[Nov-2021] ISACA CISA Dumps - Secret To Pass in First Attempt
ISACA CISA Exam Dumps [2021] Practice Valid Exam Dumps Question
How much CISA Exam Cost
- The early Registration fee for the CISA exam is $415 for Members and $545 for Non-Members.
- The final Registration fee for the CISA is $465 USD for members and $595 for Non-Members.
NEW QUESTION 396
During a security audit, an IS auditor is tasked with reviewing log entries obtained from an enterprise intrusion prevention system (IPS). Which type of risk would be associated with the potential for the auditor to miss a sequence of logged events that could indicate an error in the IPS configuration?
- A. Control risk
- B. Sampling risk
- C. Detection risk
- D. Inherent risk
Answer: C
Explanation:
Section: The process of Auditing Information System
NEW QUESTION 397
Which of the following is the BEST way to address potential data privacy concerns associated with inadvertent disclosure of machine identifier information contained within security logs?
- A. Only collect logs from servers classified as business critical.
- B. Limit the use of logs to only those purposes for which they were collected.
- C. Restrict the transfer of log files from host machine to online storage.
- D. Limit log collection to only periods of increased security activity.
Answer: B
NEW QUESTION 398
An organization has outsourced its help desk activities. An IS auditor's GREATEST concern when reviewing the contract and associated service level agreement (SLA) between the organization and vendor should be the provisions for:
- A. reporting the year-to-year incremental cost reductions.
- B. documentation of staff background checks.
- C. reporting staff turnover, development or training.
- D. independent audit reports or full audit access.
Answer: D
Explanation:
Explanation/Reference:
Explanation:
When the functions of an IS department are outsourced, an IS auditor should ensure that a provision is made for independent audit reports that cover all essential areas, or that the outsourcer has full audit access. Although it is necessary to document the fact that background checks are performed, this is not as important as provisions for audits. Financial measures such as year-to-year incremental cost reductions are desirable to have in a service level agreement (SLA); however, cost reductions are not as important as the availability of independent audit reports or full audit access. An SLA might include human relationship measures such as resource planning, staff turnover, development or training, but this is not as important as the requirements for independent reports or full audit access by the outsourcing organization.
NEW QUESTION 399
When developing a security architecture, which of the following steps should be executed FIRST?
- A. Defining roles and responsibilities
- B. Developing security procedures
- C. Defining a security policy
- D. Specifying an access control methodology
Answer: C
Explanation:
Section: Protection of Information Assets
Explanation:
Defining a security policy for information and related technology is the first step toward building a security architecture. A security policy communicates a coherent security standard to users, management and technical staff. Security policies will often set the stage in terms of what tools and procedures are needed for an organization. The other choices should be executed only after defining a security policy.
NEW QUESTION 400
Which of the following is the MOST important role of the information security manager when the organization is in the process of adopting emerging technologies?
- A. Assessing how peer organizations using the same technologies have been impacted
- B. Understanding the impact on existing resources
- C. Reviewing vendor documentation and service levels agreements
- D. Developing training for end users to familiarize them with the new technology
Answer: B
Explanation:
Section: Governance and Management of IT
NEW QUESTION 401
During a review of the IT strategic plan, an IS auditor finds several IT initiatives focused on delivering new
systems and technology are not aligned with the organization's strategy. Witch of the following would be the
IS auditor's BEST recommendation?
- A. Utilize a balanced scorecard to align IT initiatives to business strategies
- B. Modify IT initiatives that do not map to business strategies
- C. Reassess IT initiatives that do not map business strategies
- D. Reassess the return on investment for the IT initiatives
Answer: C
Explanation:
Section: Governance and Management of IT
NEW QUESTION 402
An IS auditor is conducting a review of an organization s information systems and discovers data that is no longer needed by business applications. Which of the following would b IS auditor's BEST recommendation?
- A. Keep the data and protect it using a data classification policy
- B. Assess the data according to the retention policy.
- C. Ask the data custodian to remove it after confirmation from the business user
- D. Back up the data to removable media and store in a secure area.
Answer: D
NEW QUESTION 403
Which of the following is an IS auditor's BEST course of action upon learning that preventive controls have been replaced with detective and corrective controls'
- A. Report the issue to management as the risk level has increased.
- B. Evaluate whether new controls manage the risk at an acceptable level.
- C. Verify the revised controls enhance the efficiency of related business processes.
- D. Recommend the implementation of preventive controls in addition to the other controls.
Answer: B
NEW QUESTION 404
An IS auditor notes that IDS log entries related to port scanning are not being analyzed. This lack of analysis will MOST likely increase the risk of success of which of the following attacks?
- A. Denial-of-service
- B. Replay
- C. Buffer overflow
- D. Social engineering
Answer: A
Explanation:
Explanation/Reference:
Explanation:
Prior to launching a denial-of-service attack, hackers often use automatic port scanning software to acquire information about the subject of their attack. A replay attack is simply sending the same packet again. Social engineering exploits end-user vulnerabilities, and buffer overflow attacks exploit poorly written code.
NEW QUESTION 405
Regarding a disaster recovery plan, the role of an IS auditor should include:
- A. determining the criteria for establishing a recovery time objective (RTO).
- B. determining the external service providers involved in a recovery test.
- C. identifying critical applications.
- D. observing the tests of the disaster recovery plan.
Answer: D
Explanation:
The IS auditor should be present when disaster recovery plans are tested, to ensure that the test meets the targets for restoration, and the recovery procedures are effective and efficient. As appropriate, the auditor should provide a report of the test results. All other choices are a responsibility of management.
NEW QUESTION 406
Which of the following is a detective control that can be used to uncover unauthorized access to information systems?
- A. Requiring long and complex passwords for system access
- B. Implementing a security information and event management (SIEM) system
- C. Requiring internal audit to perform penodic reviews of system access logs
- D. Protecting access to the data center with multif actor authentication
Answer: B
NEW QUESTION 407
When conducting a penetration test of an IT system, an organization should be MOST concerned with:
- A. restoring all systems to the original state.
- B. logging all changes made to the production system.
- C. finding all possible weaknesses on the system.
- D. the confidentiality of the report.
Answer: A
Explanation:
Explanation/Reference:
Explanation:
All suggested items should be considered by the system owner before agreeing to penetration tests, but the most important task is to be able to restore all systems to their original state.
Information that is created and/or stored on the tested systems should be removed from these systems. If for some reason, at the end of the penetration test, this is not possible, all files (with their location) should be identified in the technical report so that the client's technical staff will be able to remove these after the report has been received.
NEW QUESTION 408
An advantage in using a bottom-up vs. a top-down approach to software testing is that:
- A. major functions and processing are tested earlier.
- B. errors in critical modules are detected earlier.
- C. interface errors are detected earlier.
- D. confidence in the system is achieved earlier.
Answer: B
Explanation:
The bottom-up approach to software testing begins with the testing of atomic units, such as programs and modules, and works upward until a complete system testing has taken place. The advantages of using a bottom-up approach to software testing are the fact that there is no need for stubs or drivers and errors in critical modules are found earlier. The other choices in this question all refer to advantages of a top-down approach, which follows the opposite path, either in depth-first or breadth-first search order.
NEW QUESTION 409
Which of the following is MOST important to consider when assessing the scope of privacy concerns for an
IT project?
- A. Applicable laws and regulations
- B. Business requirements
- C. Classification of data
- D. End user access rights
Answer: A
Explanation:
Section: Governance and Management of IT
NEW QUESTION 410
IS management has recently disabled certain referential integrity controls in the database management system (DBMS) software to provide users increased query performance Which of the following controls win MOST effectively compensate for the lack of referential integrity?
- A. More frequent data backups
- B. Periodic table link checks
- C. Performance monitoring tools
- D. Concurrent access controls
Answer: B
NEW QUESTION 411
An IS auditor notes that several users have not logged into an application for more than one year. Which of the following would be the BEST audit recommendation?
- A. Update the termination procedures.
- B. Delete the affected users' IDs.
- C. Periodically review the information security policy.
- D. Periodically review user access.
Answer: D
Explanation:
Section: The process of Auditing Information System
NEW QUESTION 412
......
CISA Exam Dumps PDF Guaranteed Success with Accurate & Updated Questions: https://www.itexamreview.com/CISA-exam-dumps.html
CISA Dumps - Grab Out For [NEW-2021] ISACA Exam: https://drive.google.com/open?id=1SrAzeV0la4UeJXDJHNL2Um2VZ8PXTnzP
