CISA Exam-Test 25 /30 186 Sorry, Your time is over. CISA EXAM-TEST 25 1 / 30 1. Which of the following is an object-oriented technology characteristic that permits an enhanced degree of security over data? Inheritance Polymorphism Dynamic warehousing Encapsulation Encapsulation is a property of objects, and it prevents accessing either properties or methods that have not been previously defined as public. This means that any implementation of the behavior of an object is not accessible. An object defines a communication interface with the exterior and only that which belongs to that interface can be accessed. 2 / 30 2. The objective of concurrency control in a database system is to: ensure the accuracy, completeness and consistency of data. prevent integrity problems when two processes attempt to update the same data at the same time. prevent inadvertent or unauthorized disclosure of data in the database. restrict updating of the database to authorized users. Concurrency controls prevent data integrity problems, which can arise when two update processes access the same data item at the same time. 3 / 30 3. Which one of the following could be used to provide automated assurance that proper data files are being used during processing? Version usage Parity checking File header record File security controls A file header record provides assurance that proper data files are being used, and it allows for automatic checking. 4 / 30 4. An IS auditor finds out-of-range data in some tables of a database. Which of the following controls should the IS auditor recommend to avoid this situation? Implement integrity constraints in the database. Log all table update transactions. Implement before-and-after image reporting. Use tracing and tagging. Implementing integrity constraints in the database is a preventive control because data are checked against predefined tables or rules, preventing any undefined data from being entered. 5 / 30 5. Of the three major types of off-site processing facilities, what type is often an acceptable solution for preparing for recovery of noncritical systems and data? Alternate site Hot site Warm site Cold site 6 / 30 6. The MOST important function of a business continuity plan (BCP) is to. provide a schedule of events that has to occur if there is a disaster provide procedures for evaluating tests of the BCP ensure that the critical business functions can be recovered ensure that all business functions are restored 7 / 30 7. An IS auditor reviewing a purchase accounting system notices several duplicate payments made for the services rendered. Which of the following is the auditor's BEST recommendation for preventing duplicate payments? Perform additional supervisory reviews prior to the invoice payments. Implement a configuration control to enable sequential numbering of invoices. Implement a system control that determines if there are corresponding invoices for purchase orders. Request vendors to attach service acknowledgment notices to purchase orders. 8 / 30 8. During the review of an enterprise's preventive maintenance process for systems at a data center, the IS auditor has determined that adequate maintenance is being performed on all critical computing, power and cooling systems. Additionally, it is MOST important for the IS auditor to ensure that the organization: has performed background checks on all service personnel. escorts service personnel at all times when performing their work. independently verifies that maintenance is being performed. performs maintenance during noncritical processing times. The biggest risk to normal operations in a data center would be if an incident or mishap were to happen during critical peak processing times; therefore, it would be prudent to ensure that no type of system maintenance be performed at these critical times. 9 / 30 9. Which of the following should be the FIRST step in an organization's forensics process to preserve evidence? Create the forensics analysis reporting template Determine which forensic tools to use Duplicate digital evidence and validate it using a hash function Perform analytics on digital evidence obtained using forensic methods 10 / 30 10. In which of the following situations is it MOST appropriate to implement data mirroring as the recovery strategy? Recovery time objective is high. Disaster tolerance is high. Recovery point objective is low. Recovery point objective is high. 11 / 30 11. Which of the following would help to ensure the portability of an application connected to a database? Verification of database import and export procedures Analysis of stored procedures/triggers Synchronization of the entity-relation model with the database physical schema Usage of a structured query language (SQL) The use of structured query language (SQL) facilitates portability because it is an industry standard used by many systems. 12 / 30 12. During an application audit, an IS auditor is asked to provide assurance of the database referential integrity. Which of the following should be reviewed? Field definition Composite keys Master table definition Foreign key structure Referential integrity in a relational database refers to consistency between coupled (linked) tables. Referential integrity is usually enforced by the combination of a primary key or candidate key (alternate key) and a foreign key. For referential integrity to hold, any field in a table that is declared a foreign key should contain only values from a parent table's primary key or a candidate key. 13 / 30 13. Which of the following would an IS auditor recommend as the MOST effective preventive control to reduce the risk of data leakage? Implement an intrusion detection system (IDS). Verify that application logs capture any changes made. Validate that all data files contain digital watermarks Ensure that paper documents arc disposed security. 14 / 30 14. What influences decisions regarding criticality of assets? The business impact analysis Internal corporate politics business criticality of the data to be protected & scope of the impact upon the organization as a whole The business criticality of the data to be protected 15 / 30 15. An IS auditor notes that patches for the operating system used by an organization are deployed by the IT department as advised by the vendor. The MOST significant concern an IS auditor should have with this practice is that IT has NOT considered: delaying deployment until testing the impact of the patch. the necessity of advising end users of new patches. any beneficial impact of the patch on the operational systems. the training needs for users after applying the patch. Deploying patches without testing exposes an organization to the risk of system disruption or failure. 16 / 30 16. Which of the following processes will be MOST effective in reducing the risk that unauthorized software on a backup server is distributed to the production server? Review the access control log of the backup server. Ensure that developers do not have access to the backup server. Manually copy files to accomplish replication. Review changes in the software version control system. It is common practice for software changes to be tracked and controlled using version control software. An IS auditor should review reports or logs from this system to identify the software that is promoted to production. Only moving the versions on the version control system (VCS) program will prevent the transfer of development or earlier versions. 17 / 30 17. The application systems of an organization using open-source software have no single recognized developer producing patches. Which of the following would be the MOST secure way of updating open-source software? Develop in-house patches. Rewrite the patches and apply them. Identify and test suitable patches before applying them Review the code and application of available patches. Suitable patches from the existing developers should be selected and tested before applying them. 18 / 30 18. Which of the following would BEST ensure continuity of a wide area network (WAN) across the organization? A repair contract with a service provider Built-in alternative routing A duplicate machine alongside each server Complete full system backup daily Alternative routing would ensure that the network would continue if a communication device fails or if a link is severed because message rerouting could be automatic. 19 / 30 19. Which type of major BCP test only requires representatives from each operational area to meet to review the plan? Paper Preparedness Parallel Walk-thorough 20 / 30 20. During an IS audit of a bank, the IS auditor is assessing whether the enterprise properly manages staff member access to the operating system. The IS auditor should determine whether the enterprise performs: review of data communication access activity logs. periodic review of user activity logs. periodic review of changing data files. verification of user authorization at the field level. General operating system access control functions include logging user activities, events, etc. Reviewing these logs may identify users performing activities that should not have been permitted. 21 / 30 21. An enterprise uses privileged accounts to process configuration changes for mission-critical applications. Which of the following would be the BEST and appropriate control to limit the risk in such a situation? Ensure that supervisory approval and review are performed for critical changes. Ensure that personnel background checks are performed for critical personnel. Ensure that audit trails are accurate and specific. Ensure that personnel have adequate training. Supervisory approval and review of critical changes by the accountable managers in the enterprise are required to avoid and detect any unauthorized change. In addition to authorization, supervision enforces a separation of duties and prevents an unauthorized attempt by any single employee. 22 / 30 22. Which of the following controls would provide the GREATEST assurance of database integrity? Audit log procedures Rollback and rollforward database features Table link/reference checks Query/table access time checks Performing table link/reference checks serves to detect table linking errors (such as completeness and accuracy of the contents of the database), and thus provides the greatest assurance of database integrity. 23 / 30 23. An IS auditor discovers that some users have installed personal software on their PCs. This is not explicitly forbidden by the security policy. Of the following, the BEST approach for an IS auditor is to recommend that the: IT department implement control mechanisms to prevent unauthorized software installation. IT department prohibit the download of unauthorized software. users obtain approval from an IS manager before installing nonstandard software. security policy be updated to include specific language regarding unauthorized software. Lack of specific language addressing unauthorized software in the acceptable use policy is a weakness in administrative controls. The policy should be reviewed and updated to address the issue—and provide authority for the IT department to implement technical controls. 24 / 30 24. Which of the following sampling techniques is BEST to use when verifying the operating effectiveness of internal controls during an audit of transactions? Attribute sampling Judgmental sampling Stop-or-go sampling Statistical sampling 25 / 30 25. In auditing a database environment, an IS auditor will be MOST concerned if the database administrator (DBA) is performing which of the following functions? Performing backup and recovery procedures Performing database changes according to change management procedures Installing patches or upgrades to the operating system Sizing table space and consulting on table join limitations Installing patches or upgrades to the operating system is a function that should be performed by a systems administrator, not by a DBA. If a DBA were performing this function, there would be a risk based on inappropriate segregation of duties. 26 / 30 26. The database administrator (DBA) suggests that database efficiency can be improved by denormalizing some tables. This would result in: loss of confidentiality. increased redundancy. application malfunctions. unauthorized accesses. Normalization is a design or optimization process for a relational database that minimizes redundancy; therefore, denormalization would increase redundancy. Redundancy, which is usually considered positive when it is a question of resource availability, is negative in a database environment because it demands additional and otherwise unnecessary data handling efforts. Denormalization is sometimes advisable for functional reasons. 27 / 30 27. An IS auditor determined that the IT manager recently changed the vendor that is responsible for performing maintenance on critical computer systems to cut costs. While the new vendor is less expensive, the new maintenance contract specifies a change in incident resolution time specified by the original vendor. Which of the following should be the GREATEST concern to the IS auditor? Application owners were not informed of the change. Disaster recovery plans (DRPs) may be invalid and need to be revised. The new maintenance vendor is not familiar with the organization's policies. Transactional business data may be lost in the event of system failure. The greatest risk of making a change to the maintenance of critical systems is that the change could have an adverse impact on a critical business process. While there is a benefit in selecting a less expensive maintenance vendor, the resolution time must be aligned with the needs of the business. 28 / 30 28. An IS auditor discovers that some hard drives disposed of by an enterprise were not sanitized in a manner that would reasonably ensure the data could not be recovered. In addition, the enterprise does not have a written policy on data disposal. The IS auditor should FIRST: develop an appropriate data disposal policy for the enterprise. determine the sensitivity of the information on the hard drives. discuss with the IT manager the good practices in data disposal. draft an audit finding and discuss it with the auditor in charge. Even though a policy is not available, the IS auditor should make a determination as to the nature of the information on the hard drives to quantify, as much as possible, the risk. 29 / 30 29. Which of the following is MOST is critical during the business impact assessment phase of business continuity planning? Security administration involvement End-user involvement Senior management involvement IS auditing involvement 30 / 30 30. An IS auditor is reviewing database security for an organization. Which of the following is the MOST important consideration for database hardening? Stored procedures and triggers are encrypted. The service port used by the database server is changed. The default configurations are changed. All tables in the database are normalized. Default database configurations, such as default passwords and services, need to be changed; otherwise, the database could be easily compromised by malicious code and by intruders. Your score is LinkedIn Facebook Twitter Exit
