[Aug-2021] CISA Pre-Exam Practice Tests | Exam Questions and Answers for Isaca Certification Study Guide
Certified Information Systems Auditor Certification Sample Questions
NEW QUESTION 245
Which of the following represents the GREATEST potential risk in an EDI environment?
- A. Transmission delay
- B. Transaction authorization
- C. Deletion or manipulation of transactions prior to or after establishment of application controls
- D. Loss or duplication of EDI transmissions
Answer: B
Explanation:
Section: Protection of Information Assets
Explanation:
Since the interaction between parties is electronic, there is no inherent authentication occurring; therefore,
transaction authorization is the greatest risk. Choices B and D are examples of risks, but the impact is not
as great as that of unauthorized transactions. Transmission delays may terminate the process or hold the
line until the normal time for processing has elapsed; however, there will be no loss of data.
NEW QUESTION 246
What should an IS auditor do when informed that some recommendations cannot be implemented due to financial constraints?
- A. Document management's response in the working papers.
- B. Agree to waive the recommendations.
- C. Suggest management identify cost-effective alternatives.
- D. Insist the recommendations be implemented.
Answer: A
NEW QUESTION 247
Which of the following controls will MOST effectively detect the presence of bursts of errors in network transmissions?
- A. Parity check
- B. Cyclic redundancy check
- C. Echo check
- D. Block sum check
Answer: B
Explanation:
The cyclic redundancy check (CRC) can check for a block of transmitted datA . The workstations generate the CRC and transmit it with the datA . The receiving workstation computes a CRC and compares it to the transmitted CRC. if both of them are equal.then the block is assumed error free, in this case (such as in parity error or echo check), multiple errors can be detected. In general, CRC can detect all single-bit and bubble-bit errors. Parity check (known as vertical redundancy check) also involves adding a bit (known as the parity bit) to each character during transmission. In this case, where there is a presence of bursts of errors (i.e., impulsing noise during high transmission rates), it has a reliability of approximately 50 percent. Inhigher transmission rates, this limitation is significant. Echo checks detect line errors by retransmitting data to the sending
device for comparison with the original transmission.
NEW QUESTION 248
Business process re-engineering often results in ______________ automation, which results in
_____________ number of people using technology. Fill in the blanks.
- A. Increased; a greater
- B. Less; a fewer
- C. Increased; the same
- D. Increased; a fewer
Answer: A
Explanation:
Explanation/Reference:
Business process re-engineering often results in increased automation, which results in a greater number of people using technology.
NEW QUESTION 249
An IS auditor conducting audit follow-up activities learns that some previously agreed-upon corrective
actions have not been taken and that the associated risk has been accepted by senior management. If the
auditor disagrees with management's decision, what is the BEST way to address the situation?
- A. Repeat the audit with audit scope only covering areas with accepted risks
- B. Report the issue to the chief audit executive for resolution
- C. Take no action since management's decision has been made
- D. Recommend new corrective actions to mitigate the accepted risk
Answer: B
Explanation:
Section: The process of Auditing Information System
NEW QUESTION 250
Which of the following methods of suppressing a fire in a data center is the MOST effective and environmentally friendly?
- A. Carbon dioxide gas
- B. Wet-pipe sprinklers
- C. Dry-pipe sprinklers
- D. Halon gas
Answer: C
Explanation:
Section: Protection of Information Assets
Explanation:
Water sprinklers, with an automatic power shutoff system, are accepted as efficient because they can be set to automatic release without threat to life, and water is environmentally friendly.
Sprinklers must be dry-pipe to prevent the risk of leakage. Halon is efficient and effective as it does not threaten human life and, therefore, can be set to automatic release, but it is environmentally damaging and very expensive. Water is an acceptable medium but the pipes should be empty to avoid leakage, so a full system is not a viable option. Carbon dioxide is accepted as an environmentally acceptable gas, but it is less efficient because it cannot be set to automatic release in a staffed site since it threatens life.
NEW QUESTION 251
Which of the following statement INCORRECTLY describes Asynchronous Transfer Mode (ATM) technique?
- A. ATM is high speed network technology used for LAN, MAN and WAN
- B. Data are segmented into fixed size cell of 53 bytes
- C. ATM works at session layer of an OSI model
- D. ATM uses cell switching method
Answer: C
Explanation:
Section: Information System Operations, Maintenance and Support
Explanation:
The keyword INCORRECTLY is used within the question. You need to find out a statement which was incorrectly describe Asynchronous Transfer Mode.ATM operates at data link layer of an OSI model For your exam you should know below information about WAN Technologies:
Point-to-point protocol
PPP (Point-to-Point Protocol) is a protocol for communication between two computers using a serial interface, typically a personal computer connected by phone line to a server. For example, your Internet server provider may provide you with a PPP connection so that the provider's server can respond to your requests, pass them on to the Internet, and forward your requested Internet responses back to you. PPP uses the Internet protocol (IP) (and is designed to handle others). It is sometimes considered a member of the TCP/IP suite of protocols. Relative to the Open Systems Interconnection (OSI) reference model, PPP provides layer 2 (data-link layer) service. Essentially, it packages your computer's TCP/IP packets and forwards them to the server where they can actually be put on the Internet.
PPP is a full-duplex protocol that can be used on various physical media, including twisted pair or fiber optic lines or satellite transmission. It uses a variation of High Speed Data Link Control (HDLC) for packet encapsulation.
PPP is usually preferred over the earlier de facto standard Serial Line Internet Protocol (SLIP) because it can handle synchronous as well as asynchronous communication. PPP can share a line with other users and it has error detection that SLIP lacks. Where a choice is possible, PPP is preferred.
Point-to-point protocol
X.25
X.25 is an ITU-T standard protocol suite for packet switched wide area network (WAN) communication.
X.25 is a packet switching technology which uses carrier switch to provide connectivity for many different networks.
Subscribers are charged based on amount of bandwidth they use. Data are divided into 128 bytes and encapsulated in High Level Data Link Control (HDLC).
X.25 works at network and data link layer of an OSI model.
X.25
Frame Relay
Works on a packet switching
Operates at data link layer of an OSI model
Companies that pay more to ensure that a higher level of bandwidth will always be available, pay a committed information rate or CIR Two main types of equipment's are used in Frame Relay
1. Data Terminal Equipment (DTE) - Usually a customer owned device that provides a connectivity between company's own network and the frame relay's network.
2. Data Circuit Terminal Equipment (DCE) - Service provider device that does the actual data transmission and switching in the frame relay cloud.
The Frame relay cloud is the collection of DCE that provides that provides switching and data communication functionality. Frame relay is any to any service.
Frame Relay
Integrated Service Digital Network
Enables data, voice and other types of traffic to travel over a medium in a digital manner previously used only for analog voice transmission.
Same copper telephone wire is used.
Provide digital point-to-point circuit switching medium.
ISDN
Asynchronous Transfer Mode (ATM)
Uses Cell switching method
High speed network technology used for LAN, MAN and WAN
Like a frame relay it is connection oriented technology which creates and uses fixed channel Data are segmented into fixed size cell of 53 bytes Some companies have replaces FDDI back-end with ATM
Asynchronous Transfer Mode
Multiprotocol Label Switching (MPLS)
Multiprotocol Label Switching (MPLS) is a standards-approved technology for speeding up network traffic flow and making it easier to manage. MPLS involves setting up a specific path for a given sequence of packets, identified by a label put in each packet, thus saving the time needed for a router to look up the address to the next node to forward the packet to. MPLS is called multiprotocol because it works with the Internet Protocol (IP), Asynchronous Transport Mode (ATM), and frame relay network protocols. With reference to the standard model for a network (the Open Systems Interconnection, or OSI model), MPLS allows most packets to be forwarded at the Layer 2 (switching) level rather than at the Layer 3 (routing) level. In addition to moving traffic faster overall, MPLS makes it easy to manage a network for quality of service (QoS). For these reasons, the technique is expected to be readily adopted as networks begin to carry more and different mixtures of traffic.
MPLS
The following answers are incorrect:
The other options presented correctly describes Asynchronous Transfer Mode.
Reference:
CISA review manual 2014 page number 266
NEW QUESTION 252
Which of the following is the BEST sampling method to use when estimating the rate of occurrence of a specific quality in a population?
- A. Attribute sampling
- B. Stop-or-go sampling
- C. Statistical sampling
- D. Discovery sampling
Answer: A
Explanation:
Section: Information System Operations, Maintenance and Support
NEW QUESTION 253
An organization is considering replacing physical backup tapes stored offsite with real-time on-line backup to a storage area network (SAN) located in the primary data center. Which of the following is the GREATEST risk?
- A. Implementation could cause significant cost increases
- B. Backups may require excessive storage space
- C. A single disaster could cause significant data loss
- D. Archived data may not satisfy data retention requirements
Answer: C
Explanation:
Section: Information System Operations, Maintenance and Support
NEW QUESTION 254
Which of the following attack involves sending forged ICMP Echo Request packets to the broadcast address on multiple gateways in order to illicit responses from the computers behind the gateway where they all respond back with ICMP Echo Reply packets to the source IP address of the ICMP Echo Request packets?
- A. Brute force attack
- B. Buffer overflow
- C. Pulsing Zombie
- D. Reflected attack
Answer: D
Explanation:
Explanation/Reference:
Reflected attack involves sending forged requests to a large number of computers that will reply to the requests. The source IP address is spoofed to that of the targeted victim, causing replies to flood.
A distributed denial of service attack may involve sending forged requests of some type to a very large number of computers that will reply to the requests. Using Internet Protocol address spoofing, the source address is set to that of the targeted victim, which means all the replies will go to (and flood) the target.
(This reflected attack form is sometimes called a "DRDOS".
ICMP Echo Request attacks (Smurf Attack) can be considered one form of reflected attack, as the flooding host(s) send Echo Requests to the broadcast addresses of mix-configured networks, thereby enticing hosts to send Echo Reply packets to the victim. Some early DDoS programs implemented a distributed form of this attack.
In the surf attack, the attacker sends an ICMP ECHO REQUEST packet with a spoofed source address to a victim's network broadcast address. This means that each system on the victim's subnet receives an ICMP ECHO REQUEST packet. Each system then replies to that request with an ICMP ECHO REPLY packet to the spoof address provided in the packets-which is the victim's address. All of these response packets go to the victim system and overwhelm it because it is being bombarded with packets it does not necessarily know how to process. The victim system may freeze, crash, or reboot. The Smurf attack is illustrated in Figure below:
surf-attack
Image reference - http://resources.infosecinstitute.com/wp-content/
uploads/012813_1439_HaveYouEver2.png
The following answers are incorrect:
Brute force attack - Brute force (also known as brute force cracking) is a trial and error method used by application programs to decode encrypted data such as passwords or Data Encryption Standard (DES) keys, through exhaustive effort (using brute force) rather than employing intellectual strategies. Just as a criminal might break into, or "crack" a safe by trying many possible combinations, a brute force cracking application proceeds through all possible combinations of legal characters in sequence. Brute force is considered to be an infallible, although time-consuming, approach.
Buffer overflow - A buffer overflow occurs when a program or process tries to store more data in a buffer (temporary data storage area) than it was intended to hold. Since buffers are created to contain a finite amount of data, the extra information - which has to go somewhere - can overflow into adjacent buffers, corrupting or overwriting the valid data held in them. Although it may occur accidentally through programming error, buffer overflow is an increasingly common type of security attack on data integrity.
Pulsing Zombie - A Dos attack in which a network is subjected to hostile pinging by different attacker computer over an extended time period.
Following reference(s) were/was used to create this question:
CISA review manual 2014 Page number 322
NEW QUESTION 255
Which of the following is the BEST information source for management to use as an aid in the identification of assets that are subject to laws and regulations?
- A. Vendor best practices
- B. CERT coordination center
- C. Security incident summaries
- D. Significant contracts
Answer: D
Explanation:
Contractual requirements are one of the sources that should be consulted to identify the requirements for the management of information assets. Vendor best practices provides a basis for evaluating how competitive an enterprise is, while security incident summaries are a source for assessing the vulnerabilities associated with the IT infrastructure. CERT {www.cert.org) is an information source for assessing vulnerabilities within the IT infrastructure.
NEW QUESTION 256
Within a virus, which component is responsible for what the virus does to the victim file?
- A. None of the choices.
- B. the premium
- C. the trigger
- D. the signature
- E. the payload
Answer: E
Explanation:
Explanation/Reference:
Explanation:
A virus typically consist of three parts, which are a mechanism that allows them to infect other files and reproduce a trigger that activates delivery of a ""payload"" and the payload from which the virus often gets its name. The payload is what the virus does to the victim file.
NEW QUESTION 257
An IS auditor performing a review of an application's controls would evaluate the:
- A. business processes served by the application.
- B. application's optimization.
- C. efficiency of the application in meeting the business processes.
- D. impact of any exposures discovered.
Answer: D
Explanation:
Section: Protection of Information Assets
Explanation:
An application control review involves the evaluation of the application's automated controls and an assessment of any exposures resulting from the control weaknesses. The other choices may be objectives of an application audit but are not part of an audit restricted to a review of controls.
NEW QUESTION 258
Which of the following technique is NOT used by a preacher against a Private Branch Exchange (PBX)?
- A. Eavesdropping
- B. SYN Flood
- C. Illegal call forwarding
- D. Forwarding a user's to an unused or disabled number
Answer: B
Explanation:
Explanation/Reference:
The word NOT the keyword used in the question. You need to find out the technique which preacher do not use to exploit PBX.
SYN Flood -Sends a flood of TCP/SYN packets with forged sender address, causing half-open connections and saturates available connection capacity on the target machine.
For CISA Exam you should know below mentioned techniques used by preacher for illegal purpose of PBX.
Eavesdropping on conversation, without the other parties being aware of it Eavesdropping on conference call
Illegal forwarding calls from specific equipment to remote numbers
Forwarding a user's to an unused or disabled number, thereby making it unreachable by external calls.
The following were incorrect answers:
The other options presented correctly describes the techniques used preacher for illegal purpose of PBX.
The following reference(s) were/was used to create this question:
CISA review manual 2014 Page number 357
NEW QUESTION 259
Which of the following documents would be MOST useful in detecting a weakness in segregation of duties?
- A. Systems flowchart
- B. Entity-relationship diagram
- C. Data flow diagram
- D. Process flowchart
Answer: D
Explanation:
Section: Information System Operations, Maintenance and Support
NEW QUESTION 260
Hamid needs to shift users from using the application from the existing (Old) system to the replacing (new)
system. His manager Lily has suggested he uses an approach in which the newer system is changed over
from the older system on a cutoff date and time and the older system is discontinued once the changeover
to the new system takes place. Which of the following changeover approach is suggested by Lily?
- A. Pilot changeover
- B. Abrupt changeover
- C. Parallel changeover
- D. Phased changeover
Answer: B
Explanation:
Section: Information System Acquisition, Development and Implementation
Explanation/Reference:
In the abrupt changeover approach the newer system is changed over from the older system on a cutoff
date and time, and the older system is discontinued once changeover to the new system takes place.
Changeover refers to an approach to shift users from using the application from the existing (old) system to
the replacing (new) system.
Changeover to newer system involves four major steps or activities
Conversion of files and programs; test running on test bed
Installation of new hardware, operating system, application system and the migrated data.
Training employees or user in groups
Scheduling operations and test running for go-live or changeover
Some of the risk areas related to changeover includes:
Asset safeguarding
Data integrity
System effectiveness
Change management challenges
Duplicate or missing records
The following were incorrect answers:
Parallel changeover - This technique includes running the old system, then running both the old and new
systems in parallel and finally full changing over to the new system after gaining confidence in the working
of new system.
Phased Changeover -In this approach the older system is broken into deliverables modules. Initially, the
first module of older system is phased out using the first module of a new system. Then, the second
module of the newer system is phased out, using the second module of the newer system and so forth until
reaching the last module.
Pilot changeover - Not a valid changeover type.
The following reference(s) were/was used to create this question:
CISA review manual 2014 Page number 172
NEW QUESTION 261
Which of the following is the BEST way to mitigate the impact of ransomware attacks?
- A. Backing up data frequently
- B. Invoking the disaster recovery plan (DRP)
- C. Paying the ransom
- D. Requiring password changes for administrative accounts
Answer: A
NEW QUESTION 262
Which of the following is MOST important for an organization to complete when planning a new marketing
platform that targets advertising based on customer behavior?
- A. Security vulnerability assessment
- B. Data privacy impact assessment
- C. Cross-border data transfer assessment
- D. Data quality assessment
Answer: B
Explanation:
Section: Information System Acquisition, Development and Implementation
NEW QUESTION 263
An IS auditor has discovered that a cloud-based application was not included in an application inventory that was used to confirm the scope of an audit. The business process owner explained that the application will be audited by a third party in the next year. The auditor's NEXT step should be to:
- A. Report the control deficiency to senior management
- B. Review the audit report when performed by the third party
- C. Revise the audit scope to include the cloud-based application
- D. Evaluate the impact of the cloud application on the audit scope
Answer: A
NEW QUESTION 264
IS management has decided to rewrite a legacy customer relations system using fourth generation languages (4GLs). Which of the following risks is MOST often associated with system development using 4GLs?
- A. Inability to perform data intensive operations
- B. Lack of portability across operating systems
- C. Complex programming language subsets
- D. Inadequate screen/report design facilities
Answer: A
Explanation:
4GLs are usually not suitable for data intensive operations. Instead, they are used mainly for graphic user interface (GUI) design or as simple query/report generators.
NEW QUESTION 265
In a client-server system, which of the following control techniques is used to inspect activity from known or unknown users?
- A. Data encryption techniques
- B. Authentication systems
- C. Network monitoring devices
- D. Diskless workstations
Answer: C
Explanation:
Network monitoring devices may be used to inspect activities from known or unknown users and can identify client addresses, which may assist in finding evidence of unauthorized access. This serves as a detective control. Diskless workstations preventaccess control software from being bypassed. Data encryption techniques can help protect sensitive or propriety data from unauthorized access, thereby serving as a preventive control. Authentication systems may provide environmentwide , logical facilities that can differentiate among users, before providing access to systems.
NEW QUESTION 266
Which of the following testing procedure is used by the auditor during accounting audit to check errors in balance sheet and other financial documentation?
- A. Sanity testing
- B. Recovery testing
- C. Compliance testing
- D. Substantive testing
Answer: D
Explanation:
Section: The process of Auditing Information System
Explanation:
A procedure used during accounting audits to check for errors in balance sheets and other financial documentation. A substantive test might involve checking a random sample of transactions for errors, comparing account balances to find discrepancies, or analysis and review of procedures used to execute and record transactions.
Substantive testing is the stage of an audit when the auditor gathers evidence as to the extent of misstatements in client's accounting records or other information. This evidence is referred to as substantive evidence and is an important factor in determining the auditor's opinion on the financial statements as a whole. The audit procedures used to gather this evidence are referred to as substantive procedures, or substantive tests.
Substantive procedures (or substantive tests) are those activities performed by the auditor during the substantive testing stage of the audit that gather evidence as to the completeness, validity and/or accuracy of account balances and underlying classes of transactions.
Account balances and underlying classes of transaction must not contain any material misstatements. They must be materially complete, valid and accurate. Auditors gather evidence about these assertions by undertaking substantive procedures, which may include:
Physically examining inventory on balance date as evidence that inventory shown in the accounting records actually exists (validity assertion); Arranging for suppliers to confirm in writing the details of the amount owing at balance date as evidence that accounts payable is complete (completeness assertion); and Making inquiries of management about the collectability of customers' accounts as evidence that trade debtors is accurate as to its valuation.
Evidence that an account balance or class of transaction is not complete, valid or accurate is evidence of a substantive misstatement.
The following answers are incorrect:
Compliance Testing - Compliance testing is basically an audit of a system carried out against a known criterion.
Sanity testing - Testing to determine if a new software version is performing well enough to accept it for a major testing effort. If application is crashing for initial use, then system is not stable enough for further testing and build or application is assigned to fix.
Recovery testing - Testing how well a system recovers from crashes, hardware failures, or other catastrophic problems.
Reference:
CISA review manual 2014 page number 52 and 53
http://www.businessdictionary.com/definition/compliance-test.html
NEW QUESTION 267
Which of the following is the BEST audit procedure to determine if a firewall is configured in compliance with an organization's security policy?
- A. Review the device's log file for recent attacks.
- B. Review the parameter settings.
- C. Review the actual procedures.
- D. Interview the firewall administrator.
Answer: B
Explanation:
A review of the parameter settings will provide a good basis for comparison of the actual configuration to the security policy and will provide audit evidence documentation. The other choices do not provide audit evidence as strong as choice A.
NEW QUESTION 268
Which of the following is the PRIMARY objective of implementing privacy-related controls within an organization"?
- A. To comply with legal and regulatory requirements
- B. To prevent confidential data loss
- C. To identify data at rest and data in transit for encryption
- D. To provide options to individuals regarding use of their data
Answer: D
NEW QUESTION 269
Many servers in a data center are not being utilized to their full capacity Which of the following is the MOST appropriate option for a feasibility study?
- A. Storage area networks (SAN)
- B. Server inventory review
- C. Cloud computing
- D. Server consolidation
Answer: D
NEW QUESTION 270
......
ISACA Exam Practice Test To Gain Brilliante Result: https://www.examslabs.com/ISACA/Isaca-Certification/best-CISA-exam-dumps.html
Tested Material Used To CISA: https://drive.google.com/open?id=1igQ_KYNovBWVft0z24X-32oahXaADt-K