[2022] Use Valid CISA Exam – Actual Exam Question & Answer [Q32-Q54]

5/5 - (1 vote)

[2022] Use Valid CISA Exam – Actual Exam Question & Answer

Test Engine to Practice CISA Test Questions

ISACA Certified CISA Salary

Salary for ISACA Certified CISA is different for different jobs titles and experience. Salaries for different jobs title is as follows:

Senior Information Security Auditor 85,000 – 116,000 USD
Information Technology Auditor USD 63,000 – 97,000 USD
Internal Audit Manager 96,000- 134,000 USD
Internal Audit Director 124,000 – 192,000 USD
Information Technology Manager 105,000 – 149,000 USD

NEW QUESTION 32
Following an IS audit, which of the following types of risk would be MOST critical to communicate to key stakeholders?

Residual

Audit

Inherent

Control

NEW QUESTION 33
The security level of a private key system depends on the number of:

encryption key bits.

messages sent.

keys.

channels used.

NEW QUESTION 34
Which of the following is the BEST performance criterion for evaluating the adequacy of an organization’s security awareness training?

Senior management is aware of critical information assets and demonstrates an adequate concern for their protection.

Job descriptions contain clear statements of accountability for information security.

In accordance with the degree of risk and business impact, there is adequate funding for security efforts.

No actual incidents have occurred that have caused a loss or a public embarrassment.

NEW QUESTION 35
An organization considers implementing a system that uses a technology that is not in line with the organization’s IT strategy. Which of the following is the BEST justification for deviating from the IT strategy?

The system makes use of state-of-the-art technology

The organization has staff familiar with the technology

The system has a reduced cost of ownership

The business benefits are achieved even with extra costs

NEW QUESTION 36
What is the best defense against Distributed DoS Attack?

patch your systems.

run a virus checker.

run an anti-spy software.

find the DoS program and kill it.

None of the choices.

NEW QUESTION 37
During a post-incident review of a security breach, what type of analysis should an IS auditor expect to be performed by the organization’s information security team?

Gap analysis

Business impact analysis (BIA)

Qualitative risk analysis

Root cause analysis

NEW QUESTION 38
Which of the following techniques is MOST appropriate for verifying application program controls?

Statistical sampling

Code review

Use of test data

Observation of data entry

NEW QUESTION 39
Which of the following security risks can be reduced by a properly configured network firewall?

Phishing attacks

Insider attacks

Denial of service (DoS) attacks

SQL injection attacks

NEW QUESTION 40
An IS auditor notes that application super-user activity was not recorded in system logs. What is the auditor’s BEST course of action?

Investigate the reason for the lack of logging

Recommend a least privilege access model

Recommend activation of super user activity logging

Report the issue to the audit manager

NEW QUESTION 41
In a follow-up audit, an IS auditor notes that management has addressed the original findings in a different way than originally agreed upon. The auditor should FIRST:

escalate the deviation to the audit committee.

mark the recommendation as satisfied and close the finding.

verify if management’s action mitigates the identified risk

re-perform the audit to assess the changed control environment

NEW QUESTION 42
Which of the following access control situations represents the MOST serious control weakness?

Computer operators have access to system level flowcharts.

Programmers have access to development hardware.

End users have access to program development tools.

System developers have access to production data.

NEW QUESTION 43
Which of the following is the BEST use of a balanced scorecard when evaluating IT performance?

Determining compliance with relevant regulatory requirements

Monitoring alignment of the IT project portfolio to budget

Monitoring alignment of IT with the rest of the organization

Evaluating implementation of the business strategy

NEW QUESTION 44
Default permit is only a good approach in an environment where:

security threats are non-existent or negligible.

security threats are non-negligible.

security threats are serious and severe.

users are trained.

None of the choices.

NEW QUESTION 45
.Rather than simply reviewing the adequacy of access control, appropriateness of access policies, and effectiveness of safeguards and procedures, the IS auditor is more concerned with effectiveness and utilization of assets. True or false?

True

False

NEW QUESTION 46
Which of the following findings should hr of GREATEST concern for an IS auditor when auditing the effectiveness of a phishing simulation test administered for staff members?

Test results were not communicated to staff members

Staff members who failed the test did not receive follow-up education

Security awareness training was not provided poor to the test

Staff members were not notified about the test beforehand

NEW QUESTION 47
An organization has recently incorporated robotic process automation (RPA) Which of the following should be of GREATEST concern to an IS auditor?

A governance framework has not been Implemented

Controls have not been tested

A risk assessment has not been conducted

A steering committee has not been established

NEW QUESTION 48
Which of the following is an IS auditor s GREATEST concern when an organization does not regularly update software on individual workstations in the internal environment?

The organization may be more susceptible to cyber-attacks.

The organization may not be in compliance with licensing agreement.

System functionality may not meet business requirements.

The system may have version control issues.

NEW QUESTION 49
During an audit of an enterprise that is dedicated to e-commerce, the IS manager states that digital signatures are used when receiving communications from customers. To substantiate this, an IS auditor must prove that which of the following is used?

A biometric, digitalized and encrypted parameter with the customer’s public key

A hash of the data that is transmitted and encrypted with the customer’s private key

A hash of the data that is transmitted and encrypted with the customer’s public key

The customer’s scanned signature encrypted with the customer’s public key

NEW QUESTION 50
An IS auditor finds that a DBA has read and write access to production data. The IS auditor should:

accept the DBA access as a common practice.

assess the controls relevant to the DBA function.

recommend the immediate revocation of the DBA access to production data.

review user access authorizations approved by the DBA.

NEW QUESTION 51
Which of the following internet security threats could compromise integrity?

Theft of data from the client

Exposure of network configuration information

A Trojan horse browser

Eavesdropping on the net

NEW QUESTION 52
Which of the following is MOST important for an information security manager to ensure is included in a
business case for a new system?

Intangible benefits of the system

Risk associated with the system

Effectiveness of controls

Audit-logging capabilities

NEW QUESTION 53
Which of the following intrusion detection systems (IDSs) monitors the general patterns of activity and
traffic on a network and creates a database?

Signature-based

Neural networks-based

Statistical-based

Host-based

NEW QUESTION 54
To prevent IP spoofing attacks, a firewall should be configured to drop a packet if:

the source routing field is enabled.

it has a broadcast address in the destination field.

a reset flag (RST) is turned on for the TCP connection.

dynamic routing is used instead of static routing.

For more info visit:

ISACA CISA Certification Exam Reference

Governance & Management of IT: This section is designed to evaluate one’s capability to identify different critical concerns and recommend specific enterprise practices to safeguard and support information governance and related technologies. These include the following:

IT Management – IT resource management; service provider management and acquisition; quality management and quality assurance of IT; IT performance reporting and monitoring.
IT Governance – IT governance & IT strategy; IT policies, procedures, and standards; IT-related frameworks; organizational and enterprise structures; enterprise risk management; maturity models;

CISA Actual Questions Answers PDF 100% Cover Real Exam Questions: https://www.braindumpstudy.com/CISA_braindumps.html