Certified Information Systems Auditor Exam Prep And Dumps Exam Review Guide for ISACA CISA Exam PART 2

Certified Information Systems Auditor

Exam Prep And Dumps

Exam Review Guide for ISACA CISA Exam PART 2

Copyright © 2023 by Byte Books

All rights reserved. No part of this book may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, electronic, mechanical, photocopying, recording, or otherwise, without the prior written permission of the publisher, except for brief quotations embodied in critical reviews and certain other noncommercial uses permitted by copyright law.

For permissions inquiries or to request permission to use specific content from this book, please contact the publisher at:

Any individual or entity found infringing upon the copyright of this book will be liable for damages and legal expenses incurred as a result of such infringement.

While every effort has been made to ensure the accuracy and completeness of the information contained in this book, the author and the publisher assume no responsibility for errors or omissions or for any consequences arising from the use of the information contained herein.

Cover design and layout by Lara McCarthy.

First Edition:  Aug 2023

Welcome to Byte Books: Your Path to Exam Success!

At Byte Books, we are dedicated to helping aspiring professionals achieve their career goals through comprehensive exam certification guides and practice questions. We understand that exams can be daunting, and the path to success may seem challenging. That's why we're here to provide you with the knowledge, confidence, and support you need to excel in your chosen field.

Our Mission: Empowering Your Success

Our mission is simple yet powerful: to empower your success. We believe that with the right study materials and guidance, you can overcome any exam hurdle and unlock new opportunities for personal and professional growth. At Byte Books, we go the extra mile to curate top-notch resources that cater to a wide range of certification exams, covering various industries and professions.

QUESTION 476

Which of the following would BEST provide an information security manager with sufficient assurance that a service provider complies with organization’s information security requirements?

A live demonstration of the third-party supplier’s security capabilities

Third-party security control self-assessment results

An independent review report indicating compliance with industry standards

The ability to audit the third-party supplier’s IT systems and processes

QUESTION 477

A design company has multiple name and address files for its customers in several of its independent systems. Which of the following is the BEST control to ensure that the customer name and address agree across all files?

Use of hash totals on customer records

Periodic review of each master file by management

Matching of records and review of exception reports

Use of authorized master file change forms

QUESTION 478

Which of the following is MOST important for an organization to complete when planning a new marketing platform that targets advertising based on customer behavior?

Data privacy impact assessment

Data quality assessment

Cross-border data transfer assessment

Security vulnerability assessment

QUESTION 479

Which of the following is the client organization’s responsibility in a Software as a Service (SaaS) environment?

Detecting unauthorized access

Ensuring that users are properly authorized

Ensuring the data is available when needed

Preventing insertion of malicious code

QUESTION 480

An existing system is being replaced with a new application package. User acceptance testing (UAT) should ensure that:

data from the old system has been converted correctly

the new system functions as expected

the new system is better than the old system

there is a business need for the new system

––––––––

QUESTION 481

An employee of an organization has reported losing a smartphone that contains sensitive information. The BEST step to address this situation should be to:

terminate the device connectivity

escalated to the user’s management

disable the user’s access to corporate resources

remotely wipe the device

QUESTION 482

In an organization that has undergone an expansion through an acquisition, which of the following would BEST secure the enterprise network?

Business or role-based segmentation

Using security groups

Log analysis of system access

Encryption of data traversing networks.

––––––––

QUESTION 483

Which type of control is being implemented when a biometric access device is installed at the entrance to a facility?

Preventive

Deterrent

Corrective

Detective

QUESTION 484

Which of the following is the BEST physical security solution for granting and restricting access to individuals based on their unique access needs?

Bolting door locks

Cipher locks

Closed-circuit television (CCTV)

Electronic badge system

QUESTION 485

Which of the following methods should be used to purge confidential data from write-once optical media?

Degauss the media.

Destroy the media.

Remove the references to data from the access index.

Write over the data with null values.

QUESTION 486

Which of the following is the MOST effective way to minimize the risk of a SQL injection attack?

Reconfiguring content filtering settings

Performing activity monitoring

Using secure coding practices

Implementing an intrusion detection tool

QUESTION 487

When planning for the implementation of a new system, an organization will opt for a parallel run PRIMARILY to:

ensure that the system meets required user response time.

validate system processing.

facilitate the training of new personnel.

verify that system interfaces were implemented.

QUESTION 488

In a typical network architecture used for e-commerce, a load balancer is normally found between the:

routers and the web servers.

mail servers and the mail repositories.

users and the external gateways.

databases and the external gateways.

QUESTION 489

An organization is choosing key performance indicators (KPIs) for its information security management. Which of the following KPIs would provide stakeholders with the MOST useful information about whether information security risk is being managed?

Time from initial reporting of an incident to appropriate escalation

Time from identifying a security threat to implementing a solution

The number of security controls implemented

The number of security incidents during the past quarter

QUESTION 490

Which of the following control checks would utilize data analytics?

Evaluating configuration settings for the credit card application system

Reviewing credit card applications submitted in the past month for blank data fields

Attempting to submit credit card applications with blank data fields

Reviewing the business requirements document for the credit card application system

QUESTION 491

Which of the following is the BEST way to control scope creep during application system development?

Involve key stakeholders.

Implement project steering committee review.

Implement a quality management system.

Establish key performance indicators (KPIs).

QUESTION 492

An organization is using a single account shared by personnel for its social networking marketing page. Which of the following is the BEST method to maintain accountability over the account?

Reviewing access rights on a periodic basis

Integrating the account with a single sign-on

Regular monitoring of proxy server logs

Implementing an account password check-out process

QUESTION 493

When using a newly implemented security information and event management (SIEM) infrastructure, which of the following should be considered FIRST?

Report distribution

Encryption

Tuning

Retention

QUESTION 494

An organization has an approved bring your own device (BYOD) program. Which of the following is the MOST effective method to enforce application control on personal devices?

Implement a mobile device management solution.

Establish a mobile device acceptable use policy.

Implement a web application firewall.

Educate users regarding the use of approved applications.

QUESTION 495

An organization’s HR department would like to outsource its employee management system to a cloud-hosted solution due to features and cost savings offered. Management has identified this solution as a business need and wants to move forward. What should be the PRIMARY role of information security in this effort?

Ensure a security audit is performed of the service provider.

Ensure the service provider has the appropriate certifications.

Determine how to securely implement the solution.

Explain security issues associated with the solution to management.

––––––––

QUESTION 496

An emergency change was made to an IT system as a result of a failure. Which of the following should be of GREATEST concern to the organization’s information security manager?

The operations team implemented the change without regression testing.

The change did not include a proper assessment of risk.

Documentation of the change was made after implementation.

The information security manager did not review the change prior to implementation.

QUESTION 497

Which of the following is MOST critical to the successful implementation of information security within an organization?

Strong risk management skills exist within the information security group.

Budget is allocated for information security tools.

The information security manager is responsible for setting information security policy.

Security is effectively marketed to all managers and employees.

QUESTION 498

An organization implemented a mandatory information security awareness training program a year ago. What is the BEST way to determine its effectiveness?

Analyze responses from an employee survey on training satisfaction.

Analyze results from training completion reports.

Analyze results of a social engineering test.

Analyze findings from previous audit reports.

QUESTION 499

Planning for the implementation of an information security program is MOST effective when it:

uses risk-based analysis for security projects.

applies technology-driven solutions to identified needs.

uses decision trees to prioritize security projects.

applies gap analysis to current and future business plans.

QUESTION 500

The MOST important factors in determining the scope and timing for testing a business continuity plan are:

manual processing capabilities and the test location.

the importance of the function to be tested and the cost of testing.

the experience level of personnel and the function location.

prior testing results and the degree of detail of the business continuity plan.

QUESTION 501

An application development team is also promoting changes to production for a critical financial application. Which of the following would be the BEST control to reduce the associated risk?

Implementing a change management code review

Implementing a peer review process

Performing periodic audits

Submitting change logs to the business manager for review

––––––––

QUESTION 502

A start-up organization wants to develop a data loss prevention program (DLP). The FIRST step should be to implement:

data encryption.

access controls.

data classification.

security awareness training.

––––––––

QUESTION 503

An organization is in the process of rolling out a new inventory software tool to replace a suite of verified individual spreadsheet-based inventory solutions. Which of the following is MOST important to help ensure ongoing data integrity within the new inventory tool?

Restricting edit access for the new tool to data owners only

Ensuring data quality at the point of data entry

Requiring key inventory data points to be mandatory fields in the new tool

Conducting a post-migration quality assurance review

––––––––

QUESTION 504

Which of the following is the BEST methodology to use for estimating the complexity of developing a large business application?

Function point analysis

Software cost estimation

Work breakdown structure

Critical path analysis

––––––––

QUESTION 505

Which is the PRIMARY objective of evaluating the readiness of information systems for implementation?

Determine whether IT systems projects are on schedule.

Determine whether the systems comply with the organization’s policy.

Determine whether the systems meet user requirements.

Determine whether the systems meet business requirements.

QUESTION 506

An organization is considering allowing users to connect personal devices to the corporate network. Which of the following should be done FIRST?

Configure users on the mobile device management solution.

Create inventory records of personal devices.

Implement an acceptable use policy.

Conduct security awareness training.

QUESTION 507

Which of the following is MOST important for the successful establishment of a security vulnerability management program?

A comprehensive asset inventory

A tested incident response plan

An approved patching policy

A robust tabletop exercise plan

––––––––

QUESTION 508

An organization’s audit charter should:

set the enterprise strategic direction.

detail the audit objectives.

define the auditors’ right to access information.

include the IS audit plan.

––––––––

QUESTION 509

Which of the following is the MOST important privacy consideration for an organization that uses a cloud service provider to process customer data?

Data privacy must be monitored in accordance with industry standards and best practices.

All customer data transferred to the service provider must be reported to the regulatory authority.

No personal information may be transferred to the service provider without the consent of the customer.

Data privacy must be managed in accordance with the regulations applicable to the organization.

––––––––

QUESTION 510

Which of the following is critical to the successful establishment of an enterprise IT architecture?

A well-defined data migration policy

Comparison of the architecture with that of other organizations

An architecture encompassing only critical systems

Organizational support for standardization

QUESTION 511

The MAIN consideration when designing an incident escalation plan should be ensuring that:

information assets are classified.

appropriate stakeholders are involved.

high-impact risks have been identified.

requirements cover forensic analysis.

QUESTION 512

Which of the following should be an information security manager’s MOST important consideration when conducting a physical security review of a potential outsourced data center?

Environmental factors of the surrounding location

Proximity to law enforcement

Availability of network circuit connections

Distance of the data center from the corporate office

QUESTION 513

An organization is deciding whether to outsource its customer relationship management systems to a provider located in another country. Which of the following should be the PRIMARY influence in the outsourcing decision?

Time zone differences

The service provider’s disaster recovery plan

Cross-border privacy laws

Current geopolitical conditions

QUESTION 514

An organization is MOST at risk from a new worm being introduced through the intranet when:

executable code is run from inside the firewall

system software does not undergo integrity checks

hosts have static IP addresses

desktop virus definition files are not up to date

QUESTION 515

During a post-incident review. the sequence and correlation of actions must be analyzed PRIMARLY based on:

interviews with personnel

a consolidated event time line

logs from systems involved

documents created during the incident

QUESTION 516

The BEST way to obtain funding from senior management for a security awareness program is to:

meet regulatory requirements

produce an impact analysis report of potential breaches

demonstrate that the program will adequately reduce risk

produce a report of organizational risks

QUESTION 517

When considering whether to adopt bring your own device (BYOD), it is MOST important for the information security manager to ensure that:

security controls are applied to each device when joining the network

business leaders have an understanding of security risks

users have read and signed acceptable use agreements

the applications are tested prior to implementation

QUESTION 518

Which of the following would create the GREATEST risk when migrating a critical legacy system to a new system?

Using agile development methodology

Following a phased approach

Following a direct cut-over approach

Maintaining parallel systems

QUESTION 519

A company is using a software developer for a project. At which of the following points should the software quality assurance (QA) plan be developed?

As part of software definition

During the feasibility phase

Prior to acceptance testing

As part of the design phase

QUESTION 520

During development of an information security policy, which of the following would BEST ensure alignment to business objectives?

Incorporation of industry best practices

Linkage between policy and procedures

Use of a balanced scorecard

Input from relevant stakeholders

QUESTION 521

The PRIMARY reason for allocating sufficient time between the go-live phase of a new system and conducting a post-implementation review is to:

update project requirements and design documentation

increase availability of system implementation team resources

allow the system to stabilize in production

obtain sign-off on the scope of post-implementation review

QUESTION 522

Which of the following activities should occur after a business impact analysis (BIA)?

Identify threats to the IT environment

Identify critical applications

Analyze recovery options

Review the computing and user environment

QUESTION 523

The MOST important function of a business continuity plan is to:

ensure that the critical business functions can be recovered

provide procedures for evaluating tests of the business continuity plan

provide a schedule of events that has to occur if there is a disaster

ensure that all business functions are restored

QUESTION 524

Which of the following is MOST useful for determining whether the goals of IT are aligned with the organization’s goals?

Balanced scorecard

Enterprise architecture (EA)

Key performance indicators (KPIs)

Enterprise dashboard

QUESTION 525

During an internal audit review of an HR recruitment system implementation, the IS auditor notes a number of defects were unresolved at the time the system went live. Which of the following is the auditor’s MOST important task prior to formulating an audit opinion?

Identify the root cause of the defects to confirm severity.

Review the user acceptance test results.

Verify risk acceptance by the project steering committee.

Confirm the timeline for migration of the defects.

QUESTION 526

A company has implemented an IT segregation of duties policy. In a role-based environment, which of the following roles may be assigned to an approach developer?

IT operator

Database administration

System administration

Emergency support

QUESTION 527

The BEST way to evaluate the effectiveness of a newly developed application is to:

perform a post-implementation review.

analyze load-testing results.

review acceptance-testing results.

perform a pre-implementation review.

QUESTION 528

What is the BEST indicator of successful implementation of an organization’s information security policy?

Reduced number of successful phishing incidents

Reduced number of help desk calls

Reduced number of noncompliance penalties incurred

Reduced number of false-positive security events

QUESTION 529

A CIO has asked an IS auditor to implement several security controls for an organization’s IT processes and systems. The auditor should:

perform the assignment and future audits with due professional care.

obtain approval from executive management for the implementation.

refuse due to independence issues.

communicate the conflict of interest to audit management.

QUESTION 530

An audit committee is reviewing an annual IT risk assessment. Which of the following is the BEST justification for the audits selected?

Likelihood of an IT process failure

Key IT general process controls

Applications impacted

Underlying business risks

QUESTION 531

When developing a risk-based IS audit plan, the PRIMARY focus should be on functions:

considered important by IT management.

with the most ineffective controls.

with the greatest number of threats.

considered critical to business operations.

––––––––

QUESTION 532

Which of the following is the GREATEST risk associated with in-house program development and customization?

The lack of a test environment

The lack of a quality assurance function

The lack of secure coding expertise

The lack of documentation for programs developed.

QUESTION 533

Which of the following access control situations represents the MOST serious control weakness?

Computer operators have access to system level flowcharts.

Programmers have access to development hardware.

End users have access to program development tools.

System developers have access to production data.

QUESTION 534

Which of the following could an IS auditor recommend to improve the estimated resources required in system development?

Business areas involvement

Prototyping

Function point analysis

CASE tools

QUESTION 535

Which of the following would be a result of utilizing a top-down maturity model process?

A means of benchmarking the effectiveness of similar processes with peers

Identification of older, more established processes to ensure timely review

Identification of processes with the most improvement opportunities

A means of comparing the effectiveness of other processes within the enterprise

QUESTION 536

Which of the following is MOST important for an effective control self-assessment program?

Determining the scope of the assessment

Evaluating changes to the risk environment

Understanding the business process

Performing detailed test procedures

QUESTION 537

A new information security manager is charged with reviewing and revising the information security strategy. The information security manager’s FIRST course of

action should be to gain an understanding of the organization’s:

security architecture

risk register

internal control framework

business strategy

QUESTION 538

Which device acting as a translator is used to connect two networks or applications from layer 4 up to layer 7 of the ISO/OSI Model?

Bridge

Repeater

Router

Gateway

––––––––

QUESTION 539

Which of the following transmission media would NOT be affected by cross talk or interference?

Copper cable

Radio System

Satellite radio link

Fiber optic cables

––––––––

QUESTION 540

Which of the following is NOT a defined ISO basic task related to network management?

Fault management

Accounting resources

Security management

Communications management

QUESTION 541

What is the most effective means of determining that controls are functioning properly within an operating system?

Interview with computer operator

Review of software control features and/or parameters

Review of operating system manual

Interview with product vendor

––––––––

QUESTION 542

Which of the following is the BEST way to detect software license violations?

Implementing a corporate policy on copyright infringements and software use.

Requiring that all PCs be diskless workstations.

Installing metering software on the LAN so applications can be accessed through the metered software.

Regularly scanning PCs in use to ensure that unauthorized copies of software have not been loaded on the PC.

––––––––

QUESTION 543

Who is responsible for ensuring that system controls and supporting processes provides an effective level of protection, based on the data classification set in accordance with corporate security policies and procedures?

Project Sponsor

Security Officer

User Management

Senior Management

––––––––

QUESTION 544

Who is responsible for reviewing the result and deliverables within and at the end of each phase, as well as confirming compliance with requirements?

Project Sponsor

Quality Assurance

User Management

Senior Management

QUESTION 545

Which of the following factor is LEAST important in the measurement of critical success factors of productivity in the SDLC phases?

Dollar Spent per use

Number of transactions per month

Number of transactions per user

Number of occurrences of fraud/misuse detection

QUESTION 546

Which of the following type of testing uses a set of test cases that focus on control structure of the procedural design?

Interface testing

Unit Testing

System Testing

Final acceptance testing

––––––––

QUESTION 547

Which of the following type of testing validate functioning of the application under test with other system, where a set of data is transferred from one system to another?

Interface testing

Unit Testing

System Testing

Final acceptance testing

––––––––

QUESTION 548

Identify the INCORRECT statement from below mentioned testing types

Recovery Testing – Making sure the modified/new system includes provisions for appropriate access control and does not introduce any security holes that might compromise other systems

Load Testing – Testing an application with large quantities of data to evaluate its performance during peak hour

Volume testing – Studying the impact on the application by testing with an incremental volume of records to determine the maximum volume of records that application can process

Stress Testing – Studying the impact on the application by testing with an incremental umber of concurrent users/services on the application to determine maximum number of concurrent user/service the application can process

––––––––

QUESTION 549

Which of the following is the process of repeating a portion of a test scenario or test plan to ensure that changes in information system have not introduced any errors?

Parallel Test

Black box testing

Regression Testing

Pilot Testing

––––––––

QUESTION 550

Which of the following is the process of feeding test data into two systems – the modified system and alternative system and comparing the result?

Parallel Test

Black box testing

Regression Testing

Pilot Testing

––––––––

QUESTION 551

Which of the following data validation control validates input data against predefined range values?

Range Check

Table lookups

Existence check

Reasonableness check

––––––––

QUESTION 552

Which of the following control make sure that input data comply with predefined criteria maintained in computerized table of possible values?

Range Check

Table lookups

Existence check

Reasonableness check

––––––––

QUESTION 553

While implementing an invoice system, Lily has implemented a database control which checks that new transactions are matched to those previously input to ensure that they have not already been entered. Which of the following control is implemented by Lily?

Range Check

Duplicate Check

Existence check

Reasonableness check

––––––––

QUESTION 554

In which of the following payment mode, an issuer attempts to emulate physical cash by creating digital certificates, which are purchased by users who redeem them with the issuer at a later date?

Electronic Money Model

Electronics Checks model

Electronic transfer model

Electronic withdraw model

QUESTION 555

Which of the following E-commerce model covers all the transactions between companies and government organization?

B-to-C relationships

B-to-B relationships

B-to-E relationships

B-to-G relationships

––––––––

QUESTION 556

Which of the following function in traditional EDI process is used for transmitting and receiving electronic documents between trading partners via dial up lines, public switched network or VAN?

Communication handler

EDI Interface

Application System

EDI Translator

––––––––

QUESTION 557

Which of the following component of an expert system allows the expert to enter knowledge into the system without the traditional mediation of a software engineer?

Decision tree

Rules

Semantic nets

Knowledge interface

––––––––

QUESTION 558

Which of the following method of expressing knowledge base consist of a graph in which nodes represent physical or conceptual objects and the arcs describes the relationship between nodes?

Decision tree

Rules

Semantic nets

Knowledge interface

––––––––

QUESTION 559

An IS auditor should aware of various analysis models used by data architecture. Which of the following analysis model depict data entities and how they relate?

Context Diagrams

Activity Diagrams

Swim-lane diagrams

Entity relationship diagrams

QUESTION 560

Which of the following layer of an enterprise data flow architecture is concerned with transporting information between the various layers?

Data preparation layer

Desktop Access Layer

Application messaging layer

Data access layer

––––––––

QUESTION 561

Which of the following layer of an enterprise data flow architecture is concerned with the assembly and preparation of data for loading into data marts?

Data preparation layer

Desktop Access Layer

Data Mart layer

Data access layer

––––––––

QUESTION 562

Which of the following layer of an enterprise data flow architecture is responsible for data copying, transformation in Data Warehouse (DW) format and quality control?

Data Staging and quality layer

Desktop Access Layer

Data Mart layer

Data access layer

––––––––

QUESTION 563

Which of the following layer of an enterprise data flow architecture represents subsets of information from the core data warehouse?

Presentation layer

Desktop Access Layer

Data Mart layer

Data access layer

––––––––

QUESTION 564

Which of the following layer from an enterprise data flow architecture captures all data of interest to an organization and organize it to assist in reporting and analysis?

Desktop access layer

Data preparation layer

Core data warehouse

Data access layer

QUESTION 565

Which of the following layer in an enterprise data flow architecture derives enterprise information from operational data, external data and nonoperational data?

Data preparation layer

Data source layer

Data mart layer

Data access layer

––––––––

QUESTION 566

Which of the following property of the core date warehouse layer of an enterprise data flow architecture uses common attributes to access a cross section of an information in the warehouse?

Drill up

Drill down

Drill across

Historical Analysis

––––––––

QUESTION 567

Which of the following level in CMMI model focuses on process innovation and continuous optimization?

Level 4

Level 5

Level 3

Level 2

––––––––

QUESTION 568

Which of the following level in CMMI model focuses on process definition and process deployment?

Level 4

Level 5

Level 3

Level 2

––––––––

QUESTION 569

ISO 9126 is a standard to assist in evaluating the quality of a product. Which of the following is defined as a set of attributes that bear on the existence of a set of functions and their specified properties?

Reliability

Usability

Functionality

Maintainability

QUESTION 570

Which of the following ACID property ensures that transaction will bring the database from one valid state to another?

Atomicity

Consistency

Isolation

Durability

––––––––

QUESTION 571

Which of the following ACID property in DBMS requires that each transaction is all or nothing?

Atomicity

Consistency

Isolation

Durability

––––––––

QUESTION 572

Which of the following ACID property in DBMS means that once a transaction has been committed, it will remain so, even in the event of power loss, crashes, or errors?

Atomicity

Consistency

Isolation

Durability

––––––––

QUESTION 573

Which of the following ACID property in DBMS