[Feb-2024] CISA Dumps are Available for Instant Access from Actual4Exams
Study resources for the Valid CISA Braindumps!
NEW QUESTION # 376
IT governance is PRIMARILY the responsibility of the:
- A. IT steering committee.
- B. audit committee.
- C. chief executive officer.
- D. board of directors.
Answer: D
Explanation:
Explanation/Reference:
Explanation:
IT governance is primarily the responsibility of the executives and shareholders {as represented by the board of directors). The chief executive officer is instrumental in implementing IT governance per the directions of the board of directors. The IT steering committee monitors and facilitates deployment of IT resources for specific projects in support of business plans. The audit committee reports to the board of directors and should monitor the implementation of audit recommendations.
NEW QUESTION # 377
Which of the following is the BEST way to verify the effectiveness of a data restoration process?
- A. Performing periodic reviews of physical access to backup media
- B. Validating off ne backups using software utilities
- C. Reviewing and updating data restoration policies annually
- D. Performing periodic complete data restorations
Answer: D
NEW QUESTION # 378
.Which of the following is of greatest concern when performing an IS audit?
- A. Users' ability to submit queries to the database
- B. Users' ability to directly modify the database
- C. Users' ability to directly view the database
- D. Users' ability to indirectly modify the database
Answer: B
Explanation:
A major IS audit concern is users' ability to directly modify the database.
NEW QUESTION # 379
An IS auditor finds that, in accordance with IS policy, IDs of terminated users are deactivated within 90 days of termination. The IS auditor should:
- A. recommend that activity logs of terminated users be reviewed on a regular basis.
- B. recommend changes to the IS policy to ensure deactivation of user IDs upon termination.
- C. verify that user access rights have been granted on a need-to-have basis.
- D. report that the control is operating effectively since deactivation happens within the time frame stated in the IS policy.
Answer: B
Explanation:
Although a policy provides a reference for performing IS audit assignments, an IS auditor needs to review the adequacy and the appropriateness of the policy. If, in the opinion of the auditor, the time frame defined for deactivation is inappropriate,the auditor needs to communicate this to management and recommend changes to the policy. Though the deactivation happens as stated in the policy, it cannot be concluded that the control is effective. Best practice would require that the ID of a terminated user be deactivated immediately. Verifying that user access rights have been granted on a need-to-have basis is necessary when permissions are granted. Recommending that activity logs of terminated users be reviewed on a regular basis is a good practice, but not as effective as deactivation upon termination.
NEW QUESTION # 380
Which of the following provides an IS auditor assurance that the interface between a point-of-sale (POS) system and the general ledger is transferring sales data completely and accurately?
- A. The data transferred over the POS interface is encrypted.
- B. Nightly batch processing has been replaced with real-time processing.
- C. Electronic copies of customer sales receipts are maintained.
- D. Monthly bank statements are reconciled without exception.
Answer: C
Explanation:
Electronic copies of customer sales receipts are records that show the details of each sales transaction, such as the date, time, amount, item, and payment method12. Electronic copies of customer sales receipts can provide an IS auditor assurance that the interface between a point-of-sale (POS) system and the general ledger is transferring sales data completely and accurately, because:
Electronic copies of customer sales receipts can be used to verify and reconcile the sales data that is captured by the POS system and posted to the general ledger12.
Electronic copies of customer sales receipts can be used to detect and correct any errors, discrepancies, or frauds that may occur during the data transfer process12.
Electronic copies of customer sales receipts can be used to comply with accounting standards, tax regulations, and audit requirements12.
NEW QUESTION # 381
Which of the following will identify a deviation in the information security management process from generally accepted standards of good practices?
- A. Gap analysis
- B. Risk assessment
- C. Business impact analysis (BIA)
- D. Penetration testing
Answer: A
Explanation:
Section: Information System Acquisition, Development and Implementation
NEW QUESTION # 382
Which of the following factors will BEST promote effective information security management?
- A. Senior management commitment
- B. Identification and risk assessment of sensitive resources
- C. Security awareness training
- D. Security policy framework
Answer: A
Explanation:
Section: Governance and Management of IT
NEW QUESTION # 383
Which of the following should an IS auditor expect to find in an organization s information security policies?
- A. Asset provisioning lifecycle
- B. Authentication requirements
- C. Security configuration settings
- D. Secure coding procedures
Answer: B
NEW QUESTION # 384
The MOST likely effect of the lack of senior management commitment to IT strategic planning is:
- A. a lack of a methodology for systems development.
- B. an absence of control over technology contracts.
- C. technology not aligning with the organization's objectives.
- D. a lack of investment in technology.
Answer: C
Explanation:
A steering committee should exist to ensure that the IT strategies support the organization's goals. The absence of an information technology committee or a committee not composed of senior managers would be an indication of a lack of top-level management commitment. This condition would increase the risk that IT would not be aligned with the organization's strategy.
NEW QUESTION # 385
When reviewing the implementation of a LAN, an IS auditor should FIRST review the:
- A. user's list.
- B. acceptance test report.
- C. network diagram.
- D. node list.
Answer: C
Explanation:
To properly review a LAN implementation, an IS auditor should first verify the network diagram and confirm the approval. Verification of nodes from the node list and the network diagram would be next, followed by a review of the acceptance test report and then the user's list.
NEW QUESTION # 386
When performing a computer forensic investigation, in regard to the evidence gathered, an IS auditor should be MOST concerned with:
- A. evaluation.
- B. disclosure.
- C. analysis.
- D. preservation.
Answer: D
Explanation:
Preservation and documentation of evidence for review by law enforcement and judicial authorities are of primary concern when conducting an investigation. Failure to properly preserve the evidence could jeopardize the acceptance of the evidence in legal proceedings. Analysis, evaluation and disclosure are important but not of primary concern in a forensic investigation.
NEW QUESTION # 387
If an IS auditor finds evidence of risk involved in not implementing proper segregation of duties, such as having the security administrator perform an operations function, what is the auditor's primary responsibility?
- A. Segregation of duties is an administrative control not considered by an IS auditor.
- B. To implement compensator controls.
- C. To reassign job functions to eliminate potential fraud.
- D. To advise senior management.
Answer: D
Explanation:
Explanation/Reference:
An IS auditor's primary responsibility is to advise senior management of the risk involved in not implementing proper segregation of duties, such as having the security administrator perform an operations function.
NEW QUESTION # 388
Which of the following would BEST help to ensure that an incident receives attention from appropriate personnel in a timely manner?
- A. Broadcasting an emergency message
- B. Requiring a dedicated incident response team
- C. Completing the incident management log
- D. Implementing incident escalation procedures
Answer: D
NEW QUESTION # 389
Which of the following security assessment techniques attempts to exploit a system's open ports?
- A. Vulnerability scanning
- B. Password cracking
- C. Network scanning
- D. Penetration testing
Answer: D
NEW QUESTION # 390
At a hospital, medical personal carry handheld computers which contain patient health datA. These handheld computers are synchronized with PCs which transfer data from a hospital database. Which of the following would be of the most importance?
- A. The employee who deletes temporary files from the local PC, after usage, is authorized to maintain PCs.
- B. The handheld computers are properly protected to prevent loss of data confidentiality, in case of theft or loss.
- C. Timely synchronization is ensured by policies and procedures.
- D. The usage of the handheld computers is allowed by the hospital policy.
Answer: B
Explanation:
Data confidentiality is a major requirement of privacy regulations. Choices B, C and D relate to internal security requirements, and are secondary when compared to compliance with data privacy laws.
NEW QUESTION # 391
Which of the following IT service management activities is MOST likely to help with identifying the root cause of repeated instances of Network latency?
- A. Problem management
- B. Incident management
- C. Change management
- D. Configuration management
Answer: A
NEW QUESTION # 392
Which of the following should an IS auditor review FIRST when evaluating incident management procedures?
- A. Root cause analysis steps
- B. Prioritization criteria
- C. Command center monitoring
- D. Peer review requirements
Answer: B
Explanation:
Section: The process of Auditing Information System
NEW QUESTION # 393
The waterfall life cycle model of software development is most appropriately used when:
- A. requirements are well understood and are expected to remain stable, as is the business environment in which the system will operate.
- B. requirements are well understood and the project is subject to time pressures.
- C. the project intends to apply an object-oriented design and programming approach.
- D. the project will involve the use of new technology.
Answer: A
Explanation:
Explanation/Reference:
Explanation:
Historically, the waterfall model has been best suited to the stable conditions described in choice
A. When the degree of uncertainty of the system to be delivered and the conditions in which it will be used rises, the waterfall model has not been successful, in these circumstances, the various forms of iterative development life cycle gives the advantage of breaking down the scope of the overall system to be delivered, making the requirements gathering and design activities more manageable. The ability to deliver working software earlier also acts to alleviate uncertainty and may allow an earlier realization of benefits.
The choice of a design and programming approach is not itself a determining factor of the type of software development life cycle that is appropriate. The use of new technology in a project introduces a significant element of risk. An iterative form of development, particularly one of the agile methods that focuses on early development of actual working software, is likely to be the better option to manage this uncertainty.
NEW QUESTION # 394
Which of the following should be of GREATEST concern to an IS auditor reviewing the controls for a continuous software release process?
- A. Test libraries have not been reviewed in over six months.
- B. Developers are able to approve their own releases.
- C. Release documentation is not updated to reflect successful deployment.
- D. Testing documentation is not attached to production releases.
Answer: B
Explanation:
Section: The process of Auditing Information System
NEW QUESTION # 395
......
Updated CISA Tests Engine pdf - All Free Dumps Guaranteed: https://latestdumps.actual4exams.com/CISA-real-braindumps.html