Isaca CISA Online Practice Questions and Exam Preparation

Isaca CISA Online Questions & Answers

• Question 181:

  Which of the following BEST measures project progress?

  A. Earned-value analysis (EVA)
  B. Project plan
  C. SWOT analysis
  D. Gantt chart
  A. Earned-value analysis (EVA)

  ---

  Explanation

• Question 182:

  Which of the following poses the GREATEST risk to an organization related to system interfaces?

  A. There is no process documentation for some system interfaces.
  B. Notifications of data transfers through the interfaces are not retained.
  C. Parts of the data transfer process are performed manually.
  D. There is no reliable inventory of system interfaces.
  D. There is no reliable inventory of system interfaces.

  ---

  Explanation

• Question 183:

  A database administrator (DBA) should be prevented from having end user responsibilities:

  A. having end user responsibilities
  B. accessing sensitive information
  C. having access to production files
  D. using an emergency user ID
  A. having end user responsibilities

  ---

  Explanation

  A database administrator (DBA) should be prevented from having end user responsibilities to avoid a conflict of interest and a violation of the principle of segregation of duties. End user responsibilities may include initiating transactions,

  authorizing transactions, recording transactions or reconciling transactions. A DBA who has end user responsibilities may compromise the integrity, confidentiality and availability of the data and the database systems. Accessing sensitive

  information, having access to production files and using an emergency user ID are not end user responsibilities, but rather potential risks or controls associated with the DBA role.

  References:

  : Database Administrator (DBA) Definition

  : Segregation of Duties | ISACA

  : [End User Definition]

• Question 184:

  Which of the following is not a common method of multiplexing data?

  A. Analytical multiplexing
  B. Time-division multiplexing
  C. Asynchronous time-division multiplexing
  D. Frequency division multiplexing
  A. Analytical multiplexing

  ---

  Explanation

  Generally, the methods for multiplexing data include the following:

  Time-division multiplexing (TDM): information from each data channel is allocated bandwidth based on pre-assigned time slots, regardless of whether there is data to transmit. Asynchronous time-division multiplexing (ATDM): information from

  data channels is allocated bandwidth as needed, via dynamically assigned time slots. Frequency division multiplexing (FDM): information from each data channel is allocated bandwidth based on the signal frequency of the traffic.

  Statistical multiplexing: Bandwidth is dynamically allocated to any data channels that have information to transmit.

  Information Systems Audit and Control Association, Certified Information Systems Auditor 2002 review manual, Chapter 3: Technical Infrastructure and Operational Practices (page 114).

• Question 185:

  Which of the following would MOST likely impair the independence of the IS auditor when performing a post-implementation review of an application system?

  A. The IS auditor provided consulting advice concerning application system best practices.
  B. The IS auditor participated as a member of the application system project team, but did not have operational responsibilities.
  C. The IS auditor designed an embedded audit module exclusively for auditing the application system.
  D. The IS auditor implemented a specific control during the development of the application system.
  D. The IS auditor implemented a specific control during the development of the application system.

  ---

  Explanation

  The IS auditor's independence would be most likely impaired if they implemented a specific control during the development of an application system. This is because the IS auditor would be auditing their own work, which creates a self-review threat that could compromise their objectivity and impartiality. The IS auditor should avoid participating in any operational or management activities that could affect their ability to perform an unbiased audit. The other options do not pose a significant threat to the IS auditor's independence, as long as they follow the ethical standards and guidelines of the profession.

• Question 186:

  A web application is developed in-house by an organization. Which of the following would provide the BEST evidence to an IS auditor that the application is secure from external attack?

  A. Web application firewall (WAF) implementation
  B. Penetration test results
  C. Code review by a third party
  D. Database application monitoring logs
  B. Penetration test results

  ---

  Explanation

• Question 187:

  Tunneling provides additional security for connecting one host to another through the Internet by:

  A. providing end-to-end encryption.
  B. facilitating the exchange of public key infrastructure (PKI) certificates
  C. preventing password cracking and replay attacks
  D. enabling the use of stronger encryption keys
  C. preventing password cracking and replay attacks

  ---

  Explanation

• Question 188:

  When determining the specifications for a server supporting an online application using more than a hundred endpoints, which of the following is the MOST important factor to be considered?

  A. High availability of different systems
  B. Cost-benefit comparison between the available systems
  C. Reputation of the vendors and their customer base
  D. Transaction volume estimate during peak periods
  D. Transaction volume estimate during peak periods

  ---

  Explanation

• Question 189:

  The PRIMARY purpose of a vulnerability assessment in a cybersecurity program is to: A. Enhance the security awareness of employees and other internal stakeholders.

  B. Identify known security exposures before attackers find them.

  C. Improve the overall security posture of the organization.

  D. Protect the organization's IT assets against external cyberthreats.

  Correct Answer. B
  B

  ---

  Explanation

  Explanation

• Question 190:

  Which of the following recommendations would BEST prevent the implementation of IT projects without collaborating with the business?

  A. Partner with the business units to evaluate IT projects.
  B. Review the projects to identify similarities and eliminate duplication.
  C. Periodically review the projects' return on investment (ROI).
  D. Prioritize protects based on business and IT resource availability.
  A. Partner with the business units to evaluate IT projects.

  ---

  Explanation