Isaca CISA Online Practice Questions and Exam Preparation

Isaca CISA Online Questions & Answers

• Question 1:

  Which of the following should be of GREATEST concern to an IS auditor reviewing a network printer disposal process?

  A. Disposal policies and procedures are not consistently implemented
  B. Evidence is not available to verify printer hard drives have been sanitized prior to disposal.
  C. Business units are allowed to dispose printers directly to
  D. Inoperable printers are stored in an unsecured area.
  B. Evidence is not available to verify printer hard drives have been sanitized prior to disposal.

  ---

  Explanation

  The greatest concern for an IS auditor reviewing a network printer disposal process is that evidence is not available to verify printer hard drives have been sanitized prior to disposal. This can expose sensitive data to unauthorized parties and cause data breaches. Disposal policies and procedures not being consistently implemented or business units being allowed to dispose printers directly to vendors are compliance issues, but not as critical as data protection. Inoperable printers being stored in an unsecured area is a physical security issue, but not as severe as data leakage.

  References: ISACA, CISA Review Manual, 27th Edition, 2018, page 387

• Question 2:

  Which of the following layer of an enterprise data flow architecture represents subset of information from the core Data Warehouse selected and organized to meet the needs of a particular business unit or business line?

  A. Data preparation layer
  B. Desktop Access Layer
  C. Data Mart layer
  D. Data access layer
  C. Data Mart layer

  ---

  Explanation

  Data Mart layer ?Data mart represents subset of information from the core Data Warehouse selected and organized to meet the needs of a particular business unit or business line. Data mart can be relational databases or some form on-line

  analytical processing (OLAP) data structure.

  For CISA exam you should know below information about business intelligence:

  Business intelligence(BI) is a broad field of IT encompasses the collection and analysis of information to assist decision making and assess organizational performance. To deliver effective BI, organizations need to design and implement a

  data architecture. The complete data architecture consists of two components

  The enterprise data flow architecture (EDFA)

  A logical data architecture

  Various layers/components of this data flow architecture are as follows:

  Presentation/desktop access layer ?This is where end users directly deal with information. This layer includes familiar desktop tools such as spreadsheets, direct querying tools, reporting and analysis suits offered by vendors such as Congas

  and business objects, and purpose built application such as balanced source cards and digital dashboards.

  Data Source Layer ?Enterprise information derives from number of sources:

  Operational data ?Data captured and maintained by an organization's existing systems, and usually held in system-specific database or flat files. External Data ?Data provided to an organization by external sources. This could include data

  such as customer demographic and market share information.

  Nonoperational data ?Information needed by end user that is not currently maintained in a computer accessible format.

  Core data warehouse ?This is where all the data of interest to an organization is captured and organized to assist reporting and analysis. DWs are normally instituted as large relational databases. A property constituted DW should support

  three basic form of an inquiry.

  Drilling up and drilling down ?Using dimension of interest to the business, it should be possible to aggregate data as well as drill down. Attributes available at the more granular levels of the warehouse can also be used to refine the analysis.

  Drill across ?Use common attributes to access a cross section of information in the warehouse such as sum sales across all product lines by customer and group of customers according to length of association with the company. Historical

  Analysis ?The warehouse should support this by holding historical, time variant data. An example of historical analysis would be to report monthly store sales and then repeat the analysis using only customer who were preexisting at the start

  of the year in order to separate the effective new customer from the ability to generate repeat business with existing customers.

  Data Mart Layer ?Data mart represents subset of information from the core DW selected and organized to meet the needs of a particular business unit or business line. Data mart can be relational databases or some form on-line analytical

  processing (OLAP) data structure.

  Data Staging and quality layer ?This layer is responsible for data copying, transformation into DW format and quality control. It is particularly important that only reliable data into core DW. This layer needs to be able to deal with problems

  periodically thrown by operational systems such as change to account number format and reuse of old accounts and customer numbers.

  Data Access Layer ?This layer operates to connect the data storage and quality layer with data stores in the data source layer and, in the process, avoiding the need to know to know exactly how these data stores are organized. Technology

  now permits SQL access to data even if it is not stored in a relational database.

  Data Preparation layer ?This layer is concerned with the assembly and preparation of data for loading into data marts. The usual practice is to per-calculate the values that are loaded into OLAP data repositories to increase access speed.

  Data mining is concern with exploring large volume of data to determine patterns and trends of information. Data mining often identifies patterns that are counterintuitive due to number and complexity of data relationships. Data quality needs

  to be very high to not corrupt the result.

  Metadata repository layer ?Metadata are data about data. The information held in metadata layer needs to extend beyond data structure names and formats to provide detail on business purpose and context. The metadata layer should be

  comprehensive in scope, covering data as they flow between the various layers, including documenting transformation and validation rules.

  Warehouse Management Layer ?The function of this layer is the scheduling of the tasks necessary to build and maintain the DW and populate data marts. This layer is also involved in administration of security.

  Application messaging layer ?This layer is concerned with transporting information between the various layers. In addition to business data, this layer encompasses generation, storage and targeted communication of control messages.

  Internet/Intranet layer ?This layer is concerned with basic data communication. Included here are browser based user interface and TCP/IP networking.

  Various analysis models used by data architects/ analysis follows:

  Activity or swim-lane diagram ?De-construct business processes.

  Entity relationship diagram ?Depict data entities and how they relate. These data analysis methods obviously play an important part in developing an enterprise data model. However, it is also crucial that knowledgeable business operative is involved in the process. This way proper understanding can be obtained of the business purpose and context of the data. This also mitigates the risk of replication of suboptimal data configuration from existing systems and database into DW.

  The following were incorrect answers:

  Desktop access layer or presentation layer is where end users directly deal with information. This layer includes familiar desktop tools such as spreadsheets, direct querying tools, reporting and analysis suits offered by vendors such as

  Congas and business objects, and purpose built application such as balanced source cards and digital dashboards.

  Data preparation layer ?This layer is concerned with the assembly and preparation of data for loading into data marts. The usual practice is to per-calculate the values that are loaded into OLAP data repositories to increase access speed.

  Data access layer ?his layer operates to connect the data storage and quality layer with data stores in the data source layer and, in the process, avoiding the need to know to know exactly how these data stores are organized. Technology

  now permits SQL access to data even if it is not stored in a relational database.

  CISA review manual 2014 Page number 188

• Question 3:

  Which of the following should be of GREATEST concern to an IS auditor conducting an audit of an organization's backup processes?

  A. A written backup policy is not available.
  B. Backup failures are not resolved in a timely manner.
  C. The restoration process is slow due to connectivity issues.
  D. The service levels are not achieved.
  D. The service levels are not achieved.

  ---

  Explanation

• Question 4:

  An IS audit reveals that an organization is not proactively addressing known vulnerabilities. Which of the following should the IS auditor recommend the organization do FIRST?

  A. Verify the disaster recovery plan (DRP) has been tested.
  B. Ensure the intrusion prevention system (IPS) is effective.
  C. Assess the security risks to the business.
  D. Confirm the incident response team understands the issue.
  C. Assess the security risks to the business.

  ---

  Explanation

  If an IS audit reveals that an organization is not proactively addressing known vulnerabilities, the IS auditor should recommend that the organization assess the security risks to the business first, as this would help to prioritize the vulnerabilities based on their impact and likelihood, and determine the appropriate mitigation strategies. Verifying the disaster recovery plan (DRP) has been tested, ensuring the intrusion prevention system (IPS) is effective, and confirming the incident response team understands the issue are important steps, but they are not as urgent as assessing the security risks to the business.

  References: CISA Review Manual (Digital Version), Chapter 5, Section 5.6

• Question 5:

  Which of the following is the PRIMARY purpose of obtaining a baseline image during an operating system audit?

  A. To identify atypical running processes
  B. To verify antivirus definitions
  C. To identify local administrator account access
  D. To verify the integrity of operating system backups
  A. To identify atypical running processes

  ---

  Explanation

  The primary purpose of obtaining a baseline image during an operating system audit is to identify atypical running processes. A baseline image is a snapshot of the normal state and configuration of an operating system, including the processes that are expected to run on it. By comparing the current state of the operating system with the baseline image, an IS auditor can detect any deviations or anomalies that may indicate unauthorized or malicious activity, such as malware infection, privilege escalation, or data exfiltration. A baseline image can also help an IS auditor to assess the performance and efficiency of the operating system, as well as its compliance with security standards and policies. Verifying antivirus definitions (option B) is not the primary purpose of obtaining a baseline image, although it may be a part of the baseline configuration. Antivirus definitions are the files that contain the signatures and rules for detecting and removing malware. An IS auditor may verify that the antivirus definitions are up to date and consistent across the operating system, but this does not require obtaining a baseline image. Identifying local administrator account access (option C) is not the primary purpose of obtaining a baseline image, although it may be a part of the baseline configuration. Local administrator accounts are user accounts that have full control over the operating system and its resources. An IS auditor may identify and review the local administrator accounts to ensure that they are properly secured and authorized, but this does not require obtaining a baseline image. Verifying the integrity of operating system backups (option D) is not the primary purpose of obtaining a baseline image, although it may be a part of the backup process. Operating system backups are copies of the operating system data and settings that can be used to restore the system in case of failure or disaster. An IS auditor may verify that the operating system backups are complete, accurate, and accessible, but this does not require obtaining a baseline image.

  References: Linux security and system hardening checklist : CISA Certification | Certified Information Systems Auditor | ISACA : CISA Certified Information Systems Auditor Study Guide, 4th Edition : CISA - Certified Information Systems Auditor Study Guide [Book]

• Question 6:

  At the end of each business day, a business-critical application generates a report of financial transac-tions greater than a certain value, and an employee then checks these transactions for errors. What type of control is in place?

  A. Detective
  B. Preventive
  C. Corrective
  D. Deterrent
  A. Detective

  ---

  Explanation

• Question 7:

  A new regulation has been enacted that mandates specific information security practices for the protection of customer data. Which of the following is MOST useful for an IS auditor to review when auditing against the regulation?

  A. Compliance gap analysis
  B. Customer data protection roles and responsibilities
  C. Customer data flow diagram
  D. Benchmarking studies of adaptation to the new regulation
  A. Compliance gap analysis

  ---

  Explanation

  A compliance gap analysis is a detailed review of an organization's current state of compliance against a specific regulation or standard. It helps identify the areas and controls that are not meeting the requirements, assess their risk levels,

  and determine the corrective actions that can be taken to achieve compliance12. A compliance gap analysis is the most useful tool for an IS auditor to review when auditing against a new regulation, as it provides a clear and comprehensive

  picture of the compliance status, gaps, and remediation plan of the organization.

  References:

  1: Information Security Architecture: Gap Assessment and Prioritization - ISACA

  2: How to perform Compliance Gap Analysis? - Sprinto

• Question 8:

  An organization allows employee use of personal mobile devices for corporate email. Which of the following should be the GREATEST IS audit concern?

  A. Email forwarding to private devices requires excessive network bandwidth
  B. There is no corporate policy for the acceptable use of private devices
  C. There is no adequate tracking of the working time spent out-of-hours
  D. The help desk is not able to fully support different kinds of private devices
  B. There is no corporate policy for the acceptable use of private devices

  ---

  Explanation

• Question 9:

  Which of the following is the BEST way to strengthen the security of smart devices to prevent data leakage?

  A. Enforce strong security settings on smart devices.
  B. Require employees to formally acknowledge security procedures.
  C. Review access logs to the organization's sensitive data in a timely manner.
  D. Include usage restrictions in bring your own device (BYOD) security procedures.
  A. Enforce strong security settings on smart devices.

  ---

  Explanation

• Question 10:

  Which of the following is MOST important for an IS auditor to verify when reviewing a critical business application that requires high availability?

  A. Algorithms are reviewed to resolve process inefficiencies.
  B. Users participate in offsite business continuity testing.
  C. There is no single point of failure.
  D. Service level agreement (SLAs) are monitored.
  C. There is no single point of failure.

  ---

  Explanation