最新のCISA問題集PDFでCISAリアルで有効な正確な問題集は500問題と解答が待ってます！ [Q99-Q116]

4.5/5 - (2 votes)

最新のCISA問題集PDFでCISAリアルで有効な正確な問題集は500問題と解答が待ってます！

100%無料CISA試験問題集リアルCertified Information Systems Auditor問題集を試そう

ISACA CISA 認定試験の出題範囲：

トピック	出題範囲
トピック 1	情報システム運用とビジネスレジリエンス
トピック 2	情報システムの取得、開発、実装
トピック 3	情報システム監査プロセス
トピック 4	情報および関連テクノロジーのガバナンスをサポートおよび保護するための企業固有のプラクティスを推奨する
トピック 5	ITコントロールの能力だけでなく、ITがビジネスにどのように関連しているかについての理解も証明します
トピック 6	情報資産の保護

99、While conducting a review of project plans related to a new software development, an IS auditor finds the project initiation document (PID) is incomplete. What is the BEST way for the auditor to proceed?

Meet with the project sponsor to discuss the incomplete document.

Prepare a finding for the audit report.

Inform audit management of possible risks associated with the deficiency.

Escalate to the project steering committee.

100、IT governance is PRIMARILY the responsibility of the:

chief executive officer.

board of directors.

IT steering committee.

audit committee.

101、.How does the process of systems auditing benefit from using a risk-based approach to audit planning?

Controls testing starts earlier.

Auditing resources are allocated to the areas of highest concern.

Auditing risk is reduced.

Controls testing is more thorough.

102、Which of the following should an IS auditor review FIRST when evaluating a business process for auditing?

Competence of the personnel performing the process

Design and implementation of controls

Evidence that IS-related controls are operating effectively

Assignment of responsibility for process management

103、An external IS auditor is reviewing the continuous monitoring system for a large bank and notes several potential issues. Which of the following would present the GREATEST concern regarding the reliability of the monitoring system?

The measurement method is periodically varied.

The alert threshold is updated periodically.

The system results are not regularly reviewed by management.

The monitoring system was configured by internal auditors.

104、Which of the following presents the GREATEST security risk to an organization using peer-to-peer (P2P) file-sharing networks?

There is no audit trail for files residing outside of the organization.

IP addresses are shared to create a connection.

Penetration testing cannot identify issues with P2P file-sharing networks.

Controls are difficult to apply to unstructured networks.

105、Which of the following should be the PRIMARY basis for procedures to dispose of data securely?

Type of media used for data storage

Data retention policy

Classification of data

Environmental regulations

106、An organization has a mix of access points that cannot be upgraded to stronger security and newer access
points having advanced wireless security. An IS auditor recommends replacing the non-upgradeable
access points. Which of the following would BEST justify the IS auditor’s recommendation?

The new access points with stronger security are affordable.

The old access points are poorer in terms of performance.

The organization’s security would be as strong as its weakest points.

The new access points are easier to manage.

107、Which of the following attack redirects outgoing message from the client back onto the client, preventing
outside access as well as flooding the client with the sent packets?

Banana attack

Brute force attack

Buffer overflow

Pulsing Zombie

Section: Protection of Information Assets
Explanation/Reference:
A “banana attack” is another particular type of DoS. It involves redirecting outgoing messages from the
client back onto the client, preventing outside access, as well as flooding the client with the sent packets.
The Banana attack uses a router to change the destination address of a frame. In the Banana attack:
A compromised router copies the source address on an inbound frame into the destination address.
The outbound frame bounces back to the sender.
This sender is flooded with frames and consumes so many resources that valid service requests can no
longer be processed.
The following answers are incorrect:
Brute force attack – Brute force (also known as brute force cracking) is a trial and error method used by
application programs to decode encrypted data such as passwords or Data Encryption Standard (DES)
keys, through exhaustive effort (using brute force) rather than employing intellectual strategies. Just as a
criminal might break into, or “crack” a safe by trying many possible combinations, a brute force cracking
application proceeds through all possible combinations of legal characters in sequence. Brute force is
considered to be an infallible, although time-consuming, approach.
Buffer overflow – A buffer overflow occurs when a program or process tries to store more data in a buffer
(temporary data storage area) than it was intended to hold. Since buffers are created to contain a finite
amount of data, the extra information – which has to go somewhere – can overflow into adjacent buffers,
corrupting or overwriting the valid data held in them. Although it may occur accidentally through
programming error, buffer overflow is an increasingly common type of security attack on data integrity.
Pulsing Zombie – A Dos attack in which a network is subjected to hostile pinging by different attacker
computer over an extended time period.
Following reference(s) were/was used to create this question:
CISA review manual 2014 Page number 321

108、An algorithm in an email program analyzes traffic to quarantine emails identified as spam The algorithm in the program is BEST characterized as which type of control?

Directive

Preventive

Corrective

Detective

109、Which of the following will BEST ensure that a proper cutoff has been established to reinstate transactions and records to their condition just prior to a computer system failure?

Maintaining system console logs in electronic format

Ensuring bisynchronous capabilities on all transmission lines

Using a database management system (DBMS) to dynamically back-out partially processed transactions

Rotating backup copies of transaction files offsite

110、Which of the following is the MOST significant driver of efficient handling of information security incidents?

Prioritization

Budget

Expertise

Strategy

111、Which of the following is a general operating system access control function?

Creating database profiles

Verifying user authorization at a field level

Creating individual accountability

Logging database access activities for monitoring access violation

112、.What type of risk results when an IS auditor uses an inadequate test procedure and concludes that material errors do not exist when errors actually exist?

Business risk

Detection risk

Residual risk

Inherent risk

113、Proper segregation of duties prohibits a system analyst from performing quality-assurance functions. True or false?

True

False

114、A company laptop has been stolen and all photos on the laptop have been published on social media. Which of the following is the IS auditor’s BEST course of action?

Determine if the laptop had the appropriate level of encryption

Verify the organization’s incident reporting policy was followed

Ensure that the appropriate authorities have been notified

Review the photos to determine whether they were for business or personal purposes

115、Which of the following BEST supports an organization’s planning efforts for investments in IT initiatives?

Continuous gap assessment

Enterprise architecture

Agile project management

Capability maturity model

116、When reviewing procedures for emergency changes to programs, the IS auditor should verify that the procedures:

allow changes, which will be completed using after-the-fact follow-up.

allow undocumented changes directly to the production library.

do not allow any emergency changes.

allow programmers permanent access to production programs.

あなたを余裕でCISAは100%試験合格率保証：https://www.passtest.jp/ISACA/CISA-shiken.html

最新のCISA問題集PDFでCISAリアルで有効な正確な問題集は500問題と解答が待ってます！ [Q99-Q116]

ISACA CISA 認定試験の出題範囲：

コメントを残すコメントをキャンセル

CISA練習テスト

関連認証

最近の投稿

アーカイブ

カテゴリー

最新のCISA問題集PDFでCISAリアルで有効な正確な問題集は500問題と解答が待ってます！ [Q99-Q116]

ISACA CISA 認定試験の出題範囲：

コメントを残す コメントをキャンセル

CISA練習テスト

関連認証

最近の投稿

アーカイブ

カテゴリー

コメントを残すコメントをキャンセル