2025 Correct and Up-to-date ISACA CISA BrainDumps
Current CISA dumps Preparation through Our Practice Test
NEW QUESTION # 101
Before concluding that internal controls can be relied upon, the IS auditor should:
- A. document the system of internal control
- B. discuss the internal control weaknesses with the auditee
- C. conduct tests of compliance
- D. document application controls
Answer: C
Explanation:
Section: The process of Auditing Information System
NEW QUESTION # 102
Which of the following ensures components of an IT system are identified and baselined, and that changes to them are implemented in a controlled manner?
- A. Configuration management process
- B. Change management process
- C. Restricted production access
- D. Software versioning control
Answer: A
NEW QUESTION # 103
What is the BEST way for an IS auditor to assess the adequacy of an expert consultant who was selected to be involved in an audit engagement?
- A. Review the industry reputation of the expert consultant's firm.
- B. Obtain an understanding of the expert's relevant experience.
- C. Review the independence and objectivity of the expert.
- D. Verify that the engagement letter outlines the expert's responsibilities.
Answer: B
NEW QUESTION # 104
During a review of an organization's network threat response process. The IS auditor noticed that the majority of alerts were closed without resolution. Management responded that those alerts were unworkable due to lack of actionable intelligence, and therefore the support team is allowed to close them. What is the best way for the auditor to address the situation?
- A. Recommend that management enhance the policy and improve threat awareness training
- B. Further review closed unactioned alerts to identify mishandling of threats
- C. Reopen unactioned alerts and report to the audit committee
- D. Omit the finding from the report as this practice is in compliance with the current policy
Answer: B
NEW QUESTION # 105
Which of the following is the PRIMARY benefit of implementing configuration management for IT?
- A. It helps audit in verifying IT conformance to business requirements.
- B. It helps automate change and release management processes in IT.
- C. It establishes the dependency of application systems with various IT assets.
- D. It provides visibility to the overall function and technical attributes of IT assets.
Answer: D
NEW QUESTION # 106
Which of the following will BEST ensure the successful offshore development of business applications?
- A. Awareness of cultural and political differences
- B. Postimplementation reviews
- C. Stringent contract management practices
- D. Detailed and correctly applied specifications
Answer: D
Explanation:
When dealing with offshore operations, it is essential that detailed specifications be created. Language differences and a lack of interaction between developers and physically remote end users could create gaps in communication in which assumptionsand modifications may not be adequately communicated. Contract management practices, cultural and political differences, and postimplementation reviews, although important, are not as pivotal to the success of the project.
NEW QUESTION # 107
If inadequate, which of the following would be the MOST likely contributor to a denial-of-service attack?
- A. Router configuration and rules
- B. Audit testing and review techniques
- C. Design of the internal network
- D. Updates to the router system software
Answer: A
Explanation:
Inadequate router configuration and rules would lead to an exposure to denial-of-service attacks. Choices B and C would be lesser contributors. Choice D is incorrect because audit testing and review techniques are applied after the fact.
NEW QUESTION # 108
Which of the following controls will MOST effectively detect the presence of bursts of errors in network transmissions?
- A. Parity check
- B. Echo check
- C. Block sum check
- D. Cyclic redundancy check
Answer: D
Explanation:
The cyclic redundancy check (CRC) can check for a block of transmitted datA. The workstations generate the CRC and transmit it with the datA. The receiving workstation computes a CRC and compares it to the transmitted CRC. if both of them are equal.then the block is assumed error free, in this case (such as in parity error or echo check), multiple errors can be detected. In general, CRC can detect all single-bit and bubble-bit errors. Parity check (known as vertical redundancy check) also involves adding a bit (known as the parity bit) to each character during transmission. In this case, where there is a presence of bursts of errors (i.e., impulsing noise during high transmission rates), it has a reliability of approximately 50 percent. Inhigher transmission rates, this limitation is significant. Echo checks detect line errors by retransmitting data to the sending device for comparison with the original transmission.
NEW QUESTION # 109
An IS auditor performs a follow-up audit and learns the approach taken by the auditee to fix the findings differs from the agreed-upon approach confirmed during the last audit. Which of the following should be the auditor's NEXT course of action?
- A. Inform senior management of the change in approach.
- B. Report results of the follow-up to the audit committee.
- C. Evaluate vie appropriateness of the rented s action taken.
- D. Conduct a risk analysis incorporating the change.
Answer: C
NEW QUESTION # 110
Which of the following is the MOST important consideration for a contingency facility?
- A. Both the contingency facility and the primary site are easily identifiable.
- B. The contingency facility is located a sufficient distance away from the primary site.
- C. The contingency facility has the same badge access controls as the primary site.
- D. Both the contingency facility and the primary site have the same number of business assets in their inventory.
Answer: B
Explanation:
A contingency facility is a backup site that can be used to resume business operations in the event of a disaster or disruption at the primary site. The most important consideration for a contingency facility is that it is located a sufficient distance away from the primary site, so that it is not affected by the same event that caused the disruption. For example, if the primary site is damaged by a fire, flood, earthquake, or terrorist attack, the contingency facility should be in a different geographic area that is unlikely to experience the same hazard. This way, the organization can continue to provide its services and products to its customers and stakeholders without interruption.
The other options are not as important as the location of the contingency facility. The badge access controls, the number of business assets, and the identifiability of the sites are secondary factors that may affect the security and efficiency of the contingency facility, but they are not essential for its functionality. Therefore, option C is the correct answer.
References:
* The Importance of Contingency Planning
* WHO guidance for contingency planning
NEW QUESTION # 111
Which of the following manages the digital certificate life cycle to ensure adequate security and controls exist in digital signature applications related to e-commerce?
- A. Certification relocation list
- B. Registration authority
- C. Certification practice statement
- D. Certificate authority (CA)
Answer: D
Explanation:
Explanation/Reference:
Explanation:
The certificate authority maintains a directory of digital certificates for the reference of those receiving them, it manages the certificate life cycle, including certificate directory maintenance and certificate revocation list maintenance and publication. Choice A is not correct because a registration authority is an optional entity that is responsible for the administrative tasks associated with registering the end entity that is the subject of the certificate issued by the CA. Choice C is incorrect since a CRL is an instrument for checking the continued validity of the certificates for which the CA has responsibility. Choice D is incorrect because a certification practice statement is a detailed set of rules governing the certificate authority's operations.
NEW QUESTION # 112
An organization's current end-user computing practices include the use of a spreadsheet for financial statements. Which of the following is the GREATEST concern?
- A. Formulas are not protected against unintended changes.
- B. The spreadsheet contains numerous macros.
- C. The spreadsheet is not maintained by IT.
- D. Operational procedures have not been reviewed in the current fiscal year
Answer: A
NEW QUESTION # 113
Buffer overflow in an Internet environment is of particular concern to the IS auditor because it can:
- A. be used to obtain improper access to a system.
- B. corrupt databases during the build.
- C. cause the loss of critical data during processing.
- D. cause printers to lose some of the document text when printing
Answer: A
NEW QUESTION # 114
During an audit of a disaster recovery plan (DRP) for a critical business area, an IS auditor finds that not all critical systems are covered. What should the auditor do NEXT?
- A. Evaluate the impact of not covering the systems.
- B. Evaluate the prior year's audit results regarding critical system coverage.
- C. Verify whether the systems are part of the business impact analysis (BIA).
- D. Escalate the finding to senior management.
Answer: C
NEW QUESTION # 115
An organization plans to migrate some applications to an externally hosted data center However, the service provider has indicated that it does not provide assurance reports over controls in the data center. What would be an IS auditor's BEST recommendation to management in the absence of a third-party assurance report?
- A. Obtain reporting on service level agreements (SLAs)
- B. Cancel the proposed migration of applications.
- C. Have an independent assessment performed.
- D. include a right-to-audit clause in the contract
Answer: D
NEW QUESTION # 116
In-house personnel performing IS audits should posses which of the following knowledge and/or skills (choose 2):
- A. sufficient knowledge on secure system coding
- B. sufficient knowledge on secure platform development
- C. information systems knowledge commensurate with the scope of the IT environment in question
- D. information systems knowledge commensurate outside of the scope of the IT environment in question
- E. sufficient analytical skills to determine root cause of deficiencies in question
Answer: C,E
Explanation:
Explanation/Reference:
Explanation:
Personnel performing IT audits should have information systems knowledge commensurate with the scope of the institution's IT environment. They should also possess sufficient analytical skills to determine the root cause of deficiencies.
NEW QUESTION # 117
.What is the most common reason for information systems to fail to meet the needs of users? Choose the BEST answer.
- A. Poor IT strategic planning
- B. Lack of funding
- C. Inadequate user participation during system requirements definition
- D. Inadequate senior management participation during system requirements definition
Answer: C
Explanation:
Inadequate user participation during system requirements definition is the most common reason for information systems to fail to meet the needs of users.
NEW QUESTION # 118
An IS auditor performing an independent classification of systems should consider a situation where functions could be performed manually at a tolerable cost for an extended period of time as:
- A. vital.
- B. sensitive.
- C. noncritical.
- D. critical.
Answer: B
Explanation:
Sensitive functions are best described as those that can be performed manually at a tolerable cost for an extended period of time. Critical functions are those that cannot be performed unless they are replaced by identical capabilities and cannot bereplaced by manual methods. Vital functions refer to those that can be performed manually but only for a brief period of time; this is associated with lower costs of disruption than critical functions. Noncritical functions may be interrupted for anextended period of time at little or no cost to the company, and require little time or cost to restore.
NEW QUESTION # 119
Which of the following access rights presents the GREATEST risk when granted to a new member of the system development staff?
- A. Write access to development data libraries
- B. Execute access to production program libraries
- C. Execute access to development program libraries
- D. Write access to production program libraries
Answer: D
Explanation:
Explanation
Write access to production program libraries presents the greatest risk when granted to a new member of the system development staff. Production program libraries contain executable code that runs on live systems and supports critical business functions. Write access allows a user to modify or delete existing programs, or add new programs to the library. If a user were to make unauthorized or erroneous changes to production programs, it could cause serious disruptions, errors, or security breaches in the organization's operations.
Therefore, write access to production program libraries should be restricted to authorized personnel only, and subject to strict change management controls.
NEW QUESTION # 120
Which of the following would minimize the risk of losing transactions as a result of a disaster?
- A. Storing a copy of the transaction logs onsite in a fireproof vault
- B. Signing a copy of the transaction logs and store on a local server
- C. Sending a copy of the transaction logs to offsite storage on a daily basis
- D. Encrypting a copy of the transaction logs and store on a local server
Answer: C
Explanation:
Sending a copy of the transaction logs to offsite storage on a daily basis would minimize the risk of losing transactions as a result of a disaster. This is because offsite storage provides a backup of the data that can be recovered in case of a catastrophic event that destroys or damages the onsite data. Storing a copy of the transaction logs onsite in a fireproof vault (B) would not protect the data from other types of disasters, such as floods, earthquakes, or theft. Encrypting or signing (D) a copy of the transaction logs and storing them on a local server would not prevent the loss of data if the server is affected by the disaster. Encryption and digital signatures are security measures that protect the confidentiality and integrity of the data, but not the availability.
Reference: CISA - Certified Information Systems Auditor Study Guide1, Chapter 5: Protection of Information Assets, Section 5.2: Backup and Recovery Concepts, Page 353.
NEW QUESTION # 121
A new privacy regulation requires a customer's privacy information to be deleted within 72 hours, if requested.
Which of the following would be an IS auditor's GREATEST concern regarding compliance to this regulation?
- A. End user access to applications with customer information
- B. Outdated online privacy policies
- C. Incomplete backup and retention policies
- D. Lack of knowledge of where customers' information is saved
Answer: D
NEW QUESTION # 122
Which of the following is the PRIMARY basis on which audit objectives are established?
- A. Consideration of risks
- B. Audit risk
- C. Assessment of prior audits
- D. Business strategy
Answer: D
NEW QUESTION # 123
......
100% Reliable Microsoft CISA Exam Dumps Test Pdf Exam Material: https://www.examsreviews.com/CISA-pass4sure-exam-review.html
Based on Official Syllabus Topics of Actual ISACA CISA Exam: https://drive.google.com/open?id=1BgcCMdE5IoLtd3k8i2gv4oO1pw83X37p