440 Exam Questions for CISA Updated Versions With Test Engine
Pass CISA Exam with Updated CISA Exam Dumps PDF 2021
NEW QUESTION 86
Which of the following is the GREATEST risk associated with the lack of an effective data privacy
program?
- A. Failure to prevent fraudulent transactions
- B. Failure to comply with data-related regulations
- C. Inability to obtain customer confidence
- D. Inability to manage access to private or sensitive data
Answer: B
Explanation:
Section: Information System Acquisition, Development and Implementation
NEW QUESTION 87
Which of the following is the GREATEST risk associated with lack of IT involvement in the organization's strategic planning initiatives?
- A. Business strategies may not consider emerging technologies
- B. IT strategic goals may not be considered by the business.
- C. IT strategies may not align with business strategies
- D. Business strategies may not align with IT capabilities.
Answer: D
NEW QUESTION 88
An organization has begun using social media to communicate with current and potential clients. Which of the following should be of PRIMARY concern to the auditor?
- A. Negative posts by customers affecting the organization's image
- B. Using a third-party provider to host and manage content
- C. Lack of guidance on appropriate social media usage and monitoring
- D. Reduced productivity of stuff using social media
Answer: C
NEW QUESTION 89
An advantage of a continuous audit approach is that it can improve system security when used in time- sharing environments that process a large number of transactions. True or false?
- A. True
- B. False
Answer: A
Explanation:
Explanation/Reference:
Explanation:
It is true that an advantage of a continuous audit approach is that it can improve system security when used in time-sharing environments that process a large number of transactions.
NEW QUESTION 90
Which of the following will help detect changes made by an intruder to the system log of a server?
- A. Write-protecting the directory containing the system log
- B. Storing the backup of the system log offsite
- C. Simultaneously duplicating the system log on a write-once disk
- D. Mirroring the system log on another server
Answer: C
Explanation:
A write-once CD cannot be overwritten. Therefore, the system log duplicated on the disk could be compared to the original log to detect differences, which could be the result of changes made by an intruder. Write-protecting the system log does not prevent deletion or modification, since the superuser can override the write protection. Backup and mirroring may overwrite earlier files and may not be current.
NEW QUESTION 91
Which of the following human resources management practices BEST leads to the detection of fraudulent activity?
- A. Time reporting
- B. Background checks
- C. Employee code of ethics
- D. Mandatory time off
Answer: D
NEW QUESTION 92
An organization's IT security policy requires annual security awareness training for all employees. Which of the following would provide the BEST evidence of the training's effectiveness?
- A. Results of a social engineering test
- B. Surveys completed by randomly selected employees
- C. Decreased calls to the incident response team
- D. Interviews with employees
Answer: A
NEW QUESTION 93
A 5 year audit plan provides for general audits every year and application audits on alternating years. To achieve higher efficiency, the IS audit manager would MOST likely:
- A. Alternate between control self-assessment (CSA) and general audits every year.
- B. Proceed with the plan and integrate all new applications
- C. Implement risk assessment criteria to determine audit priorities
- D. Have control self-assessments (CSAs) and formal audits of application on alternating years
Answer: C
NEW QUESTION 94
Which of the following is the MOST important IS audit consideration when an organization outsources a customer credit review system to a third-party service provider? The provider:
- A. agrees to be subject to external security reviews.
- B. meets or exceeds industry security standards.
- C. complies with security policies of the organization.
- D. has a good market reputation for service and experience.
Answer: A
Explanation:
Section: Protection of Information Assets
Explanation:
It is critical that an independent security review of an outsourcing vendor be obtained because customer credit information will be kept there. Compliance with security standards or organization policies is important, but there is no way to verify or prove that that is the case without an independent review. Though long experience in business and good reputation is an important factor to assess service quality, the business cannot outsource to a provider whose security control is weak.
NEW QUESTION 95
An organization decides to establish a formal incident response capability with clear roles and responsibilities facilitating centralized reporting of security incidents. Which type of control is being implemented?
- A. Compensating control
- B. Detective control
- C. Preventive control
- D. Corrective control
Answer: D
NEW QUESTION 96
Which of the following is by far the most common prevention system from a network security perspective?
- A. Tripwire
- B. Firewall
- C. Hardened OS
- D. IDS
- E. IPS
- F. None of the choices.
Answer: B
Explanation:
Section: Protection of Information Assets
Explanation:
User account access controls and cryptography can protect systems files and data, respectively. On the other hand, firewalls are by far the most common prevention systems from a network security perspective as they can shield access to internal network services, and block certain kinds of attacks through packet filtering.
NEW QUESTION 97
What benefit does using capacity-monitoring software to monitor usage patterns and trends provide to
management?
- A. It allows management to properly allocate resources and ensure continuous efficiency of operations.
- B. It allows users to properly allocate resources and ensure continuous efficiency of operations.
- C. The software produces nice reports that really impress management.
- D. The software can dynamically readjust network traffic capabilities based upon current usage.
Answer: A
Explanation:
Section: Protection of Information Assets
Explanation:
Using capacity-monitoring software to monitor usage patterns and trends enables management to properly
allocate resources and ensure continuous efficiency of operations.
NEW QUESTION 98
________________ should be implemented as early as data preparation to support data integrity at the earliest point possible.
- A. Authentication controls
- B. Control totals
- C. Authorization controls
- D. Parity bits
Answer: B
Explanation:
Section: Protection of Information Assets
Explanation
Explanation:
Control totals should be implemented as early as data preparation to support data integrity at the earliest point possible.
NEW QUESTION 99
During a change control audit of a production system, an IS auditor finds that the change management
process is not formally documented and that some migration procedures failed. What should the IS auditor
do next?
- A. Document the finding and present it to management.
- B. Gain more assurance on the findings through root cause analysis.
- C. Recommend that program migration be stopped until the change process is documented.
- D. Recommend redesigning the change management process.
Answer: B
Explanation:
Section: Protection of Information Assets
Explanation
Explanation:
A change management process is critical to IT production systems. Before recommending that the
organization take any other action (e.g., stopping migrations, redesigning the change management
process), the IS auditor should gain assurance that the incidents reported are related to deficiencies in the
change management process and not caused by some process other than change management.
NEW QUESTION 100
During what process should router access control lists be reviewed?
- A. Business continuity review
- B. Environmental review
- C. Data integrity review
- D. Network security review
Answer: D
Explanation:
Network security reviews include reviewing router access control lists, port scanning, internal and external connections to the system, etc. Environmental reviews, business continuity reviews and data integrity reviews do not require a review of the router access control lists.
NEW QUESTION 101
An organization has installed blade server technology in its data server. To determine whether higher cooling demands are maintained, which of the following should the IS auditor review?
- A. Air conditioning capacity
- B. Ventilation systems
- C. Uninterruptable power supply (UPS) systems
- D. Duct maintenance
Answer: A
NEW QUESTION 102
An IS auditor is reviewing environmental controls and finds extremely high levels of humidity in the data center. Which of the following is the PRIMARY risk to computer equipment from this condition?
- A. Static electricity
- B. Corrosion
- C. Fire
- D. Brownout
Answer: A
NEW QUESTION 103
An information security manager has identified and implemented migrating controls according to industry
best practices. Which of the following is the GREATEST risk associated with this approach?
- A. The cost of control implementation may be too high.
- B. The security program may not be aligned with organizational objectives.
- C. Important security controls may be missed without senior management input.
- D. The migration measures may not be updated in a timely manner.
Answer: B
Explanation:
Section: Governance and Management of IT
NEW QUESTION 104
......
CISA Exam Dumps - Free Demo & 365 Day Updates: https://www.easy4engine.com/CISA-test-engine.html
Free Sales Ending Soon - Use Real CISA PDF Questions: https://drive.google.com/open?id=1RA3nxcMOzb0gttJQAOQa7mtpEhFps9k8
