Free ISACA CISA Practice Exams - Page 6 of 62

Question #51

Which of the following should be of GREATEST concern to an IS auditor reviewing an organization’s business continuity plan (BCP)?

A . The BCP’s contact information needs to be updated
B . The BCP is not version controlled.
C . The BCP has not been approved by senior management.
D . The BCP has not been tested since it was first issued.

Reveal Solution Hide Solution

Question #52

An IS auditor is evaluating the risk associated with moving from one database management system (DBMS) to another.

Which of the following would be MOST helpful to ensure the integrity of the system throughout the change?

A . Preserving the same data classifications
B . Preserving the same data inputs
C . Preserving the same data structure
D . Preserving the same data interfaces

Reveal Solution Hide Solution

Correct Answer: C
C

Explanation:

The most helpful thing to ensure the integrity of the system throughout the change when moving from one database management system (DBMS) to another is preserving the same data structure. A DBMS is a software system that manages and manipulates data stored in a database, such as creating, updating, querying, deleting, etc. A database is a collection of structured or organized data that can be accessed or manipulated by a DBMS. A data structure is a way of organizing or arranging data in a database, such as tables, columns, rows, keys, indexes, etc. Preserving the same data structure when moving from one DBMS to another can help ensure the integrity of the system throughout the change, by maintaining the consistency and accuracy of data in the database, and avoiding any errors or issues that may arise from incompatible or inconsistent data structures between different DBMSs. Preserving the same data classifications is a possible thing to ensure the integrity of the system throughout the change when moving from one DBMS to another, but it is not the most helpful one. Data classifications are categories or labels that define the level of sensitivity or importance of data in a database, such as public, confidential, secret, etc. Data classifications can help protect the security and privacy of data in the database by applying appropriate controls or restrictions on data access or use based on their classifications. Preserving the same data classifications when moving from one DBMS to another can help ensure the integrity of the system throughout the change by preventing unauthorized or inappropriate access or use of data in the database. However, this may not be directly related to the DBMS change, as it may apply to any data migration or transfer process. Preserving the same data inputs is a possible thing to ensure the integrity of the system throughout the change when moving from one DBMS to another, but it is not the most helpful one. Data inputs are sources or methods that provide data to a database, such as user inputs, sensors, files, etc. Data inputs can affect the quality and validity of data in the database by introducing errors or inconsistencies in data entry or collection. Preserving the same data inputs when moving from one DBMS to another can help ensure the integrity of the system throughout the change by reducing errors or inconsistencies in data input or collection.

Question #53

An organization’s security team created a simulated production environment with multiple vulnerable applications.

What would be the PRIMARY purpose of creating such an environment?

A . To collect digital evidence of cyberattacks
B . To attract attackers in order to study their behavior
C . To provide training to security managers
D . To test the intrusion detection system (IDS)

Reveal Solution Hide Solution

Question #54

Which of the following responses to risk associated with segregation of duties would incur the LOWEST initial cost?

A . Risk acceptance
B . Risk mitigation
C . Risk transference
D . Risk reduction

Reveal Solution Hide Solution

Correct Answer: A
A

Explanation:

Segregation of duties is a fundamental concept in cybersecurity and information security. It refers to the practice of dividing critical tasks and responsibilities among different individuals or roles within an organization to reduce the risk of fraud, error, or unauthorized activities1. Segregation of duties is designed to prevent unilateral actions within an organization’s workflow, which can result in damaging events that would exceed the organization’s risk tolerance2.

There are different types of responses to risk associated with segregation of duties, depending on the level of risk and the cost-benefit analysis.

Some of the common responses are:

Risk acceptance: This means acknowledging a risk and deciding to tolerate it without taking any corrective actions. This response is usually chosen when the risk is low or the cost of mitigation is too high3.

Risk mitigation: This means taking steps ahead of time to lessen the effects of a risk and make it less likely to happen. Some examples of mitigation strategies are making backup plans, setting up early warning systems, and staying away from high-risk areas or activities4.

Risk transference: This means shifting the negative impact of a risk and/or the responsibility for managing the risk response to a third party. Some examples of transference strategies are outsourcing, insurance, or contracts5.

Risk reduction: This means reducing the probability and/or severity of the risk below a threshold of acceptability. Some examples of reduction strategies are implementing controls, policies, or procedures to prevent or detect risks6.

Based on these definitions, the response to risk associated with segregation of duties that would incur the lowest initial cost is A. Risk acceptance. This is because risk acceptance does not require any additional resources or actions to address the risk. However, risk acceptance also implies that the organization is willing to bear the consequences of the risk if it occurs, which could be costly in the long run.

Therefore, the correct answer to your question is A. Risk acceptance.

Question #55

To confirm integrity for a hashed message, the receiver should use:

A . the same hashing algorithm as the sender’s to create a binary image of the file.
B . a different hashing algorithm from the sender’s to create a binary image of the file.
C . the same hashing algorithm as the sender’s to create a numerical representation of the file.
D . a different hashing algorithm from the sender’s to create a numerical representation of the file.

Reveal Solution Hide Solution

Question #56

Which of the following controls is the BEST recommendation to prevent the skimming of debit or credit card data in point of sale (POS) systems?

A . Encryption
B . Chip and PIN
C . Hashing
D . Biometric authentication

Reveal Solution Hide Solution

Question #57

Which of the following is the PRIMARY purpose of a rollback plan for a system change?

A . To ensure steps exist to remove the change if necessary
B . To ensure testing can be re-performed if required
C . To ensure a backup exists before implementing a change
D . To ensure the system change is effective

Reveal Solution Hide Solution

Question #58

An IS auditor discovers that an IT organization serving several business units assigns equal priority to all initiatives, creating a risk of delays in securing project funding Which of the following would be MOST helpful in matching demand for projects and services with available resources in a way that supports business objectives?

A . Project management
B . Risk assessment results
C . IT governance framework
D . Portfolio management

Reveal Solution Hide Solution

Question #59

An IS auditor reviewing the database controls for a new e-commerce system discovers a security weakness in the database configuration.

Which of the following should be the IS auditor’s NEXT course of action?

A . Identify existing mitigating controls.
B . Disclose the findings to senior management.
C . Assist in drafting corrective actions.
D . Attempt to exploit the weakness.

Reveal Solution Hide Solution

Question #60

Which of the following should be the FRST step when developing a data toes prevention (DIP) solution for a large organization?

A . Identify approved data workflows across the enterprise.
B . Conduct a threat analysis against sensitive data usage.
C . Create the DLP pcJc.es and templates
D . Conduct a data inventory and classification exercise

Reveal Solution Hide Solution