[Full-Version] 2022 New Prep4sures CISA PDF Recently Updated Questions
CISA Exam with Guarantee Updated 973 Questions
What Are Topics Tested in ISACA CISA Certification Exam?
The skills tested in the CISA exam include the following domains:
- Information Assets Protection (27%).
- Information Systems Implementation, Development, and Acquisition (12%);
- Business Resilience and Operation of Information Systems (23%);
- IT Governance and Management (17%);
- Auditing Process of Information System (21%);
The first topic is split into two parts. Therefore, candidates will need to demonstrate their skills in planning and executing the IS auditing process. The first subsection includes questions that will test the candidates' ability to manage IS audit standards, and apply the ISACA code of ethics. Also, they will need to show their experience in developing business processes and choose the right types of controls to improve business performance. Besides, they should be experts in risk-based audit planning and develop the right types of audits and assessments. The second subtopic focuses on concepts like audit project management and sampling methodology. Also, examinees should know how to audit evidence collection techniques and work with data analytics, as well as reporting and communication techniques.
Within the second domain, examinees will need to ensure IT governance and IT management. This means that they should be proficient in developing a coherent IT strategy and governance. Also, they should develop IT-related frameworks, standards, procedures, and policies. Candidates should be skilled in ensuring a correct organizational structure and enterprise architecture. They should also show maturity in handling enterprise risk management features and comply with the laws and the organization's standards. When it comes to IT management, applicants should know how to manage IT resources and manage IT service provider acquisition. Last but not least, they should ensure correct monitoring and reporting of IT performance and focus on IT quality assurance and management.
The third chapter focuses on information systems acquisition and development. Candidates should demonstrate their ability to govern and manage projects as well as develop a correct business case and feasibility analysis. Examinees will be required to answer questions related to system development methodologies and control design and identification features. The second subtopic included in this section handles Information Systems implementation. Thus, applicants will need to master testing methodologies and know how to configure and release the right management tools. Candidates should also focus on infrastructure deployment, data conversion, and system migration. The post-implementation review is also an important topic included here.
The fourth chapter concentrates on business resilience and information systems operations. Examinees will need to demonstrate how familiar they are with Business Impact Analysis, system resiliency, Business Continuity Plans, and Disaster Recovery Plans. These skills show the candidates' expertise in coming up with solutions that ensure business continuity in case something doesn't work as planned. This chapter also asks candidates to demonstrate that they know how to manage Common Technology components, master data governance, and end-user computing. Besides, they should be experienced in handling IT Service Level Agreements and Database Management. Applicants should also find the correct answer to questions related to Problem and Incident as well as Systems Performance Management.
The final topic handles information asset protection. Exam-takers should demonstrate that they understand how privacy principles work or if they are able to ensure network and end-point security. Also, they should be experienced in managing virtualization environments and work with Public Key Infrastructure. It is also essential that examinees understand how to manage Physical Access and Environmental controls as well as manage information asset security frameworks, guidelines, and standards. They should also know how to handle different security techniques dedicated to testing and monitoring. Besides, candidates should be proficient in managing incident response and handle evidence collection & forensics.
Protection of Information Assets
This objective has the highest percentage in the exam content, which means that you need to pay more attention to its components. The questions from this topic will measure your knowledge of the following:
- Security Event Management – security awareness programs and training; information system attack techniques; security testing tools and methods; security monitoring tools and methods; evidence collection and forensic; incident response management.
- Information asset security and control – privacy principles; data classification; virtual environments; information assets security frameworks, guidelines, and standards; identity & access management; public key infrastructure; data encryption & encryption-related methods; network & endpoint security; physical access & environmental controls;
You should also be ready that there will be about 39 supporting tasks that include various processes connected to the exam concepts. Therefore, it is important to master all the objectives.
Information Systems Acquisition, Development, & Implementation: This subject will measure the candidates’ skills in the following subtopics:
- Information system acquisition and development – project management and governance; control identification & design; system development methodologies; business case & feasibility analysis;
- Information systems implementation – testing methodologies; system migration, data conversion, and infrastructure deployment; post-implementation review.
NEW QUESTION 34
When evaluating the management practices at a third-party organization providing outsourced services, the IS auditor considers relying on an independent auditors report. The IS auditor would first
- A. discuss the report with the independent auditor
- B. review the objectives of the audit
- C. determine if recommendations have been implemented
- D. examine the independent auditor's workpapers.
Answer: B
NEW QUESTION 35
What is often assured through table link verification and reference checks?
- A. Database accuracy
- B. Database synchronization
- C. Database integrity
- D. Database normalcy
Answer: C
Explanation:
Explanation/Reference:
Database integrity is most often ensured through table link verification and reference checks.
NEW QUESTION 36
When identifying an earlier project completion time, which is to be obtained by paying a premium for early completion, the activities that should be selected are those:
- A. whose sum of activity time is the shortest.
- B. that have zero slack time.
- C. whose sum of slack time is the shortest.
- D. that give the longest possible completion time.
Answer: B
Explanation:
A critical path's activity time is longer than that for any other path through the network. This path is important because if everything goes as scheduled, its length gives the shortest possible completion time for the overall project. Activities onthe critical path become candidates for crashing, i.e., for reduction in their time by payment of a premium for early completion. Activities on the critical path have zero slack time and conversely, activities with zero slack time are on a critical path. By successively relaxing activities on a critical path, a curve showing total project costs vs. time can be obtained.
NEW QUESTION 37
When protecting the confidentiality of information assets, the MOST effective control practice is the:
- A. enforcement of a need-to-know access control philosophy.
- B. configuration of read-only access to all users.
- C. awareness training of personnel on regulatory requirements.
- D. utilization of a dual-factor authentication mechanism.
Answer: D
Explanation:
Section: Protection of Information Assets
NEW QUESTION 38
An IS auditor finds that the process for removing access for terminated employee is not documented. What is the MOST significant risk from this observation?
- A. Procedures may not align with the practices
- B. Unauthorized access cannot be identified
- C. HR records may not match system access
- D. Access rights may not be removed in a timely manner
Answer: D
NEW QUESTION 39
While reviewing sensitive electronic work papers, the IS auditor noticed that they were not encrypted. This could compromise the:
- A. access rights to the work papers.
- B. approval of the audit phases.
- C. confidentiality of the work papers.
- D. audit trail of the versioning of the work papers.
Answer: C
Explanation:
Explanation/Reference:
Explanation:
Encryption provides confidentiality for the electronic work papers. Audit trails, audit phase approvals and access to the work papers do not, of themselves, affect the confidentiality but are part of the reason for requiring encryption.
NEW QUESTION 40
Which of the following is the GREATEST advantage of elliptic curve encryption over RSA encryption?
- A. Computation speed
- B. Simpler key distribution
- C. Greater strength for a given key length
- D. Ability to support digital signatures
Answer: A
Explanation:
The main advantage of elliptic curve encryption over RSA encryption is its computation speed. This method was first independently suggested by Neal Koblitz and Victor S.
Miller. Both encryption methods support digital signatures and are used for public key encryption and distribution. However, a stronger key per se does not necessarily guarantee better performance, but rather the actual algorithm employed.
NEW QUESTION 41
During an external assessment of network vulnerability, which of the following activities should be performed FIRST?
- A. Implement an intrusion detection system (IDS).
- B. Review policies.
- C. Monitor the network.
- D. Collect network information.
Answer: C
NEW QUESTION 42
During the review of a web-based software development project, an IS auditor realizes that coding
standards are not enforced and code reviews are rarely carried out. This will MOST likely increase the
likelihood of a successful:
- A. war dialing attack.
- B. distributed denial-of-service attack.
- C. buffer overflow.
- D. brute force attack.
Answer: C
Explanation:
Section: Protection of Information Assets
Explanation:
Poorly written code, especially in web-based applications, is often exploited by hackers using buffer
overflow techniques. A brute force attack is used to crack passwords. A distributed denial- of-service attack
floods its target with numerous packets, to prevent it from responding to legitimate requests. War dialing
uses modem-scanning tools to hack PBXs.
NEW QUESTION 43
The GREATEST benefit in implementing an expert system is the:
- A. capturing of the knowledge and experience of individuals in an organization.
- B. enhancement of personnel productivity and performance.
- C. sharing of knowledge in a central repository.
- D. reduction of employee turnover in key departments.
Answer: A
Explanation:
The basis for an expert system is the capture and recording of the knowledge and experience of individuals in an organization. Coding and entering the knowledge in a central repository, shareable within the enterprise, is a means of facilitating the expert system. Enhancing personnel productivity and performance is a benefit; however, it is not as important as capturing the knowledge and experience. Employee turnover is not necessarily affected by an expert system.
NEW QUESTION 44
After identifying potential security vulnerabilities, what should be the IS auditor's next step?
- A. To immediately advise senior management of the findings
- B. To implement effective countermeasures and compensatory controls
- C. To perform a business impact analysis of the threats that would exploit the vulnerabilities
- D. To evaluate potential countermeasures and compensatory controls
Answer: C
Explanation:
Explanation/Reference:
Explanation:
After identifying potential security vulnerabilities, the IS auditor's next step is to perform a business impact analysis of the threats that would exploit the vulnerabilities.
NEW QUESTION 45
An IS auditor should know information about different network transmission media. Which of the following transmission media is used for short distance transmission?
- A. Fiber Optics
- B. Satellite Radio Link
- C. Copper cable
- D. Satellite Radio Link
Answer: C
Explanation:
Explanation/Reference:
Copper cable is very simple to install and easy to tap. It is used mostly for short distance and supports voice and data.
For your exam you should know below information about transmission media:
Copper Cable
Copper cable is very simple to install and easy to tap. It is used mostly for short distance and supports voice and data.
Copper has been used in electric wiring since the invention of the electromagnet and the telegraph in the
1820s.The invention of the telephone in 1876 created further demand for copper wire as an electrical conductor.
Copper is the electrical conductor in many categories of electrical wiring. Copper wire is used in power generation, power transmission, power distribution, telecommunications, electronics circuitry, and countless types of electrical equipment. Copper and its alloys are also used to make electrical contacts.
Electrical wiring in buildings is the most important market for the copper industry. Roughly half of all copper mined is used to manufacture electrical wire and cable conductors.
Copper Cable
Coaxial cable
Coaxial cable, or coax (pronounced 'ko.aks), is a type of cable that has an inner conductor surrounded by a tubular insulating layer, surrounded by a tubular conducting shield. Many coaxial cables also have an insulating outer sheath or jacket. The term coaxial comes from the inner conductor and the outer shield sharing a geometric axis. Coaxial cable was invented by English engineer and mathematician Oliver Heaviside, who patented the design in 1880.Coaxial cable differs from other shielded cable used for carrying lower-frequency signals, such as audio signals, in that the dimensions of the cable are controlled to give a precise, constant conductor spacing, which is needed for it to function efficiently as a radio frequency transmission line.
Coaxial cable is expensive and does not support many LAN's. It supports data and video.
Coaxial Cable
Fiber optics
An optical fiber cable is a cable containing one or more optical fibers that are used to carry light. The optical fiber elements are typically individually coated with plastic layers and contained in a protective tube suitable for the environment where the cable will be deployed. Different types of cable are used for different applications, for example long distance telecommunication, or providing a high-speed data connection between different parts of a building.
Fiber optics used for long distance, hard to splice, not vulnerable to cross talk and difficult to tap. It supports voice data, image and video.
Fiber Optics
Radio System
Radio systems are used for short distance, cheap and easy to intercept.
Radio is the radiation (wireless transmission) of electromagnetic signals through the atmosphere or free space.
Information, such as sound, is carried by systematically changing (modulating) some property of the radiated waves, such as their amplitude, frequency, phase, or pulse width. When radio waves strike an electrical conductor, the oscillating fields induce an alternating current in the conductor. The information in the waves can be extracted and transformed back into its original form.
Microwave radio system
Microwave transmission refers to the technology of transmitting information or energy by the use of radio waves whose wavelengths are conveniently measured in small numbers of centimeter; these are called microwaves.
Microwaves are widely used for point-to-point communications because their small wavelength allows conveniently-sized antennas to direct them in narrow beams, which can be pointed directly at the receiving antenna. This allows nearby microwave equipment to use the same frequencies without interfering with each other, as lower frequency radio waves do. Another advantage is that the high frequency of microwaves gives the microwave band a very large information-carrying capacity; the microwave band has a bandwidth 30 times that of all the rest of the radio spectrum below it. A disadvantage is that microwaves are limited to line of sight propagation; they cannot pass around hills or mountains as lower frequency radio waves can.
Microwave radio transmission is commonly used in point-to-point communication systems on the surface of the Earth, in satellite communications, and in deep space radio communications. Other parts of the microwave radio band are used for radars, radio navigation systems, sensor systems, and radio astronomy.
Microwave radio systems are carriers for voice data signal, cheap and easy to tap.
Microwave Radio System
Satellite Radio Link
Satellite radio is a radio service broadcast from satellites primarily to cars, with the signal broadcast nationwide, across a much wider geographical area than terrestrial radio stations. It is available by subscription, mostly commercial free, and offers subscribers more stations and a wider variety of programming options than terrestrial radio.
Satellite radio link uses transponder to send information and easy to intercept.
The following answers are incorrect:
Fiber optics - Fiber optics cables are used for long distance, hard to splice, not vulnerable to cross talk and difficult to tap. It supports voice data, image and video.
Radio System - Radio systems are used for short distance, cheap and easy to tap.
Satellite Radio Link - Satellite radio link uses transponder to send information and easy to tap.
The following reference(s) were/was used to create this question:
CISA review manual 2014 page number 265
NEW QUESTION 46
Which of the following would be the MOST useful metric for management to consider when reviewing a project portfolio?
- A. Cost of projects divided by total IT cost
- B. Total cost of each project
- C. Netpresent value (NPV) of the portfolio
- D. Expected return divided by total project cost
Answer: C
NEW QUESTION 47
Which of the following is the PRIMARY benefit of using a capability maturity model?
- A. It provides detailed changes management strategies for performance improvement.
- B. It helps the organization develop a roadmap toward its desired level of n each area
- C. It provides a way to compare against similar organizations' maturity levels
- D. It helps the organization estimate how long it will lake to reach the highest level of maturity in each area
Answer: B
NEW QUESTION 48
Which of the following is an advantage of asymmetric crypto system over symmetric key crypto system?
- A. Key Management is built in
- B. Number of keys grows very quickly
- C. Performance and Speed
- D. Adequate for Bulk encryption
Answer: A
Explanation:
Explanation/Reference:
Key management is better in asymmetric key encryption as compare to symmetric key encryption. In fact, there is no key management built within Symmetric Crypto systems. You must use the sneaker net or a trusted courier to exchange the key securely with the person you wish to communicate with.
Key management is the major issue and challenge in symmetric key encryption.
In symmetric key encryption, a symmetric key is shared between two users who wish to communicate together. As the number of users grows, the number of keys required also increases very rapidly.
For example, if a user wants to communicate with 5 different users then total number of different keys required by the user are 10. The formula for calculating total number of key required is n(n-1)/2Or total number of users times total of users minus one divided by 2.
Where n is number of users communicating with each others securely.
In an asymmetric key encryption, every user will have only two keys, also referred to as a Key Pair.
Private Key - Only known to the user who initially generated the key pair Public key - Known to everyone, can be distributed at large The following were incorrect answers:
Performance - Symmetric key encryption performance is better than asymmetric key encryption Bulk encryption - As symmetric key encryption gives better performance, symmetric key should be used for bulk data encryption Number of keys grows very quickly - The number of keys under asymmetric grows very nicely.1000 users would need a total of only 2000 keys, or a private and a public key for each user. Under symmetric encryption, one thousand users would need 495,000 keys to communicate securely with each others.
The following reference(s) were/was used to create this question:
CISA review manual 2014 Page number 348
NEW QUESTION 49
Which of the following is MOST effective in detecting an intrusion attempt?
- A. Using packer finer software
- B. Installing biometrics-based authentication
- C. Using smart cards with one-time passwords
- D. Analyzing system logs
Answer: D
NEW QUESTION 50
What benefit does using capacity-monitoring software to monitor usage patterns and trends provide to management?
- A. The software produces nice reports that really impress management.
- B. The software can dynamically readjust network traffic capabilities based upon current usage.
- C. It allows management to properly allocate resources and ensure continuous efficiency of operations.
- D. It allows users to properly allocate resources and ensure continuous efficiency of operations.
Answer: C
Explanation:
Explanation/Reference:
Explanation:
Using capacity-monitoring software to monitor usage patterns and trends enables management to properly allocate resources and ensure continuous efficiency of operations.
NEW QUESTION 51
Which of the following MOST effectively mitigates the risk of disclosure of sensitive data stored on company-owned smartphones?
- A. Secure containers
- B. Data leakage prevention (DLP) tools
- C. Physical device tagging
- D. Mobile device management (MDM)
Answer: B
NEW QUESTION 52
Which of the following establishes the role of the internal audit function?
- A. Audit project
- B. plan Audit charter
- C. Audit objectives
- D. Audit governance
Answer: B
NEW QUESTION 53
Which of the following procedures would MOST effectively detect the loading of illegal software packages onto a network?
- A. Policies that result in instant dismissal if violated
- B. The use of diskless workstations
- C. Periodic checking of hard drives
- D. The use of current antivirus software
Answer: C
Explanation:
Explanation/Reference:
Explanation:
The periodic checking of hard drives would be the most effective method of identifying illegal software packages loaded to the network. Antivirus software will not necessarily identify illegal software, unless the software contains a virus. Disk less workstations act as a preventive control and are not effective, since users could still download software from other than disk less workstations. Policies lay out the rules about loading the software, but will not detect the actual occurrence.
NEW QUESTION 54
......
Latest CISA Pass Guaranteed Exam Dumps Certification Sample Questions: https://www.prep4sures.top/CISA-exam-dumps-torrent.html
CISA Updated Exam Dumps [2022] Practice Valid Exam Dumps Question: https://drive.google.com/open?id=1Paq6DXy73BQDtrH6kQXHE8MLO0uFatwB