Updated Aug 30, 2026 Certification Exam CISA Dumps - Practice Test Questions
Updated Verified CISA dumps Q&As - Pass Guarantee or Full Refund
NEW QUESTION # 436
When engaging services from external auditors, which of the following should be established FIRST?
- A. Termination conditions agreements
- B. Operational level agreements
- C. Service level agreements
- D. Nondisclosure agreements
Answer: D
Explanation:
Section: The process of Auditing Information System
NEW QUESTION # 437
Which of the following is the BEST indication of effective IT investment management?
- A. Key performance indicators (KPIs) are defined for each business requiring IT Investment
- B. IT investments are mapped to specific business objectives
- C. The IT Investment budget is significantly below industry benchmarks
- D. IT investments are implemented and monitored following a system development life cycle (SDLC)
Answer: B
Explanation:
This means that the IT investments are aligned with the strategic goals and priorities of the organization, and that they deliver value and benefits to the business. Mapping IT investments to specific business objectives can help ensure that the IT investments are relevant, justified, and measurable, and that they support the organization's mission and vision.
IT investments are implemented and monitored following a system development life cycle (SDLC) is an indication of effective IT project management, but not necessarily of effective IT investment management.
The SDLC is a framework that guides the development and implementation of IT systems and applications, but it does not address the alignment, justification, or measurement of the IT investments.
Key performance indicators (KPIs) are defined for each business requiring IT investment is an indication of effective IT performance management, but not necessarily of effective IT investment management. KPIs are metrics that measure the outcomes and results of IT activities and processes, but they do not address the alignment, justification, or value of the IT investments.
The IT investment budget is significantly below industry benchmarks is not an indication of effective IT investment management, but rather of low IT spending. The IT investment budget should be based on the organization's needs and capabilities, and not on external comparisons. A low IT investment budget may indicate that the organization is underinvesting in IT, which could limit its potential for growth and innovation.
NEW QUESTION # 438
Which of the following threats is prevented by using token-based authentication?
- A. Man-in-the-middle attack on the client
- B. Password sniffing attack on the network
- C. Session eavesdropping attack on the network
- D. Denial of service attack over the network
Answer: B
Explanation:
Section: Protection of Information Assets
NEW QUESTION # 439
A recent audit concluded that an organization's information security system was weak and that monitoring
would likely fail to detect penetration. Which of the following would be the MOST appropriate
recommendation?
- A. Identify and periodically remove sensitive data that is no longer needed
- B. Encrypt sensitive data while strengthening the system
- C. Look continually for new criminal behavior and attacks on sensitive data
- D. Establish a clear policy related to security and the handling of sensitive data
Answer: B
Explanation:
Section: Information System Operations, Maintenance and Support
NEW QUESTION # 440
Following a security breach in which a hacker exploited a well-known vulnerability in the domain controller, an IS audit has been asked to conduct a control assessment. the auditor ' s BEST course of action would be to determine if:
- A. The network traffic was being monitored.
- B. The domain controller was classified for high availability.
- C. the patches were updated.
- D. The logs were monitored.
Answer: D
Explanation:
The auditor's best course of action after a security breach in which a hacker exploited a well-known vulnerability in the domain controller is to determine if the logs were monitored. Log monitoring is an essential control for detecting and responding to security incidents, especially when known vulnerabilities exist in the system. The auditor should assess if the logs were properly configured, collected, reviewed, analyzed, and acted upon by the responsible parties. Updating patches, monitoring network traffic, and classifying domain controllers for high availability are also important controls, but they are not directly related to the detection and response of the security breach. References:
CISA Review Manual (Digital Version), page 301
CISA Questions, Answers and Explanations Database, question ID 3340
NEW QUESTION # 441
An organization has been recently downsized, in light of this, an IS auditor decides to test logical access controls. The IS auditor's PRIMARY concern should be that:
- A. only the system administrator has authority to grant or modify access to individuals.
- B. management has authorized appropriate access for all newly-hired individuals.
- C. access authorization forms are used to grant or modify access to individuals.
- D. all system access is authorized and appropriate for an individual's role and responsibilities.
Answer: D
Explanation:
Explanation/Reference:
Explanation:
The downsizing of an organization implies a large number of personnel actions over a relatively short period of time. Employees can be assigned new duties while retaining some or all of their former duties.
Numerous employees may be laid off. The auditor should be concerned that an appropriate segregation of duties is maintained, that access is limited to what is required for an employee's role and responsibilities, and that access is revoked for those that are no longer employed by the organization. Choices B, C and D are all potential concerns of an IS auditor, but in light of the particular risks associated with a downsizing, should not be the primary concern.
NEW QUESTION # 442
An IS auditor wants to determine who has oversight of staff performing a specific task and is referencing the organization's RACI chart. Which of the following roles within the chart would provide this information?
- A. Informed
- B. Consulted
- C. Responsible
- D. Accountable
Answer: D
Explanation:
The role within the RACI chart that would provide information on who has oversight of staff performing a specific task is accountable. A RACI chart is a matrix that defines and assigns the roles and responsibilities of different stakeholders for a project, process, or activity. RACI stands for responsible, accountable, consulted, and informed. Accountable is the role that has the authority and oversight to approve or reject the work done by the responsible role. The other options are not the roles that provide information on who has oversight of staff performing a specific task, as they have different meanings and functions. Consulted is the role that provides input or advice to the responsible or accountable roles. Informed is the role that receives updates or reports from the responsible or accountable roles. Responsible is the role that performs or executes the work or task. References: CISA Review Manual (Digital Version), Chapter 3, Section 3.3
NEW QUESTION # 443
Which of the following is MOST important for an IS auditor to examine when reviewing an organization's privacy policy?
- A. Whether there is explicit permission from regulators to collect personal data
- B. Whether sharing of personal information with third-party service providers is prohibited
- C. The organization's legitimate purpose for collecting personal data
- D. The encryption mechanism selected by the organization for protecting personal data
Answer: C
Explanation:
The most important thing for an IS auditor to examine when reviewing an organization's privacy policy is its legitimate purpose for collecting personal data. A legitimate purpose is a clear and specific reason for collecting personal data that is necessary for the organization's business operations or legal obligations, and that respects the rights and interests of the data subjects. A legitimate purpose is the basis for establishing a lawful and fair processing of personal data, and it should be communicated to the data subjects in the privacy policy. The other options are not as important as the legitimate purpose in reviewing the privacy policy.
Explicit permission from regulators to collect personal data is not always required, as there may be other lawful bases for data collection, such as consent, contract, or public interest. Sharing of personal information with third-party service providers is not prohibited, as long as there are adequate safeguards and agreements in place to protect the data. The encryption mechanism selected by the organization for protecting personal data is a technical control that can enhance data security, but it does not determine the legality or fairness of data collection. References: CISA Review Manual (Digital Version), Chapter 5, Section 5.3.2
NEW QUESTION # 444
Before the release of a new application into an organization's production environment, which of the following should be in place to ensure that proper testing has occurred and rollback plans are in place?
- A. Secure code review
- B. Change approval board
- C. Independent third-party approval
- D. Standardized change requests
Answer: B
NEW QUESTION # 445
In response to an audit finding regarding a payroll application, management implemented a new automated control. Which of the following would be MOST helpful to the IS auditor when evaluating the effectiveness of the new control?
- A. Written procedures defining processes and controls
- B. Approved project scope document
- C. Approved test scripts and results prior to implementation
- D. A review of tabletop exercise results
Answer: A
Explanation:
The best way to evaluate the effectiveness of a new automated control is to review the written procedures that define the processes and controls. This will help the IS auditor to understand the objectives, scope, roles, responsibilities, and expected outcomes of the control. The written procedures will also provide a basis for testing the control and verifying its compliance with the audit finding recommendations. References:
* ISACA Frameworks: Blueprints for Success
* CISA Review Manual (Digital Version)
NEW QUESTION # 446
In a security server audit, focus should be placed on (Choose two.):
- A. system stability
- B. continuous and accurate audit trail
- C. proper application licensing
- D. adequate user training
- E. None of the choices.
- F. proper segregation of duties
- G. performance and controls of the system
Answer: B,F
Explanation:
Section: Protection of Information Assets
NEW QUESTION # 447
An organization has contracted with a vendor for a turnkey solution for their electronic toll collection system (ETCS). The vendor has provided its proprietary application software as part of the solution. The contract should require that:
- A. a backup server be available to run ETCS operations with up-to-date data.
- B. a backup server be loaded with all the relevant software and data.
- C. the systems staff of the organization be trained to handle any event.
- D. source code of the ETCS application be placed in escrow.
Answer: D
Explanation:
Section: Protection of Information Assets
Explanation:
Whenever proprietary application software is purchased, the contract should provide for a source code agreement. This will ensure that the purchasing company will have the opportunity to modify the software should the vendor cease to be in business. Having a backup server with current data and staff training is critical but not as critical as ensuring the availability of the source code.
NEW QUESTION # 448
A local area network (LAN) administrator normally would be restricted from:
- A. reporting to the end-user manager
- B. being responsible for LAN security administration.
- C. having end-user responsibilities.
- D. having programming responsibilities.
Answer: D
Explanation:
Section: Protection of Information Assets
Explanation:
A LAN administrator should not have programming responsibilities but may have end-user responsibilities.
The LAN administrator may report to the director of the IPF or, in a decentralized operation, to the end-user
manager. In small organizations, the LAN administrator may also be responsible for security administration
over the LAN.
NEW QUESTION # 449
Business Continuity Planning (BCP) is not defined as a preparation that facilitates:
- A. the rapid recovery of mission-critical business operations
- B. the continuation of critical business functions
- C. the monitoring of threat activity for adjustment of technical controls
- D. the reduction of the impact of a disaster
Answer: C
Explanation:
Explanation/Reference:
The following answers are incorrect:
All of the other choices are facilitated by a BCP:
the continuation of critical business functions
the rapid recovery of mission-critical business operations
the reduction of the impact of a disaster
NEW QUESTION # 450
An organization has outsourced many application development activities to a third party that uses contract programmers extensively. Which of the following would provide the BEST assurance that the third party's contract programmers comply with the organization's security policies?
- A. Require annual signed agreements of adherence to security policies.
- B. Conduct periodic vulnerability scans of the application.
- C. Perform periodic security assessments of the contractors' activities.
- D. Include penalties for noncompliance in the contracting agreement.
Answer: C
Explanation:
Section: Governance and Management of IT
NEW QUESTION # 451
An operations manager has recently moved to internal audit Which of the following would be of GREATEST concern when assigning audit projects to this individual?
- A. A control within the audit scope was downgraded to low risk by the operations manager six months ago.
- B. A system within the audit scope is supported by an emerging technology for which the operations manager lacks experience.
- C. A control within the audit scope was implemented by the operations manager six months ago.
- D. The owner of a process within the audit scope worked for the operations manager six months ago.
Answer: C
NEW QUESTION # 452
What are often the primary safeguards for systems software and data?
- A. Physical access controls
- B. Detective access controls
- C. Logical access controls
- D. Administrative access controls
Answer: C
Explanation:
Explanation/Reference:
Explanation:
Logical access controls are often the primary safeguards for systems software and datA.
NEW QUESTION # 453
Which of the following controls is MOST effective at preventing system failures when implementing a new web application?
- A. Transaction monitoring
- B. System recovery plan
- C. System testing
- D. Business continuity plan (BCP)
Answer: C
Explanation:
Comprehensive and Detailed Step-by-Step Explanation:
Thoroughsystem testingbefore deployment helps identify potentialbugs, vulnerabilities, and performance issuesto prevent system failures.
* System Testing (Correct Answer - B)
* Detects defects that could lead to system crashes.
* Ensures compatibility and performance stability.
* Example:Stress testing an e-commerce application to prevent crashes on Black Friday.
* System Recovery Plan (Incorrect - A)
* Focuses on recovery after failure rather than prevention.
* Business Continuity Plan (Incorrect - C)
* Addresses overall business resilience, not application stability.
* Transaction Monitoring (Incorrect - D)
* Detects fraud and anomalies but does not prevent failures.
References:
* ISACA CISA Review Manual
* NIST 800-160 (Systems Security Engineering)
NEW QUESTION # 454
Which of the following types of firewalls provide the GREATEST degree and granularity of control?
- A. Circuit gateway
- B. Application gateway
- C. Screening router
- D. Packet filter
Answer: B
Explanation:
The application gateway is similar to a circuit gateway, but it has specific proxies for each service. To handle web services, it has an HTTP proxy that acts as an intermediary between externals and internals, but is specifically for HTTP. This meansthat it not only checks the packet IP addresses (layer 3) and the ports it is directed to (in this case port 80, or layer 4), it also checks every HTTP command (layers 5 and 7). Therefore, it works in a more detailed (granularity) way than the others. Screening router and packet filter (choices A and BJ work at the protocol, service and/or port level. This means that they analyze packets from layers 3 and 4, and not from higher levels. A circuit gateway (choice D) is based on a proxy or programthat acts as an intermediary between external and internal accesses. This means that during an external access, instead of opening a single connection to the internal server, two connections are established-one from the external server to the proxy(which conforms the circuit-gateway) and one from the proxy to the internal server. Layers 3 and 4 (IP and TCP) and some general features from higher protocols are used to perform these tasks.
NEW QUESTION # 455
An IS auditor is performing an audit of a network operating system. Which of the following is a user feature the IS auditor should review?
- A. Support of terminal access to remote hosts
- B. Performance management, audit and control
- C. Availability of online network documentation
- D. Handling file transfer between hosts and interuser communications
Answer: C
Explanation:
Section: Protection of Information Assets
Explanation:
Network operating system user features include online availability of network documentation. Other features would be user access to various resources of network hosts, user authorization to access particular resources, and the network and host computers used without special user actions or commands.
Choices B, C and D are examples of network operating systems functions.
NEW QUESTION # 456
Which of the following presents the GREATEST challenge to the alignment of business and IT?
- A. Lack of chief information officer (CIO) involvement in board meetings
- B. Insufficient IT budget to execute new business projects
- C. Lack of information security involvement in business strategy development
- D. An IT steering committee chaired by the chief information officer (CIO)
Answer: A
Explanation:
The greatest challenge to the alignment of business and IT is the lack of chief information officer (CIO) involvement in board meetings. The CIO is the senior executive responsible for overseeing the IT strategy, governance, and operations of the organization, and ensuring that they support the business objectives and needs. The CIO should be involved in board meetings to communicate the value and contribution of IT to the organization, to align the IT vision and direction with the business strategy and priorities, and to advocate for the IT resources and investments required to achieve the desired outcomes. The lack of CIO involvement in board meetings can result in a disconnect between business and IT, a loss of trust and confidence in IT, and missed opportunities for innovation and value creation. The other options are not as challenging as the lack of CIO involvement in board meetings, because they either do not affect the strategic alignment of business and IT, or theycanbe addressed by other means such as collaboration, negotiation, or escalation. References: CISA Review Manual (Digital Version)1, Chapter 1, Section 1.2.1
NEW QUESTION # 457
......
Exam Engine for CISA Exam Free Demo & 365 Day Updates: https://certblaster.prep4away.com/ISACA-certification/braindumps.CISA.ete.file.html