Isaca CISA Online Practice Questions and Exam Preparation

Isaca CISA Online Questions & Answers

• Question 1291:

  During which phase of the software development life cycle should an IS auditor be consulted to recommend security controls?

  A. Design and development
  B. Final acceptance testing
  C. Implementation of software
  D. Requirements definition
  D. Requirements definition

  ---

  Explanation

  An IS auditor should be consulted during the requirements definition phase to recommend security controls. This ensures that security considerations are integrated from the beginning of the software development life cycle, leading to more

  secure software design and implementation.

  References:

  ISACA CISA Review Manual 27th Edition, Page 240-241 (SDLC Phases)

• Question 1292:

  Which of the following is the PRIMARY basis on which audit objectives are established?

  A. Audit risk
  B. Consideration of risks
  C. Assessment of prior audits
  D. Business strategy
  B. Consideration of risks

  ---

  Explanation

  The primary basis on which audit objectives are established is the consideration of risks. This involves identifying and assessing the risks that could prevent the organization from achieving its objectives. The audit objectives are then designed to address these risks and provide assurance that the organization's controls are effective in managing them. While audit risk, assessment of prior audits, and business strategy are important factors in the audit process, they are secondary to the fundamental requirement of considering risks.

  References: Objectives of Auditing - Primary and Secondary Objectives of Auditing | Auditing Management Notes Audit Objectives | Primary and Subsidiary Audit Objectives - EDUCBA

• Question 1293:

  In an area susceptible to unexpected increases in electrical power, which of the following would MOST effectively protect the system?

  A. Generator
  B. Voltage regulator
  C. Circuit breaker
  D. Alternate power supply line
  B. Voltage regulator

  ---

  Explanation

• Question 1294:

  Which of the following is a detective control?

  A. Programmed edit checks for data entry
  B. Backup procedures
  C. Use of pass cards to gain access to physical facilities
  D. Verification of hash totals
  D. Verification of hash totals

  ---

  Explanation

  Verification of hash totals is a detective control. A detective control is a control that aims to identify and report errors or irregularities that have already occurred. Verification of hash totals is a technique that compares the hash values of data before and after transmission or processing to detect any changes or corruption. The other options are examples of other types of controls, such as programmed edit checks (preventive), backup procedures (recovery), and use of pass cards (preventive).

  References: CISA Review Manual, 27th Edition, page 223

• Question 1295:

  Which of the following layer from an enterprise data flow architecture captures all data of interest to an organization and organize it to assist in reporting and analysis?

  A. Desktop access layer
  B. Data preparation layer
  C. Core data warehouse
  D. Data access layer
  C. Core data warehouse

  ---

  Explanation

  Core data warehouse ?This is where all the data of interest to an organization is captured and organized to assist reporting and analysis. DWs are normally instituted as large relational databases. A property constituted DW should support

  three basic form of an inquiry.

  For CISA exam you should know below information about business intelligence:

  Business intelligence(BI) is a broad field of IT encompasses the collection and analysis of information to assist decision making and assess organizational performance. To deliver effective BI, organizations need to design and implement a

  data architecture. The complete data architecture consists of two components

  The enterprise data flow architecture (EDFA)

  A logical data architecture

  Various layers/components of this data flow architecture are as follows:

  Presentation/desktop access layer ?This is where end users directly deal with information. This layer includes familiar desktop tools such as spreadsheets, direct querying tools, reporting and analysis suits offered by vendors such as Congas

  and business objects, and purpose built application such as balanced source cards and digital dashboards.

  Data Source Layer ?Enterprise information derives from number of sources:

  Operational data ?Data captured and maintained by an organization's existing systems, and usually held in system-specific database or flat files. External Data ?Data provided to an organization by external sources. This could include data

  such as customer demographic and market share information.

  Nonoperational data ?Information needed by end user that is not currently maintained in a computer accessible format.

  Core data warehouse ?This is where all the data of interest to an organization is captured and organized to assist reporting and analysis. DWs are normally instituted as large relational databases. A property constituted DW should support

  three basic form of an inquiry.

  Drilling up and drilling down ?Using dimension of interest to the business, it should be possible to aggregate data as well as drill down. Attributes available at the more granular levels of the warehouse can also be used to refine the analysis.

  Drill across ?Use common attributes to access a cross section of information in the warehouse such as sum sales across all product lines by customer and group of customers according to length of association with the company. Historical

  Analysis ?The warehouse should support this by holding historical, time variant data. An example of historical analysis would be to report monthly store sales and then repeat the analysis using only customer who were preexisting at the start

  of the year in order to separate the effective new customer from the ability to generate repeat business with existing customers.

  Data Mart Layer ?Data mart represents subset of information from the core DW selected and organized to meet the needs of a particular business unit or business line. Data mart can be relational databases or some form on-line analytical

  processing (OLAP) data structure.

  Data Staging and quality layer ?This layer is responsible for data copying, transformation into DW format and quality control. It is particularly important that only reliable data into core DW. This layer needs to be able to deal with problems

  periodically thrown by operational systems such as change to account number format and reuse of old accounts and customer numbers.

  Data Access Layer ?This layer operates to connect the data storage and quality layer with data stores in the data source layer and, in the process, avoiding the need to know to know exactly how these data stores are organized. Technology

  now permits SQL access to data even if it is not stored in a relational database.

  Data Preparation layer ?This layer is concerned with the assembly and preparation of data for loading into data marts. The usual practice is to per-calculate the values that are loaded into OLAP data repositories to increase access speed.

  Data mining is concern with exploring large volume of data to determine patterns and trends of information. Data mining often identifies patterns that are counterintuitive due to number and complexity of data relationships. Data quality needs

  to be very high to not corrupt the result.

  Metadata repository layer ?Metadata are data about data. The information held in metadata layer needs to extend beyond data structure names and formats to provide detail on business purpose and context. The metadata layer should be

  comprehensive in scope, covering data as they flow between the various layers, including documenting transformation and validation rules.

  Warehouse Management Layer ?The function of this layer is the scheduling of the tasks necessary to build and maintain the DW and populate data marts. This layer is also involved in administration of security.

  Application messaging layer ?This layer is concerned with transporting information between the various layers. In addition to business data, this layer encompasses generation, storage and targeted communication of control messages.

  Internet/Intranet layer ?This layer is concerned with basic data communication. Included here are browser based user interface and TCP/IP networking.

  Various analysis models used by data architects/ analysis follows:

  Activity or swim-lane diagram ?De-construct business processes.

  Entity relationship diagram ?Depict data entities and how they relate. These data analysis methods obviously play an important part in developing an enterprise data model. However, it is also crucial that knowledgeable business operative is

  involved in the process. This way proper understanding can be obtained of the business purpose and context of the data. This also mitigates the risk of replication of suboptimal data configuration from existing systems and database into DW.

  The following were incorrect answers:

  Desktop access layer or presentation layer is where end users directly deal with information. This layer includes familiar desktop tools such as spreadsheets, direct querying tools, reporting and analysis suits offered by vendors such as

  Congas and business objects, and purpose built application such as balanced source cards and digital dashboards.

  Data access layer ?his layer operates to connect the data storage and quality layer with data stores in the data source layer and, in the process, avoiding the need to know to know exactly how these data stores are organized. Technology

  now permits SQL access to data even if it is not stored in a relational database.

  Data preparation layer -This layer is concerned with the assembly and preparation of data for loading into data marts. The usual practice is to per-calculate the values that are loaded into OLAP data repositories to increase access speed.

  CISA review manual 2014 Page number 188

• Question 1296:

  Which of the following is the PRIMARY reason for an IS auditor to issue an interim audit report?

  A. To avoid issuing a final audit report
  B. To enable the auditor to complete the engagement in a timely manner
  C. To provide feedback to the auditee for timely remediation
  D. To provide follow-up opportunity during the audit
  C. To provide feedback to the auditee for timely remediation

  ---

  Explanation

• Question 1297:

  When engaging services from external auditors, which of the following should be established FIRST?

  A. Termination conditions agreements
  B. Nondisclosure agreements
  C. Service level agreements
  D. Operational level agreements
  B. Nondisclosure agreements

  ---

  Explanation

• Question 1298:

  Which of the following type of testing has two major categories: QAT and UAT?

  A. Interface testing
  B. Unit Testing
  C. System Testing
  D. Final acceptance testing
  C. System Testing

  ---

  Explanation

• Question 1299:

  Which of the following is the MOST efficient control to reduce the risk associated with a systems administrator having network administrator responsibilities?

  A. The administrator must obtain temporary access to make critical changes.
  B. The administrator will need to request additional approval for critical changes.
  C. The administrator must sign a due diligence agreement.
  D. The administrator will be subject to unannounced audits.
  B. The administrator will need to request additional approval for critical changes.

  ---

  Explanation

• Question 1300:

  When testing the adequacy of tape backup procedures, which step BEST verifies that regularly scheduled Backups are timely and run to completion?

  A. Observing the execution of a daily backup run
  B. Evaluating the backup policies and procedures
  C. Interviewing key personnel evolved In the backup process
  D. Reviewing a sample of system-generated backup logs
  D. Reviewing a sample of system-generated backup logs

  ---

  Explanation

  Reviewing a sample of system-generated backup logs is the best step to verify that regularly scheduled backups are timely and run to completion. Backup logs are records that document the details and results of backup operations, such as the date, time, duration, status, errors, and exceptions. By reviewing a sample of backup logs, the IS auditor can check whether the backups are performed according to the schedule and whether they are completed successfully or not. The other steps do not provide as much evidence or assurance as reviewing backup logs, as they do not show the actual outcome or performance of backup operations.

  References: CISA Review Manual, 27th Edition, page 247