Exact CISA Free Practice Questions 2019

Master the content and be ready for exam day success quickly with this . We guarantee it!We make it a reality and give you real in our Isaca CISA braindumps. Latest 100% VALID at below page. You can use our Isaca CISA braindumps and pass your exam.

Also have CISA free dumps questions for you:

Off-site data backup and storage should be geographically separated so as to ________________ (fill in the blank) the risk of a widespread physical disaster such as a hurricane or earthquake.

  • A. Accept
  • B. Eliminate
  • C. Transfer
  • D. Mitigate

Answer: D

Explanation: Off-site data backup and storage should be geographically separated, to mitigate the risk of a widespread physical disaster such as a hurricane or an earthquake.

An advantage of using sanitized live transactions in test data is that:

  • A. all transaction types will be include
  • B. every error condition is likely to be teste
  • C. no special routines are required to assess the result
  • D. test transactions are representative of live processin

Answer: D

Test data will be representative of live processing; however, it is unlikely that all transaction types or error conditions will be tested in this way.

Which of the following terms refers to systems designed to detect and prevent the unauthorized transmission of information from the computer systems of an organization to outsiders?

  • A. ILD&P
  • B. ICT&P
  • C. ILP&C
  • D. ILR&D
  • E. None of the choice

Answer: A

Information Leakage Detection and Prevention (ILD&P) is a computer security term referring to systems designed to detect and prevent the unauthorized transmission of information from the computer systems of an organization to outsiders. Network ILD&P are gateway-based systems installed on the organization's internet network connection and analyze network traffic to search for unauthorized information transmissions. Host Based ILD&P systems run on end-user workstations to monitor and control access to physical devices and access information before it has been encrypted.

In a small organization, an employee performs computer operations and, when the situation demands, program modifications. Which of the following should the IS auditor recommend?

  • A. Automated logging of changes to development libraries
  • B. Additional staff to provide separation of duties
  • C. Procedures that verify that only approved program changes are implemented
  • D. Access controls to prevent the operator from making program modifications

Answer: C

While it would be preferred that strict separation of duties be adhered to and that additional staff is recruited as suggested in choice B, this practice is not always possible in small organizations. An IS auditor must look at recommended alternative processes. Of the choices, C is the only practical one that has an impact. An IS auditor should recommend processes that detect changes to production source and object code, such as code comparisons, so the changes can be reviewed on a regular basis by a third party. This would be a compensating control process. Choice A, involving logging of changes to development libraries, would not detect changes to production libraries. Choice D is in effect requiring a third party to do the changes, which may not be practical in a small organization.

Which of the following uses a prototype that can be updated continually to meet changing user or business requirements?

  • A. PERT
  • B. Rapid application development (RAD)
  • C. Function point analysis (FPA)
  • D. GANTT

Answer: B

Explanation: Rapid application development (RAD) uses a prototype that can be updated continually to meet changing user or business requirements.

Which of the following should be a concern to an IS auditor reviewing a wireless network?

  • A. 128-bit static-key WEP (Wired Equivalent Privacy) encryption is enable
  • B. SSID (Service Set IDentifier) broadcasting has been enable
  • C. Antivirus software has been installed in all wireless client
  • D. MAC (Media Access Control) access control filtering has been deploye

Answer: B

SSID broadcasting allows a user to browse for available wireless networks and to access them without authorization. Choices A, C and D are used to strengthen a wireless network.

During a human resources (HR) audit, an IS auditor is informed that there is a verbal agreement between the IT and HR departments as to the level of IT services expected. In this situation, what should the IS auditor do FIRST?

  • A. Postpone the audit until the agreement is documented
  • B. Report the existence of the undocumented agreement to senior management
  • C. Confirm the content of the agreement with both departments
  • D. Draft a service level agreement (SLA) for the two departments

Answer: C

An IS auditor should first confirm and understand the current practice before making any recommendations. The agreement can be documented after it has been established that there is an agreement in place. The fact that there is not a written agreement does not justify postponing the audit, and reporting to senior management is not necessary at this stage of the audit. Drafting a service level agreement (SLA) is not the IS auditor's responsibility.

Which of the following provides the best evidence of the adequacy of a security awareness program?

  • A. The number of stakeholders including employees trained at various levels
  • B. Coverage of training at all locations across the enterprise
  • C. The implementation of security devices from different vendors
  • D. Periodic reviews and comparison with best practices

Answer: D

The adequacy of security awareness content can best be assessed by determining whether it is periodically reviewed and compared to industry best practices. Choices A, B and C provide metrics for measuring various aspects of a security awareness program, but do not help assess the content.

Which of the following antivirus software implementation strategies would be the MOST effective in an interconnected corporate network?

  • A. Server antivirus software
  • B. Virus walls
  • C. Workstation antivirus software
  • D. Virus signature updating

Answer: B

An important means of controlling the spread of viruses is to detect the virus at the point of entry, before it has an opportunity to cause damage. In an interconnected corporate network, virus scanning software, used as an integral part of firewall technologies, is referred to as a virus wall. Virus walls scan incoming traffic with the intent of detecting and removing viruses before they enter the protected network. The presence of virus walls does not preclude the necessity for installing virus detection software on servers and workstations within the network, but network-level protection is most effective the earlier the virus is detected. Virus signature updating is a must in all circumstances, networked or not.

Which of the following should an IS auditor review to understand project progress in terms of time, budget and deliverables for early detection of possible overruns and for projecting estimates at completion (EACs)?

  • A. Function point analysis
  • B. Earned value analysis
  • C. Cost budget
  • D. Program Evaluation and Review Technique

Answer: B

Earned value analysis (EVA) is an industry standard method for measuring a project's progress at any given point in time, forecasting its completion date and final cost, and analyzing variances in the schedule and budget as the project proceeds. It compares the planned amount of work with what has actually been completed, to determine if the cost, schedule and work accomplished are progressing in accordance with the plan. EVA works most effectively if a well-formed work breakdown structure exists. Function point analysis (FPA) is an indirect measure of software size and complexity and, therefore, does not address the elements of time and budget. Cost budgets do not address time. PERT aids in time and deliverables management, but lacks projections for estimates at completion (EACs) and overall financial management.

The reason for establishing a stop or freezing point on the design of a new system is to:

  • A. prevent further changes to a project in proces
  • B. indicate the point at which the design is to be complete
  • C. require that changes after that point be evaluated for cost-effectivenes
  • D. provide the project management team with more control over the project desig

Answer: C

Projects often have a tendency to expand, especially during the requirements definition phase. This expansion often grows to a point where the originally anticipated cost-benefits are diminished because the cost of the project has increased. When this occurs, it is recommended that the project be stopped or frozen to allow a review of all of the cost-benefits and the payback period.

Which of the following results in a denial-of-service attack?

  • A. Brute force attack
  • B. Ping of death
  • C. Leapfrog attack
  • D. Negative acknowledgement (NAK) attack

Answer: B

The use of Ping with a packet size higher than 65 KB and no fragmentation flag on will cause a denial of service. A brute force attack is typically a text attack that exhausts all possible key combinations. A leapfrog attack, the act of telneting through one or more hosts to preclude a trace, makes use of user ID and password information obtained illicitly from one host to compromise another host. A negative acknowledgement attack is a penetration technique that capitalizes on a potential weakness in an operating system that does not handle asynchronous interrupts properly, leaving the system in an unprotected state during such interrupts.

An IS auditor reviewing an organization that uses cross-training practices should assess the risk of:

  • A. dependency on a single perso
  • B. inadequate succession plannin
  • C. one person knowing all parts of a syste
  • D. a disruption of operation

Answer: C

Cross-training is a process of training more than one individual to perform a specific job or procedure. This practice helps decrease the dependence on a single person and assists in succession planning. This provides for the backup of personnel in the event of an absence and, thereby, provides for the continuity of operations. However, in using this approach, it is prudent to have first assessed the risk of any person knowing all parts of a system and the related potential exposures. Cross-training reduces the risks addressed in choices A, B and D.

IT operations for a large organization have been outsourced. An IS auditor reviewing the outsourced operation should be MOST concerned about which of the following findings?

  • A. The outsourcing contract does not cover disaster recovery for the outsourced IT operation
  • B. The service provider does not have incident handling procedure
  • C. Recently a corrupted database could not be recovered because of library management problem
  • D. incident logs are not being reviewe

Answer: A

The lack of a disaster recovery provision presents a major business risk. Incorporating such a provision into the contract will provide the outsourcing organization leverage over the service provider. Choices B, C and D are problems that should be addressed by the service provider, but are not as important as contract requirements for disaster recovery.

Integrating business continuity planning (BCP) into an IT project aids in:

  • A. the retrofitting of the business continuity requirement
  • B. the development of a more comprehensive set of requirement
  • C. the development of a transaction flowchar
  • D. ensuring the application meets the user's need

Answer: B

Integrating business continuity planning (BCP) into the development process ensures complete coverage of the requirements through each phase of the project. Retrofitting of the business continuity plan's requirements occurs when BCP is not integrating into the development methodology. Transaction flowcharts aid in analyzing an application's controls. A business continuity plan will not directly address the detailed processing needs of the users.

Is it appropriate for an IS auditor from a company that is considering outsourcing its IS processing to request and review a copy of each vendor's business continuity plan?

  • A. Yes, because an IS auditor will evaluate the adequacy of the service bureau's plan and assist their company in implementing a complementary pla
  • B. Yes, because based on the plan, an IS auditor will evaluate the financial stability of the service bureau and its ability to fulfill the contrac
  • C. No, because the backup to be provided should be specified adequately in the contrac
  • D. No, because the service bureau's business continuity plan is proprietary informatio

Answer: A

The primary responsibility of an IS auditor is to assure that the company assets are being safeguarded. This is true even if the assets do not reside on the immediate premises. Reputable service bureaus will have a well-designed and tested business continuity plan.

Which of the following is the MOST effective control over visitor access to a data center?

  • A. Visitors are escorte
  • B. Visitor badges are require
  • C. Visitors sign i
  • D. Visitors are spot-checked by operator

Answer: A

Escorting visitors will provide the best assurance that visitors have permission to access the data processing facility. Choices B and C are not reliable controls. Choice D is incorrect because visitors should be accompanied at all times while they are on the premises, not only when they are in the data processing facility.

During a disaster recovery test, an IS auditor observes that the performance of the
disaster recovery site's server is slow. To find the root cause of this, the IS auditor should FIRST review the:

  • A. event error log generated at the disaster recovery sit
  • B. disaster recovery test pla
  • C. disaster recovery plan (DRP).
  • D. configurations and alignment of the primary and disaster recovery site

Answer: D

Since the configuration of the system is the most probable cause, the IS auditor should review that first. If the issue cannot be clarified, the IS auditor should then review the event error log. The disaster recovery test plan and the disaster recovery plan (DRP) would not contain information about the system configuration.

P.S. DumpSolutions now are offering 100% pass ensure CISA dumps! All CISA exam questions have been updated with correct answers: https://www.dumpsolutions.com/CISA-dumps/ (1177 New Questions)