Isaca CISA Certification CISA Questions & Answers

• Question 11:

  An organization is migrating its HR application to an Infrastructure as a Service (laaS) model in a private cloud. Who is PRIMARILY responsible for the security configurations of the deployed application's operating system?

  A. The cloud provider's external auditor

  B. The cloud provider

  C. The operating system vendor

  D. The organization

  Correct Answer: D

• Question 12:

  Which of the following is the BEST reason for an IS auditor to emphasize to management the importance of using an IT governance framework?

  A. Frameworks enable IT benchmarks against competitors

  B. Frameworks can be tailored and optimized for different organizations

  C. Frameworks help facilitate control self assessments (CSAs)

  D. Frameworks help organizations understand and manage IT risk

  Correct Answer: B

• Question 13:

  Which of the following is the PRIMARY advantage of using virtualization technology for corporate applications?

  A. Stronger data security

  B. Better utilization of resources

  C. Increased application performance

  D. Improved disaster recovery

  Correct Answer: B

• Question 14:

  An organization implemented a cybersecurity policy last year.

  Which of the following is the GREATE ST indicator that the policy may need to be revised?

  A. A significant increase in authorized connections to third parties

  B. A significant increase in cybersecurity audit findings

  C. A significant increase in approved exceptions

  D. A significant increase in external attack attempts

  Correct Answer: C

• Question 15:

  When testing the accuracy of transaction data, which of the following situations BEST justifies the use of a smaller sample size?

  A. The IS audit staff has a high level of experience.

  B. It is expected that the population is error-free.

  C. Proper segregation of duties is in place.

  D. The data can be directly changed by users.

  Correct Answer: B

  Explanation: The best situation to justify the use of a smaller sample size when testing the accuracy of transaction data is when it is expected that the population is error-free. This is because if the data is assumed to be error-free, then a smaller sample size can be used to confirm the accuracy of the data. It is important to note, however, that this does not replace the need for proper segregation of duties and other controls to ensure accuracy and integrity of the data.

• Question 16:

  To mitigate the risk of exposing data through application programming interface (API) queries. which of the following design considerations is MOST important?

  A. Data retention

  B. Data minimization

  C. Data quality

  D. Data integrity

  Correct Answer: B

  Explanation: Data minimization is an important design consideration when mitigating the risk of exposing data through API queries. This involves limiting the amount of data returned from an API query to only the data that is required for the task at hand. This reduces the risk of exposing sensitive or confidential data, as well as reducing the risk of data overload. Additionally, data minimization helps to ensure that the API query is not overly complex, which can lead to performance issues.

• Question 17:

  Which of the following should be the FIRST step when planning an IS audit of a third-party service provider that monitors network activities?

  A. Review the third party's monitoring logs and incident handling

  B. Review the roles and responsibilities of the third-party provider

  C. Evaluate the organization's third-party monitoring process

  D. Determine if the organization has a secure connection to the provider

  Correct Answer: B

• Question 18:

  Which type of attack targets security vulnerabilities in web applications to gain access to data sets?

  A. Denial of service (DOS)

  B. SQL injection

  C. Phishing attacks

  D. Rootkits

  Correct Answer: B

  Explanation: SQL injection is a type of attack that targets security vulnerabilities in web applications to gain access to data sets. It is accomplished by injecting malicious SQL code into user-supplied data fields, allowing the attacker to gain access to and manipulate the underlying database. In addition to gaining access to data, SQL injection can also be used to modify existing data or even delete it. According to ISACA's Certified Information Systems Auditor (CISA) Study Guide, "SQL injection attacks are the most common type of attack against web applications and databases, and they are a major security concern."

• Question 19:

  Which of the following methods BEST enforces data leakage prevention in a multi-tenant cloud environment?

  A. Monitoring tools are configured to alert in case of downtime

  B. A comprehensive security review is performed every quarter.

  C. Data for different tenants is segregated by database schema

  D. Tenants are required to implement data classification polices

  Correct Answer: D

• Question 20:

  An IS auditor learns that an in-house system development life cycle (SDLC) project has not met user specifications. The auditor should FIRST examine requirements from which of the following phases?

  A. Configuration phase

  B. User training phase

  C. Quality assurance (QA) phase

  D. Development phase

  Correct Answer: D

  Explanation: The IS auditor should first examine the requirements from the development phase of the system development life cycle (SDLC) project to identify any discrepancies between the user specifications and the actual system. Other phases that may need to be examined include the configuration phase, user training phase, and quality assurance (QA) phase.

  The IS auditor should FIRST examine requirements from the Development phase. This is because the development phase is the phase where the actual software is built and coded. If the system has not met user specifications, it could be due to requirements not being accurately captured or properly understood in the development phase. It's important for the auditor to determine what went wrong in this phase and make recommendations for improving the process moving forward.