Real CISA are Uploaded by Exams4sures provide 2024 Latest CISA Practice Tests Dumps.
All CISA Dumps and Certified Information Systems Auditor Training Courses Help candidates to study and pass the Certified Information Systems Auditor Exams hassle-free!
The Certified Information Systems Auditor (CISA) certification exam is a professional certification that is globally recognized for individuals who audit, control, monitor, and assess an organization's IT and business systems. Certified Information Systems Auditor certification is offered by ISACA, an independent, non-profit organization that is dedicated to providing education, research, and guidance to IT professionals. The CISA certification is one of the most sought-after certifications in the IT industry and is a testament to an individual's knowledge and expertise in the field of audit, risk, and governance.
NEW QUESTION # 328
Batch control reconciliation is a _____________________ (fill in the blank) control for mitigating risk of inadequate segregation of duties.
- A. Corrective
- B. Preventative
- C. Compensatory
- D. Detective
Answer: C
Explanation:
Explanation/Reference:
Batch control reconciliations is a compensatory control for mitigating risk of inadequate segregation of duties.
NEW QUESTION # 329
Which of the following exposures associated with the spooling of sensitive reports for offline printing should an IS auditor consider to be the MOST serious?
- A. Sensitive data can be read by operators.
- B. Unauthorized report copies can be printed.
- C. Data can be amended without authorization.
- D. Output can be lost in the event of system failure.
Answer: B
Explanation:
Explanation/Reference:
Explanation: Unless controlled, spooling for offline printing may enable additional copies to be printed. Print files are unlikely to be available for online reading by operations. Data on spool files are no easier to amend without authority than any other file. There is usually a lesser threat of unauthorized access to sensitive reports in the event of a system failure.
NEW QUESTION # 330
Which of the following should be the PRIMARY role of an internal audit function in the management of identified business risks?
- A. Establishing a risk appetite
- B. Operating the risk management framework
- C. Validating enterprise risk management (ERM)
- D. Establishing a risk management framework
Answer: C
NEW QUESTION # 331
Which of the following would MOST effectively detect a condition where an employee assigned to an operations role could perform system administrator functions?
- A. Entitlement design review
- B. User Access review
- C. Business process review
- D. System review
Answer: B
NEW QUESTION # 332
An IS auditor is reviewing logical access controls for an organization's financial business application Which of the following findings should be of GREATEST concern to the auditor?
- A. User accounts are shared between users
- B. Password length is set to eight characters
- C. Users are not required to change their passwords on a regular basis
- D. Management does not review application user activity logs
Answer: A
Explanation:
Explanation
The finding that should be of greatest concern to the IS auditor is that user accounts are shared between users.
User accounts are unique identifiers that grant access to an organization's financial business application based on the roles and responsibilities of the users. User accounts should be individualized and personalized to ensure accountability, traceability, and auditability of user actions and transactions. User accounts should not be shared between users, because this can compromise the confidentiality, integrity, and availability of the financial data and systems, and can enable unauthorized or fraudulent activities. If user accounts are shared between users, the IS auditor may not be able to determine who performed what action or transaction, or whether the user had the appropriate authorization or approval. The other findings are also concerning, but not as much as user account sharing, because they either affect the password strength or frequency rather than the user identity, or they relate to monitoring rather than controlling user access. References: CISA Review Manual (Digital Version)1, Chapter 5, Section 5.2.2
NEW QUESTION # 333
Which of the following is a PRIMARY benefit of using risk assessments to determine areas to be included in an audit plan?
- A. Effective risk mitigation
- B. Effective allocation of audit resources
- C. Reduced travel and expense costs
- D. Timely audit execution
Answer: B
Explanation:
Explanation
Using risk assessments to determine areas to be included in an audit plan is a primary benefit because it helps to prioritize the audit activities based on the level of risk and the potential impact of the audit findings. This way, the audit resources, such as time, staff, and budget, can be allocated more efficiently and effectively to the areas that need the most attention and provide the most value.
References
ISACA CISA Review Manual, 27th Edition, page 256
What is the Purpose of a Risk Assessment?
Mastering the Process of Risk Assessment
NEW QUESTION # 334
Which of the following should an organization do to anticipate the effects of a disaster?
- A. Develop a business impact analysis (BIA)
- B. Analyze capability maturity model gaps
- C. Simulate a disaster recovery
- D. Define recovery point objectives (RPO)
Answer: A
NEW QUESTION # 335
In the review of a feasibility study for an IS acquisition, the important step is to:
- A. ensure that a contingency plan is in place should the project fail.
- B. determine whether the cost-benefits are achievable.
- C. determine whether security and control requirements have been specified.
- D. ensure that the right to audit the vendor has been considered.
Answer: D
NEW QUESTION # 336
The PRIMARY purpose of a security information and event management (SIEM) system is to:
- A. identify potential incidents
- B. track ongoing incidents
- C. resolve incidents
- D. provide status of incidents
Answer: A
Explanation:
Section: Information System Operations, Maintenance and Support
NEW QUESTION # 337
Which of the following is the MOST important reason to implement version control for an end-user computing (EUC) application?
- A. To ensure that older versions are availability for reference
- B. To ensure compatibility different versions of the application
- C. To ensure that only authorized users can access the application
- D. To ensure that only the latest approved version of the application is used
Answer: D
Explanation:
Explanation
Version control is a process of managing changes to an application or a document. It ensures that only the latest approved version of the application is used by end-users, which reduces the risk of errors, inconsistencies, and unauthorized modifications. Version control also allows tracking the history of changes and restoring previous versions if needed.
NEW QUESTION # 338
Which of the following is of greatest concern to the IS auditor?
- A. Failure to report a successful attack on the network
- B. Failure to prevent a successful attack on the network
- C. Failure to recover from a successful attack on the network
- D. Failure to detect a successful attack on the network
Answer: A
Explanation:
Explanation/Reference:
Lack of reporting of a successful attack on the network is a great concern to an IS auditor.
NEW QUESTION # 339
Disaster recovery planning (DRP) for a company's computer system usually focuses on:
- A. strategic long-range planning.
- B. alternative procedures to process transactions.
- C. operations turnover procedures.
- D. the probability that a disaster will occur.
Answer: B
Explanation:
Section: Protection of Information Assets
Explanation/Reference:
Explanation:
It is important that disaster recovery identifies alternative processes that can be put in place while the system is not available.
NEW QUESTION # 340
An IS auditor is conducting an IT governance audit and notices many initiatives are managed informally by isolated project managers. Which of the following recommendations would have the GREATEST impact on improving the maturity of the IT team?
- A. Discontinue all current IT projects until formal approval is obtained and documented.
- B. Create an interdisciplinary IT steering committee to oversee IT prioritization and spending.
- C. Schedule a follow-up audit in the next year to confirm whether IT processes have matured.
- D. Document and track all IT decisions in a project management tool.
Answer: B
Explanation:
Explanation
An IT steering committee is a group of senior executives and stakeholders who provide strategic direction, guidance, and oversight for the IT function of an organization. An IT steering committee can help to improve the maturity of the IT team by ensuring that the IT initiatives are aligned with the business goals and objectives, that the IT resources are allocated and utilized effectively and efficiently, and that the IT performance and value are measured and communicated. An IT steering committee can also help to resolve conflicts, prioritize demands, and foster collaboration among the IT project managers and other business units.
References
ISACA CISA Review Manual, 27th Edition, page 254
Auditing IT Governance
The Impact of Poor IT Audit Planning and Mitigating Audit Risk
IS Audit Basics: The Components of the IT Audit Report
NEW QUESTION # 341
To confirm integrity for a hashed message, the receiver should use:
- A. the same hashing algorithm as the sender's to create a binary image of the file.
- B. a different hashing algorithm from the sender's to create a numerical representation of the file.
- C. a different hashing algorithm from the sender's to create a binary image of the file.
- D. the same hashing algorithm as the sender's to create a numerical representation of the file.
Answer: D
Explanation:
Section: Protection of Information Assets
NEW QUESTION # 342
Which of the following would an IS auditor consider a weakness when performing an audit of an
organization that uses a public key infrastructure with digital certificates for its business-to- consumer
transactions via the internet?
- A. Customers are widely dispersed geographically, but the certificate authorities are not.
- B. The certificate authority has several data processing subcenters to administer certificates.
- C. Customers can make their transactions from any computer or mobile device.
- D. The organization is the owner of the certificate authority.
Answer: D
Explanation:
Section: Protection of Information Assets
Explanation: If the certificate authority belongs to the same organization, this would generate a conflict of
interest. That is, if a customer wanted to repudiate a transaction, they could allege that because of the
shared interests, an unlawful agreement exists between the parties generating the certificates, if a
customer wanted to repudiate a transaction, they could argue that there exists a bribery between the
parties to generate the certificates, as shared interests exist. The other options are not weaknesses.
NEW QUESTION # 343
What should an IS auditor do FIRST when a follow-up audit reveals some management action plans have not been initiated?
- A. Request an additional action plan review to confirm the findings.
- B. Confirm whether the identified risks are still valid.
- C. Escalate the lack of plan completion to executive management.
- D. Provide a report to the audit committee.
Answer: C
Explanation:
Explanation
The first thing that an IS auditor should do when a follow-up audit reveals some management action plans have not been initiated is to escalate the lack of plan completion to executive management. This is because the failure to implement the agreed management action plans may indicate that the management is not taking the audit findings and recommendations seriously, or that they are accepting too much risk by not addressing the identified issues. Escalating the lack of plan completion to executive management can help to raise awareness and accountability, as well as to seek support and intervention to ensure that the management action plans are executed in a timely and effective manner12.
Confirming whether the identified risks are still valid is not the first thing to do, although it may be a useful step to reassess the current situation and the potential impact of not implementing the management action plans. However, confirming the validity of the risks does not address the root cause of why the management action plans have not been initiated, nor does it provide any assurance or remediation for the unresolved issues34.
Providing a report to the audit committee is not the first thing to do, although it may be a necessary step to communicate and document the results of the follow-up audit. However, providing a report to the audit committee does not guarantee that the management action plans will be initiated, nor does it resolve any conflicts or challenges that may prevent the management from implementing them34.
Requesting an additional action plan review to confirm the findings is not the first thing to do, although it may be a prudent step to verify and validate the accuracy and completeness of the follow-up audit. However, requesting an additional review may delay or defer the implementation of the management action plans, as well as consume more internal audit resources and time
NEW QUESTION # 344
Which of the following is the BEST way to mitigate the risk associated with a document storage application that has a syncing feature that could allow malware to spread to other machines in the network?
- A. An audit should be conducted to detect shadow data and shadow IT in the network.
- B. Content inspection technologies should be used to scan files for sensitive data.
- C. All files should be scanned when they are uploaded to and downloaded from the application.
- D. User behavior modeling and analysis should be performed to discover anomalies in user behavior.
Answer: C
NEW QUESTION # 345
Which of the following exposures associated with the spooling of sensitive reports for offline printing should
an IS auditor consider to be the MOST serious?
- A. Sensitive data can be read by operators.
- B. Unauthorized report copies can be printed.
- C. Data can be amended without authorization.
- D. Output can be lost in the event of system failure.
Answer: B
Explanation:
Section: Protection of Information Assets
Explanation: Unless controlled, spooling for offline printing may enable additional copies to be printed. Print
files are unlikely to be available for online reading by operations. Data on spool files are no easier to amend
without authority than any other file. There is usually a lesser threat of unauthorized access to sensitive
reports in the event of a system failure.
NEW QUESTION # 346
Which of the following security measures will reduce the risk of propagation when a cyberattack occurs?
- A. Web application firewall
- B. Perimeter firewall
- C. Network segmentation
- D. Data loss prevention (DLP) system
Answer: C
NEW QUESTION # 347
Which of the following PBX feature allows a PBX to be configured so that incoming calls are distributed to the next available agent or placed on-hold until one become available?
- A. Voice mail
- B. Call forwarding
- C. Automatic Call distribution
- D. Tenanting
Answer: C
Explanation:
Explanation/Reference:
Automatic Call distribution allows a PBX to be configured so that incoming calls are distributed to the next available agent or placed on-hold until one become available
For your exam you should know below mentioned PBX features and Risks:
System Features
Description
Risk
Automatic Call distribution
Allows a PBX to be configured so that incoming calls are distributed to the next available agent or placed on-hold until one become available
Tapping and control of traffic
Call forwarding
Allow specifying an alternate number to which calls will be forwarded based on certain condition User tracking
Account codes
Used to:
Track calls made by certain people or for certain projects for appropriate billing Dial-In system access (user dials from outside and gain access to normal feature of the PBX) Changing the user class of service so a user can access a different set of features (i.e. the override feature)
Fraud, user tracking, non authorized features
Access Codes
Key for access to specific feature from the part of users with simple instruments, i.e. traditional analog phones.
Non-authorized features
Silent Monitoring
Silently monitors other calls
Eavesdropping
Conferencing
Allows for conversation among several users
Eavesdropping, by adding unwanted/unknown parties to a conference
override(intrude)
Provides for the possibility to break into a busy line to inform another user an important message Eavesdropping
Auto-answer
Allows an instrument to automatically go when called usually gives an auditor or visible warning which can easily turned off
Gaining information not normally available, for various purpose
Tenanting
Limits system user access to only those users who belong to the same tenant group - useful when one company leases out part of its building to other companies and tenants share an attendant, trunk lines,etc Illegal usage, fraud, eavesdropping
Voice mail
Stores messages centrally and - by using a password - allows for retrieval from inside or outside lines.
Disclosure or destruction of all messages of a user when that user's password in known or discovered by an intruder, disabling of the voice mail system and even the entire switch by lengthy messages or embedded codes, illegal access to external lines.
Privacy release
Supports shared extensions among several devices, ensuring that only one device at a time can use an extension. Privacy release disables the security by allowing devices to connect to an extension already in use.
Eavesdropping
No busy extension
Allows calls to an in-use extension to be added to a conference when that extension is on conference and already off-hook
Eavesdropping a conference in progress
Diagnostics
Allows for bypassing normal call restriction procedures. This kind of diagnostic is sometimes available from any connected device. It is a separate feature, in addition to the normal maintenance terminal or attendant diagnostics
Fraud and illegal usage
Camp-on or call waiting
When activated, sends a visual audible warning to an off-hook instrument that is receiving another call.
Another option of this feature is to conference with the camped-on or call waiting Making the called individual a party to a conference without knowing it.
Dedicated connections
Connections made through the PBX without using the normal dialing sequences. It can be used to create hot-lines between devices i.e. one rings when the other goes off-hook. It is also used for data connections between devices and the central processing facility
Eavesdropping on a line
The following were incorrect answers:
Call forwarding - Allow specifying an alternate number to which calls will be forwarded based on certain condition
Tenanting - Limits system user access to only those users who belong to the same tenant group useful when one company leases out part of its building to other companies and tenants share an attendant, trunk lines,etc
Voice Mail - Stores messages centrally and - by using a password - allows for retrieval from inside or outside lines.
The following reference(s) were/was used to create this question:
CISA review manual 2014 Page number 358
NEW QUESTION # 348
......
Valid Way To Pass ISACA's CISA Exam with : https://www.exams4sures.com/ISACA/CISA-practice-exam-dumps.html
Free Test Engine For Certified Information Systems Auditor Certification Exams: https://drive.google.com/open?id=12VaMxVrBj0tw0vjx2gf5T25ZhS4P9EVb