Brilliant CISA Exam Dumps Get CISA Dumps PDF
CISA Dumps PDF - CISA Real Exam Questions Answers
NEW QUESTION 153
Using swipe cards to limit employee access to restricted areas requires implementing which additional control?
- A. Periodic review of access profiles by management
- B. Initial escort of all new hires by a current employee
- C. Physical sign-in of all employees for access to restricted areas
- D. Employee-access criteria determined on the basis of IS experience
Answer: B
NEW QUESTION 154
Which of the following should be the MOST important consideration when determining which information
system application to audit?
- A. Business impact analysis
- B. Newly implemented systems
- C. Cost-benefit analysis
- D. Available resources
Answer: A
Explanation:
Section: Protection of Information Assets
NEW QUESTION 155
Which is the PRIMARY objective of evaluating the readiness of information systems for implementation?
- A. Determine whether the systems meet business requirements.
- B. Determine whether the systems comply with the organization's policy.
- C. Determine whether IT systems projects are on schedule.
- D. Determine whether the systems meet user requirements.
Answer: A
Explanation:
Section: Information System Acquisition, Development and Implementation
NEW QUESTION 156
Which of the following physical access controls effectively reduces the risk of piggybacking?
- A. Combination door locks
- B. Deadman doors
- C. Biometric door locks
- D. Bolting door locks
Answer: B
Explanation:
Explanation/Reference:
Explanation:
Deadman doors use a pair of doors. For the second door to operate, the first entry door must close and lock with only one person permitted in the holding area. This effectively reduces the risk of piggybacking.
An individual's unique body features such as voice, retina, fingerprint or signature activate biometric door locks; however, they do not prevent or reduce the risk of piggybacking. Combination door locks, also known as cipher locks, use a numeric key pad or dial to gain entry. They do not prevent or reduce the risk of piggybacking since unauthorized individuals may still gain access to the processing center. Bolting door locks require the traditional metal key to gain entry. Unauthorized individuals could still gain access to the processing center along with an authorized individual.
NEW QUESTION 157
During an IS audit, one of your auditor has observed that some of the critical servers in your organization can be accessed ONLY by using shared/common user name and password. What should be the auditor's PRIMARY concern be with this approach?
- A. Shared account management
- B. Difficulty in auditing shared account
- C. Password sharing
- D. Accountability
Answer: D
Explanation:
Explanation/Reference:
The keyword PRIMARY is used in the question. Accountability should be the primary concern if critical servers can be accessed only by using shared user id and password. It would be very difficult to track the changes done by employee on critical server.
For your exam you should know the information below:
Accountability
Ultimately one of the drivers behind strong identification, authentication, auditing and session management is accountability. Accountability is fundamentally about being able to determine who or what is responsible for an action and can be held responsible. A closely related information assurance topic is non-repudiation.
Repudiation is the ability to deny an action, event, impact or result. Non-repudiation is the process of ensuring a user may not deny an action. Accountability relies heavily on non-repudiation to ensure users, processes and actions may be held responsible for impacts.
The following contribute to ensuring accountability of actions:
Strong identification
Strong authentication
User training and awareness
Comprehensive, timely and thorough monitoring
Accurate and consistent audit logs
Independent audits
Policies enforcing accountability
Organizational behavior supporting accountability
The following answers are incorrect:
The other options are also valid concern. But the primary concern should be accountability.
Following reference(s) were/was used to create this question:
CISA review manual 2014 Page number 328 and 329
Official ISC2 guide to CISSP CBK 3rd Edition Page number 114
NEW QUESTION 158
Which of the following key performance indicators (KPIs) provides the BEST indication of a security awareness campaign's effectiveness?
- A. Percentage of attendees passing the awareness quiz
- B. Decrease m the number of help desk calls
- C. Reduced average rime for incident resolution
- D. Increase in the number of reponed security incidents
Answer: D
NEW QUESTION 159
Which of the following is a feature of an intrusion detection system (IDS)?
- A. Blocking access to particular sites on the Internet
- B. Gathering evidence on attack attempts
- C. Identifying weaknesses in the policy definition
- D. Preventing certain users from accessing specific servers
Answer: B
Explanation:
Section: Protection of Information Assets
Explanation:
An IDS can gather evidence on intrusive activity such as an attack or penetration attempt. Identifying
weaknesses in the policy definition is a limitation of an IDS. Choices C and D are features of firewalls, while
choice B requires a manual review, and therefore is outside the functionality of an IDS.
NEW QUESTION 160
The responsibility for authorizing access to a business application system belongs to the:
- A. requestor's immediate supervisor.
- B. data owner.
- C. security administrator.
- D. IT security manager.
Answer: B
Explanation:
When a business application is developed, the best practice is to assign an information or data owner to the application. The Information owner should be responsible for authorizing access to the application itself or to back-end databases for queries. Choices B and C are not correct because the security administrator and manager normally do not have responsibility for authorizing access to business applications. The requestor's immediate supervisor may share the responsibility for approving user access to a business application system; however, the final responsibility should go to the information owner.
NEW QUESTION 161
An organization has implemented a distributed security administration system to replace the previous centralized one. The IS auditor's GREATEST concern should be that:
- A. the new system will require additional training.
- B. end-user acceptance of the new system is likely to be difficult to obtain.
- C. a distributed security system is inherently a weak security system.
- D. security procedures may be inadequate to support the change.
Answer: D
Explanation:
Section: Information System Acquisition, Development and Implementation
NEW QUESTION 162
An IS auditor is using data analytics in an audit and has obtained the data to be used for testing. Which of the following is the MOST important task before testing begins?
- A. Verify data analytics test scripts
- B. Document the method used to obtain the data
- C. Select the analytical sampling model
- D. Verify the completeness and accuracy of the data
Answer: B
NEW QUESTION 163
Due to cost restraints, a company defers the replacement of hardware supporting core applications. Which of the following represents the GREATEST risk?
- A. Eventual replacement may be more expensive.
- B. Maintenance costs may rise
- C. Systems availability may suffer.
- D. future upgrades may not be possible.
Answer: C
NEW QUESTION 164
An auditor notes the administrator user ID is shared among three financial managers to perform month-end updates. Which of the following is the BEST recommendation to ensure the administrator ID in the financial system is controlled effectively?
- A. Implement use of individual software tokens
- B. Institute user ID logging and monitoring
- C. Conduct employee awareness training
- D. Ensure data in the financial systems has been classified
Answer: A
Explanation:
Section: The process of Auditing Information System
NEW QUESTION 165
Which of the following poses the GREATEST risk to data security and integrity in a cloud environment?
- A. Data backups are maintained with the cloud provider.
- B. Data is transmitted using hypertext transfer protocol (HTTP).
- C. Data is not classified prior to transmission to the cloud provider.
- D. Data regulations are not clearly defined for the cloud provider.
Answer: C
NEW QUESTION 166
Which of the following is a prevalent risk in the development of end-user computing (EUC) applications?
- A. Decision-making may be impaired due to diminished responsiveness to requests for information
- B. Applications may not be subject to testing and IT general controls
- C. increased application development time
- D. increased development and maintenance costs
Answer: B
Explanation:
Explanation/Reference:
Explanation:
End-user developed applications may not be subjected to an independent outside review by systems analysts and frequently are not created in the context of a formal development methodology. These applications may lack appropriate standards, controls,quality assurance procedures, and documentation. A risk of end-user applications is that management may rely on them as much as traditional applications.
End-user computing (EUC) systems typically result in reduced application development and maintenance costs, and a reduced development cycle time. EUC systems normally increase flexibility and responsiveness to management's information requests.
NEW QUESTION 167
Which of the following level in CMMI model focuses on process innovation and continuous optimization?
- A. Level 5
- B. Level 3
- C. Level 2
- D. Level 4
Answer: A
Explanation:
Section: Information System Acquisition, Development and Implementation
Explanation/Reference:
Level 5 is the optimizing process and focus on process innovation and continuous integration.
For CISA Exam you should know below information about Capability Maturity Model Integration (CMMI)
mode:
Maturity model
A maturity model can be viewed as a set of structured levels that describe how well the behaviors,
practices and processes of an organization can reliably and sustainable produce required outcomes.
CMMI Levels
A maturity model can be used as a benchmark for comparison and as an aid to understanding - for
example, for comparative assessment of different organizations where there is something in common that
can be used as a basis for comparison. In the case of the CMM, for example, the basis for comparison
would be the organizations' software development processes.
Structure
The model involves five aspects:
Maturity Levels: a 5-level process maturity continuum - where the uppermost (5th) level is a notional ideal
state where processes would be systematically managed by a combination of process optimization and
continuous process improvement.
Key Process Areas: a Key Process Area identifies a cluster of related activities that, when performed
together, achieve a set of goals considered important.
Goals: the goals of a key process area summarize the states that must exist for that key process area to
have been implemented in an effective and lasting way. The extent to which the goals have been
accomplished is an indicator of how much capability the organization has established at that maturity level.
The goals signify the scope, boundaries, and intent of each key process area.
Common Features: common features include practices that implement and institutionalize a key process
area. There are five types of common features: commitment to perform, ability to perform, activities
performed, measurement and analysis, and verifying implementation.
Key Practices: The key practices describe the elements of infrastructure and practice that contribute most
effectively to the implementation and institutionalization of the area.
Levels
There are five levels defined along the continuum of the model and, according to the SEI: "Predictability,
effectiveness, and control of an organization's software processes are believed to improve as the
organization moves up these five levels. While not rigorous, the empirical evidence to date supports this
belief".[citation needed]
Initial (chaotic, ad hoc, individual heroics) - the starting point for use of a new or undocumented repeat
process.
Repeatable - the process is at least documented sufficiently such that repeating the same steps may be
attempted.
Defined - the process is defined/confirmed as a standard business process, and decomposed to levels 0, 1
and 2 (the last being Work Instructions).
Managed - the process is quantitatively managed in accordance with agreed-upon metrics.
Optimizing - process management includes deliberate process optimization/improvement.
Within each of these maturity levels are Key Process Areas which characteristic that level, and for each
such area there are five factors: goals, commitment, ability, measurement, and verification. These are not
necessarily unique to CMM, representing - as they do - the stages that organizations must go through
on the way to becoming mature.
The model provides a theoretical continuum along which process maturity can be developed incrementally
from one level to the next. Skipping levels is not allowed/feasible.
Level 1 - Initial (Chaotic)
It is characteristic of processes at this level that they are (typically) undocumented and in a state of
dynamic change, tending to be driven in an ad hoc, uncontrolled and reactive manner by users or events.
This provides a chaotic or unstable environment for the processes.
Level 2 - Repeatable
It is characteristic of processes at this level that some processes are repeatable, possibly with consistent
results. Process discipline is unlikely to be rigorous, but where it exists it may help to ensure that existing
processes are maintained during times of stress.
Level 3 - Defined
It is characteristic of processes at this level that there are sets of defined and documented standard
processes established and subject to some degree of improvement over time. These standard processes
are in place (i.e., they are the AS-IS processes) and used to establish consistency of process performance
across the organization.
Level 4 - Managed
It is characteristic of processes at this level that, using process metrics, management can effectively
control the AS-IS process (e.g., for software development). In particular, management can identify ways to
adjust and adapt the process to particular projects without measurable losses of quality or deviations from
specifications. Process Capability is established from this level.
Level 5 - Optimizing
It is a characteristic of processes at this level that the focus is on continually improving process
performance through both incremental and innovative technological changes/improvements.
At maturity level 5, processes are concerned with addressing statistical common causes of process
variation and changing the process (for example, to shift the mean of the process performance) to improve
process performance. This would be done at the same time as maintaining the likelihood of achieving the
established quantitative process-improvement objectives.
The following were incorrect answers:
Level 4 - Focus on process management and process control
Level 3 - Process definition and process deployment.
Level 2 - Performance management and work product management.
The following reference(s) were/was used to create this question:
CISA review manual 2014 Page number 188
NEW QUESTION 168
......
ISACA CISA Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
| Topic 5 |
|
| Topic 7 |
|
| Topic 8 |
|
| Topic 9 |
|
| Topic 10 |
|
Valid CISA Test Answers & ISACA CISA Exam PDF: https://www.easy4engine.com/CISA-test-engine.html
Realistic CISA Exam Dumps with Accurate & Updated Questions: https://drive.google.com/open?id=1lq-gNP1y9b_jE78MODe-wepwpEKMMz_-
