2023 Updated Verified CISA Downloadable Printable Exam Dumps
The Ultimate ISACA CISA Dumps PDF Review
Why to take ISACA CISA Certification?
There are various reasons you should consider ISACA CISA Certification. If you work in an IT security-related industry, earning this certification will show your employers that you have the skills necessary to help them grow their security programs successfully. With more than 40% of the global workforce using information technology, getting certified is critical for career advancement. Another renowned reason to get certified is if you're self-employed and want to market yourself as an experienced security consultant with verified credentials based on how much experience and knowledge they have. In most industries, IT security is a crucial department of expertise these days, and meeting the expectations of employers is instrumental for career advancement.
NEW QUESTION # 103
Which of the following must be in place before an IS auditor initiates audit follow-up activities?
- A. Supporting evidence for the gaps and recommendations mentioned in the audit report
- B. A heat map with the gaps and recommendations displayed in terms of risk
- C. Available resources for the activities included in the action plan
- D. A management response in the final report with a committed implementation date
Answer: D
NEW QUESTION # 104
Which of the following should be of concern to an IS auditor performing a software audit on virtual machines?
- A. Applications have not been approved by the CFO.
- B. Software licensing does not support virtual machines.
- C. Multiple users can access critical applications.
- D. Software has been installed on virtual machines by privileged users.
Answer: B
Explanation:
Section: The process of Auditing Information System
NEW QUESTION # 105
What is essential for the IS auditor to obtain a clear understanding of network management?
- A. A graphical map of the network topology
- B. Systems logs of all hosts providing application services
- C. Administrator access to systems
- D. Security administrator access to systems
Answer: A
Explanation:
Explanation/Reference:
Explanation:
A graphical interface to the map of the network topology is essential for the IS auditor to obtain a clear understanding of network management.
NEW QUESTION # 106
Which of the following is the KST source of information for assessing the effectiveness of IT process monitoring?
- A. Performance data
- B. Participative management techniques
- C. Real-time audit software
- D. Quality assurance (QA) reviews
Answer: A
NEW QUESTION # 107
An IS auditor has been asked to audit the proposed acquisition of new computer hardware. The auditor's PRIMARY concern Is that:
- A. the new hardware meets established security standards
- B. a full, visible audit trail will be Included.
- C. the implementation plan meets user requirements.
- D. a dear business case has been established.
Answer: D
NEW QUESTION # 108
An organization has recently incorporated robotic process automation (RPA) Which of the following should be of GREATEST concern to an IS auditor?
- A. A governance framework has not been Implemented
- B. A risk assessment has not been conducted
- C. Controls have not been tested
- D. A steering committee has not been established
Answer: C
NEW QUESTION # 109
As an outcome of information security governance, strategic alignment provides:
- A. an understanding of risk exposure.
- B. institutionalized and commoditized solutions.
- C. baseline security following best practices.
- D. security requirements driven by enterprise requirements.
Answer: D
Explanation:
Information security governance, when properly implemented, should provide four basic outcomes: strategic alignment, value delivery, risk management and performance measurement. Strategic alignment provides input for security requirements driven by enterprise requirements. Value delivery provides a standard set of security practices, i.e., baseline security following best practices or institutionalized and commoditized solutions. Risk management provides an understanding of risk exposure.
NEW QUESTION # 110
An IS auditor is reviewing an organization's incident management processes and procedures. Which of the following observations should be the auditor's GREATEST concern?
- A. Ineffective incident classification
- B. Ineffective incident prioritization
- C. Ineffective post-incident review
- D. Ineffective incident detection
Answer: D
Explanation:
Section: The process of Auditing Information System
NEW QUESTION # 111
When reviewing a digital certificate verification process, which of the following findings represents the MOST significant risk?
- A. The certificate revocation list (CRL) is not current.
- B. Digital certificates contain a public key that is used to encrypt messages and verify digital signatures.
- C. Subscribers report key compromises to the certificate authority (CA).
- D. There is no registration authority (RA) for reporting key compromises.
Answer: A
Explanation:
If the certificate revocation list (CRL) is not current, there could be a digital certificate that is not revoked that could be used for unauthorized or fraudulent activities. The certificate authority (CA) can assume the responsibility if there is no registration authority (RA). Digital certificates containing a public key that is used to encrypt messages and verifying digital signatures is not a risk. Subscribers reporting key compromises to the CA is not a risk since reporting this to the CA enables the CA to take appropriate action.
NEW QUESTION # 112
Which of the following BEST limits the impact of server failures in a distributed environment?
- A. Redundant pathways
- B. Dial backup lines
- C. Standby power
- D. Clustering
Answer: D
Explanation:
Section: Protection of Information Assets
Explanation:
Clustering allows two or more servers to work as a unit, so that when one of them fails, the other takes
over. Choices A and C are intended to minimize the impact of channel communications failures, but not a
server failure. Choice D provides an alternative power source in the event of an energy failure.
NEW QUESTION # 113
Which of the following type of network service maps Domain Names to network IP addresses or network IP addresses to Domain Names?
- A. Directory Service
- B. DNS
- C. Network Management
- D. DHCP
Answer: B
Explanation:
Explanation/Reference:
Domain Name System(DNS) - Translates the names of network nodes into network IP address.
For your exam you should know below information about network services:
In computer networking, a network service is an application running at the network application layer and above, that provides data storage, manipulation, presentation, communication or other capability which is often implemented using a client-server or peer-to-peer architecture based on application layer network protocols.
Each service is usually provided by a server component running on one or more computers (often a dedicated server computer offering multiple services) and accessed via a network by client components running on other devices. However, the client and server components can both be run on the same machine.
Clients and servers will often have a user interface, and sometimes other hardware associated with them.
Different types of network services are as follows:
Network File System - Network File System (NFS) is a distributed file system protocol originally developed by Sun Microsystems in 1984, allowing a user on a client computer to access files over a network much like local storage is accessed.
Remote Access Service - Remote Access Services (RAS) refers to any combination of hardware and software to enable the remote access tools or information that typically reside on a network of IT devices.
Directory Services - A directory service is the software system that stores, organizes and provides access to information in a directory. In software engineering, a directory is a map between names and values. It allows the lookup of values given a name, similar to a dictionary. As a word in a dictionary may have multiple definitions, in a directory, a name may be associated with multiple, different pieces of information.
Likewise, as a word may have different parts of speech and different definitions, a name in a directory may have many different types of data.
Network Management - In computer networks, network management refers to the activities, methods, procedures, and tools that pertain to the operation, administration, maintenance, and provisioning of networked systems. Network management is essential to command and control practices and is generally carried out of a network operations center.
Dynamic Host Configuration Protocol (DHCP) - The Dynamic Host Configuration Protocol (DHCP) is a standardized networking protocol used on Internet Protocol (IP) networks for dynamically distributing network configuration parameters, such as IP addresses for interfaces and services. With DHCP, computers request IP addresses and networking parameters automatically from a DHCP server, reducing the need for a network administrator or a user to configure these settings manually.
Email service - Provides the ability, through a terminal or PC connected to a communication network, to send an entrusted message to another individual or group of people.
Print Services - Provide the ability, typically through a print server on a network, to manage and execute print request services from other devices on the network Domain Name System(DNS) - Translates the names of network nodes into network IP address.
The following were incorrect answers:
Dynamic Host Configuration Protocol (DHCP) - The Dynamic Host Configuration Protocol (DHCP) is a standardized networking protocol used on Internet Protocol (IP) networks for dynamically distributing network configuration parameters, such as IP addresses for interfaces and services. With DHCP, computers request IP addresses and networking parameters automatically from a DHCP server, reducing the need for a network administrator or a user to configure these settings manually.
Directory Services - A directory service is the software system that stores, organizes and provides access to information in a directory. In software engineering, a directory is a map between names and values. It allows the lookup of values given a name, similar to a dictionary. As a word in a dictionary may have multiple definitions, in a directory, a name may be associated with multiple, different pieces of information.
Likewise, as a word may have different parts of speech and different definitions, a name in a directory may have many different types of data.
Network Management - In computer networks, network management refers to the activities, methods, procedures, and tools that pertain to the operation, administration, maintenance, and provisioning of networked systems. Network management is essential to command and control practices and is generally carried out of a network operations center.
The following reference(s) were/was used to create this question:
CISA review manual 2014 Page number 258
NEW QUESTION # 114
In an IT organization where many responsibilities are shared which of the following is the BEST control for detecting unauthorized data changes'?
- A. Users are required to periodically rotate responsibilities
- B. Data changes are independently reviewed by another group
- C. Data changes are logged in an outside application
- D. Segregation of duties conflicts are periodically reviewed
Answer: B
NEW QUESTION # 115
Which of the following should be the MOST important consideration in IT portfolio management?
- A. Determining the opportunity cost of IT investment projects
- B. Increasing the budget and resources allocated for IT investments
- C. Selecting IT investment projects that align with corporate strategy
- D. Aligning IT portfolio processes with corporate objectives
Answer: D
Explanation:
Section: Information System Operations, Maintenance and Support
NEW QUESTION # 116
Which of the following is the MOST important prerequisite for implementing a data loss prevention (DLP) tool?
- A. Requiring users to save files in secured folders instead of a company-wide shared drive
- B. Developing a DLP policy and requiring signed acknowledgment by users
- C. Identifying where existing data resides and establishing a data classification matrix
- D. Reviewing data transfer logs to determine historical patterns of data flow
Answer: C
NEW QUESTION # 117
Which of the following mechanisms for process improvement involves examination of industry best practice?
- A. Continuous improvement
- B. Knowledge management
- C. Benchmarking
D18912E1457D5D1DDCBD40AB3BF70D5D - D. Business process reengineering (BPR)
Answer: C
NEW QUESTION # 118
In the case of a disaster where the data center is no longer available which of the following tasks should be done FIRST?
- A. Arrange for a secondary site
- B. Analyze risk
- C. Activate the call tree
- D. Perform data recovery
Answer: C
NEW QUESTION # 119
Which of the following intrusion detection systems (IDSs) monitors the general patterns of activity and
traffic on a network and creates a database?
- A. Host-based
- B. Neural networks-based
- C. Statistical-based
- D. Signature-based
Answer: B
Explanation:
Section: Protection of Information Assets
Explanation:
The neural networks-based IDS monitors the general patterns of activity and traffic on the network and
creates a database. This is similar to the statistical model but has the added function of self-learning.
Signature-based systems are a type of IDS in which the intrusive patterns identified are stored in the form
of signatures. These IDS systems protect against detected intrusion patterns. Statistical-based systems
need a comprehensive definition of the known and expected behavior of systems. Host-based systems are
not a type of IDS, but a category of IDS, and are configured for a specific environment. They will monitor
various internal resources of the operating system to warn of a possible attack.
NEW QUESTION # 120
......
Achive your Success with Latest CISA Exam: https://www.prep4away.com/ISACA-certification/braindumps.CISA.ete.file.html
Achieve The Utmost Performance In CISA Exam Pass Guaranteed: https://drive.google.com/open?id=1M6e0skT5XvDglGPbR7idZonXg1P5un7G