Last Updated on December 13, 2021 by Admin 3

 CISA : Certified Information Systems Auditor : Part 127

  1. What are intrusion-detection systems (IDS) primarily used for?

    • To identify AND prevent intrusion attempts to a network
    • To prevent intrusion attempts to a network
    • Forensic incident response
    • To identify intrusion attempts to a network

    Explanation: 
    Intrusion-detection systems (IDS) are used to identify intrusion attempts on a network.

  2. Rather than simply reviewing the adequacy of access control, appropriateness of access policies, and effectiveness of safeguards and procedures, the IS auditor is more concerned with effectiveness and utilization of assets. True or false?

    • True
    • False
    Explanation: 
    Instead of simply reviewing the effectiveness and utilization of assets, an IS auditor is more concerned with adequate access control, appropriate access policies, and effectiveness of safeguards and procedures.
  3. If a programmer has update access to a live system, IS auditors are more concerned with the programmer’s ability to initiate or modify transactions and the ability to access production than with the programmer’s ability to authorize transactions. True or false?

    • True
    • False
    Explanation: 
    If a programmer has update access to a live system, IS auditors are more concerned with the programmer’s ability to initiate or modify transactions and the ability to access production than with the programmer’s ability to authorize transactions.
  4. Organizations should use off-site storage facilities to maintain ______________ (fill in the blank) of current and critical information within backup files.

    • Confidentiality
    • Integrity
    • Redundancy
    • Concurrency
    Explanation: 
    Redundancy is the best answer because it provides both integrity and availability. Organizations should use off-site storage facilities to maintain redundancy of current and critical information within backup files.
  5. The purpose of business continuity planning and disaster-recovery planning is to:

    • Transfer the risk and impact of a business interruption or disaster
    • Mitigate, or reduce, the risk and impact of a business interruption or disaster
    • Accept the risk and impact of a business
    • Eliminate the risk and impact of a business interruption or disaster
    Explanation: 
    The primary purpose of business continuity planning and disaster-recovery planning is to mitigate, or reduce, the risk and impact of a business interruption or disaster.
    Total elimination of risk is impossible.
  6. If a database is restored from information backed up before the last system image, which of the following is recommended?

    • The system should be restarted after the last transaction.
    • The system should be restarted before the last transaction.
    • The system should be restarted at the first transaction.
    • The system should be restarted on the last transaction.
    Explanation: 
    If a database is restored from information backed up before the last system image, the system should be restarted before the last transaction because the final transaction must be reprocessed.
  7. An off-site processing facility should be easily identifiable externally because easy identification helps ensure smoother recovery. True or false?

    • True
    • False
    Explanation: 
    An off-site processing facility should not be easily identifiable externally because easy identification would create an additional vulnerability for sabotage.
  8. Which of the following is the dominating objective of BCP and DRP?

    • To protect human life
    • To mitigate the risk and impact of a business interruption
    • To eliminate the risk and impact of a business interruption
    • To transfer the risk and impact of a business interruption
    Explanation: 
    Although the primary business objective of BCP and DRP is to mitigate the risk and impact of a business interruption, the dominating objective remains the protection of human life.
  9. How can minimizing single points of failure or vulnerabilities of a common disaster best be controlled?

    • By implementing redundant systems and applications onsite
    • By geographically dispersing resources
    • By retaining onsite data backup in fireproof vaults
    • By preparing BCP and DRP documents for commonly identified disasters
    Explanation: 
    Minimizing single points of failure or vulnerabilities of a common disaster is mitigated by geographically dispersing resources.
  10. Mitigating the risk and impact of a disaster or business interruption usually takes priority over transference of risk to a third party such as an insurer. True or false?

    • True
    • False
    Explanation: 
    Mitigating the risk and impact of a disaster or business interruption usually takes priority over transferring risk to a third party such as an insurer.
  11. Off-site data storage should be kept synchronized when preparing for recovery of time- sensitive data such as that resulting from which of the following?

    • Financial reporting
    • Sales reporting
    • Inventory reporting
    • Transaction processing
    Explanation: 
    Off-site data storage should be kept synchronized when preparing for the recovery of time sensitive data such as that resulting from transaction processing.
  12. What is an acceptable mechanism for extremely time-sensitive transaction processing?

    • Off-site remote journaling
    • Electronic vaulting
    • Shadow file processing
    • Storage area network
    Explanation: 
    Shadow file processing can be implemented as a recovery mechanism for extremely time- sensitive transaction processing.
  13. Off-site data backup and storage should be geographically separated so as to _______________ (fill in the blank) the risk of a widespread physical disaster such as a hurricane or earthquake.

    • Accept
    • Eliminate
    • Transfer
    • Mitigate
    Explanation: 
    Off-site data backup and storage should be geographically separated, to mitigate the risk of a widespread physical disaster such as a hurricane or an earthquake.
  14. Why is a clause for requiring source code escrow in an application vendor agreement important?

    • To segregate systems development and live environments
    • To protect the organization from copyright disputes
    • To ensure that sufficient code is available when needed
    • To ensure that the source code remains available even if the application vendor goes out of business
    Explanation: 
    A clause for requiring source code escrow in an application vendor agreement is important to ensure that the source code remains available even if the application vendor goes out of business.
  15. What uses questionnaires to lead the user through a series of choices to reach a conclusion?

    • Logic trees
    • Decision trees
    • Decision algorithms
    • Logic algorithms
    Explanation: 
    Decision trees use questionnaires to lead the user through a series of choices to reach a conclusion.
  16. What protects an application purchaser’s ability to fix or change an application in case the application vendor goes out of business?

    • Assigning copyright to the organization
    • Program back doors
    • Source code escrow
    • Internal programming expertise
    Explanation: 
    Source code escrow protects an application purchaser’s ability to fix or change an application in case the application vendor goes out of business.
  17. Who is ultimately responsible for providing requirement specifications to the software- development team?

    • The project sponsor
    • The project members
    • The project leader
    • The project steering committee
    Explanation: 
    The project sponsor is ultimately responsible for providing requirement specifications to the software-development team.
  18. What should regression testing use to obtain accurate conclusions regarding the effects of changes or corrections to a program, and ensuring that those changes and corrections have not introduced new errors?

    • Contrived data
    • Independently created data
    • Live data
    • Data from previous tests
    Explanation: 
    Regression testing should use data from previous tests to obtain accurate conclusions regarding the effects of changes or corrections to a program, and ensuring that those changes and corrections have not introduced new errors.
  19. An IS auditor should carefully review the functional requirements in a system-development project to ensure that the project is designed to:

    • Meet business objectives
    • Enforce data security
    • Be culturally feasible
    • Be financially feasible
    Explanation: 
    An IS auditor should carefully review the functional requirements in a systems-development project to ensure that the project is designed to meet business objectives.
  20. Which of the following processes are performed during the design phase of the systems development life cycle (SDLC) model?

    • Develop test plans.
    • Baseline procedures to prevent scope creep.
    • Define the need that requires resolution, and map to the major requirements of the solution.
    • Program and test the new system. The tests verify and validate what has been developed.
    Explanation: 
    Procedures to prevent scope creep are baselined in the design phase of the systems- development life cycle (SDLC) model.