Online CISA Test Brain Dump Question and Test Engine [Q42-Q62]

4.5/5 - (2 votes)

Online CISA Test Brain Dump Question and Test Engine

Real ISACA CISA Exam Dumps with Correct 500 Questions and Answers

NO.42 Which of the following refers to the act of creating and using an invented scenario to persuade a target to perform an action?

Pretexting

Backgrounding

Check making

Bounce checking

None of the choices.

NO.43 An IS auditor is assessing an organization’s data loss prevention (DLP) solution for protecting intellectual property from insider theft. Which of the following would the auditor consider MOST important for effective data protection?

Creation of DLP policies and procedures

Encryption of data copied to flash drives

Employee training on information handling

Identification and classification of sensitive data

NO.44 When introducing a maturity model to the IT management process, it is BEST to align the maturity level to a point that reflects which of the following?

Ideal business production level

Industry standard practice level

Minimum cost expenditure level

Maximum risk tolerance level

NO.45 Which of the following is a feature of an intrusion detection system (IDS)?

Gathering evidence on attack attempts

Identifying weaknesses in the policy definition

Blocking access to particular sites on the Internet

Preventing certain users from accessing specific servers

NO.46 When reviewing an organization’s strategic IT plan an IS auditor should expect to find:

an assessment of the fit of the organization’s application portfolio with business objectives.

actions to reduce hardware procurement cost.

a listing of approved suppliers of IT contract resources.

a description of the technical architecture for the organization’s network perimeter security.

NO.47 What should be the PMMARY basis for selecting which IS audits to perform in the coming year?

Senior management’s request

Previous audit coverage and scope

Organizational risk assessment

Prior year’s audit findings

NO.48 What type of cryptosystem is characterized by data being encrypted by the sender using the recipient’s public key, and the data then being decrypted using the recipient’s private key?

With public-key encryption, or symmetric encryption

With public-key encryption, or asymmetric encryption

With shared-key encryption, or symmetric encryption

With shared-key encryption, or asymmetric encryption

NO.49 Who should be responsible for network security operations?

Business unit managers

Security administrators

Network administrators

IS auditors

NO.50 Which of the following is the BEST approach to identify whether a vulnerability is actively being exploited?

Conduct a penetration test

Perform log analysis.

Review service desk reports.

Implement key performance indicators (KPIs).

NO.51 Relatively speaking, firewalls operated at the physical level of the seven-layer OSI model are:

almost always less efficient.

almost always less effective.

almost always less secure.

almost always less costly to setup.

None of the choices.

NO.52 Intrusion detection systems (IDSs) can:

substitute for a firewall.

compensate for weak authentication mechanisms

conduct investigations of attacks from within the network

provide information to enhance the security infrastructure.

NO.53 Which of the following conditions would be of MOST concern to an IS auditor assessing the risk of a successful brute force attack against encrypted data at rest?

Use of asymmetric encryption

Random key generation

Use of symmetric encryption

Short key length

NO.54 Due to system limitations, segregation of duties (SoD) cannot be enforced in an accounts payable system.
Which of the following is the IS auditor s BEST recommendation for a compensating control?

Restrict payment authorization to senior staff members

Review payment transaction history.

Require written authorization for all payment transactions.

Reconcile payment transactions with invoices.

NO.55 A project team has decided to switch to an agile approach to develop a replacement tor an existing business application Which of the following should an IS auditor do FIRST to the effectiveness of the project audit?

Identity and assess existing agile process controls.

compare the agile process with previous methodology

Interview business process owners to compile a list of business requirements

Understand the specific agile methodology fiat wil be followed

NO.56 An existing system is being replaced with a new application package User acceptance testing (UAT) should ensure that

there is a business need for the new system

the new system functions as expected.

the new system is better than the old system.

data from the old system has been converted correctly

NO.57 Which of the following should an IS auditor be MOST concerned with when a system uses radio frequency identification (RFID)?

Scalability

Maintainability

Nonrepudiation

Privacy

NO.58 The use of digital signatures:

requires the use of a one-time password generator.

provides encryption to a message.

validates the source of a message.

ensures message confidentiality.

NO.59 Identify the correct sequence which needs to be followed as a chain of event in regards to evidence handling in computer forensics?

Identify, Analyze, preserve and Present

Analyze, Identify, preserve and present

Preserve, Identify, Analyze and Present

Identify, Preserve, Analyze and Present

NO.60 While conducting an audit of a service provider, an IS auditor observes that the service provider has outsourced a part of the work to another provider. Since the work involves confidential information, the IS auditor’s PRIMARY concern should be that the:

requirement for protecting confidentiality of information could be compromised.

contract may be terminated because prior permission from the outsourcer was not obtained.

other service provider to whom work has been outsourced is not subject to audit.

outsourcer will approach the other service provider directly for further work.

NO.61 The traditional role of an IS auditor in a control self-assessment (CSA) should be that of a(n):

Implementor

Facilitator

Developer

Sponsor

NO.62 Which of the following is the MOST effective control to ensure electronic records beyond their retention periods are deleted from IT systems?

Review the record retention register regularly to initiate data deletion.

Build in system logic to trigger data deletion at predefined times.

Perform a sample check of current data against the retention schedule.

Execute all data deletions at a predefined month during the year.