Get CISA Products Practice Material for CISA Exam Question Preparation [Q318-Q338]

NEW QUESTION 318
Which of the following BEST enables system resiliency for an e-commerce organization that requires a low recovery time objective (RTO) ana a few recovery point objective (RPO)?

Remote backups

Redundant arrays

Nightly backups

Mirrored sites

NEW QUESTION 319
Fourth-Generation Languages (4GLs) are most appropriate for designing the application’s graphical user
interface (GUI). They are inappropriate for designing any intensive data- calculation procedures. True or
false?

True

False

NEW QUESTION 320
An externally facing system containing sensitive data is configured such that users have either read-only or administrator rights. Most users of the system have administrator access. Which of the following is the GREATEST risk associated with this situation?

Users can export application logs.

Users can view sensitive data.

Users can make unauthorized changes.

Users can install open-licensed software.

NEW QUESTION 321
Within a payroll department, which of the following responsibilities should be assigned to two or more individuals to avoid a segregation of duties conflict?

Adding and removing new users of the payroll system

Viewing lists of terminated employees and editing payroll information

Approving payroll payments and inputting salary rates into the system

Reviewing time sheets and accessing bank statements for account reconciliation

NEW QUESTION 322
Which of the following is the PRIMARY responsibility of an organization’s IT steering committee?

Reporting on key performance measures

Communicating strategic goals to IT project teams

Conducting peer reviews of other organizations

Identifying new technological threats

NEW QUESTION 323
When implementing Internet Protocol security (IPsec) architecture, the servers involved in application delivery:

communicate via Transport Layer Security (TLS),

block authorized users from unauthorized activities.

channel access only through the public-facing firewall.

channel access through authentication.

NEW QUESTION 324
What type(s) of firewalls provide(s) the greatest degree of protection and control because both firewall technologies inspect all seven OSI layers of network traffic?

A first-generation packet-filtering firewall

A circuit-level gateway

An application-layer gateway, or proxy firewall, and stateful-inspection firewalls

An application-layer gateway, or proxy firewall, but not stateful-inspection firewalls

NEW QUESTION 325
CORRECT TEXT
E-mail message authenticity and confidentiality is BEST achieved by signing the message using the:
(
A) sender’s private key and encrypting the message using the receiver’s public key.
B.sender’s public key and encrypting the message using the receiver’s private key.
C.receiver’s private key and encrypting the message using the sender’s public key.
D.receiver’s public key and encrypting the message using the sender’s private key.

NEW QUESTION 326
During an IT general controls audit of a high-risk area where both internal and external audit teams are reviewing the same approach to optimize resources?

Leverage the work performed by external audit for the internal audit testing.

Ensure both the internal and external auditors perform the work simultaneously.

Request that the external audit team leverage the internal audit work.

Roll forward the general controls audit to the subsequent audit year.

NEW QUESTION 327
Which of the following is MOST critical to include when developing a data loss prevention (DIP) policy?

Identification of enforcement actions

Identification of the relevant network channels requiring protection

Identification of the users, groups, and roles to whom the policy will apply

Identification of the content to protect

NEW QUESTION 328
Which of the following is the GREATEST security risk associated with data migration from a legacy human resources (HR) system to a cloud-based system?

Data from the source and target system may be intercepted.

Data from the source and target system may have different data formats.

Records past their retention period may not be migrated to the new system.

System performance may be impacted by the migration

The greatest security risk associated with data migration from a legacy human resources (HR) system to a cloud-based system is data from the source and target system may be intercepted. Data interception is an attack that occurs when an unauthorized entity or individual captures or accesses data that are being transmitted or stored on an information system or network. Data interception can compromise the confidentiality and integrity of data, and cause harm or damage to data owners or users. Data migration from a legacy HR system to a cloud-based system involves transferring data from one system or location to another system or location over a network connection. This poses a high risk of data interception, as data may be exposed or vulnerable during transit or storage on unsecured or untrusted networks or systems. Data from the source and target system may have different data formats is a possible challenge associated with data migration from a legacy HR system to a cloud-based system, but it is not a security risk. Data formats are specifications that define how data are structured or encoded on an information system or network. Data formats may vary depending on different systems or platforms. Data migration may require converting data from one format to another format to ensure compatibility and interoperability between systems. Records past their retention period may not be migrated to the new system is a possible outcome associated with data migration from a legacy HR system to a cloud-based system, but it is not a security risk. Retention period is a duration that defines how long data should be kept or stored on an information system or network before being deleted or destroyed. Retention period may depend on various factors such as legal requirements, business needs, storage capacity, etc. Data migration may involve deleting or destroying data that are past their retention period to reduce the volume or complexity of data to be transferred or to comply with regulations or policies. System performance may be impacted by the migration is a possible impact associated with data migration from a legacy HR system to a cloud-based system, but it is not a security risk. System performance is a measure of how well an information system or network functions or operates, such as speed, reliability, availability, etc. System performance may be affected by data migration, as data migration may consume significant resources or bandwidth, cause interruptions or delays, or introduce errors or inconsistencies.

NEW QUESTION 329
When segregation of duties concerns exists between IT support staff and end users, what would be suitable compensating control?

Restricting physical access to computing equipment

Reviewing transaction and application logs

Performing background checks prior to hiring IT staff

Locking user sessions after a specified period of inactivity

NEW QUESTION 330
Which of the following is the BEST reason for an IS auditor to emphasize to management the importance of using an IT governance framework?

Frameworks enable IT benchmarks against competitors

Frameworks can be tailored and optimized for different organizations

Frameworks help facilitate control self-assessments (CSAs)

Frameworks help organizations understand and manage IT risk

NEW QUESTION 331
Using swipe cards to limit employee access to restricted areas requires implementing which additional control?

Physical sign-in of all employees for access to restricted areas

Implementation of additional PIN pads

Periodic review of access profiles by management

Installation of closed-circuit television (CCTV)

Periodic review of access profiles by management is an additional control that is required when using swipe cards to limit employee access to restricted areas. Swipe cards are a type of physical access control that use magnetic stripes or radio frequency identification (RFID) to store and transmit information about the cardholder’s identity and access rights. Swipe cards can help to prevent unauthorized entry, protect sensitive assets and data, and monitor access activity. However, swipe cards alone are not enough to ensure effective access control. They need to be complemented by other controls, such as:
* Periodic review of access profiles by management: This is a type of logical access control that involves verifying that the access rights assigned to each cardholder are appropriate, necessary, and consistent with the organization’s policies and procedures. Periodic review of access profiles can help to detect and correct any errors, inconsistencies, or violations in the access control system, such as outdated, excessive, or redundant access rights, segregation of duties conflicts, or unauthorized changes. Periodic
* review of access profiles can also help to ensure compliance with internal and external audit requirements and regulations.
* Implementation of additional PIN pads: This is a type of multi-factor authentication (MFA) that requires the cardholder to enter a personal identification number (PIN) in addition to swiping their card. MFA can enhance the security of the access control system by adding another layer of verification and reducing the risk of lost, stolen, or cloned cards being used by unauthorized persons.
* Installation of closed-circuit television (CCTV): This is a type of surveillance system that uses cameras and monitors to record and display the images of the people and activities in the restricted areas. CCTV can deter potential intruders, provide evidence of any security incidents or breaches, and enable real-time monitoring and response by security personnel.
The other options are not as effective or relevant as periodic review of access profiles by management for an additional control when using swipe cards. Physical sign-in of all employees for access to restricted areas is a redundant and inefficient control that can be easily bypassed or manipulated. It also does not provide any assurance or verification of the identity or access rights of the cardholders. Audit hooks are software routines embedded in an application that can trigger an alert or a report when certain conditions are met. Audit hooks can help to detect anomalies or exceptions in access control lists, but they do not provide a comprehensive or integrated view of them.
References:
* ISACA, CISA Review Manual, 27th Edition, 2019, p. 236
* ISACA, ITAF: A Professional Practices Framework for IS Audit/Assurance, 3rd Edition, 2014, p. 88
* Data Analytics for Auditing Access Control

NEW QUESTION 332
Which of the following should be of GREATEST concern for an IS auditor reviewing an organization’s disaster recovery plan (DRP)?

The DRP has not been formally approved by senior management.

The DRP has not been distributed to end users.

The DRP has not been updated since an IT infrastructure upgrade.

The DRP contains recovery procedures for critical servers only.

NEW QUESTION 333
Which of the following is the MOST reliable network connection medium in an environment where there is strong electromagnetic interface?

Fiber optic cable

Coaxial cable

Shielded twisted-pair cable

Wireless link

NEW QUESTION 334
Which of the following BEST ensures IT incident and problem management practices will meet expected service level agreements (SLAs)?

Incorporating lessons learned into problem resolution review meetings

Defining problem impact and urgency levels through consultation with the business

Creating records of known errors and documenting procedures for workarounds

Obtaining regular progress reports from IT change management on problem resolution

NEW QUESTION 335
In a large organization, IT deadlines on important projects have been missed because IT resources are not prioritized properly. Which of the following is the BEST recommendation to address this problem?

Revisit the IT strategic plan.

Implement project portfolio management.

Implement an integrated resource management system.

Implement a comprehensive project scorecard.

NEW QUESTION 336
Which of the following is a benefit of increasing the use of data analytics in audits?

Less time spent on verifying completeness and accuracy of the total population

More time spent on analyzing the outers identified and the root cause

Less time spent on selecting adequate audit programs and scope

More time spent on select and reviewing samples for testing

NEW QUESTION 337
A firewall is being deployed at a new location. Which of the following is the MOST important factor in ensuring a successful deployment?

Reviewing logs frequently

Testing and validating the rules

Training a local administrator at the new location

Sharing firewall administrative duties

NEW QUESTION 338
A bank has a combination of corporate customer accounts (higher monetary value) and small business accounts (lower monetary value) as part of online banking. Which of the following is the BEST sampling approach for an IS auditor to use for these accounts?

Difference estimation sampling

Stratified mean per unit sampling

Customer unit sampling

Unstratified mean per unit sampling

Explanation
Stratified mean per unit sampling is a method of audit sampling that divides the population into subgroups (strata) based on some characteristic, such as monetary value, and then selects a sample from each stratum using mean per unit sampling. Mean per unit sampling is a method of audit sampling that estimates the total value of a population by multiplying the average value of the sample items by the number of items in the population. Stratified mean per unit sampling is suitable for populations that have a high variability or a skewed distribution, such as the bank accounts in this question. By stratifying the population, the auditor can reduce the sampling error and increase the precision of the estimate.
Difference estimation sampling (option A) is not the best sampling approach for these accounts. Difference estimation sampling is a method of audit sampling that estimates the total error or misstatement in a population by multiplying the average difference between the book value and the audited value of the sample items by the number of items in the population. Difference estimation sampling is suitable for populations that have a low variability and a symmetrical distribution, which is not the case for the bank accounts in this question.
Customer unit sampling (option C) is not a sampling approach, but a type of monetary unit sampling.
Monetary unit sampling is a method of audit sampling that selects sample items based on their monetary value, rather than their physical units. Customer unit sampling is a variation of monetary unit sampling that treats each customer account as a single unit, regardless of how many transactions or balances it contains. Customer unit sampling may be appropriate for testing existence or occurrence assertions, but not for estimating total values.
Unstratified mean per unit sampling (option D) is not the best sampling approach for these accounts.
Unstratified mean per unit sampling is a method of audit sampling that applies mean per unit sampling to the entire population without dividing it into subgroups. Unstratified mean per unit sampling may result in a larger sample size and a lower precision than stratified mean per unit sampling, especially for populations that have a high variability or a skewed distribution, such as the bank accounts in this question.
Therefore, option B is the correct answer.
References:
Audit Sampling – AICPA
Audit Sampling: Examples and Guidance To The Sampling Methods
Audit Sampling | Audit | Financial Audit – Scribd