Nov-2024 Latest TestPassed CISA Exam Dumps with PDF and Exam Engine Free Updated Today!
Following are some new CISA Real Exam Questions!
NEW QUESTION # 250
Which of the following encryption methods uses a matching pair of key-codes, securely distributed, which are used once-and-only-once to encode and decode a single message?
- A. Blowfish
- B. certificate
- C. Tripwire
- D. one-time pad
- E. DES
- F. None of the choices.
Answer: D
Explanation:
It's possible to protect messages in transit by means of cryptography. One method of encryption --the one-time pad --has been proven to be unbreakable when correctly used. This method uses a matching pair of key- codes, securely distributed, which are used once-and-only-once to encode and decode a single message. Note that this method is difficult to use securely, and is highly inconvenient as well.
NEW QUESTION # 251
An IS auditor is planning on utilizing attribute sampling to determine the error rate for health care claims processed. Which of the following factors will cause the sample size to decrease?
- A. Tolerable error rate increase
- B. Acceptable risk level decrease
- C. Population size increase
- D. Expected error rate increase
Answer: D
NEW QUESTION # 252
What is the GREATEST concern for an IS auditor reviewing contracts for licensed software that executes a critical business process?
- A. Software escrow was not negotiated.
- B. Several vendor deliverables missed the commitment date.
- C. The contract does not contain a right-to-audit clause.
- D. An operational level agreement (OLA) was not negotiated.
Answer: C
Explanation:
Section: Information System Operations, Maintenance and Support
NEW QUESTION # 253
In an environment that automatically reports all program changes, which of the following is the MOST efficient way to detect unauthorized changes to production programs?
- A. Manually comparing code in production programs to controlled copies
- B. Reviewing the last compile date of production programs
- C. Verifying user management approval of modifications
- D. Periodically running and reviewing test data against production programs
Answer: B
Explanation:
Reviewing the last compile date of production programs is the most efficient way to detect unauthorized changes to production programs, as it can quickly identify any discrepancies between the expected and actual dates of program modification. The last compile date is a timestamp that indicates when a program was last compiled or translated from source code to executable code. Any changes to the source code would require a recompilation, which would update the last compile date. The IS auditor can compare the last compile date of production programs with the authorized change requests and reports to verify that only approved changes were implemented. The other options are not as efficient as option A, as they are more time-consuming, labor-intensive or error-prone. Manually comparing code in production programs to controlled copies is a method of verifying that the code in production matches the code in a secure repository or library, but it requires access to both versions of code and a tool or technique to compare them line by line. Periodically running and reviewing test data against production programs is a method of verifying that the programs produce the expected outputs and results, but it requires designing, executing and evaluating test cases for each program. Verifying user management approval of modifications is a method of verifying that the changes to production programs were authorized and documented, but it does not ensure that the changes were implemented correctly or accurately. References: CISA Review Manual (Digital Version) , Chapter 4:
Information Systems Operations and Business Resilience, Section 4.3: Change Management Practices.
NEW QUESTION # 254
Which of the following audit procedures would be MOST conclusive in evaluating the effectiveness of an e-commerce application system's edit routine?
- A. Use of test transactions
- B. Review of source code
- C. Review of program documentation
- D. Interviews with knowledgeable users
Answer: B
NEW QUESTION # 255
Which of the following should be of GREATEST concern to an IS auditor when auditing an organization's information security awareness
- A. Security awareness training is not included as part of the on boarding process for new hires
- B. Security awareness training is run via the organization's enterprise wide e-learning portal
- C. The number of security incidents logged by employees to the help desk has increased in the past year
- D. Training quizzes are designed and run by a third party company under a contract with the organization
Answer: A
NEW QUESTION # 256
Which of the following is a ITU-T standard protocol suite for packet switched wide area network communication?
- A. Point-to-point protocol
- B. X.25
- C. Frame Relay
- D. ISDN
Answer: B
Explanation:
Explanation/Reference:
X.25 is an ITU-T standard protocol suite for packet switched wide area network (WAN) communication.X.25 is a packet switching technology which uses carrier switch to provide connectivity for many different networks.
For your exam you should know below information about WAN Technologies:
The following answers are incorrect:
Point-to-point protocol - PPP (Point-to-Point Protocol) is a protocol for communication between two computers using a serial interface, typically a personal computer connected by phone line to a server.
Frame Relay - The Frame relay cloud is the collection of DCE that provides that provides switching and data communication functionality. Frame relay is any to any service.
ISDN -Enables data, voice and other types of traffic to travel over a medium in a digital manner previously used only for analog voice transmission. Same copper telephone wire is used. Provide digital point-to-point circuit switching medium.
The following reference(s) were/was used to create this question:
CISA review manual 2014 page number 266
NEW QUESTION # 257
During a follow-up engagement, an IS auditor confirms evidence of a problem that was not an issue in the original audit. Which of the following is the auditor's BEST course of action?
- A. Report the risk to management in the follow-up report.
- B. Report only on the areas within the scope of the follow-up.
- C. Expand the follow-up scope to include examining the evidence.
- D. Include the evidence as part of a future audit.
Answer: A
NEW QUESTION # 258
The GREATEST benefit of using a polo typing approach in software development is that it helps to:
- A. conceptualize and clarify requirements.
- B. decrease the time allocated for user testing and review.
- C. Improve efficiency of quality assurance (QA) testing
- D. minimize scope changes to the system.
Answer: A
Explanation:
Explanation
The greatest benefit of using a prototyping approach in software development is that it helps to conceptualize and clarify requirements. A prototyping approach is a method of creating a simplified or partial version of a software product to demonstrate its features and functionality. A prototyping approach can help to elicit, validate, and refine the requirements of the software product, as well as to obtain feedback from the users and stakeholders. The other options are not the greatest benefits of using a prototyping approach, but rather possible outcomes or advantages of doing so. References:
CISA Review Manual (Digital Version), Chapter 4, Section 4.3.11
CISA Review Questions, Answers & Explanations Database, Question ID 227
NEW QUESTION # 259
Which of the following would be the FIRST step to help ensure the necessary regulatory requirements are addressed in an organization's cross-border data protection policy?
- A. Conduct a risk assessment
- B. Conduct stakeholder interviews
- C. Perform a gap analysis
- D. Perform a business impact analysis
Answer: C
Explanation:
Section: Protection of Information Assets
NEW QUESTION # 260
What method might an IS auditor utilize to test wireless security at branch office locations?
- A. War dialing
- B. Password cracking
- C. Social engineering
- D. War driving
Answer: D
Explanation:
War driving is a technique for locating and gaining access to wireless networks by driving or walking with a wireless equipped computer around a building. War dialing is a technique for gaining access to a computer or a network through the dialing of defined blocks of telephone numbers, with the hope of getting an answer from a modem. Social engineering is a technique used to gather information that can assist an attacker in gaining logical or physical access to data or resources. Social engineering exploits human weaknesses. Password crackers are tools used to guess users' passwords by trying combinations and dictionary words.
NEW QUESTION # 261
Retention periods and conditions for the destruction of personal data should be determined by the.
- A. privacy manager.
- B. risk manager.
- C. business owner.
- D. database administrator (DBA).
Answer: C
Explanation:
The business owner is the person or entity that has the authority and responsibility for defining the purpose and scope of the processing of personal data, as well as the expected outcomes and benefits. The business owner is also accountable for ensuring that the processing of personal data complies with the applicable laws and regulations, such as the General Data Protection Regulation (GDPR) or the Data Protection Act 2018 (DPA 2018).
One of the requirements of the GDPR and the DPA 2018 is to adhere to the principle of storage limitation, which states that personal data should be kept for no longer than is necessary for the purposes for which it is processed1. This means that the business owner should determine and justify how long they need to retain personal data, based on factors such as:
* The nature and sensitivity of the personal data
* The legal or contractual obligations or rights that apply to the personal data
* The business or operational needs and expectations that depend on the personal data
* The risks and impacts that may arise from retaining or deleting the personal data The business owner should also establish and document the conditions and methods for the destruction of personal data, such as:
* The criteria and triggers for deciding when to destroy personal data
* The procedures and tools for securely erasing or anonymising personal data
* The roles and responsibilities for carrying out and overseeing the destruction of personal data
* The records and reports for verifying and evidencing the destruction of personal data Therefore, retention periods and conditions for the destruction of personal data should be determined by the business owner, as they are in charge of defining and managing the processing of personal data, as well as ensuring its compliance with the law.
NEW QUESTION # 262
To properly evaluate the collective effect of preventative, detective, or corrective controls within a process, an IS auditor should be aware of which of the following? Choose the BEST answer.
- A. The point at which controls are exercised as data flows through the system
- B. The business objectives of the organization
- C. The effect of segregation of duties on internal controls
- D. Organizational control policies
Answer: A
Explanation:
Explanation/Reference:
When evaluating the collective effect of preventive, detective, or corrective controls within a process, an IS auditor should be aware of the point at which controls are exercised as data flows through the system.
NEW QUESTION # 263
An IS auditor is evaluating a virtual server environment and learns that the production server, development
server, and management console are housed in the same physical host. What should be the auditor's
PRIMARY concern?
- A. The development server and management console share the same host
- B. The physical host is a single point of failure
- C. The development and production servers share the same host
- D. The management console is a single point of failure
Answer: B
Explanation:
Section: The process of Auditing Information System
NEW QUESTION # 264
An IS auditor performing detailed network assessments and access control reviews should FIRST:
- A. assess users' identification and authorization.
- B. evaluate users' access authorization.
- C. determine the points of entry.
- D. evaluate the domain-controlling server configuration.
Answer: C
Explanation:
Explanation/Reference:
Explanation:
In performing detailed network assessments and access control reviews, an IS auditor should first determine the points of entry to the system and review the points of entry accordingly for appropriate controls. Evaluation of user access authorization, assessment of user identification and authorization, and evaluation of the domain-controlling server configuration are all implementation issues for appropriate controls for the points of entry.
NEW QUESTION # 265
......
Resources From:
- 2024 Latest TestPassed CISA Exam Dumps (PDF & Exam Engine) Free Share: https://www.testpassed.com/CISA-still-valid-exam.html
- 2024 Latest TestPassed CISA PDF and CISA Exam Dumps Free Share: https://drive.google.com/open?id=1AbL6IuYqQpX2Oa7wRf6CniI4510q8QQ2
Free Resources from TestPassed, We Devoted to Helping You 100% Pass All Exams!