Start your CISA Exam Questions Preparation with Updated 927 Questions
A Fully Updated 2024 CISA Exam Dumps - PDF Questions and Testing Engine
NEW QUESTION # 525
An IS auditor is evaluating the access controls at a multinational company with a shared network infrastructure. Which of the following is MOST important?
- A. Simplicity of end-to-end communication paths
- B. Remote network administration
- C. Common security policies
- D. Logging of network information at user level
Answer: C
NEW QUESTION # 526
Which of the following access rights presents the GREATEST risk when granted to a new member of the system development staff?
- A. Write access to development data libraries
- B. Execute access to development program libraries
- C. Execute access to production program libraries
- D. Write access to production program libraries
Answer: D
Explanation:
Section: Information System Acquisition, Development and Implementation
NEW QUESTION # 527
In which of the following RFID risks competitor potentially could gain unauthorized access to RFID-
generated information and use it to harm the interests of the organization implementing the RFID system?
- A. Externality Risk
- B. Privacy Risk
- C. Business Intelligence Risk
- D. Business Process Risk
Answer: C
Explanation:
Section: Information System Operations, Maintenance and Support
Explanation/Reference:
An adversary or competitor potentially could gain unauthorized access to RFID-generated information and
use it to harm the interests of the organization implementing the RFID system.
RFID is a powerful technology, in part, because it supports wireless remote access to information about
assets and people that either previously did not exist or was difficult to create or dynamically maintain.
While this wireless remote access is a significant benefit, it also creates a risk that unauthorized parties
could also have similar access to that information if proper controls are not in place. This risk is distinct
from the business process risk because it can be realized even when business processes are functioning
as intended.
A competitor or adversary can gain information from the RFID system in a number of ways, including
eavesdropping on RF links between readers and tags, performing independent queries on tags to obtain
relevant data, and obtaining unauthorized access to a back-end database storing information about tagged
items. Supply chain applications may be particularly vulnerable to this risk because a variety of external
entities may have read access to the tags or related databases.
The risk of unauthorized access is realized when the entity engaging in the unauthorized behavior does
something harmful with that information. In some cases, the information may trigger an immediate
response. For example, someone might use a reader to determine whether a shipping container holds
expensive electronic equipment, and then break into the container when it gets a positive reading. This
scenario is an example of targeting. In other cases, data might also be aggregated over time to provide
intelligence regarding an organization's operations, business strategy, or proprietary methods.
For instance, an organization could monitor the number of tags entering a facility to provide a reasonable
indication of its business growth or operating practices. In this case, if someone determined that a
warehouse recently received a number of very large orders, then that might trigger an action in financial
markets or prompt a competitor to change its prices or production schedule.
For your exam you should know the information below:
Radio-frequency identification (RFID) is the wireless non-contact use of radio-frequency electromagnetic
fields to transfer data, for the purposes of automatically identifying and tracking tags attached to objects.
The tags contain electronically stored information. Some tags are powered by and read at short ranges (a
few meters) via magnetic fields (electromagnetic induction). Others use a local power source such as a
battery, or else have no battery but collect energy from the interrogating EM field, and then act as a passive
transponder to emit microwaves or UHF radio waves (i.e., electromagnetic radiation at high frequencies).
Battery powered tags may operate at hundreds of meters. Unlike a barcode, the tag does not necessarily
need to be within line of sight of the reader, and may be embedded in the tracked object.
RFID tags are used in many industries. An RFID tag attached to an automobile during production can be
used to track its progress through the assembly line. Pharmaceuticals can be tracked through warehouses.
Livestock and pets may have tags injected, allowing positive identification of the animal.
RFID RISKS
RFID technology enables an organization to significantly change its business processes to:
Increase its efficiency, which results in lower costs, Increase its effectiveness, which improves mission
performance and makes the implementing organization more resilient and better able to assign
accountability, and Respond to customer requirements to use RFID technology to support supply chains
and other applications.
The RFID technology itself is complex, combining a number of different computing and communications
technologies to achieve the desired objectives. Unfortunately, both change and complexity generate risk.
For RFID implementations to be successful, organizations need to effectively manage that risk, which
requires an understanding of its sources and its potential characteristics. This section reviews the major
high-level business risks associated with RFID systems so that organizations planning or operating these
systems can better identify, characterize, and manage the risk in their environments.
The risks are as follows:
Business Process Risk -Direct attacks on RFID system components potentially could undermine the
business processes the RFID system was designed to enable.
Business Intelligence Risk- An adversary or competitor potentially could gain unauthorized access to RFID-
generated information and use it to harm the interests of the organization implementing the RFID system.
Privacy Risk - Personal privacy rights or expectations may be compromised if an RFID system uses what is
considered personally identifiable information for a purpose other than originally intended or understood.
The personal possession of functioning tags also is a privacy risk because it could enable tracking of those
holding tagged items.
Externality Risk -RFID technology potentially could represent a threat to non-RFID networked or collocated
systems, assets, and people.
An important characteristic of RFID that impacts all of these risks is that RF communication is invisible to
operators and users.
The following answers are incorrect:
Business Process Risk -Direct attacks on RFID system components potentially could undermine the
business processes the RFID system was designed to enable.
Externality Risk -RFID technology potentially could represent a threat to non-RFID networked or collocated
systems, assets, and people.
Privacy Risk - Personal privacy rights or expectations may be compromised if an RFID system uses what
is considered personally identifiable information for a purpose other than originally intended or understood.
The personal possession of functioning tags also is a privacy risk because it could enable tracking of those
holding tagged items.
The following reference(s) were/was used to create this question:
CISA review manual 2014 page number 248
NEW QUESTION # 528
.Which of the following best characterizes "worms"?
- A. Malicious programs that require the aid of a carrier program such as email
- B. Programming code errors that cause a program to repeatedly dump data
- C. Malicious programs that masquerade as common applications such as screensavers or macro-enabled Word documents
- D. Malicious programs that can run independently and can propagate without the aid of a carrier program such as email
Answer: D
Explanation:
Worms are malicious programs that can run independently and can propagate without the aid of a carrier program such as email.
NEW QUESTION # 529
The most common problem in the operation of an intrusion detection system (IDS) is:
- A. reject-error rates.
- B. the detection of false positives.
- C. receiving trap messages.
- D. denial-of-service attacks.
Answer: B
Explanation:
Explanation/Reference:
Explanation:
Because of the configuration and the way IDS technology operates, the main problem in operating IDSs is the recognition (detection) of events that are not really security incidents- false positives, the equivalent of a false alarm. An IS auditor needs to be aware of this and should check for implementation of related controls, such as IDS tuning, and incident handling procedures, such as the screening process to know if an event is a security incident or a false positive. Trap messages are generated by the Simple Network Management Protocol (SNMP) agents when an important event happens, but are not particularly related to security or IDSs.
Reject-error rate is related to biometric technology and is not related to IDSs. Denial-of-service is a type of attack and is not a problem in the operation of IDSs.
NEW QUESTION # 530
Which of the following is the MOST effective type of antivirus software?
- A. Scanners
- B. Active monitors
- C. integrity checkers
- D. Vaccines
Answer: C
Explanation:
Section: Protection of Information Assets
Explanation:
Integrity checkers compute a binary number on a known virus-free program that is then stored in a database file. This number is called a cyclical redundancy check (CRC). When that program is called to execute, the checker computes the CRC on the program about to be executed and compares it to the number in the database. A match means no infection; a mismatch means that a change in the program has occurred. A change in the program could mean a virus. Scanners look for sequences of bits called signatures that are typical of virus programs. They examine memory, disk boot sectors, executables and command files for bit patterns that match a known virus. Therefore, scanners need to be updated periodically to remain effective. Active monitors interpret DOS and ROM basic input-output system (BIOS) calls, looking for virus-like actions.
Active monitors can be misleading, because they cannot distinguish between a user request and a program or virus request. As a result, users are asked to confirm actions like formatting a disk or deleting a file or set of files. Vaccines are known to be good antivirus software. However, they also need to be updated periodically to remain effective.
NEW QUESTION # 531
The PRIMARY purpose of implementing Redundant Array of Inexpensive Disks (RAID) level 1 in a file server is to:
- A. provide user authentication.
- B. achieve performance improvement.
- C. ensure availability of data.
- D. ensure the confidentiality of data.
Answer: C
Explanation:
Explanation/Reference:
Explanation:
RAID level 1 provides disk mirroring. Data written to one disk are also written to another disk. Users in the network access data in the first disk; if disk one fails, the second disk takes over. This redundancy ensures the availability of data. RAID level 1 does not improve performance, has no relevance to authentication and does nothing to provide for data confidentiality.
NEW QUESTION # 532
Which of the following should be done FIRST when developing a business continuity plan (BCP)?
- A. Conduct a business impact analysis (BIA).
- B. Perform a business threat assessment.
- C. Perform a vulnerability analysis
- D. Review environmental controls.
Answer: A
NEW QUESTION # 533
A potential risk of executing a program on an Internet site is that it may:
- A. lack version control, which may result in the use of an older program.
- B. overwrite system files with older versions
- C. be browser-dependent, and therefore abort.
- D. install executable code on the computer.
Answer: D
NEW QUESTION # 534
Which of the following findings would be of MOST concern to an IS auditor performing a review of an end-user developed application that generates financial statements?
- A. There is not adequate training in the use of the application.
- B. The application is not sufficiently supported by the IT department
- C. There is no adequate user license for the application.
- D. There is no control to ensure accuracy of the processed data.
Answer: D
NEW QUESTION # 535
A financial group recently implemented new technologies and processes, Which type of IS audit would provide the GREATEST level of assurance that the department's objectives have been met?
- A. Financial audit
- B. Cyber audit
- C. Performance audit
- D. Integrated audit
Answer: D
NEW QUESTION # 536
Which of the following would be the BEST method for ensuring that critical fields in a master record have been updated properly?
- A. A before-and-after maintenance report
- B. Field checks
- C. Reasonableness checks
- D. Control totals
Answer: A
Explanation:
A before-and-after maintenance report is the best answer because a visual review would provide the most positive verification that updating was proper.
NEW QUESTION # 537
An IS auditor will be testing accounts payable controls by performing data analytics on the entire population of transactions. Which of the following is MOST important for the auditor to confirm when sourcing the population data?
- A. The data analysis tools have been recently updated.
- B. The data is taken directly from the system.
- C. The data can be obtained in a timely manner.
- D. There is no privacy information in the data.
Answer: D
NEW QUESTION # 538
Which of the following is the BEST way to mitigate the risk of unintentional modifications associated with complex calculations in end-user computing (EUC)?
- A. Utilize an independent party to review the source calculations.
- B. Verify EUC results through manual calculations.
- C. Implement data integrity checks.
- D. Operate copies of EUC programs out of a secure library.
Answer: C
Explanation:
Section: Protection of Information Assets
NEW QUESTION # 539
Which of the following is the MOST secure and economical method for connecting a private network over the Internet in a small- to medium-sized organization?
- A. Virtual private network
- B. Dedicated line
- C. Leased line
- D. integrated services digital network
Answer: A
Explanation:
The most secure method is a virtual private network (VPN), using encryption, authentication and tunneling to allow data to travel securely from a private network to the internet. Choices B, C and D are network connectivity options that are normally too expensive to be practical for small- to medium-sized organizations.
NEW QUESTION # 540
Which of the following is a MAJOR benefit of using a wireless network?
- A. Lower installation cost
- B. Faster network speed
- C. Stronger authentication
- D. Protection against eavesdropping
Answer: C
Explanation:
Section: Protection of Information Assets
NEW QUESTION # 541
A manager Identifies active privileged accounts belonging to staff who have left the organization. Which of the following is the threat actor In this scenario?
- A. Hacktivists
- B. Terminated staff
- C. Unauthorized access
- D. Deleted log data
Answer: B
Explanation:
Explanation
A threat actor is an entity or individual that poses a potential harm or danger to an organization's information systems or data. Terminated staff are the threat actors in this scenario, as they are former employees who may still have active privileged accounts that grant them access to sensitive or critical information or resources of the organization. Terminated staff may abuse their access privileges or credentials to compromise the confidentiality, integrity, or availability of the information systems or data, either intentionally or unintentionally. Unauthorized access is a threat event or action that occurs when an unauthorized entity or individual gains access to an organization's information systems or data without permission or authorization.
Unauthorized access is not a threat actor, but rather a result of a threat actor's activity. Deleted log data is a threat consequence or impact that occurs when log data, which are records of events or activities that occur on an information system or network, are erased or corrupted by a threat actor. Deleted log data can affect the auditability, accountability, and visibility of the information system or network, and prevent detection or investigation of security incidents. Deleted log data is not a threat actor, but rather a result of a threat actor's activity. Hacktivists are threat actors who use hacking techniques to promote a political or social cause or agenda. Hacktivists are not the threat actors in this scenario, as there is no indication that they are involved in this case.
NEW QUESTION # 542
Which of the following is a substantive test?
- A. Using a statistical sample to inventory the tape library
- B. Reviewing password history reports
- C. Ensuring approval for parameter changes
- D. Checking a list of exception reports
Answer: A
Explanation:
A substantive test confirms the integrity of actual processing. A substantive test would determine if the tape library records are stated correctly. A compliance test determines if controls are being applied in a manner that is consistent with management policies and procedures. Checking the authorization of exception reports, reviewing authorization for changing parameters and reviewing password history reports are all compliance tests.
NEW QUESTION # 543
An IT management group has developed a standardized security control checklist and distributed it to the
control self-assessors in each organizational unit. Which of the following would be the GREATEST risk in
this approach?
- A. Delayed feedback may increase exposures
- B. Assessors may manipulate the results
- C. Over time the checklist may become outdated
- D. Business-specific vulnerabilities may be overlooked
Answer: B
Explanation:
Section: Information System Acquisition, Development and Implementation
NEW QUESTION # 544
Which of the following goals would you expect to find in an organization's strategic plan?
- A. Implement a new project planning system within the next 12 months.
- B. Perform an evaluation of information technology needs.
- C. Test a new accounting package.
- D. Become the supplier of choice for the product offered.
Answer: D
Explanation:
Strategic planning sets corporate or departmental objectives into motion. Comprehensive planning helps ensure an effective and efficient organization. Strategic planning is time- and project-oriented, but also must address and help determine priorities to meet business needs. Long- and short-range plans should be consistent with the organization's broader plans for attaining their goals. Choice D represents a business objective that is intended to focus the overall direction of the business andwould thus be a part of the organization's strategic plan. The other choices are project-oriented and do not address business objectives.
NEW QUESTION # 545
A stockbroker accepts orders over the Internet. Which of the following is the MOST appropriate control to ensure confidentiality of the orders?
- A. Public key encryption
- B. Data Encryption Standard (DES)
- C. Virtual private network
- D. Digital signature
Answer: A
Explanation:
Section: Protection of Information Assets
NEW QUESTION # 546
Which of the following is MOST important for an IS auditor to determine when reviewing how the organization's incident response team handles devices that may be involved in criminal activity?
- A. Whether the access logs are checked before seizing the devices
- B. Whether users have knowledge of their devices being examined
- C. Whether there is a chain of custody for the devices
- D. Whether devices are checked for malicious applications
Answer: C
NEW QUESTION # 547
Which of the following is the PRIMARY purpose for conducting parallel testing?
- A. To highlight errors in the program interfaces with files
- B. To ensure the new system meets user requirements
- C. To determine if the system is cost-effective
- D. To enable comprehensive unit and system testing
Answer: B
Explanation:
Explanation/Reference:
Explanation:
The purpose of parallel testing is to ensure that the implementation of a new system will meet user requirements. Parallel testing may show that the old system is, in fact, better than the new system, but this is not the primary reason. Unit and system testing are completed before parallel testing. Program interfaces with files are tested for errors during system testing.
NEW QUESTION # 548
During a human resources (HR) audit, an IS auditor is informed that there is a verbal agreement between the IT and HR departments as to the level of IT services expected. In this situation, what should the IS auditor do FIRST?
- A. Draft a service level agreement (SLA) for the two departments
- B. Confirm the content of the agreement with both departments
- C. Postpone the audit until the agreement is documented
- D. Report the existence of the undocumented agreement to senior management
Answer: B
Explanation:
Section: Protection of Information Assets
Explanation:
An IS auditor should first confirm and understand the current practice before making any recommendations. The agreement can be documented after it has been established that there is an agreement in place. The fact that there is not a written agreement does not justify postponing the audit, and reporting to senior management is not necessary at this stage of the audit. Drafting a service level agreement (SLA) is not the IS auditor's responsibility.
NEW QUESTION # 549
......
How to get CISA Certification on the basis of prior experience?
It is also possible to get the CISA certification through a combination of prior experience and an apprenticeship. There are over 300 Core Competency Domains (CCDs) in the CISA domain and another 200 CCDs in the Security Domain. Candidates with at least six years of experience as security specialists may attempt to complete core domain courses within six months.
Easy Success ISACA CISA Exam in First Try: https://examcollection.vcetorrent.com/CISA-valid-vce-torrent.html