Isaca CISA Online Practice Questions and Exam Preparation

Isaca CISA Online Questions & Answers

• Question 681:

  Which of the following falls within the scope of an information security governance committee?

  A. Selecting the organization's external security auditors
  B. Approving access to critical financial systems
  C. Reviewing content for information security awareness programs
  D. Prioritizing information security technology initiatives
  C. Reviewing content for information security awareness programs

  ---

  Explanation

• Question 682:

  Data analytics Tools are BEST suited for which of the following purposes?

  A. Identifying business process errors
  B. Quantifying business impact analysis (BIA) results
  C. Examining low-frequency business transactions
  D. Analyzing the effectiveness of risk assessment processes
  C. Examining low-frequency business transactions

  ---

  Explanation

• Question 683:

  What should an IS auditor recommend to management as the MOST important action before selecting a Software as a Service (SaaS) vendor?

  A. Determine service level requirements.
  B. Complete a risk assessment.
  C. Perform a business impact analysis (BIA)
  D. Conduct a vendor audit.
  B. Complete a risk assessment.

  ---

  Explanation

  Before selecting a SaaS vendor, the most important action is to complete a risk assessment. A risk assessment is a process of identifying, analyzing, and evaluating the potential risks associated with outsourcing software and IT infrastructure to a third-party provider. A risk assessment helps to determine the impact and likelihood of various threats, such as data breaches, service disruptions, vendor lock-in, compliance issues, and legal disputes. A risk assessment also helps to identify the mitigation strategies and controls that can reduce or eliminate the risks. A risk assessment is more important than determining service level requirements, performing a business impact analysis (BIA), or conducting a vendor audit because it provides the basis for these other actions. Service level requirements are the expectations and obligations that define the quality and quantity of service that the vendor must provide to the customer. A BIA is a process of assessing the potential effects of an interruption or disruption of critical business functions or processes due to an incident or disaster. A vendor audit is a process of verifying the vendor's compliance with the contract terms, service levels, security policies, and best practices. Service level requirements, BIA, and vendor audit are all important actions for selecting a SaaS vendor, but they depend on the results of the risk assessment. For example, service level requirements should reflect the risk appetite and tolerance of the customer, which are determined by the risk assessment. A BIA should prioritize the recovery of the most critical and vulnerable business functions or processes, which are identified by the risk assessment. A vendor audit should focus on the areas of highest risk and concern, which are highlighted by the risk assessment. Therefore, an IS auditor should recommend to management that completing a risk assessment is the most important action before selecting a SaaS vendor.

  References: SaaS checklist: Nine factors to consider when selecting a vendor SaaS vendor management: 10 best practices to achieve success Best Practices for Software SaaS Vendor Selection and Negotiation How to Evaluate SaaS Providers and Solutions by Developing ... - Gartner

• Question 684:

  In which of the following payment mode, the payer creates payment transfer instructions, signs it digitally and sends it to issuer?

  A. Electronic Money Model
  B. Electronics Checks model
  C. Electronic transfer model
  D. Electronic withdraw model
  C. Electronic transfer model

  ---

  Explanation

  Electronic systems are simplest of three payment models. The payer simply creates a payment transfer instructions, sign it digitally and send it to issuer. The issuer then verifies the signature on the request and performs the transfer. This type of systems requires payer to be on-line and not payee.

  For CISA exam you should know below information about payment systems

  There are two types of parties involved in all payment systems ?the issuer and the user. An issuer is an entity that operates the payment service. An issuer holds the items that the payment represents. The user of the payment service performs two main functions ?making payments and receiving payments ?and therefore can be described as a payer or payee receptively.

  Electronic Money Model ?The objective of electronic money systems is emulating physical cash. An issuer attempts to do this by creating digital certificates, which are then purchased by users who redeem them with the issuer at a later date. In the interim, certificates can be transferred among users to trade for goods or services. For the certificate to take on some of the attributes of physical cash, certain techniques are used so that when a certificate is deposited, the issuer can not determine the original withdrawer of the certificate. This provides an electronic certificate with unconditional uncertainty.

  Electronic Check Model ?Electronic check system model real-world checks quite well and thus relatively simple to understand and implement. A users write an electronic check, which is digitally signed instruction to pay. This is transferred to another user, who then deposits the electronic check with the issuer. The issuer will verify payer's signature on the payment and transfer the fund from the payer's account to the payee's account.

  Electronic Transfer Model ?Electronic systems are simplest of three payment models. The payer simply creates a payment transfer instructions, sign it digitally and send it to issuer. The issuer then verifies the signature on the request and performs the transfer. This type of systems requires payer to be on-line and not payee.

  The following were incorrect answers:

  Electronic Money Model ?The objective of electronic money systems is emulating physical cash. An issuer attempts to do this by creating digital certificates, which are then purchased by users who redeem them with the issuer at a later date. In the interim, certificates can be transferred among users to trade for goods or services. For the certificate to take on some of the attributes of physical cash, certain techniques are used so that when a certificate is deposited, the issuer can not determine the original withdrawer of the certificate. This provides an electronic certificate with unconditional uncertainty.

  Electronic Check Model ?Electronic check system model real-world checks quite well and thus relatively simple to understand and implement. A users write an electronic check, which is digitally signed instruction to pay. This is transferred to another user, who then deposits the electronic check with the issuer. The issuer will verify payer's signature on the payment and transfer the fund from the payer's account to the payee's account.

  Electronic Withdraw Model ?Not a valid type of payment system.

  CISA review manual 2014 Page number 183

• Question 685:

  Which of the following is the BEST reason for an organization to use clustering?

  A. To decrease system response time
  B. To Improve the recovery lime objective (RTO)
  C. To facilitate faster backups
  D. To improve system resiliency
  D. To improve system resiliency

  ---

  Explanation

  Clustering is a technique that groups multiple servers or nodes together to act as one system, providing high availability, scalability, and load balancing for applications or services. Clustering can improve system resiliency, which is the ability of a system to withstand or recover from failures or disruptions without compromising its functionality or performance. Clustering can achieve this by providing redundancy and fault tolerance for critical components or processes, enabling automatic failover and recovery in case of node failures, distributing workload among multiple nodes to avoid overloading or bottlenecks, and allowing dynamic addition or removal of nodes to meet changing demand or capacity needs. Clustering may also decrease system response time by improving performance and efficiency through load balancing and parallel processing, but this is not its primary purpose. Clustering may facilitate faster backups by enabling concurrent backup operations across multiple nodes, but this is not its main benefit. Clustering may improve the recovery time objective (RTO), which is the maximum acceptable time for restoring a system or service after a disruption, by reducing the downtime and data loss caused by failures, but this is not the best reason for using clustering, as there may be other factors that affect the RTO, such as backup frequency, recovery procedures, and testing methods.

• Question 686:

  Which of the following would BEST prevent an arbitrary application of a patch?

  A. Database access control
  B. Established maintenance windows
  C. Network based access controls
  D. Change management
  D. Change management

  ---

  Explanation

• Question 687:

  An IS auditor has found that an organization is unable to add new servers on demand in a cost-efficient manner. Which of the following is the auditor's BEST recommendation?

  A. Increase the capacity of existing systems.
  B. Upgrade hardware to newer technology.
  C. Hire temporary contract workers for the IT function.
  D. Build a virtual environment.
  D. Build a virtual environment.

  ---

  Explanation

  The best recommendation for an organization that is unable to add new servers on demand in a cost-efficient manner is to build a virtual environment. A virtual environment is a technology that allows multiple virtual machines to run on a single physical server, sharing its resources and capabilities. A virtual environment can help the organization add new servers on demand in a cost-efficient manner by reducing the need for hardware acquisition, maintenance, and power consumption. The other options are not as effective as building a virtual environment, as they do not address the root cause of the problem or provide the same benefits. Increasing the capacity of existing systems is a short-term solution that can help improve the performance and availability of the current servers, but it does not enable the organization to add new servers on demand in a cost- efficient manner. Upgrading hardware to newer technology is a costly solution that can help enhance the functionality and reliability of the servers, but it does not enable the organization to add new servers on demand in a cost-efficient manner. Hiring temporary contract workers for the IT function is an irrelevant solution that can help supplement the IT staff's skills and knowledge, but it does not enable the organization to add new servers on demand in a cost-efficient manner.

  References: CISA Review Manual (Digital Version), Chapter 3, Section 3.3.1

• Question 688:

  Which of the following would provide the STRONGEST indication that senior management commitment to information security is lacking within an organization?

  A. Inconsistent enforcement of information security policies
  B. A reduction in information security investment
  C. A high of information security risk acceptance
  D. The information security manager reports to the chief risk officer
  A. Inconsistent enforcement of information security policies

  ---

  Explanation

• Question 689:

  An IS auditor discovers that a developer has used the same key to grant access to multiple applications making calls to an application programming interface (API). Which of the following is the BEST recommendation to address this situation?

  A. Replace the API key with time-limited tokens that grant least privilege access.
  B. Authorize the API key to allow read-only access by all applications.
  C. Implement a process to expire the API key after a previously agreed-upon period of time.
  D. Coordinate an API key rotation exercise with all impacted application owners.
  A. Replace the API key with time-limited tokens that grant least privilege access.

  ---

  Explanation

• Question 690:

  An external attacker spoofing an internal Internet Protocol (IP) address can BEST be detected by which of the following?

  A. Comparing the source address to the domain name server (DNS) entry
  B. Using static IP addresses for identification
  C. Comparing the source address to the interface used as the entry point
  D. Using a state table to compare the message states of each packet as it enters the system
  D. Using a state table to compare the message states of each packet as it enters the system

  ---

  Explanation