy disk drives can restrict users to specific functions, but are not the best choices. A network monitoring device is a detective control, not a preventive control.
NEW QUESTION 75
E-mail message authenticity and confidentiality is BEST achieved by signing the message using the:
(
A) sender's private key and encrypting the message using the receiver's public key.
- A. receiver's public key and encrypting the message using the sender's private key.
- B. receiver's private key and encrypting the message using the sender's public key.
- C. sender's public key and encrypting the message using the receiver's private key.
Answer: C
Explanation:
By signing the message with the sender's private key, the receiver can verify its authenticity using the sender's public key. By encrypting the message with the receiver's public key, only the receiver can decrypt the message using their own private key. The receiver's private key is confidential and, therefore, unknown to the sender. Messages encrypted using the sender's private key can be read by anyone with the sender's public key.
NEW QUESTION 76
Which of the following statement INCORRECTLY describes anti-malware?
- A. 0
- B. 2 and 3
- C. 1
- D. None of the choices listed
Answer: D
Explanation:
Section: Protection of Information Assets
Explanation/Reference:
The word INCORRECT is the keyword used in the question. All the terms presented in options correctly
describes some type of anti-malware related activities.
For your exam you should know below mentioned different kinds of malware Controls
A. Scanners Look for sequences of bit called signature that are typical malware programs.
The two primary types of scanner are
1. Malware mask or Signatures - Anti-malware scanners check files, sectors and system memory for
known and new (unknown to scanner) malware, on the basis of malware masks or signatures. Malware
masks or signature are specific code strings that are recognized as belonging to malware. For polymorphic
malware, the scanner sometimes has algorithms that check for all possible combinations of a signature
that could exist in an infected file.
2. Heuristic Scanner - Analyzes the instructions in the code being scanned and decide on the basis of
statistical probabilities whether it could contain malicious code. Heuristic scanning result could indicate that
malware may be present, that is possibly infected. Heuristic scanner tend to generate a high level false
positive errors (they indicate that malware may be present when, in fact, no malware is present)
Scanner examines memory disk- boot sector, executables, data files, and command files for bit pattern that
match a known malware. Scanners, therefore, need to be updated periodically to remain effective.
B. Immunizers - Defend against malware by appending sections of themselves to files - sometime in the
same way Malware append themselves. Immunizers continuously check a file for changes and report
changes as possible malware behavior. Other types of Immunizers are focused to a specific malware and
work by giving the malware the impression that the malware has already infected to the computer. This
method is not always practical since it is not possible to immunize file against all known malware.
C. Behavior Blocker- Focus on detecting potential abnormal behavior such as writing to the boot sector or
the master boot record, or making changes to executable files. Blockers can potentially detect malware at
an early stage. Most hardware based anti-malware mechanism are based on this concept.
D. Integrity CRC checker- Compute a binary number on a known malware free program that is then stored
in a database file. The number is called Cyclic Redundancy Check (CRC). On subsequent scans, when
that program is called to execute, it checks for changes to the file as compare to the database and report
possible infection if changes have occurred. A match means no infection; a mismatch means change in the
program has occurred. A change in the program could mean malware within it. These scanners are
effective in detecting infection; however, they can do so only after infection has occurred. Also, a CRC
checker can only detect subsequent changes to files, because they assume files are malware free in the
first place. Therefore, they are ineffective against new files that are malware infected and that are not
recorded in the database. Integrity checker take advantage of the fact that executable programs and boot
sectors do not change often, if at all.
E. Active Monitors - Active monitors interpret DOS and read-only memory (ROM) BIOS calls, looking for
malware like actions. Active monitors can be problematic because they can not distinguish between a user
request and a program or a malware request. As a result, users are asked to confirm actions, including
formatting a disk or deleting a file or set of files.
The following were incorrect answers:
All of the choices presented other than one were describing Anti-Malware related activities
The following reference(s) were/was used to create this question:
CISA review manual 2014 Page number 354 and 355
NEW QUESTION 77
Which of the following line media would provide the BEST security for a telecommunication network?
- A. Dial-up
- B. Dedicated lines
- C. Broadband network digital transmission
- D. Baseband network
Answer: B
Explanation:
Explanation/Reference:
Explanation:
Dedicated lines are set apart for a particular user or organization. Since there is no sharing of lines or intermediate entry points, the risk of interception or disruption of telecommunications messages is lower.
NEW QUESTION 78
An IS auditor evaluates the test results of a modification to a system that deals with payment computation.
The auditor finds that 50 percent of the calculations do not match predetermined totals. Which of the
following would MOST likely be the next step in the audit?
- A. Design further tests of the calculations that are in error.
- B. Examine some of the test cases to confirm the results.
- C. Identify variables that may have caused the test results to be inaccurate.
- D. Document the results and prepare a report of findings, conclusions and recommendations.
Answer: B
Explanation:
Section: Protection of Information Assets
Explanation:
An IS auditor should next examine cases where incorrect calculations occurred and confirm the results.
After the calculations have been confirmed, further tests can be conducted and reviewed. Report
preparation, findings and recommendations would not be made until all results are confirmed.
NEW QUESTION 79
Which of the following would normally be the MOST reliable evidence for an auditor?
- A. Ratio analysts developed by the IS auditor from reports supplied by line management
- B. Assurance from line management that an application is working as designed
- C. Trend data obtained from World Wide Web (Internet) sources
- D. A confirmation letter received from a third party verifying an account balance
Answer: D
Explanation:
Evidence obtained from independent third parties almost always is considered to be the most reliable. Choices B, C and D would not be considered as reliable.
NEW QUESTION 80
Which of the following BEST supports the risk assessment process to determine criticality of an asset?
- A. Vulnerability assessment
- B. Business impact analysis (BIA)
- C. Residual risk analysis
- D. Threat assessment
Answer: B
Explanation:
Section: Protection of Information Assets
NEW QUESTION 81
An IS auditor has been asked to review an event log aggregation system to ensure risk management practices have been applied. Which of the following should be of MOST concern to the auditor?
- A. Log feeds are uploaded via batch process.
- B. The log data is not normalized.
- C. Completeness testing has not been performed on the log data.
- D. Data encryption standards have not been considered.
Answer: C
Explanation:
Section: The process of Auditing Information System
NEW QUESTION 82
.Database snapshots can provide an excellent audit trail for an IS auditor. True or false?
- A. True
- B. False
Answer: A
Explanation:
Database snapshots can provide an excellent audit trail for an IS auditor.
NEW QUESTION 83
Which of the following would BEST ensure continuity of a wide area network (WAN) across the organization?
- A. A repair contract with a service provider
- B. Completing full system backup daily
- C. Built-in alternative routing
- D. A duplicate machine alongside each server
Answer: C
Explanation:
Section: Protection of Information Assets
Explanation: Alternative routing would ensure the network would continue if a server is lost or if a link is severed as message rerouting could be automatic. System backup will not afford immediate protection.
The repair contract is not as effective as perm a nentalte (native routing). Standby servers will not provide continuity if a link is severed.
NEW QUESTION 84
Which of the following term in business continuity defines the total amount of time that a business process can be disrupted without causing any unacceptable consequences?
- A. MTD
- B. RTO
- C. RPO
- D. WRT
Answer: A
Explanation:
Explanation/Reference:
The sum of RTO and WRT is defined as the Maximum Tolerable Downtime (MTD) which defines the total amount of time that a business process can be disrupted without causing any unacceptable consequences. This value should be defined by the business management team or someone like CTO, CIO or IT manager.
For your exam you should know below information about RPO, RTO, WRT and MTD:
Stage 1: Business as usual
Business as usual
Image Reference - http://defaultreasoning.files.wordpress.com/2013/12/bcdr-01.png At this stage all systems are running production and working correctly.
Stage 2: Disaster occurs
Disaster Occurs
Image Reference - http://defaultreasoning.files.wordpress.com/2013/12/bcdr-02.png On a given point in time, disaster occurs and systems needs to be recovered. At this point the Recovery Point Objective (RPO) determines the maximum acceptable amount of data loss measured in time. For example, the maximum tolerable data loss is 15 minutes.
Stage 3: Recovery
Recovery
Image Reference - http://defaultreasoning.files.wordpress.com/2013/12/bcdr-03.png At this stage the system are recovered and back online but not ready for production yet. The Recovery Time Objective (RTO) determines the maximum tolerable amount of time needed to bring all critical systems back online. This covers, for example, restore data from back-up or fix of a failure. In most cases this part is carried out by system administrator, network administrator, storage administrator etc.
Stage 4: Resume Production
Resume Production
Image Reference - http://defaultreasoning.files.wordpress.com/2013/12/bcdr-04.png At this stage all systems are recovered, integrity of the system or data is verified and all critical systems can resume normal operations. The Work Recovery Time (WRT) determines the maximum tolerable amount of time that is needed to verify the system and/or data integrity. This could be, for example, checking the databases and logs, making sure the applications or services are running and are available.
In most cases those tasks are performed by application administrator, database administrator etc. When all systems affected by the disaster are verified and/or recovered, the environment is ready to resume the production again.
MTD
Image Reference - http://defaultreasoning.files.wordpress.com/2013/12/bcdr-05.png The sum of RTO and WRT is defined as the Maximum Tolerable Downtime (MTD) which defines the total amount of time that a business process can be disrupted without causing any unacceptable consequences. This value should be defined by the business management team or someone like CTO, CIO or IT manager.
The following answers are incorrect:
RPO - Recovery Point Objective (RPO) determines the maximum acceptable amount of data loss measured in time. For example, the maximum tolerable data loss is 15 minutes.
RTO - The Recovery Time Objective (RTO) determines the maximum tolerable amount of time needed to bring all critical systems back online. This covers, for example, restore data from back-up or fix of a failure.
In most cases this part is carried out by system administrator, network administrator, storage administrator etc.
WRT - The Work Recovery Time (WRT) determines the maximum tolerable amount of time that is needed to verify the system and/or data integrity. This could be, for example, checking the databases and logs, making sure the applications or services are running and are available. In most cases those tasks are performed by application administrator, database administrator etc. When all systems affected by the disaster are verified and/or recovered, the environment is ready to resume the production again.
The following reference(s) were/was used to create this question:
CISA review manual 2014 page number 284
http://defaultreasoning.com/2013/12/10/rpo-rto-wrt-mtdwth/
NEW QUESTION 85
While reviewing an organization s business continuity plan (BCP) an IS auditor observes that a recently developed application is not included. The IS auditor should:
- A. ignore the observation as the application is not mission critical.
- B. ensure that the criticality of the application is determined
- C. recommend that the application b# incorporated in the BCP.
- D. include m the audit findings that the BCP is incomplete
Answer: B
NEW QUESTION 86
When a new system is to be implemented within a short time frame, it is MOST important to:
- A. add last-minute enhancements to functionalities.
- B. perform user acceptance testing.
- C. ensure that the code has been documented and reviewed.
- D. finish writing user manuals.
Answer: B
Explanation:
It would be most important to complete the user acceptance testing to ensure that the system to be implemented is working correctly. The completion of the user manuals is similar to the performance of code reviews. If time is tight, the last thing one would want to do is add another enhancement, as it would be necessary to freeze the code and complete the testing, then make any other changes as future enhancements. It would be appropriate to have the code documented and reviewed, but unless the acceptance testing is completed, there is no guarantee that the system will work correctly and meet user requirements.
NEW QUESTION 87
When conducting a penetration test of an organization's internal network, which of the following approaches would BEST enable the conductor of the test to remain undetected on the network?
- A. Pause the scanning every few minutes to allow thresholds to reset.
- B. Use the IP address of an existing file server or domain controller.
- C. Conduct the scans during evening hours when no one is logged-in.
- D. Use multiple scanning tools since each tool has different characteristics.
Answer: A
Explanation:
Section: Protection of Information Assets
Explanation:
Pausing the scanning every few minutes avoids overtaxing the network as well as exceeding thresholds that may trigger alert messages to the network administrator. Using the IP address of a server would result in an address contention that would attract attention. Conducting scans after hours would increase the chance of detection, since there would be less traffic to conceal ones activities. Using different tools could increase the likelihood that one of them would be detected by an intrusion detection system.
NEW QUESTION 88
Which of the following is the MOST important consideration when developing an online business architecture and recovery strategy?
- A. Single points of failure
- B. Vendors financial stability
- C. Vendors network security
- D. Immediate problem resolution
Answer: A
NEW QUESTION 89
Which significant risk is introduced by running the file transfer protocol (FTP) service on a server in a demilitarized zone (DMZ)?
- A. FTP services could allow a user to download files from unauthorized sources.
- B. FTP could significantly reduce the performance of a DMZ server.
- C. A user from within could send a file to an unauthorized person.
- D. A hacker may be able to use the FTP service to bypass the firewall.
Answer: D
Explanation:
Since file transfer protocol (FTP) is considered an insecure protocol, it should not be installed on a server in a demilitarized zone (DMZ). FTP could allow an unauthorized user to gain access to the network. Sending files to an unauthorized person and the risk of downloading unauthorized files are not as significant as having a firewall breach. The presence of the utility does not reduce the performance of a DMZ server; therefore, performance degradation is not a threat.
NEW QUESTION 90
While conducting an audit of a service provider, an IS auditor observes that the service provider has outsourced a part of the work to another provider. Since the work involves confidential information, the IS auditor's PRIMARY concern shouldbe that the:
- A. outsourcer will approach the other service provider directly for further work.
- B. contract may be terminated because prior permission from the outsourcer was not obtained.
- C. requirement for protecting confidentiality of information could be compromised.
- D. other service provider to whom work has been outsourced is not subject to audit.
Answer: C
Explanation:
Explanation/Reference:
Explanation:
Many countries have enacted regulations to protect the confidentiality of information maintained in their countries and/or exchanged with other countries. Where a service provider outsources part of its services to another service provider, there is a potential risk that the confidentiality of the information will be compromised. Choices B and C could be concerns but are not related to ensuring the confidentiality of information. There is no reason why an IS auditor should be concerned with choice D.
NEW QUESTION 91
......
Prerequisites
The main requirement for earning the CISA certification is to pass one test. However, before you can take it, you are required to have at least five years of practical experience in the field of information security and information technology audit. The candidates should also have experience with control, assurance, and security. If you don’t have up to five years, you can also complete the exam with a minimum of two years of hands-on experience in the domain of the qualifying test.
Verified CISA dumps Q&As - Pass Guarantee Exam Dumps Test Engine: https://www.pass4leader.com/ISACA/CISA-exam.html
CISA Dumps for Pass Guaranteed - Pass CISA Exam: https://drive.google.com/open?id=1__1aUlFIglIOC9WD1nAa0orNm9BhzzFV