CISA PDF Dumps Real 2023 Recently Updated Questions [Q119-Q138]

CISA PDF Dumps Real 2023 Recently Updated Questions

Released ISACA CISA Updated Questions PDF

Information Systems Acquisition, Development, & Implementation: This subject will measure the candidates’ skills in the following subtopics:

• Information systems implementation – testing methodologies; system migration, data conversion, and infrastructure deployment; post-implementation review.
• Information system acquisition and development – project management and governance; control identification & design; system development methodologies; business case & feasibility analysis;

What Are Topics Tested in ISACA CISA Certification Exam?

The skills tested in the CISA exam include the following domains:

• Information Systems Implementation, Development, and Acquisition (12%);
• Business Resilience and Operation of Information Systems (23%);
• IT Governance and Management (17%);
• Auditing Process of Information System (21%);
• Information Assets Protection (27%).

The first topic is split into two parts. Therefore, candidates will need to demonstrate their skills in planning and executing the IS auditing process. The first subsection includes questions that will test the candidates’ ability to manage IS audit standards, and apply the ISACA code of ethics. Also, they will need to show their experience in developing business processes and choose the right types of controls to improve business performance. Besides, they should be experts in risk-based audit planning and develop the right types of audits and assessments. The second subtopic focuses on concepts like audit project management and sampling methodology. Also, examinees should know how to audit evidence collection techniques and work with data analytics, as well as reporting and communication techniques.

Within the second domain, examinees will need to ensure IT governance and IT management. This means that they should be proficient in developing a coherent IT strategy and governance. Also, they should develop IT-related frameworks, standards, procedures, and policies. Candidates should be skilled in ensuring a correct organizational structure and enterprise architecture. They should also show maturity in handling enterprise risk management features and comply with the laws and the organization’s standards. When it comes to IT management, applicants should know how to manage IT resources and manage IT service provider acquisition. Last but not least, they should ensure correct monitoring and reporting of IT performance and focus on IT quality assurance and management.

The third chapter focuses on information systems acquisition and development. Candidates should demonstrate their ability to govern and manage projects as well as develop a correct business case and feasibility analysis. Examinees will be required to answer questions related to system development methodologies and control design and identification features. The second subtopic included in this section handles Information Systems implementation. Thus, applicants will need to master testing methodologies and know how to configure and release the right management tools. Candidates should also focus on infrastructure deployment, data conversion, and system migration. The post-implementation review is also an important topic included here.

The fourth chapter concentrates on business resilience and information systems operations. Examinees will need to demonstrate how familiar they are with Business Impact Analysis, system resiliency, Business Continuity Plans, and Disaster Recovery Plans. These skills show the candidates’ expertise in coming up with solutions that ensure business continuity in case something doesn’t work as planned. This chapter also asks candidates to demonstrate that they know how to manage Common Technology components, master data governance, and end-user computing. Besides, they should be experienced in handling IT Service Level Agreements and Database Management. Applicants should also find the correct answer to questions related to Problem and Incident as well as Systems Performance Management.

The final topic handles information asset protection. Exam-takers should demonstrate that they understand how privacy principles work or if they are able to ensure network and end-point security. Also, they should be experienced in managing virtualization environments and work with Public Key Infrastructure. It is also essential that examinees understand how to manage Physical Access and Environmental controls as well as manage information asset security frameworks, guidelines, and standards. They should also know how to handle different security techniques dedicated to testing and monitoring. Besides, candidates should be proficient in managing incident response and handle evidence collection & forensics.

NEW QUESTION 119
Which of the following is the BEST development methodology to help manage project requirements in a rapidly changing environment?

 Prototyping

 Iterative development process

 Object-oriented system development

 Waterfall development process

NEW QUESTION 120
What is the BEST way to control updates to the vendor master file in an accounts payable system?

 Using prenumbered and authorized request forms

 Having only one person updating the master file

 Periodically reviewing the entire vendor master file

 Comparing updates against authorization

NEW QUESTION 121
An IS auditor is reviewing a data conversion project Which of the following is the auditor’s BEST recommendation prior to golive?

 Establish a conliguiation baseline.

 Conduct a mock conversion test.

 Automate the test scripts

 Review test procedures and scenarios

NEW QUESTION 122
An intruder accesses an application server and makes changes to the system log. Which of the following
would enable the identification of the changes?

 Mirroring the system log on another server

 Simultaneously duplicating the system log on a write-once disk

 Write-protecting the directory containing the system log

 Storing the backup of the system log offsite

Section: Protection of Information Assets
Explanation:
A write-once CD cannot be overwritten. Therefore, the system log duplicated on the disk could be
compared to the original log to detect differences, which could be the result of changes made by an
intruder. Write-protecting the system log does not prevent deletion or modification, since the superuser can
override the write protection. Backup and mirroring may overwrite earlier files and may not be current.

NEW QUESTION 123
Which of the following is the MOST important consideration when establishing vulnerability scanning on critical IT infrastructure?

 The scanning will be performed during non-peak hours.

 The scanning will be cost-effective.

 The scanning will be followed by penetration testing.

 The scanning will not degrade system performance.

NEW QUESTION 124
The most likely error to occur when implementing a firewall is:

 incorrectly configuring the access lists.

 compromising the passwords due to social engineering.

 connecting a modem to the computers in the network.

 inadequately protecting the network and server from virus attacks.

Section: Protection of Information Assets
Explanation:
An updated and flawless access list is a significant challenge and, therefore, has the greatest chance for errors at the time of the initial installation. Passwords do not apply to firewalls, a modem bypasses a firewall and a virus attack is not an element in implementing a firewall.

NEW QUESTION 125
Digital signatures require the:

 signer to have a public key and the receiver to have a private key.

 signer to have a private key and the receiver to have a public key.

 signer and receiver to have a public key.

 signer and receiver to have a private key.

Section: Protection of Information Assets
Explanation:
Digital signatures are intended to verify to a recipient the integrity of the data and the identity of the sender.
The digital signature standard is a public key algorithm. This requires the signer to have a private key and
the receiver to have a public key.

NEW QUESTION 126
Which of the following is MOST important for an IS auditor to verify when evaluating an organization’s data conversion and infrastructure migration plan?

 Strategic: goals have been considered.

 A rollback plan is included.

 A code check review is included.

 A migration steering committee has been formed.

NEW QUESTION 127
Two servers are deployed in a cluster to run a mission-critical application. To determine whether the system has been designed for optimal efficiency, the IS auditor should verify that:

 the security features in the operating system are all enabled

 the number of disks in the cluster meets minimum requirements

 the two servers are of exactly the same configuration

 load balancing between the servers has been implemented

NEW QUESTION 128
Many organizations require an employee to take a mandatory vacation (holiday) of a week or more to:

 ensure the employee maintains a good quality of life, which will lead to greater productivity.

 reduce the opportunity for an employee to commit an improper or illegal act.

 provide proper cross-training for another employee.

 eliminate the potential disruption caused when an employee takes vacation one day at a time.

Required vacations/holidays of a week or more in duration in which someone other than the regular employee performs the job function is often mandatory for sensitive positions, as this reduces the opportunity to commit improper or illegal acts. During this time it may be possible to discover any fraudulent activity that was taking place. Choices A, C and D could all be organizational benefits from a mandatory vacation policy, but they are not the reason why the policy is established.

NEW QUESTION 129
.An off-site processing facility should be easily identifiable externally because easy identification helps ensure smoother recovery. True or false?

 True

 False

An off-site processing facility should not be easily identifiable externally because easy identification would create an additional vulnerability for sabotage.

NEW QUESTION 130
When an information security manager presents an information security program status report to senior management, the MAIN focus should be:

 key performance indicators (KPIs)

 critical risks indicators

 net present value (NPV)

 key controls evaluation

Section: Governance and Management of IT

NEW QUESTION 131
Which of the following is MOST likely to be spoofed in an email transmission?

 The path the message traveled through the Internet

 The identity of the sending host

 The identity of the receiving host

 The identity of the sender

NEW QUESTION 132
During a business continuity audit an IS auditor found that the business continuity plan
(BCP) covered only critical processes. The IS auditor should:

 recommend that the BCP cover all business processes.

 assess the impact of the processes not covered.

 report the findings to the IT manager.

 redefine critical processes.

The business impact analysis needs to be either updated or revisited to assess the risk of not covering all processes in the plan. It is possible that the cost of including all processes might exceed the value of those processes; therefore, they should not be covered. An IS auditor should substantiate this by analyzing the risk.

NEW QUESTION 133
Which of the following is a distinctive feature of the Secure Electronic Transactions (SET) protocol when used for electronic credit card payments?

 The buyer is assured that neither the merchant nor any other party can misuse their credit card data.

 All personal SET certificates are stored securely in the buyer’s computer.

 The buyer is liable for any transaction involving his/her personal SET certificates.

 The payment process is simplified, as the buyer is not required to enter a credit card number and an expiration date.

Explanation/Reference:
Explanation:
The usual agreement between the credit card issuer and the cardholder stipulates that the cardholder assumes responsibility for any use of their personal SET certificates for e-commerce transactions.
Depending upon the agreement between the merchant and the buyer’s credit card issuer, the merchant will have access to the credit card number and expiration date. Secure data storage in the buyer’s computer (local computer security) is not part of the SET standard. Although the buyer is not required to enter their credit card data, they will have to handle the wallet software.

NEW QUESTION 134
Which of the following testing method examines the functionality of an application without peering into its internal structure or knowing the details of it’s internals?

 Black-box testing

 Parallel Test

 Regression Testing

 Pilot Testing

Explanation/Reference:
Black-box testing is a method of software testing that examines the functionality of an application (e.g.
what the software does) without peering into its internal structures or workings (see white-box testing).
This method of test can be applied to virtually every level of software testing: unit, integration, system and acceptance. It typically comprises most if not all higher level testing, but can also dominate unit testing as well.
For your exam you should know the information below:
Alpha and Beta Testing – An alpha version is early version is an early version of the application system submitted to the internal user for testing. The alpha version may not contain all the features planned for the final version. Typically, software goes to two stages testing before it consider finished. The first stage is called alpha testing is often performed only by the user within the organization developing the software.
The second stage is called beta testing, a form of user acceptance testing, generally involves a limited number of external users. Beta testing is the last stage of testing, and normally involves real world exposure, sending the beta version of the product to independent beta test sites or offering it free to interested user.
Pilot Testing -A preliminary test that focuses on specific and predefined aspect of a system. It is not meant to replace other testing methods, but rather to provide a limited evaluation of the system. Proof of concept are early pilot tests – usually over interim platform and with only basic functionalities.
White box testing – Assess the effectiveness of a software program logic. Specifically, test data are used in determining procedural accuracy or conditions of a program’s specific logic path. However, testing all possible logical path in large information system is not feasible and would be cost prohibitive, and therefore is used on selective basis only.
Black Box Testing – An integrity based form of testing associated with testing components of an information system’s “functional” operating effectiveness without regards to any specific internal program structure. Applicable to integration and user acceptance testing.
Function/validation testing – It is similar to system testing but it is often used to test the functionality of the system against the detailed requirements to ensure that the software that has been built is traceable to customer requirements.
Regression Testing -The process of rerunning a portion of a test scenario or test plan to ensure that changes or corrections have not introduced new errors. The data used in regression testing should be same as original data.
Parallel Testing – This is the process of feeding test data into two systems – the modified system and an alternative system and comparing the result.
Sociability Testing -The purpose of these tests is to confirm that new or modified system can operate in its target environment without adversely impacting existing system. This should cover not only platform that will perform primary application processing and interface with other system but, in a client server and web development, changes to the desktop environment. Multiple application may run on the user’s desktop, potentially simultaneously, so it is important to test the impact of installing new dynamic link libraries (DLLs), making operating system registry or configuration file modification, and possibly extra memory utilization.
The following answers are incorrect:
Parallel Testing – This is the process of feeding test data into two systems – the modified system and an alternative system and comparing the result.
Regression Testing -The process of rerunning a portion of a test scenario or test plan to ensure that changes or corrections have not introduced new errors. The data used in regression testing should be same as original data.
Pilot Testing -A preliminary test that focuses on specific and predefined aspect of a system. It is not meant to replace other testing methods, but rather to provide a limited evaluation of the system. Proof of concept are early pilot tests – usually over interim platform and with only basic functionalities The following reference(s) were/was used to create this question:
CISA review manual 2014 Page number 167
Official ISC2 guide to CISSP CBK 3rd Edition Page number 176

NEW QUESTION 135
Which of the following is the GREATEST benefit of adopting an international IT governance framework rather than establishing a new framework based on the actual situation of a specific organization1?

 Readily available resources such as domains and risk and control methodologies

 Comprehensive coverage of fundamental and critical risk and control areas for IT governance

 Fewer resources expended on trial-and-error attempts to fine-tune implementation methodologies

 Wide acceptance by different business and support units with IT governance objectives

NEW QUESTION 136
Business process re-engineering often results in ___________________ automation, which results in
____________ number of people using technology. Fill in the blanks.

 Increased; a greater

 Increased; a fewer

 Less; a fewer

 Increased; the same

Explanation/Reference:
Explanation:
Business process re-engineering often results in increased automation, which results in a greater number of people using technology.

NEW QUESTION 137
A company has decided to implement an electronic signature scheme based on public key infrastructure.
The user’s private key will be stored on the computer’s hard drive and protected by a password. The MOST significant risk of this approach is:

 use of the user’s electronic signature by another person if the password is compromised.

 forgery by using another user’s private key to sign a message with an electronic signature.

 impersonation of a user by substitution of the user’s public key with another person’s public key.

 forgery by substitution of another person’s private key on the computer.

Explanation/Reference:
Explanation:
The user’s digital signature is only protected by a password. Compromise of the password would enable access to the signature. This is the most significant risk. Choice B would require subversion of the public key infrastructure mechanism, which is very difficult and least likely.
Choice C would require that the message appear to have come from a different person and therefore the true user’s credentials would not be forged. Choice D has the same consequence as choice C.

NEW QUESTION 138
The PRIMARY reason an IS department should analyze past incidents and problems is to:

 determine if all incidents and problems are reported

 assess help desk performance

 assign responsibility for problems.

 identify the causes of recurring incidents and problems.

 Loading …

The ISACA CISA (Certified Information Systems Auditor) Certification Exam is a globally recognized certification for professionals in the field of information systems auditing. It is designed to test the knowledge, skills, and abilities of candidates in five domains related to information systems auditing. The certification is highly regarded in the industry and is recognized by employers worldwide, making it an excellent choice for professionals looking to advance their careers in this field.

CISA Dumps and Practice Test (690 Exam Questions): https://www.actualcollection.com/CISA-exam-questions.html

Related Links: myportal.utt.edu.tt myportal.utt.edu.tt myportal.utt.edu.tt myportal.utt.edu.tt myportal.utt.edu.tt www.stes.tyc.edu.tw