How to pass Isaca CISA Certification Exam Successfully?

test2022-02-18T06:42:47+00:00

By test Certified Information Systems Auditor, CISA Certification, update CISA exam questions 0 Comments

CISA certification is foundational to a successful IT career. Attaining CISA certification is considered beneficial because it is accepted by employers worldwide and is often requested for IT audit and security information management (SIM) positions. Our ISACA CISA practice tests cover CISA exam questions and answers to help you know about the topics of Certified Information Systems Auditor exam easily! It will help you achieve good exam results and assist you in testing yourself.

Get started now and obtain CISA certification tomorrow!

Page 1 of 62

1. Which of the following is the GRE A TEST c oncern with cond u cting penetr a tion testing o n an internal l y develop e d a pplication in the pr o duction environm e nt?

The t e sti n g could create application availability i ssues.

The t e sti n g may identify on l y known operating system vulner a bilities.

The issues identified during the testing may req u ire signif i cant remediation e f forts.

Internal security sta f f may not be qualified to conduct app l ication penet ra tion testing.

2. An IS auditor finds that not all employees are aware of t h e enterpris e' s informa t ion security polic y . The IS auditor shou l d conclude that:

th i s lack o f knowledge may lead to unintentional disclosure o f sensitive information.

informati o n security is not critical to all function s .

IS audit should provide sec u rity training to the employees.

the audit finding will cause management to provide continuo u s training to s ta f f .

3. Wh e n r ev iewing backup policie s , a n IS auditor MUST verify that backup intervals of c ritical s y ste m s do not exceed which of t h e following?

Recovery point objective (RPO)

Recovery time objective ( R T O)

Service l e v el objective (SLO)

Maximum accep t able outage (M A O)

4. Which of the following manages the digital certificate l i f e cycle to ensure ade q uate security and controls exist in digital si g na t ure a p plications related to e- c ommerce?

Registration authority

Certif i cate authority (CA)

Certificat i on relocation li s t

Certificat i on practice s tatement

5. The M O ST important reason why an IT risk assessment s h ould be u p d a ted on a re g ular basis is to: A. utilize IT r esources in a cost-e f f e ctive manner

B. comply with data classification changes C. comply with risk management policies D. react to changes in t h e IT environment

6. A data center has a bad g e- e ntry system.

Which of the following is MOST i m portant to prote c t the comput i ng assets in the center? A. Badge re a ders are installed in locations where t a mpering w o u ld be noticed

B. The computer that controls the bad g e system is b acked up frequently

C. A process for promptly deactivating lost or stolen bad g es e x ists

D. All badge entry attempts are logged

7. By evaluating appli c ation de v el o pment proje c ts against the capability maturity mo d el (CMM), an IS

auditor shou l d be able to verify that: A. reliable products are guar a nteed.

B. programmers' e f ficiency is improv e d. C. security r equire m ents are desig n e d .

D. predictable software p r ocesses are followed.

8. An IS auditor should awa r e of various analysis models used by data architecture. Which of the following a na lysis model d epict data entities and h o w they relate?

Context D iagrams

Activity Diagrams

Swim-lane diagrams

Entity relationship dia g rams

9. Key verification is one of the best controls f or ensuring tha t : A. Data is entered correctly

B. Only authorized cryptogra p hic keys are used

C. Input is authorized

D. Database indexing is performed p ro perly

10. Which of the following is the BEST performance criterion for evaluating the adeq ua cy of an org a nization ' s s e curity a w are n ess training?

Senior managem e nt is awa r e of cr i tical informa t ion assets a n d demonstrates an adeq u ate concern for their protection.

Job descriptions contain clear stat e ments of accountability for information securit y .

In accordance with the degree of risk and business impact, t here is ade q uate funding for security e f forts.

No actual incidents have occ u rred that have caused a loss or a public embarrassment.

Page 2 of 62

11. In the p rocess of e valuating p r o g ram change controls, an I S auditor w o uld use source code comparison software to:

examine source pr o gr a m changes without information from IS personnel.

detect a source pr o gr a m c hange made bet w een acquiring a copy of the source and t h e comparison run.

confirm t h at the control copy is the curr e nt version of the pro d uction progr a m.

ensure that all changes made in t h e current source copy are detected.

12. Which of the following activ i ties i s MOST im p ortant to consider when conducting IS audit planni n g? A. Results f r om previous audits are r ev iewed.

B. Audit sch e duling is ba s ed on skill set of audit te a m. C. Resourc e s are allocated to areas of high ris k .

D. The audit committee agrees on risk rankings.

13. In computer forens i c which o f the following d escribe the process that converts the information extracted into a format t h at can be understood by investigator?

I n vestigat i on

Interrogation

Reporting

E x traction

14. Which of the following device in F r ame Relay W AN technique is genera l ly customer own e d device that provides a connectivity between company's o w n network a n d the frame relays network?

DTE

DCE

DME

DLE

15. Wh e n e valuating the recent implementation of an intrusion detection system (IDS), a n IS auditor should be MOST conce r ned with in a ppr o priate:

encryptio n .

training.

tuning.

patching.

16. An or g anization recently e x perienced a phishing attack that resulted in a breach of confidential information.

Which of the following would be MOST relevant f o r an IS auditor to review when d eter m ining the root cause of the incident?

Email co n figurations

Simple mail transfer protocol (SMTP) logging

Browser configurati o ns

Audit logging

17. Intrusion detection sy s tems (IDSs) can: A. s ubstitute for a firewall.

B. compensate for weak authentication mechanisms.

C. conduct i n v estigations of attacks from within the network. D. provide information to enh a nce the security infrastructure.

18. At a project steering commit t ee meeting, it is stated that ad d ing controls to business processes und e rgoi n g r e-e n gine e ri n g is an unnecessary cost.

The IS audito r ’ s BEST response is t h at the actual control overhead for a bu s iness process is: A. usually c o nsiderable, b ut the benefits of good c o ntrols alw a ys exceed the cost.

B. the responsibility of t h e project manage r , and the cost should have been included in the bu d get. C. usually di f ficult to ascertain but is j u stifiable, because c ontrols are essenti a l to doing business

D. usually l e ss than the poten t ial cost of failure caused by la c k o f controls.

19. W h at is/are used to measure and ensure pr op er network capacity ma n agement and availability o f services?

Network performance - monitoring t o ols

Network compon e nt r e dun d ancy

Syslog reporting

IT strateg i c planning

20. Which of the following is the MOST important reason for logging firewall act i vi t y ? A. Intru s ion detection

B. Auditing purposes

C. Firewall tuning

D. Incident i n v estigation

Page 3 of 62

21. Which of t h e following r i sk handling technique in v olves the practice of being proactive s o that the ri s k in question is not realized?

Ri s k M iti g ation

Risk Acc e ptance

Risk A v oidance

Risk transfer

22. So p histicated database systems provide ma n y layers and types of securit y , including (Ch o ose three.):

Access control

Auditing

Encrypti o n

Integrity c ontrols

Compression controls

23. Which of the following wou l d prevent unauth o rized changes to i n formation stored in a server's log? A. W rite-protecting the directory containing the system log

B. W riting a duplicate log to another server

C. Daily printing of the system log

D. Storing the s y stem log in write-once media

24. An IS auditor revie w ing an or g an i zation that u ses cross-t r aining practices shou l d assess the risk of: A. depend en cy on a single person.

B. inadequa t e succession planning.

C. one pers o n knowing all parts of a system. D. a disruption of operat i ons.

25. A call- b ack system r equires that a user with an id and pa s sword call a remote server through a dial-up line, then the s e rver disconnects and:

dials back to the user ma c hine based on the user id and pa s s word using a telepho n e number from its database.

dials back to the user ma c hine based on the user id and pas s word using a telepho n e number p r ovid e d by the user during this c o nnection.

waits for a redial back from the user machine for reconfirm a tion and then verifies the user id and password using its database.

waits for a redial back from the user machine for reconfirm a tion and then verifies the user id and password using the send e r's database.

26. W h o is ultimately r e sponsible a n d accountable for reviewi n g user access to s y s te m s ? A. S y s tems s ecurity administrators

B. Data custodians

C. Data ow n ers

D. Information systems auditors

27. Which of the following state m ent correctly describes the d i f ference between total flooding a nd l ocal application ex tinguishing agent?

The local application d esign contain physical b a rrier enclo s i n g the fire space where as physical barrier is not present in total flooding extingu i sher

The total flooding d esign con t ain physical barrier enclosing the fire space whe r e as physical barrier is not present in local appli c ation design extinguisher

The physical barrier e nc losing fire s pace is not p resent in total flooding a n d local application extinguisher agent

The physical barrier e nc losing fire s pace is pre s ent in tot a l flooding a nd l ocal application extinguisher agent

28. What is the PRIMA R Y purpose of audit trails? A. T o document auditing e f forts

B. T o correct data integrity errors

C. T o establish accountability and responsibility for processed transactions

D. T o prevent unauthoriz e d access to data

29. T o ensure the inte g rity of a recovered data bas e, which of the following would be M OST useful? A. Before-and-after transaction images

B. Database defragm e nt a tion tools

C. A copy of the data dictionary D. Application transaction logs

30. W h en should plans for test i ng for user acceptance be pr ep are d?

In the requirements definition phase of the s y stems-develop m ent project

In the feasibility phase of the syst e ms-development project

In the design phase of the s y stems - development project

In the de v elopment phase of the sy s tems-deve l opment project

Page 4 of 62

31. Pretexting is an act of: A. DoS

B. social engineeri n g

C. eavedro p ping

D. soft coding

E. hard coding

F . None of t h e choices.

32. Followi n g an unaut ho rized disclo s ure of data, an or g anization ne e ds to implement d a ta loss prevention ( DLP) meas u res.

The IS audito r ’ s BEST re c ommendation should be to:

install DLP software on corporate servers to prevent recurr e nce.

monitor a nd block outgoing e m ails based on common DLP criteria.

restrict removable media access on all compu t er sy s tems.

establish a risk and c o ntrol frame w ork.

33. An IS auditor is r eviewing access to an application to determine w h ether the 10 most recent “new user” forms were cor r ectly au t horized. This is an e x ample of:

variable sampling.

substantive testing.

compliance testing.

stop-or-go sampling.

34. Which of the following could provide an organization with t he fastest resumption of processing following a d i sk failure?

Server load balancing

Mirroring

Open da t abase connect i v ity ( O DBC) of the backup server

Replication

35. A chan g e to the scope of an IT p r oject has been formally submitted to the project mana g e r . What should the project mana g er do N EXT?

Update the project plan to reflect the change in scope

Discuss t h e change wi t h the project team and de t ermine if it should be a p p roved

Escalate the change to the change advisory board for app r oval

Determine how the change will a f fect the s c hedule and budget

36. Which of the following should be the GRE A T EST concern to a n IS auditor reviewi n g the information security framework of an org a nization?

The info r mation security policy has not been u p dated in the last two years.

A list of critical information assets w as not included in t h e information security polic y .

Senior management was not in v olved in the development of the informati o n security polic y .

The information security policy is n ot aligned with regulat o ry requi r ements.

37. Which of the following should be an information security m anag e r ’ s PRIMA R Y role when an org a nization initiates a da t a classification process?

A s s ign the asset cla s si f ication level.

Define the classificati o n structure to be implemented.

V erify that assets have been ap p r o priately classified.

Apply security in accordance with specific classification.

38. In a bo t net, mailbot l ogs in t o a particular type of system for making coordinated attack attempts. What type of s y s tem is th i s ?

Chat s y st em

S MS s y s tem

Email s y s t em

Log system

Kernel sy s tem

None of t h e choices.

39. Assessments of critical inf o rmation systems are based on a c yclical audit plan that has not been updat e d for several years.

Which of the following should t he IS auditor recommend to BEST address this situation? A. Use a revolving set of aud i t plans to cover all systems

B. Update the audit plan quarter l y to account for delays and deferrals of per i odic reviews

C. Regularly validate the audit plan a g ainst bu s iness risks

D. Do not include per i odic reviews in detail as part of the audit plan

40. Which of the following would be an IS auditor's GRE A TEST c o ncern wh e n evaluating a cybersecu r ity incident response plan?

The plan has not been recently t e sted.

Roles and responsibilities are not detailed for each proces s .

Stakeholder contact details are not up-to- d ate.

The plan does not include incident response m e trics.

Page 5 of 62

41. Once a n org a nization has fin i shed the business process r eengi n eer i ng (BPR) of all its critical ope r ations, an IS auditor would M O ST likely foc u s on a review o f:

pre-BPR process flowcharts.

post-BPR pro c ess flowcharts.

BPR project plans.

continuo u s improveme n t and monitoring pl a ns.

42. Which of the following contr o ls would BEST detect intrus io n?

User IDs and user pri v ileges are g r anted thro ug h authorized proced u res.

Automatic logo f f is us e d when a wo rkstation is i n active for a particular period of time.

Automatic logo f f of the system occ u rs after a sp e c ified number of unsucc e ssful attemp t s .

Unsuccessful logon attempts a re monitored by the security a d ministrato r .

43. Foll o wing a recent internal data breach, an IS auditor w a s asked to evaluate information security practices within the org an ization.

Which of the following findings would be MOST im p ortant to report to senior management? A. Employees are not required to sign a non-comp e te agreem en t.

B. S e c urity e ducation and awar e ness workshops have not been co m pleted. C. Users lack technical knowl e dge re l ated to security and data protection.

D. Desktop passwords do not r equire special char ac ters.

44. Which of the following acts as a decoy to de t ect active in t ernet attack s ? A. Honeypots

B. Firewalls

C. T rapdoors

D. T ra f f ic a n al ys is

45. Which of the following sit e s would be MOST appropriate in the case of a v ery short r e c overy time objective ( R T O)?

Mobile

Redund an t

Shared

W arm

46. Which of the following dynamic interaction of a Business Model for Information Security (B M IS) i s a place to introduce possible solutions such as feedback loops; a lignment with process improvement; and considerati o n of emerg e nt issues in system design life cycle, c han g e contr o l, and risk mana g ement?

Governing

Culture

Enabling and supp o rt

Emergence

47. Which of the following is the PRIMA R Y advantage of having an established infor m at i on security govern a nce framew o rk in place when an or g anization is adopting emerging t echnolog i es?

An emerging technolo g ies strategy would be in place

A cost-benefit analysis process would be easier to perform

An e f fective security risk manage m ent process is established

End-user acceptance of emerging technolog i es has been estab l ished

48. An IS auditor has completed a service level mana g ement a udit related to order ma n agement services provided by a t h ird part y .

Which of the following is t he MOST si g nificant findi n g? A. The third party has o f f shore suppo r t arrangem e nts. B. Penalties for missing ser v ice levels are limited.

C. The service level agreement does not define how availability is measure d .

D. Service d esk support is not a vailable outside the company ’ s business hours.

49. Which of the following is the MOST important outcome of e f f e c t i ve risk tr e atment?

T imely reporting of incidents

Elimination of risk

Implementation of corrective a c tions

Reduced cost o f maintaining contr o ls

50. Th e re i s a concern that a salesperson may downl o ad an org a nization ’ s full cu s to m er list from t h e

Software as a Service (SaaS) wh e n leaving to work for a competito r . Which of the following would BEST help to identify this type of i n c ident? A. Monitor a pplications logs

B. Disable remote access to the application

C. Implement a web appl ic ation firewall

D. Implement an intrusion detection sy s tem (IDS)

Page 6 of 62

51. W h at is a primary high-lev e l goal for an audit o r who is rev i ewing a sys t em development project? A. T o ensure that progr a mming and p rocessing environments are s egre g at e d

B. T o ensure that proper app r o v al for the project h a s been obtained

C. T o ensure that business objectives are achieved

D. T o ensure that projects are monito r ed and adm i nistrated e f fect i v ely

52. D uring an audit of a business co n tinuity plan ( BCP), an IS auditor found that, although all dep a rtments were h oused in the same building, ea c h dep a rtme n t had a sepa r ate BC P . T h e IS auditor recommended that the B C Ps be reconciled.

Which of the following ar e as should be recon c iled FIRST? A. Evacuati o n plan

B. Recovery priorities C. Backup stora g es D. Call tree

53. Which of the following attack i s also known as T ime of C h eck( T OC)/ T i me of Use( T OU)? A. E a v esdropping

B. T ra f fic analysis C. Masquer a ding D. Race Co n dition

54. An integrated test f a cility i s cons i dered a useful audit tool because it: A. is a cost- e f ficient appr o ach to auditing applicati o n control s.

B. enables the financial and IS auditors to i n tegrate their audit test s . C. compares processing output with inde p en d ently calculated da t a.

D. provides the IS auditor with a tool to analyze a large r a nge of information

55. Which of the following should be used to assess the level of security required to p ro tect i n formation on a corpo ra te network?

Data cl a s sif i cation

B u s iness intelligence

Acc e ss ri g hts

Acc e ss c o ntrol matrix

56. The ne twork of an organization h as been the victim of sev e ral intruders' attac k s. Which of the following m e asures w ou l d allow for the early dete c tion of such incidents? A. Antivirus software

B. Hardening the servers

C. Screening routers D. Honeypo t s

57. Which of the following entities i s BEST suited to define t h e data classification levels within an org a nization?

Database administrator based on the data schema

Legal compliance team based on the appli c ation regulations

Business own e r resp o nsib l e for the respective d ata

System a dministrator respon s ible for data security controls

58. Which of the following findings should be of MOST concern t o an IS auditor wh e n evaluating information security governan c e within an or g anization?

The data center man a ger has final sign-o f f on security proje ct s .

The info r mation security o v e rsight committee meets quarter l y .

The information security department has di f ficulty filling v a c ancies.

Information security policies were last updated two years ago.

59. D u ring a n audit of a mission-critical system h o sted in an outsourced data cen t e r , an IS auditor discovers that contracted routine mai n tenance for the alternate pow e r ge n e r ator was not perform e d. Which of the following sh o uld be the a u dito r ’ s MAIN concern?

Fraudule n t behavior by the outsourcer charging f or work not p erfor m ed

Failure of the alternate pow e r ge n e r ator duri n g a power o uta ge

High repa i r costs i f fau l ty generator parts are not detected in a timely manner

Loss of warr a nty due to lack of system mainten a nce

60. D ata edits are implemented be f ore processing and a r e considered which of the f o llowing? A. Deterrent integrity controls

B. Detective integrity controls

C. Corrective integrity controls

D. Preventative integrity controls

Page 7 of 62

61. Which of the following term describes a failure of an ele c tric utility company to supply power within acceptable rang e ?

Sag

Bl a ckout

Brownout

EMI

62. In addi t ion to the backup con s id e rations for all systems, w h ich of the following is an important consideration in providing backup for online syst e ms?

Maintaining system software pa r a m eters

E n s uring periodic du m ps of transa c tion logs

Ensuring gra n dfather- f ather-son file backups

Maintaining important da t a at an o f fsite location

63. Which of the following BEST descr i bes a common risk in i mplementing a new application software package?

Parameter settings are incorrect

T ransacti o n volume is excessive

Sensit i v i t y of transacti o ns is high

The application lacks audit trails

64. When developing a risk-based IS audit plan, the PRIMA R Y focus should be on functions: A. consider e d important by IT management.

B. with the most ine f f e ctive controls.

C. with the greatest number of threats.

D. considered critical to b usiness operations.

65. Integ ra ting busine s s continuity planning (BC P ) into an IT p roject aids i n : A. the retrofitting of the business continuity requirements.

B. the development of a more compre h ensive set o f requirem e nts. C. the development of a t ransaction flowchart.

D. ensuring the applicati o n meets the user's need s .

66. T o create a digital si g natu r e in a message using asymmetric encryption, it i s necessary to: A. first use a symm e tric algorithm for the authenti c ation seque nc e.

B. encrypt t h e authen t ication sequen c e u s ing a public ke y .

C. transmit the actual digital signature in unencrypted clear text. D. encrypt t h e authentication sequen c e using a private ke y .

67. W h en auditing a software deve l opment proj e ct, a review of which of the following will BEST v e rify that project work is adequately subdivided?

W ork breakdown structure

S tatement of work

Scope st a tement

Functional and techn i cal design d o cuments

68. Which of the following type of computer has highest proces s ing speed? A. Supercomputers

B. Midrange servers

C. Personal computers D. Thin client computers

69. A comp a ny is using a soft w are developer for a project.

At which of the following poin t s should the software quality a s surance (QA) plan be dev e loped? A. As part of software definition

B. During the feasibility phase C. Prior to acceptance testing D. As part of the design phase

70. Which of t h e following secur i ty cont r ol is intended to bring e n vironment b a ck to regular ope r ation? A. Deterrent

B. Preventive C. Corrective D. Recovery

Page 8 of 62

71. Which of the following E-comm e rce model covers all the transactions between companies and government org a nization?

B-to-C relationships

B-to-B relationships

B-to-E relationships

B-to-G relationships

72. What is the MOST important r ole of an organi z ation ’ s data c ustodian in support of information security function?

Evaluating data sec u rity technolo g y vendors

Applying approval security polici e s

Approving access rights to departmental data

Ass e ssing data security r isks to the organization

73. Which of the following soft w are development methods is based on iterative and incremental developmen t , where re q u i rements and solutions ev o lve through c o llabo r ation betwe e n self-or g anizing, cross-functi o nal teams?

Agile Development

Software prototyping

Rapid ap p lica t ion development

Compon e nt based development

74. An IS a u ditor discovers a re c urri n g software control proce s s issue that s e v erely impacts the e f ficiency of a crit i cal b usiness pro c ess.

Which of the following is the BEST recommendation? A. Replace t he malfunct i oning syst e m.

B. Determine the compensating controls. C. Identify other impacted processes.

D. Determine the root cause of the issue.

75. R ather than simply r eviewing the ade q uacy of access cont r ol, appro p riateness of access policies, and e f fect i v eness of saf e guards and procedures, t h e IS auditor is more concern e d w i th e f fect i veness a nd utilization of assets.

T rue or false? A. T rue

B. False

76. T est and developm e nt environm e nts should be separated. T rue or false?

T rue

False

77. Which of the following attack occurs when a malicious a ct i on is perfo r med by i n v oking the operating system to execute a particular s y stem call?

E a v esdropping

T ra f fic analysis

Masquer a ding

Interrupt attack

78. Which of the following translates e-mail formats from one network to another so that the message can travel through all the networks?

Gateway

Protocol c onverter

Front-end communication processor

Concent r ator/multiplexor

79. An IS auditor is reviewing the r e mote access methods of a company used to acc e ss system remotel y .

Which of the following is LEAST p referred remote access method from a s e c urity and cont r ol point of view?

RADIUS

T ACACS

DIAL-UP

DIAME TE R

80. Who is responsible for ensuring t hat system controls and s u pp o rting p r ocesses p r o v ides an e f f e ctive level of protection, based on the data classification set in accordance with corpo r ate security polici e s a nd proced u res?

Project S p onsor

S e c urity O f ficer

User Management

Senior Managem e nt

Page 9 of 62

81. Which of the following is the protocol data unit (PDU) of a pp l ication layer in TCP/IP m o del? A. Data

B. Segment

C. Packet D. Frame

82. A nu m ber of system failures are occurring when cor r ections to previously dete c ted err o rs are resubmitted for acceptance testing. This would indicate that t h e maintenance team is pro b ably not adequately performing which of the fol l owing types of testing?

Unit testi n g

Integration testing

Design walk-throughs

Configur a tion manag e ment

83. A manu f acturing company is i m pl e menting app l ication soft w a r e for its sales and distr i bution syst e m. Which of the following is the MOST important rea s on for the co m pany choose a cen t ralized online

database?

Enhanced data redu nd ancy

E l imination of multiple points of fai l ure

Eliminati o n of the need for data no r malization

Enhanced integrity controls

84. The in f ormation security policy t h at stat e s 'each individ u al must have t h eir bad g e r e ad at every

controlled d o or' a d dress e s whi c h of the following attack methods? A. Piggybacking

B. Shoulder surfing C. Dumpster diving D. Impersonation

85. Which of the following is the M O ST cr i tical a n d contributes the greatest to the quality of data in a data wa r eh o use?

Accuracy of the source data

Credibility of the data source

Accuracy of the extraction process

Accuracy of the data transformation

86. An or g anization h a s created a policy that defines the typ e s of web s i tes that u s e rs are forbi d d e n to acces s .

What is the MOST e f fective technology to en f orce this policy? A. S tateful i n spection fir e wall

B. W eb content filter C. W eb cache server D. Proxy server

87. The M OST e f f e c tive control f o r reducing the risk related to phishing is: A. centralized monit o ring of s y s te m s .

B. including signatures for phishing in antivirus software. C. publishing the policy o n an t iphishi n g on the intr a net. D. security t r aining for all users.

88. What is the pu r pose o f a hypervis o r?

Monitoring the perfo r man c e of virtual machin e s

Cloning virtual machines

Deploying settings to multiple machines simult a neously

Running t he virtual machine envir o nment

89. Which of the following would be the MOST a ppropriate reas o n for an o rganization to purchase fault-tolerant har d wa r e?

Reducing har d wa r e maintenance costs.

Improving system performance.

Minimizing business l o ss.

Compen s ating for the lack of conti n gency plann i ng

90. W h at uses questionnaires to lead the user throu g h a series of choices to r each a conclusion? A. Logic tre e s

B. Decision trees

C. Decision algorithms D. Logic algorithms

Page 10 of 62

91. A live test of a mut u al agree m ent for IT syst e m recovery h as been carried out, including a four- h ou r test of intensive usage by the business units.

The test has been successful, but giv e s only partial assurance that the:

system a n d the IT operations team can susta i n ope r ations in the emerg e ncy environment.

resources and the environment cou l d sustain the transaction load.

connectivity to the applications at t h e remote site meets response time requirements.

workflow of actual business operations can use the emerg enc y s y s tem in c ase of a d is aste r .

92. The op timum busi n ess continuity strategy for an entity is determined b y the:

lowest d o wntime cost and hig h est recovery cost.

lowest s u m of downtime cost and recovery cost.

lowest recovery cost a nd highest downtime cost.

average of the combi n ed do w ntime and recovery c o s t.

93. In a small organization, an e m pl oy ee performs computer operations and, when the situation demands, p r ogram modifications.

Which of the following sh o uld the IS auditor recommend? A. Automat e d logging of changes to development libraries B. Additional sta f f to prov i de separati o n of duties

C. Procedu r es that verify that only a p proved p r og r am changes a r e implem e nted D. Acc e ss c o ntrols to prevent t he ope r ator from making program modificatio n s

94. An IS auditor revie w ing an or g an i zation's IT strategic plan should FIRST review: A. the existi n g IT environment.

B. the business plan.

C. the present IT budget.

D. current technology trends.

95. An or g anization h a s a recovery time objective ( R T O) eq u al to zero and a recovery point objective

(RPO) close to 1 minute for a critical system. This implies that the s y st e m can tolerate:

a data lo s s of up to 1 minu t e, but the processing must be c o ntinuous.

a 1-minute processing int e rruption but cannot tolerate any data los s .

a process i ng interruption of 1 minute or more.

both a data less and processing int e rruption lo ng er than 1 minute.

96. W h en auditing a d i saster reco v ery plan for a critical busi n ess area, an IS auditor fi n ds that it does not cover all the systems.

Which of the following is the MOST appro p riate action for the I S auditor? A. Alert ma n agement a n d evaluate the impact of not covering all s y s te m s . B. Cancel t h e audit.

C. Complete the audit of the syst e ms covered by the existing d i saster recovery plan. D. Postpone the audit until the systems are add e d to the disast e r recovery plan.

97. An IT governance fr a mework pro v ides an org a nization with: A. a basis for directing and controlling I T .

B. assurance that there will be IT cost r eductions.

C. organizational structures to enlarge the market share thr o u g h I T . D. assurance that there are surplus IT inve s tments.

98. Which of the following shou l d an IS auditor recommend be d one FIRST upon learni n g that new d a t a protection legislation may a f fect the organization?

Implement data pro t ection best practices

Implement a new sec u rity ba s eline for achieving compliance

Restrict system acc e ss for non c ompliant busin e ss processes

Perform a gap analysis of data protection practices

99. Which of the following would be the GRE A TEST risk assoc i ated with a new chat feature on a retaile r ’ s website?

Productivity l o s s

Reputational dama g e

Data loss

S y s tem d owntime

100. Passwords should be:

assigned by the security ad m inistrator for first time logon.

changed every 30 days at the disc r etion of the use r .

reused often to ensure the u s er does not forget t he passwor d .

displayed on the screen so that the user can ensure that it has been ente r ed pr o perl y .

Page 11 of 62

101. Which of the following is a data validation ed i t and control? A. Hash tota l s

B. Reasona b leness checks

C. Online access controls

D. Before and after image reporting

102. An IS auditor is performing an a u dit of a large org a nizat i on ’ s operating system maintenance proced u res.

Which of the following fin d ings presents the GRE A TEST risk?

Some int e rnal servers cannot be p a tched due to software incompatibilit y .

The configuration ma n agement da t abase is not up-to- d ate.

V ulnerability testing i s not performed on the development se rv er s.

Critical patches are applied immediately while others follow quarterly rele as e cycles.

103. Which of the following would an IS auditor c o nsider to be the MOST helpful w hen evaluating the e f fectiveness and ade q u a cy of a com p uter prevent iv e maintenance prog r am?

A system downtime l o g

V endors' reliability figures

Regularly schedu l ed maintenance l og

A written preventive maintenance schedule

104. An org a nization is deciding whether to outsource its c usto m er relationsh i p manage me nt systems to a provider loc a ted in anoth e r countr y .

Which of the following sh o uld be the PRIMA R Y influence in the outsourcing decision? A. T ime zone di f ferences

B. The service provid e r ’ s disaster recovery plan

C. Cross-border privacy l aws

D. Curr e nt geopolitical conditions

105. An IS auditor cond u cting an access control review in a cl i ent-server e nvironment d iscovers that all printing o ptions are accessible by all users. In this s ituation, the IS auditor is MOST likely to c onclude that: A. exposure is greate r , since information is available to unau t hor iz ed users.

B. operating e f ficiency is enh a nced, since an y one can print any report at a n y time. C. operating proced u res are more e f fective, since information is easily a vailable.

D. user friendliness and f l exi b ility is f a cilitated, since there is a smooth flow of information among user s .

106. The M OST likely e x planation for a succ e ssful social engineeri n g attack is: A. that com p uters make logic errors.

B. that peop l e make judgment errors.

C. the com p uter knowle d ge of the attackers.

D. the technological sop h istication of the attack m e thod.

107. An info r mation security m anager has identified and impl e mented mig r ating con t rols according to industry best practices.

Which of the following is the GRE A TEST risk ass o ciated with t h i s approach?

Important security controls may be missed with o ut senior managem e nt input.

The cost of control implementation may be too high.

The migration measur e s may not be updated in a timely manne r .

The security program may not be aligned with o rganizational objectives.

108. The P RIMA R Y purpose for mee t ing with auditees prior to formally closing a review is to: A. confirm t h at the audito r s did not ov e rlook any important issues.

B. gain agr e ement on the findings.

C. receive f e edback on the ade q uacy of the audit procedures. D. test the st ructure of t he final presentation.

109. Which of the following proce d ures would MOST e f fect i ve l y d etect the loading of illegal software packages onto a network?

The use o f diskless workstations

Periodic checking of hard drives

The use of current antivirus software

policies that result in i n stant dismissal if violated

110. W h en participating in a systems - development project, an IS auditor should focus on system co n trols rather than e nsuring that ade q uate a n d complete documentation exists for all projects.

T rue or false? A. T rue

B. False

Page 12 of 62

111. A previ o usly agreed - upon r ecommendation w as not impl e mented bec a use the aud i tee no lon g er agr e es with the origi n al findings.

The IS audito r ’ s FIRST course of action should be to: A. exclude the finding in the follow- u p audit rep o rt.

B. e s c alate t he disagreement to the a udit commi tt ee. C. assess the reason f o r the disagre e ment.

D. require i m plementation of the original recommendation.

112. D uring an IS audit, auditor has o bserved that authentication and auth o r i zation s t eps are split into two functions and there is a possibility to force the authorization step to be c o mpleted bef o re the authentication step.

Which of the following technique a n attacker could user to for c e authorization step be f ore authentication? A. E a v esdropping

B. T ra f fic analysis C. Masquer a ding D. Race Co n dition

113. Which of the following attack i n c l udes social e ngineering, link manipulation or web site forgery techniques?

s urf atta c k

T ra f fic analysis

Phishing

Interrupt attack

114. What type of crypt o s ystem i s characterized by data being encrypted by the sender u sing the recipient's public ke y , and the data then being d ecrypted using the recipient ' s private key?

With public-key encry p tion, or sym m etric encryption

With public-key encry p tion, or asy m metric encryption

With shared-key encryption, or symmetric encryption

With shared-key encryption, or asymmetric enc r y ption

115. An org a nization is considering w h ether to allow employees to use personal co m puting devices for business purposes.

T o BEST f a cilitate senior managem e nt ’ s decision, the informati o n security mana g er shou l d: A. perform a cost-benefit analysis

B. map the s trategy to business objectives

C. conduct a risk assessment D. develop a business case

116. Which of the following option INCORREC T L Y describes PBX featur e ?

V oice mail -Stores messages centrally and C by using a pass w ord C all ow s for retrieval from inside or outside lines.

T enanting-Provides for the possibility to break into a busy line to inform another user a n important message

Automatic Call Distribution - Allows a PBX to be configured s o that incoming calls are distributed to the next available agent or p l aced on -h old until one become available

Diagnostics -Allows f o r bypassing normal call restriction p r ocedures

117. W h at is the primary secur i ty concern for EDI environments? A. T ransacti o n authentication

B. T ransacti o n completeness

C. T ransaction accuracy

D. T ransaction authoriza t ion

118. An IS auditor revie w ing d i gital rights management (DRM) applications should exp e ct to find an extensive use for which of the following technolog i es?

Digitalized signatures

Hashing

Parsing

Stegano g raphy

119. During a human re s ources (HR) audit, an IS auditor is informed that there is a verbal agr e em e nt between the IT and HR departments as to the level of IT serv i c e s expected.

In this situation, what should the IS auditor do FIRST?

P o s tpone the audit until the agree m ent is documented

Report the existence of the undocumented agreement to senior mana ge ment

Confirm the content of the agree m ent with both departments

Draft a s e rvice level a g ree m ent (SLA) for the t w o departmen t s

120. Which of the following is the PRIMA R Y role of an IS auditor with regard t o data privacy? A. E n s uring compliance w i th data privacy laws

B. Communicating data privacy requirements to t h e org a nization

C. Drafting the or g anization ’ s data privacy policy

D. V erifying that privacy p ract i ces match privacy statements

Page 13 of 62

121. Which of the following BEST l i m i ts the impact of server f a ilures in a dis t ributed envi r onment? A. Redund an t pathways

B. Clustering

C. Dial backup lines D. Standby power

122. An IS auditor performing a r e view of the backup process i ng facilities should be M O ST concerned that:

adequate fire in s urance exists.

regular h a rdw a re maintenance is performed.

o f fsite st o rage of transa c tion and master files ex i s ts.

backup processing fac i lities are ful l y tested.

123. A bank is selecting a server for its retail accounts applicatio n .

T o ensure that the server can handle a high volume of transacti o ns with the r equir e d res p onse times, which test should the IS auditor reco m mend?

Regression

Acceptance

Benchmark

Integration

124. An IS auditor is a member of an application development team that i s selecting softw a re. Which of the following w o uld i m pair the audito r ’ s i n dep e nd e nce?

V erifying the weighti n g of each sel e ction criteria

Approving the vendor selection methodol o gy

Reviewi n g the request for proposal (RFP)

Witnessi n g the vendor s election process

125. After assessing risk, the decisi o n to treat the risk should be based P R IMARI L Y on: A. whether the level of r isk e xceeds risk appetite

B. availability of financial r esources

C. whether the level of r isk e xceeds inhe r ent risk

D. the critica l ity of the risk

126. In an o nline banki n g applicatio n , which of the following w ould BEST p rotect against identity theft? A. E n c rypti o n of personal password

B. Restr i c ti n g the user to a specif i c te r minal

C. T wo-factor authentication

D. Periodic review of ac c ess logs

127. Which of the following is MO S T i nfluential when defining d isaster recovery strategies? A. Existing server re d un d ancies

B. Maximum tolerable do wntime

C. Data classification scheme D. Annual l o ss e x pectancy

128. Which of the following sta t ement is NOT true about smoke d etector?

The Smoke detect o rs should be above and below the ceiling tiles throughout the facil i t i es and below the raised in the c o mputer room floor

The smoke detector should pr o duce an aud i ble a larm when ac t i vated and be linked to a monitored station

The location of the smoke de t ector should be marked on the tiling for easy identi f ication and access

Smoke detector should rep l ace fire suppression system

129. A com p any underta k es a business process reengin e eri n g ( BPR) project in support of a new and direct marketing app r oa c h to its cust o mers.

Which of the following w o uld be an IS auditor's ma i n concern a b out the new process? A. Whether key controls a re in place to protect ass e ts and inf o rmation resour c es

B. If the system address e s corporate customer re q uirements

C. Whether the system can meet the perform a nce goals (time and resources)

D. Whether owners have been identi f ied who will be responsib l e for the pr oc ess

130. In which of the following database models is t he data rep re sented in terms of tulles and g r oup e d into relations?

A. Hierarchical database model

B. Network database mo d el

C. Relational database model

D. Object-relational data b ase model

Page 14 of 62

131. Perfor m ance monitoring too l s report that serv e rs are consi s tently above the recommended utilization capacit y .

Which of the following is the BEST recommendation of the IS auditor? A. Develop a capa c ity plan based on us age projections.

B. Deploy l o ad balanc e rs. C. Monitor act i vi t y logs.

D. Add servers until utiliz a t i on is at target capacit y .

132. The GR E A TEST risk when p erfo r ming data n o rmalization is: A. the incre a sed complexity of the data model

B. duplicati o n of audit logs

C. reduced d ata redu n d a ncy D. decreased performa n ce

133. When reviewing IS strategie s , a n IS auditor can BEST asse s s wheth e r IS strategy supports the organizations’ business o bjectives by determining if I S :

has all the personnel a nd equip m e n t it needs.

plans are consistent with manage m ent strateg y .

uses its equipment a n d person n el e f ficiently and e f fectivel y .

has su f ficient excess capa c ity to r e s pond to changing di r ections.

134. Which of the following physical a ccess controls e f f e c t i vely r educes the risk of piggybacking? A. Biometr i c door locks

B. Combination do o r locks

C. Deadman doors

D. Bolting door locks

135. Man a g e ment has agreed to perfo r m multiple remediation actions in res p onse to an audit issue, including the implementa t ion of a new control.

Which of the following is t he BEST ti m e for an IS a uditor to p e rform an audit follow-up of this issue? A. After management has comp l eted the re q uired actions

B. When au d it resources are available

C. When managem e nt r es ources are available

D. After the n ew control has been in place for one year

136. Which of the following is the MOST likely reason an organi z a t ion would u s e Pl a tform a s a Serv i c e

(PaaS)?

T o operate third-p a r t y hosted appl ic ations

T o install and man a ge ope r ating systems

T o establish a network and security architecture

T o develop and integ ra te its applications

137. Which of the following manage m ent decisions p resents the GRE A TEST risk associated with data leakage?

S e c urity a war e ness train i ng is not provided to s t a f f.

There is n o requirement f o r deskt o ps to be encrypted.

Security policies have not been u pd ated in the past yea r .

Sta f f are allowed to work remotel y .

138. Which of the following is a guiding best practice for imp l e menting log i cal acc e ss controls? A. Implementing the Biba Integrity Model

B. Access is grant e d on a least-privilege ba s is, per the organ i z a tion's data owners

C. Implementing the T ak e -Grant access control m o del

D. Classifyi n g data according to the subject ’ s requirements

139. Which of the following ACID p r operty in DBMS e nsures that t he concurrent execution o f transactio n s results in a system s tate that would be obtained if transactions were executed seriall y , i.e. one after the other?

Atom i ci t y

Consistency

Isolation

Durability

140. Which of the following would B E ST support a business case to implement a data leakage prevention ( DLP) solution?

An unusual upwa r d tr e nd in outbo u nd email volume

Lack of visibility into p r evious data leakage incidents

Industry b enchmark of DLP investments

A risk assessment on the threat of data leakage

Page 15 of 62

141. An org a nization has su f fe r ed a number of incidents in which USB fl a s h drives w ith sensitive data have been l o st.

Which of the following w o uld be M O ST e f fective in preventing l o ss of sensitive data? A. Modifying the disciplinary policy to b e more stringent

B. Implementing a check - in/ch e ck-out process for USB flash dri v es

C. I s suing encrypted USB flash drives to st a f f

D. Increasing the frequency of secur i ty awareness training

142. An IT department has given a vendor remote a ccess to the internal net w ork for troubleshooting network per f ormance pr o blems.

After discov e ring the remote ac t ivity d uring a fire w all log re v ie w , which of the following is t he BEST c o u r s e of action for an informati o n security mana g er?

Revoke t h e access.

Review t h e related service level agreement (SLA).

Determine the lev e l of access granted.

Declare a security inci d ent.

143. Wh e n conducting a follow- u p au d it on an org a nization ’ s fir e wall configu r ation, the IS auditor

discovered that the firewall had be e n integrated in t o a new sy s tem that provides both firewall and intrusion detection capabilities.

The IS auditor should:

consider the follow- u p audit unnec e ssary since the firewall is no long e r be i ng used.

assess whether the in t egrat e d system address e s the identified risk.

review the compatibility of the new system with e x isting ne t w o rk controls.

evaluate whether current sta f f i s a ble to support the new s y stem.

144. A dat a base admin is trator has detected a pe r formance p r oblem with some tables which could be solved through de n ormal i zation.

This s i tuation will increase the risk of: A. c oncurrent acc e s s .

B. deadlocks.

C. unauthor iz ed access to data. D. a loss of d ata integrit y .

145. An IS auditor obser v es a weakn e ss in the tape managem e nt s ystem at a data center in that some parameters are set to bypass or ignore tape header records.

Which of the following is the MOST e f f ective compensating control for this weakness? A. Staging and job set up

B. Supervis o ry review of logs C. Regular back-up of tapes D. O f f site st o rage of tapes

146. The IS auditor has identified a potential fraud p e rpetrated by the network administrato r . The IS auditor should:

i ssue a report to ensure a timely resolution

review the audit finding with the audit committee prior to a ny other discussions

perform more detail e d tests prior to disclosing t h e audit results

share the potential audit find i ng with the securi t y adminis t rator

147. A firewa l l has been instal l ed on the company ’ s web serve r . Which concern does the firewall a d dr e ss?

A vailability of the information

Unauthor iz ed modific a tion of i nformation by internal users

Acc e ssing information by the outsi d e world

Connectivity to the Int e rnet

148. Which of the following is a s tep in establishing a security policy? A. Developing platform-l ev el security b aselines.

B. Developing configurations parame t ers for the network,

C. Implementing a process for developing and mai n taining the polic y . D. Creating a RACI matrix.

149. A reduction in which of the following would indi c ate impro v ed performan c e in the administration of information security?

I T security awareness t raining days

Number of s ta f f involv e d in security administration

S y s tems s ubject to an intrusion detection process

T urnarou n d time for requests for new user access

150. An IS auditor review e d the bu s iness case for a proposed i nv estment to virtuali z e an org a nization ’ s server infrastructure.

Which of the following is MOST likely to be included among the benefits in t h e project pr o posal? A. Fewer operating syst e m licenses

B. Be t ter e f f i ciency of logical resources

C. Reduced har d wa r e footprint

D. Less m e mory and storage space

Page 16 of 62

151. W h at is a callback system?

I t i s a re m ote-access s ystem w hereby the remote-access server immediately calls the user back at a pre d etermi n ed numb e r if t he dial-in connection fails.

I t i s a re m ote-access s ystem w her e by the user's application automatically redials the remote acce s s server if the initial connection attempt fails.

It is a remote-access c ontrol whereby the user i nitially c o n n e cts to the network systems via dial-up access, only to have the initial connection terminat e d by the s erve r , which then subseque n tly dials the user back at a pre d etermined nu mb er stored in the server's configuration d atabase.

It is a remote-access c ontrol whereby the user i nitially c o n n e cts to the network systems via dial-up access, only to have the initial connection terminat e d by the s erve r , which then subseque n tly allows the user to call b ack at an approved num b er for a limit e d period of time.

152. Which of the following is t he BEST method to defend against social engin e ering attacks? A. Periodically perform antivirus scans to iden t ify malware.

B. Communicate guideli n es to limit i n f ormation po s ted to public s ites. C. Monitor for unauth o rized access attempts and failed logins.

D. Employ the use of a web-content filtering solution.

153. W h en segregati o n of duties co n c erns exists betwe e n IT sup p o rt sta f f a nd end user s , what would be suitable compensating control?

Restricti n g physical access to computing equ ip ment

Reviewing transaction and a p plication logs

Performing backgrou n d ch e cks prior to hiring IT s ta f f

Locking user sess i ons after a specified peri o d of inactivity

154. D uring the testing of the business continuity p lan (BCP), which of the f o llowing met h ods of results analysis provides the BEST assurance that the plan is workable?

Measurement of acc u racy

Elapsed ti me for comp l etion of crit ic al tas k s

Quantitatively measuring the results of the test

Evaluati o n of the observed test results

155. The B E ST way to assure an o r ga nization ’ s board of directo r s that IT st r ategies support business objectives is to:

provide regular assessments of emerging tech n ologies

identify and report on t he achievement of critical success f actors

confirm t h at IT strateg i es have been fully doc u mented and d i sseminated

ensure that senior business managers review IT budgets

156. An or g anization is considering m oving one of its critical business applications to a cloud hosting service. The cloud provi d er may not provide the same level of security for this application as the org a nization.

Which of the following will pro v ide the BEST information to he l p maintain the security posture? A. Ri s k a s s e ssment

B. Cloud security strategy

C. V ulnerability a ssessm e nt

D. Risk governance fra m ework

157. Which of the following will p r event dangling tuples in a database? A. C y c lic int e grity

B. Domain integrity

C. Relational integrity D. Referent i al integrity

158. W h en r eviewing the proced u r e s for the disposal of computers, which of the following should be the

GRE A TEST concern for the IS auditor?

Hard disks are overwr i tten s e veral times at the sector leve l , b ut are not reformatted before leaving the org a nization.

All files and folders on hard disks are separately deleted, and the hard disks are formatted before leaving the organization.

Hard disks are rendered unreadab l e by hole-punching through the platte r s at specific positions before leaving the organization.

The transport of hard disks is esc o rted by internal security sta f f to a nearby metal recycling comp a n y , where the hard disks are r egistered and then shredded.

159. As compar e d to un d erstanding a n org a nization's IT process from evidence directly collected, how valuable are prior a u d i t reports as evi d ence?

The same value.

Greater value.

Lesser va l ue.

Prior audit reports are not relevant.

160. Which of the following data v a lidation control validates input data against pre d efined r ange value s ? A. Range C h eck

B. T able lookups

C. Existence check

D. Reasona b leness check

Page 17 of 62

161. Identify the W AN message swi t ching techniq u e being used fr o m the description presented bel o w: “Data is routed in its enti r e t y from the source node to the de s ti n ation node, o ne ho p e at a time. During message ro u ting, every i n termedia t e switch in the n etwork stor e s the whole message. If t he entire network's re s ources are e nga g ed or t h e network b ec omes blocked, this W AN switching t e chnology s tores and delays the message un t il ample resources become available f or e f fective transmission of the message. “

Message Switching

P a cket s w itching

Circuit sw i tching

V irtual Circuits

162. An onli n e retailer is receiving customer ab o ut receiving d i f f e rent items from what they ord e red on t he org a nization ’ s website. T he r oot cause has been t r aced to poor data qualit y . Despite e f forts to clean err o neous d ata from the system, m u ltiple data qua l ity issues c o ntinue to occu r .

Which of the following re c ommendations would be the BEST way to reduce the likelihood of future occurrences?

I mplement business r u les to validate emp l oyee data entr y .

I n vest in additional e m ployee train i ng for data entr y .

Assign r e sponsibility for improving data qualit y .

Outsource data cleansing act i viti e s to reliable third partie s.

163. A finance dep a rtme n t director has decided to outsource the org a nization ’ s budget ap p lication and has identified poten t ial p r oviders.

Which of the following actions should be initiated FIRST by the information security manager? A. V alidate that connectivity to the s e rvice p r ovider can be m a de securel y .

B. Obtain audit reports on the ser v ice providers h o sting environment. C. Review the disaster recovery plans (DRP) of the providers.

D. Align the roles of the organ i zation ’ s and the service providers’ sta f f s .

164. W h at is the most c o mmon purp o se of a virtual private network implementation?

A v irtual private network ( VPN) helps to secure access between an ente rp rise and its p artners wh e n communicating over an o t herwise un s ecured cha n nel such as the Internet.

A v irtual private network ( VPN) helps to secure access between an ente rp rise and its p artners wh e n communicating over a d e dicated T1 connection.

A virtual p rivate network ( VPN) helps to secure access with i n an enter p rise when communicating over a dedicated T1 connection betwe e n network segments within t h e s ame fa c ilit y .

A virtual p rivate network ( VPN) helps to secure access between an ente rp rise and its p artners wh e n communicating over a wi r eless connection.

165. In which of the follow i ng pay m ent mode, an is s uer attempts to emulate physic a l cash by creating digital certificates, which a re purchased by users w h o red e em t hem with the issuer at a later date?

El e ctronic Money Model

El e ctronics Checks m o del

Electronic transfer model

Electronic withdraw model

166. Which of the following contr o ls would an IS auditor look for in an envi r onment w h er e duties cannot be ap p ropr ia tely segrega t ed?

Overlapping controls

Boundary controls

Acc e ss c o ntrols

Compen s ating controls

167. Which of the following refers to the proving of mathematical theorems by a computer pro g ram? A. Analytical theorem pr o ving

B. Automat e d technology proving C. Automated theorem p r ocessing D. Automated theorem p r oving

E. None of t h e choices.

168. W h at is the best defense against Local DoS attacks? A. patch your systems.

B. run a vir u s checke r .

C. run an an t i-spy software.

D. find this program and kill i t. E. None of t h e choices.

169. Which of the following would be MOST useful to an informa t ion security manager w hen conducting a post-incident review of an attack?

Details from intrusion detection system logs

Method of operation u s ed by the attacker

Cost of the attack to t h e organization

Location of the attacker

170. The use of residual biomet r ic information to g ain un a utho riz ed access is an example of which of the following attac k s?

Replay

Brute force

Cryptogr a phic

Mim i c

Page 18 of 62

171. Which of the following is the PRIMA R Y purpose of documenting and a pproving a n information security pol ic y?

T o comm u nicate management ’ s in t ent for securing the organ i zation ’ s info r mation assets

T o mitigate the organi z ation ’ s information security risk to an acceptable level

T o ensure awar e ness of disciplinary procedures for security breaches by authorized us ers

T o determine the be s t app r oach for implementing information security wit h in the organ i zation

172. What should be a security mana g e r ’ s PRIMA R Y objective in t h e event of a s e c urity incident? A. Identify the source of the br e ach a n d how it was per p etrated.

B. Contain the threat and restore ope r ations in a timely manne r . C. Ensure that normal o p erations are not disrupte d .

D. Identify lapses in operational control e f fectiveness.

173. Which type of risk w o uld MOST influence the selection of a sampling methodology? A. Control

B. Inherent C. Residual D. Detection

174. Which of the following is the GRE A TEST risk of an inade q uate policy definition for ownership of data and systems?

User ma n agement co o rd i nation d o e s not exist.

Specific user accountability cannot be established.

Unauthor iz ed users may have a c cess to originate, modify o r d elete data.

Audit recommendatio n s may not be implemented.

175. Which of the following would be of GRE A TEST concern to an IS auditor receiving an org a nization ’ s security inci d ent handli n g proced u res?

Annual tabletop exercises are performed instead of functional incident response exercises.

Roles for computer emerg e ncy response team (CE R T) members have n o t been formally documented.

Guidelin e s for prioritizing incidents have not be e n identif i ed.

W orkstation antivirus software ale r ts are not regularly rev i ewed.

176. Which of the following should be of GRE A TEST concern to an IS auditor condu c ting an audit of an org a nization ’ s backup processes?

A written b ackup policy is not availa b le.

B a ckup f a ilures are not r esolved in a timely manne r .

The restoration process is slow due to conne c tivity issues.

The service levels are not achieved.

177. Which of the following should be of GRE A TEST concern to an IS auditor reviewing actions taken during a fo re nsic inv e s ti g ation?

The inv e stigation re p ort does not indicate a conclusion.

An image copy of the att a cked syst e m was not t a ken.

The prop e r authorities were n ot notified.

The hand l ing procedu r es of the attacked s y stem are not docu m ented.

178. An IS auditor finds that a D BA has read and write access t o production data. The IS auditor should:

a c c ept the DBA acce s s as a c ommon practice.

a s s ess t h e controls re l evant to the DBA function.

recommend the immediate rev o cation of the DBA access to production data.

review user access authorizations app r oved by the DB

179. After implementation of a di s aster recovery plan, pre - disaster and p o st-disaster o peratio n al costs for an organ i zation will:

decrease.

not chan g e (remain t h e same).

increase.

increase or decrease depending upon the nature of the busine ss.

180. During an audit of identity and access management, an IS auditor finds that the eng a gement audit plan does n o t include the testing of controls that regulate ac c ess by third pa r ties.

Which of the following would be the audito r ’ s BEST c ourse of action? A. Plan to t e st these controls in another audit.

B. Escalate the deficiency to audit management.

C. Add testi n g of third-party a ccess controls to the scope of the audit.

D. Determine wheth e r the risk has been identified in the plann i ng documen t s.

Page 19 of 62

181. An integrated test f a c ility is not c onsidered a useful audit t ool because it c annot c ompare p r ocessi n g output with inde p en d ently calculated data.

T rue or false? A. T rue

B. False

182. The BEST access strategy while configuring a firewall wou l d be to: A. permit access to all and log the activity

B. deny access to all but permit selected

C. permit access to a ll b u t deny selected

D. deny acc e ss to all except authorized programs

183. An IS a uditor perfo r ming an application maintenance audit would review the log of pro g ram c hang e s for the:

authorization of prog ra m changes.

creation date of a current object module.

number of program c h anges actually made.

creation date of a current source program.

184. W h at can be impl e mented to provide the highest level of protection from external attack?

Layering perimeter n e twork protection by configuring the fir e wall as a screen e d host in a screened subnet behi n d the bastion host

Configuri n g the firewall as a screened host behind a router

Configuri n g the firewall as the protecting bastion host

Configuring two load-sharing firewalls facili t ating VPN access from external hosts to i n ternal hosts

185. Which of the following is the MOST important element when developi n g an information security strategy?

Identifying applicable l a ws and regu l ations

Identifying information assets

Determining the risk mana g ement methodol o gy

Aligning security activities with organizational g o als

186. Which of the following sampling t e chniques is commonly used in fraud d etection wh e n the expected occurrence r ate is small a nd the specific controls are critical?

Discovery sampling

Monetary unit sampling

Stop-or- g o sampling

Random sampling

187. Which of the following is MO S T important for an IS auditor to consider during a revi e w of the IT

govern a nce of an organi z ation? A. Funding allocations

B. Risk ma n agement methodol o gy

C. Defined service levels

D. Decision making responsibilities

188. Th e re are many known w e akn e ss e s within an Intrusion Detection S y s t em (IDS). Which of the following is NOT a limitation of an IDS?

W eakness in the identification and authentica t ion scheme.

Applicati o n level vulnerabilit y .

Backdoor into application

Detect zero day attac k .

189. An IS auditor has just compl e ted a physical a ccess review of the organization ’ s primary data cente r . Which of the following w e aknesses should be of MOST conce r n?

Metal keys are used for access.

B a ckups of video cameras are cor r upt.

There is no mantrap at the main doo r .

There is no manual lo g ging for visitors.

190. Which of the following state m ent INCORREC T L Y describes dev i ce and whe r e they sit within the

TCP/IP model?

Layer 4 s witch work at Network interface layer in TCP/IP mo d el

Router w o rks at Network in t erface layer in TCP/IP model

Layer 3 s witch work at Network interface layer in TCP/IP mo d el

Hub wor k s at LAN or W AN interface layer of a TCP/IP model

Page 20 of 62

191. When facilitating the align m ent of corporate governance and information securi t y govern a nce, which of the following is the MOST important role of an organization ’ s security s te e ring commit t ee?

Obtaining support for the integration from business owners

Obtaining app r oval for the informati o n security budget

Evaluati n g and re p ort i ng the deg re e of integration

Defining metrics to demonstrate alignment

192. Which of the following help(s) prevent an organization's s ystems from participa t ing in a distributed denialof-ser v ice (DDoS) a ttack?

Inbound tra f fic filtering

Using access control lists (ACLs) to restrict inbound conne c tion attempts

Outbound tra f fic filtering

Recentralizing distributed systems

193. R everse proxy tec h nology for web servers should be d e p loyed if: A. http serv e rs' address e s must be hidden.

B. accelerated access to a ll published pages is required. C. caching is needed f o r fault tolerance.

D. bandwidth to the user is limited.

194. Which of the following is the BEST physical security solution for granting and restricting access to individuals based on their unique access needs?

Bolting door locks

Cipher locks

Closed-circuit tele v isi o n (CCTV)

Electronic badge syst e m

195. Which of the following should be an information security m a nag e r ’ s MOST important consideration when con duc ting a physical secur i ty r eview of a potential outs o urced data center?

E n v ironmental factors of the surrounding locati o n

Pro x i mity to law enforcement

A vailability of network circuit connections

Distance of the data center from the corporate o f fice

196. An info r mation security manag e r ’ s PRIMA R Y objective for pr e senting key risks to t h e boa r d of directors is to:

re-evaluate the risk a p petite.

quantify repu t ational r is ks.

meet information security compliance requi r em e nts.

ensure a p pro p riate infor m ation security governa n ce.

197. Which key is used b y the s ender of a messa g e to create a digital signature for the message bei n g sent?

Sender's public key

Sender's private key

Receiver ' s public key

Receiver ' s private key

198. The re covery point objective (RPO) is required in which of the following? A. Informati o n security plan

B. I n cident response plan C. Disaster r ecovery plan D. Business continuity pl a n

199. Inhe r ent risk ratings are de t ermi n ed by assessing the impa c t and likeli h ood of a threat or v ulnerability occurring:

after inte r nal controls are taken into account.

before the risk appetite is e stablished.

after compensating con t rols have been a p plied.

before internal contro l s are taken into account.

200. Which of the following is the MOST important benefit of in v olving IS audit when impl e menting govern a nce of enterprise IT?

Identifying relevant rol e s for an enterprise IT govern a nce framework

V erifying that legal, re g ula t ory and contractual r e quirem e n t s are being met

Making decisions regarding risk respon s e and monitoring of residual risk

Providing independ e nt and objective feedback to facilitate i m provement of IT proce s s es

Page 21 of 62

201. Which of the following is the M O ST e f fect i ve control to m i nimize the risk of cross-site scripting

(XSS)?

Periodic vulnerability a ssessments

S e c ure coding practices

Network intrusion pre v ention syst e m

W eb firewall policy

202. The P RIMA R Y objective of a l o gical access control review is to: A. review access controls provided th r ough softwa r e.

B. ensure access is granted per the o r ganization's authorities.

C. walk through and assess the access provided in the IT environment.

D. provide assurance that compu t er hard w are is adeq u ately protected against abuse.

203. Which of the following is the INCORRECT Layer to Protocol m apping used in the DOD TCP/IP

model?

Applicati o n layer C T elnet

T ransport layer C ICMP

Internet layer C IP

Network Access layer C Ethernet

204. An or ga nization pla n s to implem e nt a virtualization strate g y enabling m ultiple ope r ating systems on a single host.

Which of the following sh o uld be the GRE A TEST concern with this strategy? A. Adequate storage space

B. Complexity of administration

C. Network bandw i dth

D. Application performa n ce

205. Which of the following is the BEST way to help ensure the security of pr i vacy-r e lated data stored b y an or g anization?

E n c rypt p ersonally identifiable information (PII).

Publish t h e data classification scheme.

Inform da t a owners of t he purpo s e of colle c ting information.

Classify p rivacy-related data as c o nfidential.

206. In the context of physical access control, what is known as the process of verifying u s er identities?

Authentication

Authorization

Accounti n g

Encrypti o n

Compression

None of t h e choices.

207. Which of the following protocol does NOT work at Network i n terface layer in TCP/IP model? A. IC M P

B. DNS C. ARP

D. Internet protocol

208. What should be the MAIN goal of an organiza t ion ’ s incident response plan? A. Keep stakehold e rs notif i ed of incident stat u s.

B. Enable appro p riate response according to criticalit y . C. Correlate incidents f r o m di f ferent systems.

D. Identify t h e root cause of the incident.

209. An IS auditor has completed a r e view of an outsourcing agreem e nt a n d has identi f ied IT governance issues.

Which of the following is the MOST e f f ective and e f ficient way of communicating the issues at a meeting with senior managem e nt?

Present a completed r e port and discuss the details.

Provide a detailed r e p or t in advance and open t h e floor to q u e stions.

Present an overview highlighting t h e key findin g s.

Provide a plan of action and milestones.

210. Which of the following fun c tion in t r aditional EDI process m a nipulates a n d routes data between the application system and the communication hand l er?

Communication hand l er

EDI Inter f ace

Application System

EDI T ranslator

Page 22 of 62

211. An IS auditor discovers th a t developers have ope r ator access to the c o mmand line of a production environment ope r ating system.

Which of the following controls would BEST m itigate the risk of u ndetected a n d unau t h o rized pr o gram changes to the pr o du c tion environm e nt?

Commands typed on the command line are lo g g e d

Hash k e ys are calcul a ted periodic a lly for prog ra ms and matched a g ainst hash keys c a lculated for the most recent authorized v e rsions of t h e programs

Acc e ss to the operati n g system command line is grant e d thr o ugh an access restriction tool with pre a pprov e d rights

Software development tools and c o mpilers have been remo v ed from the pro d uction environment

212. Which of the following is t he m o st fundamen t al step in preventing virus attacks? A. Adopting and commu n icating a c o mpreh e nsive an t ivirus policy

B. Implementing antivirus prot e ction software on us ers' deskt o p computers

C. Implementing antivirus conte n t ch e cking at all network-to-Internet gate way s

D. Inoculating systems with antivirus code

213. W h at determines the strength of a secret k e y within a symmetric key cryptos y stem?

A combination of key l e ngth, degr e e of permutation, and the complexity of the data- en c ryption algorithm th a t uses the k e y

A combination of key l e ngth, initial i n put vectors, and the complexity of the data- encryption algorit h m that uses the key

A combination of key l ength and the complexity of the data- e ncryption algorithm that uses the key

Initial input vectors and the complexity of the data-encryp t ion algorithm th a t uses the k e y

214. The BEST way to v a lidate whether a malicious act has actua l ly occurred in an appl ic ation is to review:

segregat i on of duties

ac c e s s c o ntrols

act i v i t y l o gs

change mana g ement logs

215. Which of the following is the BEST source of information w h en assessing the amount of time a project will t a ke?

GANTT c hart

W orkforce estimate

Critical path analysis

Scheduling bud g et

216. An IS auditor who h as disc o vered unauth o rized transactions during a r eview of EDI transactions is likely to recommend improving the:

EDI trading partner a g r eements.

physical controls for terminals.

authentication techniques for sending and rece iv ing messa g e s .

program chan g e contr o l procedures.

217. Which of the following find i ngs should be an IS audito r ’ s GRE A TEST co n cern when re viewing an org a nization ’ s purchase of new IT infr a structure hardwa r e?

The new infrastructure arrived with default syst e m settings.

The new infrastructure has re s idual risk within t h e org a nization ’ s risk tole r ance.

The new infrastructure ’ s hardeni n g require m ents are stronger than requ i r e d by polic y .

The new infrastructure has compat i bility i ssues with existing s y stem s .

218. Which of the following is MO S T i mportant for the improvement of an organization ’ s incident response pr oc esses?

P o s t-event reviews by the incident response team

Regular u pgr a des to in c ident management software

Ongoing i ncident response training for users

Periodic walk-thro u gh of incident r esponse pr oc edures

219. Which of the following tasks should be performed during an o rganization ’ s business continuity plan

(BCP) test?

Evaluate the security a t the o f fsite facilit y .

Review t h e coverage o f insurance.

Ass e ss the critical info r mation retrieval capabilit y .

Review the alternate p rocessing site contract.

220. Which of the following audit ma i nly focuses on d iscovering and disclosing on frauds a n d crimes? A. Compliance Audit

B. Financial Audit C. Integrated Audit D. Forensic audit

Page 23 of 62

221. Which of the following would be MOST important to inclu d e in a data security policy to adequate l y manage the privacy of c u s tomer information?

Informati o n class i fic a t i on criteria

E n c rypti o n technology

Backup strategy

Data ow n ership

222. An IS auditor revie w ing an a ccounts payable system disc o v e rs that audit logs are not being reviewed. When this issue is ra i sed w i th manage m ent the respon s e is that additional co n trols are not necessary b ecause e f fective system a ccess controls are in plac e .

The BEST r e s ponse the auditor can make is to: A. review the integrity of system acc e ss controls.

B. accept m a nagement's statement t h at e f fective a ccess controls are in place. C. stress the importance of having a system control framework in place.

D. review the background checks of the accounts p ayable sta f f.

223. Which of the following is an imp l ementation r i sk w i thin the process of d ecision support systems? A. Management control

B. Semistructured dimen s ions

C. inability to specify purpose and usage patterns

D. Chan g es in decision processes

224. An IS auditor discove r s that validation controls in a web app l ication have been mo v ed from the server side into the browser to b oost performance. This w ould MOST li k ely increase the risk of a successful attack by:

phishing

structured query lang u age (SQL) i n jection

denial of service (DoS)

bu f fer overflow

225. What is the MOST e f f ective w ay to ensure info r mation secur i ty incidents will be managed e f fectiv e ly and in a timely manner?

Obtain s e nior mana ge ment commitment.

T est inci d ent respon s e procedu r es regul a rl y .

Communicate incident r esponse p r ocedures to sta f f.

Establish and measure key pe r formance indicators (KPIs ) .

226. Diskless workstation is an example of: A. Handheld devices

B. Thin client computer C. Personal computer D. Midrange server

227. When developing a formal enterprise s e curity program, the MOST cr i tical succ e ss factor (CSF)

would be th e :

establishment of a review boa r d.

creation of a s e c urity u nit.

e f fective supp o rt of an executi v e sponso r .

selection of a se c urity process owne r .

228. A p e n e tration test p erfor m ed as part of evaluating netwo r k s e c urity: A. provides a ssurance that all v u lnerabilities are discovered.

B. should be perform e d without warni n g the organi z ation's man a gement. C. exploits the existing vulnerabilities to ga i n unauthorized access.

D. would not damage the i nforma t ion a ssets when performed at n e twork per i meters.

229. As part of an audit response, an auditee has concerns with the recommendations and is hesitant to implement them.

Which of the following would be the BEST c ourse of action for t he IS auditor? A. Accept t h e auditee ’ s response and perform additional testin g .

B. Conduct further discussions with t h e auditee to develop a mitigation plan.

C. Suggest hiring a third-party consult a nt to perform a current st a te asse s s m e nt. D. Issue a fi n al report without including the opinion of the auditee.

230. Which of the following actions should an organization ’ s s e curity policy require a n e mployee to take upon findi n g a security breach?

Report the incident to the manager immediatel y .

Inform IS audit management immediatel y .

Confirm the br e ach can be exploited.

Devise appro p ria t e countermeasur es .

Page 24 of 62

231. Which of the follow i ng is a telecommun i cation device that translates data from digital form to a n alog form and back to digital?

Multiplexer

Modem

Protocol c onverter

Concent r ator

232. One a dvantage of m o netary un i t sampling is t h e fact that: A. results are stated in t e rms of the f r equ e ncy of items in er r or

B. it can easily be applied manually when computer resources a r e not available

C. it i n c reases the likelihood of selecting material items from the population D. large-val u e populati o n items are s e gre g ated a n d audited sep a rately

233. W h at t opology pro v ides the greatest redun da ncy of routes and the greatest network fault toler a nce? A. A star network topolo g y

B. A mesh n etwork topology wi t h packet forwarding enabled at each host

C. A bus ne t work topolo g y D. A ring network topolo g y

234. A p e r p etrator looki n g to gain access to and gather infor m ation about e ncr y pted data being transmitted over the network would use:

eavesdropping

spoofing.

tra f f i c analys i s.

masquer a ding.

235. An IS auditor selects a ser v er for a penetrati o n test that will be carried o ut by a t e chnical specialist. Which of the following is MOST important?

The tools used to conduct the t e st

Certifications he l d by the IS auditor

Permission from the da t a own e r of the server

An intrusion detection system (IDS) is enabled

236. Which of the following should be PRIMARI L Y i n cluded in a security training pr o gram for business process owners?

Applicati o n vulnerabilities

List of security incidents reported

Application recovery time

Impact of s ecurity r i s k s

237. Which of the following would an IS auditor c o nsider the MOST relevant to short-term planning for an

IS department?

Alloca t ing resources

Keeping curr e nt with technology a dv ances

Conducti n g control self-assessment

Evaluati n g har d ware n eeds

238. Which of the following should be an IS audito r ’ s FIRST activity when pl a nning an a u d it? A. Gain an understand i ng of t he area to be audited.

B. Document specific questions in the audit pro g r a m. C. Create a list of key c o n trols to be reviewed.

D. Identify proper res o ur c es for audit activities.

239. As part of the IEEE 802. 1 1 standard ratified in September 1999, WEP uses which stream cipher for confidentiality?

CRC-32

CRC-64

DES

3DES

RC4

RC5

None of the choices.

240. Which of the following is BE S T a ddressed when using a timestamp within a digital signature to deliver sensitive finan c ial information?

Replay protection

Authentication

Nonr e pu d iation

Data integrity

Page 25 of 62

241. The M O ST important reason f o r documenting all aspects of a digital forensic inv e s ti g ation is that documentation:

provides traceability f o r independent investigation by third parties.

ensures complian c e w i th corporate incident response policie s .

ensures the process will be repeatable in future investigati o n s .

meets IT audit documentation standards.

242. D uring an exit intervie w , in cases where the r e is disagre e ment rega r di n g the impact of a finding, an

IS auditor s h ould:

ask the a u ditee to sign a r e lease fo r m accepting full legal responsibilit y .

elaborate on the significan c e of the finding and the risks o f n ot correcting it.

report the disagreement to the audit committee for resolution.

accept the auditee's p osition since they are the process owners.

243. Wh e n r ev iewing business continuity plan (BCP) test results, it is MOST important for the IS auditor to determine w hether the t e st:

verifies the ability to r e s ume key business operations.

considers changes to t he systems environment.

assesses the capability to r etrieve vital records.

follows up on activ i ties that occurred since the previous te s t .

244. What is the FIRST li n e of defense against cr i minal insider act i vities?

V alidating the i n tegrity of personnel

Monitoring employee activities

Signing security agre em ents by critical person n el

Stringent and enforc e d access controls

245. Which of the following fourth generation language depends on self-contained da t a b ase managem e nt s y stems?

Query and report g en erator

Embedd e d database 4 GLs

Relational database 4 GL

Application gen e rators

246. A vailability C The IT resource must be available on a timely basis to meet mission requirements or to avoid substantial losses.

All of the options presented

None of t h e options presented

Options number 1 a n d 2

Option number 3

247. Which of the following is the BEST way to cont r ol the concurrent use of licensed soft w are? A. User se l f-discipline.

B. Monitor b y s y s tem administrato r .

C. Surprise audit conducted by vendo r s. D. Metering software

248. An IS auditor revie w ing security incident processes reali z e s incidents are res o lved a nd closed, but root causes are not investigated.

Which of the following sh o uld be the MAJOR conc e rn with this s i tuation? A. Abuses b y employees have not be e n report e d.

B. V ulnerabi l ities have n o t been pro pe rly addressed. C. Security incident policies are out of date.

D. Lessons lear n ed have n o t been p ro perly documented.

249. Which of the following is a benefit of a r i sk-based appro a ch to audit planning? A u dit: A. scheduling may be perf o rmed months in advance.

B. budgets are more likely to be met by the IS audit sta f f. C. sta f f will be exposed to a variety of technolog i es.

D. resources are allocated to the are a s of highest concern

250. In an a udit of an inventory application, which app r oach w o uld provide the BEST evidence that purchase or d ers are valid?

T esting w hether in a p p ropriate p ersonnel can change a pplication parame t ers

T racing purchase ord e rs to a computer listing

Compari n g receiving reports to purchase order details

Reviewi n g the appli c ation documentation

Page 26 of 62

251. T alking about application sy s tem audit, focus should alwa y s be placed on (C h oose five.) A. performa n ce and con t rols of the system

B. the ability to limit unauthorized access and manipulation

C. input of data are pro c essed correctly

D. output of data are p roc essed correctly

E. changes to the system are pro p erly authorized

F . None of t h e choices.

252. Which of the following is pr o tocol d ata unit (PDU) of netwo r k interface l a y er in TCP/IP model? A. Data

B. Segment

C. Packet D. Frame

253. An IS auditor finds that client requests were processed m u ltiple times when received from di f fer e nt indep e nd e nt dep a rtmental databases, which are synchronized wee k l y .

What would be the BEST recommendation?

increase the frequ e ncy for da t a replication betw e en the di f f erent departm e nt systems to ensure timely updates.

Centralize all request proc e ssing in one depart m ent to avoid parallel processing of the same request.

Chan g e the applicati o n archite c ture so that common data is h eld in just one shar e d d atabase for a ll dep a rtments.

implement reconciliati o n con t rols to detect duplicates before o rders are p roc essed in t h e systems.

254. Which of the following user p rofiles should be of MOST concern to an IS auditor when performi n g an audit of an EFT system?

Three users with the a bility to capt u re and verify their own m e ssages

Five users with the ability to capture and send their own messages

Five use r s with the ability to veri f y o ther users and to send their own messages

Three users with the a bility to capt u re and verify the mess a ges of other u s ers and to send their own messages

255. Which of the following is the MOST important requirement f o r the succ e ssful implem e ntation of security govern a nce?

Aligning to an interna t i o nal security framew o rk

Mapping to org a nizational strategies

Implementing a secur i t y balanced scorecard

Performing an enter p r is e-wide risk assessment

256. Which of the following would he l p to ensure the portability of an application connected to a database?

V erification of database import and export proc e dures

Usage of a structured query lan g u a ge (SQL)

Analysis of stored pro c edu r es/triggers

Synchronization of the enti t y-relation model with the database physical s c hema

257. An emp l oyee transfers from an organization ’ s risk manageme n t depar t ment to become the lead IS audito r . Whi l e in the risk m anagement department, the employee helped d evelop the key perform a nce indicators (KPIs) now used by the org a nization.

Which of the following would po s e the GRE A TEST threat to the in dependence of this auditor? A. Evaluating the e f fectiven e ss of IT risk manage m ent processes

B. Recomm e nding contro l s to address the IT risks identified by KPIs

C. Developi n g KPIs to measure the internal a u dit team

D. T raining the IT audit t e am on IT risk management processes

258. Which of the following should the IS auditor use to BEST d e termine whether a project has met it s business objectives?

Earned-value analysis

Completed project plan

I s sues log with resolutions

Benefits r ealization d o cument

259. A recent audit has identified that security controls requir e d by the organ i zation ’ s policies have not been imple m ented for a p ar t icular app l ication.

What should the information s e curity manag e r do NEXT to address this i s s u e? A. Deny access to the application until the issue is resolved.

B. Discuss t h e issue with data custodians to determine the re as on for the exception. C. Report the issue to s e nior management and request funding to fix the issue.

D. Discuss the issue with data owners to determine the reason f or the exception.

260. Which of the following would B E ST help ensure informat i on security i s e f fe c t ive following the outsourcing of ne t work operations?

T est secu r ity controls p eriodicall y .

Review s e curity k ey p e r formance i n dicators (KPIs).

Establish security serv i ce level agreements (SLAs).

Appoint a security service delivery monitoring mana g e r .

Page 27 of 62

261. The se l ection of s e c urity controls is PRIMARI L Y linked to: A. risk appetite of the organization.

B. regulatory requirem e nts.

C. business i m pact assessment.

D. best practices of similar organizati o ns.

262. The IS managem e nt of a multinational comp a ny is consideri n g up g rad in g its e xisting virtual private network (VPN) to support voice-over IP ( V oIP) c o mmunications v i a tunneling.

Which of the following co ns ide r ations should be PR I MARI L Y addr e ssed? A. Reliability and quali t y o f service (QoS)

B. Means of authentication

C. Privacy of voice transmissions

D. Confident i ality of data transmissions

263. In the IT dep a rtment whe r e segr e gation of dut i es is not feasible due to a limited number of resour c es, a team member is perfo r ming the functions of c o mputer ope r ator and rev i ewer of appl ic ation logs.

Which of the following w o uld be t he IS audito r ’ s BEST recomm e ndation? A. Develop procedures to verify that t h e application logs are n ot modified. B. Prevent the ope r ator from performing applicati o n developm e nt act i v ities. C. Assign an indepe n dent second reviewer to verify the applica t ion logs.

D. Restrict t h e computer operat o r ’ s access to the production environment.

264. Which of the following data validation edits is e f fect i v e in d etecting transposition and transcription errors?

Range check

Check di g it

V alidity c h eck

Duplicate check

265. Which of the following access rights in the production en v ironment s hould be grant e d to a develop e r to maintain segr e gation of duties?

Database administration

Emergen c y support

IT operations

S y s tem a dministration

266. Which of the following property of the core date warehouse l ayer of an e n terprise data flow architecture uses comm o n attribu t es t o access a c ross se c tion o f an information in the ware h ouse? A. Drill up

B. Drill down

C. Drill across

D. Historical Analysis

267. A vulnerability in wh i ch of t he fol l owing virtual systems would be of GRE A TEST concern to the IS

auditor?

The virtual mach i ne mana g ement server

The virtual file server

The virtual application server

The virtual an t ivirus server

268. An IS auditor is revi e wing IT policies and found that most policies have n ot been revi e wed in over 3 years.

The MOST significant risk is t hat the p olicies do not reflect: A. current legal requ i re m ents.

B. the vision of the CEO.

C. the missi o n of the org a nization. D. current industry best p ractices.

269. The MAIN pur p ose of documenti n g information security gui d e l ines for use within a la r ge, internati o nal org a nization is to:

ensure that all business units have the same st r ategic secu r ity goals

provide evidence for a u ditors that s e c urity practices are ade qu a te

explain the org a nization ’ s pre f erred practices for security

ensure that all business units implement identical security procedures

270. A new i n formation security m ana g er is charged with reviewi n g and revising the information security strateg y .

The information security manag e r ’ s FIRST course of action sh o uld be to gain an und e rstanding of the org a nization ’ s:

security architecture

risk register

internal control fram e work

business strategy

Page 28 of 62

271. Which of the following term r e lated to network p erformance refers to the variation in t h e time of arrival of packets on the recei v er of the information?

Bandwidth

Through p ut

Latency

Ji t ter

272. R un-to - run totals c a n veri f y data throu g h which stage(s) of application p rocessing? A. In i tial

B. V arious

C. Final

D. Output

273. For mission-critical applica t ions with a low recovery time objective ( R T O ) , which of the following is t he

BEST back u p strategy?

Frequent back-ups to tape

Mirroring

Use of virtual tape libr a ries

Archiving to conventional disk

274. Which of the following compon e nts i s responsible for the c ollection of data in an intrusion detection s y stem (IDS ) ?

Analyzer

Administration console

User interface

Sensor

275. IT control objectives are u s eful to IS auditors, as they p rovide the basis for underst a nding the: A. desired result or purp o se of implementing spe c if i c control procedures.

B. best IT s e c urity control practices relevant to a s p ecific entit y . C. techniques for securing information.

D. security p olic y .

276. Which of the following is MOST important for an IS auditor to verify when reviewing an org a nization ’ s information security practices following the adoption of a bring your own d evice (BYOD) p r ogram?

Only applications approved by information security may be i n stalled on devices.

The exp e cted benefi t s of adopting the BYOD program have been r ealized.

Security policies have been u pdat e d to include BYO

Remote wipe is enabl e d for devices allowed by BYO

277. V e nd or s have relea s ed patches fixing s e curity flaws in their software. Which of the following sh o uld an IS auditor recommend in this situation?

A s s e s s t h e impact of p atches prior to installation.

Ask the v e ndors for a new soft w are version with all fixes incl u ded.

install the security patch immediatel y .

Decline to deal with these vendors in the future.

278. Which of the following would B E ST detect t h at a distribut e d- d enial - of-service attack (DDoS) is occurring?

Server crashes

Automat e d monitoring of logs

Penetration testing

Customer service co m plaints

279. Which of the following is the M O ST important di f ference between e nd - user computing (EUC)

applications and traditio n al applicatio ns ?

T raditional applica t ion documentation is t ypically less comprehensive than EUC application documentation.

T raditional applications requ ir e roll- b ack procedu r es where a s EUC applications do not.

T raditional applications requ i re p er i odic patching whe r eas EUC applications do not.

T raditional application input controls are typically more ro b ust than EUC a p plica t ion inp u t controls.

280. Which of the following term in bus i ness continu i ty determi n es the ma x i m um tolerable amount of t i me that is need e d to verify t h e s y stem a n d/or data int e grity?

RPO

R T O

W R T

MTD

Page 29 of 62

281. An IS auditor can verify that an organization's business c o n tinuity plan ( BCP) is e f fe c tive by reviewing t h e:

alignment of the BCP w ith industry b est practices.

results of business co n tinu i ty tests p erf o rmed by IS and end- u ser personn e l.

o f f-site f a cilit y , its con t ents, security and environmental controls.

annual fi n ancial cost of the B C P activities versus the expe c ted benefit of implemen t ation of the plan.

282. Which of the following is the PRIMA R Y reason for database optimization in an enviro n ment with a high volume of transacti o ns?

Improving availability

Maintaining integrity

Preventing data leakage

Improving performan c e

283. On a daily basis, an in-hou s e development team moves d uplicate copies of production data containing p ersonally identifiable information (PII) to the test e n v ironment.

Which of the following is t he BEST w a y to mitigate the privacy risk involved? A. Require d ata own e rs to sign o f f on pro d uction data.

B. E n c rypt the data file.

C. Obtain customer opt-in acceptances.

D. Sanitize the data in the test envir o nment.

284. Which of the following compa r isons are used for identific a tion and aut h entication in a biometric s y stem?

One-to-many for identi f ication and au t hentication

One-to-o n e for identi f ication and au t hentication

One-to- m any for identifica t ion and one-to - one f or authentic a tion

One-to- on e for identification and o n e-to-many for authentication

285. Which of the following step of PDCA establishes the object i ves and proc e sses ne c essary to deliver

results in a cc ordance with the expect e d output? A. Plan

B. Do

C. Check D. A c t

286. The pr io ritization of inc i dent response actions should be P RIMARI L Y b ased on which of the following?

Scope of disaster

B u s iness impact

A vailability of personnel

Escalation process

287. Which of the following is MO S T important when planning a n e twork audit? A. Determination of IP range in use

B. Isolation of rogue access points C. Identification of existi n g nodes D. Analysis of tra f f ic content

288. Which of the following should be of MOST c o ncern to an IS auditor reviewing an or ganization ’ s disaster recovery plan (DRP)?

The responsibility for declar i ng a d i saster is not identified.

The dis a ster recovery steps are not detailed.

The CIO has not signed o f f on the DR

Copies of the DRP are not kept in a secure o f fsite location.

289. Wh e n engagi n g s ervices from external audito rs , which of t h e following should be established FIRS T ? A. T ermination conditions agr e ements

B. Nondiscl o s ure agr e ements

C. Service l e v el agreem e nts

D. Operatio n al level agr e ements

290. Which of the following activ i ties performed by a database administrator (DBA) should be perfo r med by a di f ferent person?

Deleting databa s e activity logs

Implementing databa s e optimizati o n tools

Monitoring database us age

Defining b ackup and r e covery procedures

Page 30 of 62

291. D uring an ERP post-implementa t ion revie w , it was noted that operating costs have b een significantly higher th a n a nticipated.

Which of the following sh o uld the org an ization have done to de tec t this issue? A. Updated the project chart e r as major changes occurred

B. Conducted periodic user satisf a cti o n surveys

C. Performed an analysis of system u s age

D. Monitored financial key performan c e indicators (KPIs)

292. While observing a full simulation of the business continu i ty plan, an IS aud i tor notices that the notification systems within the organi z ational facilities could be severely im p acted by inf r a structural damage.

The BEST r e c ommendation the IS auditor can provide to the organization is to ensure: A. the salvage team is trained to use the notification system.

B. the notification system pro v ides for the recovery of the ba c k u p. C. redu n da n cies are built in t o the notification syst e m.

D. the notification systems are stored in a vault.

293. An IS auditor notes that IDS log e ntries related to port scanning are not being a n alyzed. This l a ck o f analysis will MOST likely increa s e the risk of succ e ss of which of the following attac k s?

Denial-of - service

Replay

Social e n gineer i ng

Bu f fer ov e rflow

294. Which of the following cryptography demands less computational po w er and o f fers more security per bit?

Quantum cryptography

Elliptic Curve Cryptog r aphy (ECC)

Symmetric Key Cryptogra p hy

Asymmet r ic Key Cryptogr a phy

295. W h en assessing the design of network monitoring contro ls , an IS auditor should FIRST review network:

topology diagrams.

bandwidth usage.

tra f f i c analys i s reports.

bottleneck locations.

296. Which of the following would be MOST cr i tical for an IS auditor to look for when eval u ating fire precautions in a manned data center loca t ed in the upper floor of a multi- s tory building?

Existence of handhe l d fire ext i nguishers in high l y visible l oc a tions

Documentation of regu l ar in s pections by the local fire department

Adequacy of the H V AC syst e m throughout the facility

Documentation of test e d e mergency evacuation plans

297. An IS a u ditor is perfo r ming a busi n ess continuity plan (BC P ) audit and id entifies that the plan has not been tested for five years.

Howeve r , the plan was succe s s fully activated during a recent e x tended p o w e r outage. Which of the following is the IS audito r ’ s BEST course of acti o n?

Determine if l e ssons l e arn e d from the activation were incor p orated into t h e plan.

Determine if the business impa c t a n alysis (BIA) i s s till accurate.

Determine if a follow-up BCP audit is required t o identify f uture g a ps.

Determine if the annual BCP training pr o gram is in need of a revie w .

298. An or g anization h a s recently i nstalled a security patch, which crashed the production serve r . T o minimize the probability of this o cc u rring again, an IS aud i tor should:

apply the patch according to the patch's release notes.

ensure that a good change ma n a g ement proc e ss is in place.

thorough l y test the patch be f ore sending it to production.

approve the patch after doing a risk assessment.

299. An IS auditor is assessing r i sk associated with peer-to - pe e r file sharing within an or g an i zation. Which of the following sh o uld be of GRE A TEST co n cern?

File-sharing policies have not been reviewed since last year

Only some employees are requ i red to attend s e curity awarene s s training

Not all devices are ru n ning antivir u s programs

The orga n ization does not have an e f ficient patch managem e nt process

300. Which of the following should be included in an organization's IS s e c urity policy? A. A l i s t of k e y I T resources to be secured

B. The basis for acc e ss a uthorization

C. Identity of sensiti v e s e curity featur e s D. Relevant software security features

Page 31 of 62

301. Which of the following is NOT a defined ISO basic task related to netwo r k managem e nt? A. Fault management

B. Accounting resources

C. Security managem e nt

D. Communications ma n agement

302. "Under the concept of ""defense in depth"", subsystems should be d esigned to:" A. ""fail insecure"""

B. ""fail sec u re"""

C. ""react to attack""" D. ""react to failure"""

E. None of t h e choices.

303. The ab i lity of the internal IS aud i t function to achieve d esired objectives depends largely on: A. the training of audit pe r sonnel

B. the backgrou n d of aud i t personnel

C. the inde p end e nce o f audit person n el D. the perfo r mance of audit personnel E. None of t h e choices.

304. An IS auditor is evalu a ting the completeness of privacy procedu r es involving per s on a lly identifiable information ( PII).

Which of the following is MOST important for the auditor to ve r ify is included in the proce d ures? A. Regulato r y requireme nt s for protecting PII

B. The orga n ization ’ s definition of PII

C. Encrypti o n requirements for transmitting PII e xternally D. A descript i on of how PII i s masked w ithin key systems

305. Following request for proposal (RFP) responses, a project s eeking to acquire a new application system has i dentif i ed a short list of v e ndors. At this point, the IS auditor sho u ld:

encoura g e contact with current users of the vendo r ’ s pro d ucts

perform a detailed cost-be n efit exercise on the p roposed a pp l ication

require t h at contract terms include a right- t o-a u dit clause

recommend performi n g s y stem integration tests

306. Involvement of senior mana g ement is MOST important in the develop m ent of: A. strategic p lans.

B. IS policies.

C. IS procedures.

D. standards and guideli n es.

307. Wh e n r ev iewing a n e wly i m plemented quality managem e nt system (QMS), which of t he following should be the IS audito r ’ s PRIMA R Y concern?

The QMS benefit measures were no t included in the business c ase.

The QMS testing met h odology is not clearly d o c umented.

The QMS post-imple m entation review (PIR) has not been finalized.

The QMS is not mapped to some c o re business processes.

308. Which of the following term in bus i ness continu i ty defines the total amount of t i me that a business process can be disrupted witho u t causing any unacceptable consequences?

RPO

R T O

W R T

MTD

309. Which of the following is the BEST way to determine if IT is delivering value to the business? A. Distribute surveys to various end us ers of IT services.

B. Interview key IT managers and service providers. C. Review IT service level agreem e nt (SLA) metrics. D. Analyze d owntime fre q uency and duration.

310. Which of the following is MO S T he l pful in preventing a sys t e ms failure fr o m occurring when a n application is repla c ed using the abr up t changeover technique?

Compre h ensi v e documentation

Compre h ensive testing

Threat and risk assessment

Chan g e managem e nt

Page 32 of 62

311. D uring an impleme n tation rev i ew of a multi u s er distributed application, an IS auditor finds minor weaknesses in three ar eas -the ini t ial setting of par a meters is impro p erly installed, weak passwords are being us e d a nd some v ital reports are not being c h ecked prop erl y . While preparing t h e a u dit report, the IS auditor shou l d:

record the observations separately with the impact of each o f them mark e d against each respective finding.

adv i s e the manager of probab l e risks without recording the obs ervations, a s the control weaknesses are minor o n es.

record the observations and the risk arising fr o m the collect i ve weaknesses.

apprise the dep a rtme n tal heads concerned with each observation and p ro perly do c ument it in the rep o rt.

312. In an IS audit of several critical servers, the IS auditor wants to analyze audit trails to discover potential an o malies in us e r or system b ehavio r .

Which of the following too l s are MOST suitable for performing that ta s k ? A. CA S E too l s

B. Embedd e d data collection tools

C. Heuristic scanning tools

D. T rend/variance detection tools

313. An or g anization using insta n t messaging to communicate with cust o mers can prevent legitim a te customers from being impersonat e d b y:

using call monitoring.

using f irewalls to lim i t ne t work tra f fic to authorized port s .

logging conversations.

authenticating users before conve r sations are initiated.

314. Upon receipt of the initial signed digital certif ic ate the user will decrypt the cer t ificate with the public key of the:

registrati o n authority (RA).

certific a te authority (CA).

certificate repositor y .

receive r .

315. Which of the following testing procedure is u sed by an audi t or to che c k whether a firm i s following the rules and re g ulations appl ic able to an activity or practice?

Compliance testing

Sani t y t e s ting

Recovery testing

Substantive testing

316. An organ i zation perfo r ms nightly backups but d oes not have a formal polic y . An IS auditor should

FIRS T :

evaluate curr e nt backup proced u res

escalate to senior ma n agement

document a policy for the or g anization

recommend automat e d backup

317. Which of the following must ex i st to ensure t h e viability of a duplicate inf o rmation p rocessing facility?

The site is near the pr i mary site to ensure quick and e f ficient recover y .

The site contains the most advanced ha r dwa r e available.

The workload of the pr i mary s i te is monitored to ensure ade q uate backup is available.

The har d ware is test e d when it is installed to ensure it is working prop e r l y .

318. Which of the following onli n e a u diting techniques is most e f fective for the early de t ection of err o rs or irregu l arities?

Embedd e d audit mod u le

Integrated test fac i li t y

Snapshots

Audit hooks

319. Which of the following is the M O ST reliable form of single factor personal identification? A. S mart ca r d

B. P a ssword

C. Photo identification

D. iris scan

320. Which of the following lay e r of an OSI model t r ansmits and receives the bit st r eam as electrical, optical or ra d io signals over an ap p ro p riate medium or carrier?

T ransport Layer

Network Layer

Data Link Layer

Phys i cal L ayer

Page 33 of 62

321. An info r mation security team has discovered that users are sharing a login account to an application with sensit iv e information, in v iolation of the access polic y . Business management indicates that the practice creates opera t io n al e f ficiencies.

The information security manag e r ’ s BEST course of action sh o uld be to: A. modi f y the policy

B. present t h e risk to sen i or management

C. enforce the policy

D. create an exception for the deviation

322. The FI R ST step in e stablishing an information security pro g ram is to: A. secure organizational c ommitment and supp o rt

B. assess t h e org a nization ’ s complia n c e with regulatory requir e ments C. determine the level of r isk that is acceptable to senior man ag e m ent D. define policies and st a nda r ds t hat mitigate the org a nization ’ s ri s k s

323. W h at are intrusion- d etection systems (IDS) primarily used for? A. T o identify AND preve n t in t rusion attempts to a n etwork

B. T o prevent intrusion at t empts to a n etwork

C. Forensic incident response

D. T o identify intrusion attempts to a n etwork

324. An IS auditor determ i nes that a business continuity plan has not been re v iewed a n d a pproved by managem e nt.

Which of the following is the MOST si g nificant risk a ssociated with this situati o n? A. Continuity planning m a y be sub j ect to resource constraints.

B. The plan may not be aligned w i th i n dustry best p ractice.

C. Critical business proc e ss e s may n o t be addressed ad e quate l y . D. The plan has not been re v iewed by risk manag e ment.

325. Which of the following activ i ties should the business con t inuity manager perform FIRST after t h e replacement of hard w are at the p r imary information processing f acility?

verify co m patibility with the hot s i te.

Review t h e implementation rep o rt.

Perform a walk-through of the dis a ster recovery plan.

Update the IS as s ets inventor y .

326. Y ou are p a rt of a s e c urity s t a f f at a highly profitable bank and e ach da y , all tra f fic on the network is logged for la t er revie w . Every Friday when major d e posits are made you' r e seeing a s e ri e s of bits placed in the "Urge n t Pointer" fie l d of a TCP p acket.

This is only 1 6 bits which isn't much but it concerns you because:

This could be a sign of c overt channeling in bank network c ommunications and should be investigated.

It could be a sign of a d amaged n etwork cable causing the i s sue.

It could be a symptom of malfunc ti oning network card or drivers and the source system should be checked for the pr o blem.

It is normal tra f f i c be c ause s o met i mes the previous fields 1 6 -bit checksum value can over run into the urgent pointer's 16-bit fie l d causing the condition.

327. While planning a review of IT governance, the IS auditor is MOST l i k ely to: A. examine a udit committee minu t es for IS-related matters and their control.

B. obtain informa t ion about the framework of control adopted by managem e nt.

C. assess w hether business proce s s owner responsibilities are c onsistent a cross the or g anization. D. review compliance with poli c ies and proced u res issued by t h e boa r d of directors.

328. Which of the following are valid examples of Malware: A. viruses

B. worms

C. trojan horses

D. spyware

E. All of the above

329. Which of the following is the PRIMA R Y advantage of single s ign-on (SSO)? A. I mproves s y stem performance

B. E n s ures good passwo r d practices

C. Improves s ecurity

D. Reduces administrative workload.

330. An IS auditor finds t h at an organi z ation ’ s data loss prevention (DLP) system is confi g ured to use vendor def au lt settings to identify violations.

The audit o r ’ s MAIN con c ern should be that:

violations may not be categorized a ccording to the or g aniza t ion ’ s risk profile.

violation reports may not be retain e d according to the orga n i z ation ’ s risk p rofile.

violation reports may not be reviewed in a timely manne r .

a signif i cant number of false posi t i v e violations may be rep o rted.

Page 34 of 62

331. W h at should IS aud i tors alw a ys check when a uditing passwo r d files? A. That deleting passwo r d files i s pro t ected

B. That password files are encrypted

C. That password files are not acce s s i ble over the network

D. That password files are archived

332. T o det e rmine which users can g a in access to t he privileged supervisory s tate, which of the following should an IS auditor revi e w?

S y s tem a cce s s log f i les

Enabled access control software pa r ameters

Logs of access control violations

System configurati o n fil e s for cont r ol options used

333. Heuristic Scanner C Analyzes the instructions in the code being scann e d and deci d e on the basis of statistical probabilities whether it could contain malicious code. Heuristic scanning result could indicate that malware may be present, that i s p ossibly infec t ed. Heuris t ic scanner tend to generate a high level false positive errors (they indicate that malware m a y be present when, in fac t , no mal w are is present). Scanners examines memory disk- bo o t sector, ex e cutables, data files, and command files for bit pattern that match a known mal w are. Scanne r s, therefore, need to be u pdated p e ri o dically to remain effective.

B. Immuniz e rs C Defend against malware by app en ding sections of themse lv es to f iles C sometime in the same way Malware a pp e nd thems e lves. Immunizers continuously check a file for changes and rep or t changes as possible malware b ehav i or. Other types of Immunizers are focused to a s pecific malware and work by givi n g the malwa r e the impression that the malware h as already infected to the computer. This method is not always practical since it is not possible to immunize file against all known malware.

C. Behavior Blocker- Focus on de t ecting potential abn o rmal b e havior s uch as writing to the boot s ector or the master boot record, or making changes to executable files. Blockers c an potentially detect malware at an early stage. Most har d ware b ased anti-malwa r e mechanism are based o n this concept.

D. Integrity C RC checker- Compu t e a binary number on a known m a lware free program th a t is then stored in a database file. The number is called Cyclic Redund a n cy Check (CRC). On subsequent scans, when that p r ogram is called to execute, it checks for changes to the file as compare to the database and rep o rt possible infection if c hanges have occurred. A match me a ns no infection; a mism a tch means change in the prog r am has occur r ed. A change in the pr o gram could mean malware wit h in it. These scanners are effective in detecting infection; however, they can do so only a fter infection has occurre d . Also, a CRC checker can only de t ect subsequ e nt chan g es to file s , because they assume files are malware free in the fir s t p l ace. Therefore, they are ineffective a g ainst new files th a t are m a lware infected and that are not recorded in the database. Integrity checker t a ke advantage of the fact t h at executable pro g rams and boot sectors do not ch a nge often, if at all.

The followi n g were incor r ect answers:

Scanners -Look for sequences of bit called signature that are typical malware pro g rams.

Immunizers C Defend against malware by append i ng sections of themselv e s to files C s o metime in t h e same way Malware a pp e nd thems e lves. Immunizers continuously check a file for changes and rep or t changes as possible malware b ehav i or.

Behavior Blocker- Focus on de t ecting potential ab n ormal behav i or such as w riting to the boot sector or the master boot record, or making changes to executable files. Blockers c an potentially detect malware at an early stage. Most har d ware b ased anti-malwa r e mechanism are based o n this concept.

The followi n g reference ( s) were / was used to create this question: CISA review manual 2 0 14 Page num b er 354 a n d 3 55

2 1 19.Which are the two p rimary types of scanner used for prote c ting against Malware? A. Malware mask/signatures and H e uristic Scanner

B. Active and passive Sc a nner

C. Behavior a l Blockers and immunizer Scanner

D. None of the above

334. Which of the following would be MOST important for an IS a u ditor to review duri n g an audit of an automated continuous monitoring p roc ess be i ng us ed by the finance de p ar t ment?

Resiliency of the monitoring service

Dual control and ap p r o vals embedded in processes

Manage m ent sign-o f f of test documentation

Configur a tion of the monitoring tool

335. Which of the following techn i que is NOT used by a preacher against a Private Branch Exchange

(PBX)?

E a v esdropping

Illegal call forwardi n g

Forward in g a user to an unused or disabled n u mber

SYN Flo o d

336. Which of the following exp l oit vu l nerabilities to cause l o ss or dama g e to the organi z ation and its assets?

Exposures

Threats

Hazards

Insu f ficie n t controls

337. W h at process is us e d to validate a subject ’ s i d entity? A. Identification

B. Nonrep u diation

C. Authorization D. Authentication

338. W h en e ver an application is m odified, what s h ould be tested to determine the full im p act of the change?

Interface systems with other applications or systems

The entire program, including any i n terface s y s t e ms with ot h e r applicatio n s or systems

All progr a ms, including inter f ace systems with other a p plications or s y st e ms

Mission-critical functions and any interface syst e ms with oth e r applicatio n s or systems

339. Which of the following i s NOT an example of corrective control? A . O S Upgr a de

B. B a ckup and restore

C. Continge n cy planning D. S y s tem M onitoring

340. Which of the following is a f eature of an intrusion detec t ion system (IDS)?

Gathering evidence on attack attempts

Identifying weaknesses in the policy definition

Bloc k ing access to p a rtic u lar sit e s on the Internet

Preventing certain users f r om accessing spe c i f i c s er v e rs

Page 35 of 62

341. Which of the following is the BEST type of program for an organization to implement to aggrega t e, correlate and store di f fer e nt log and event files, and then produ c e weekly and mon t hly reports for IS auditors?

A security information ev ent manag e ment (SIEM) product

An open-source correl a tion engine

A log management tool

An extract, transf o rm, l oad (ETL) system

342. What is the GRE A TEST concern for an IS auditor reviewing c o ntracts for licensed software that executes a critical business process?

Software escrow was not negotiat e d.

An operational level a g reeme n t (O L A) was not negotiated.

The contract does not contain a righ t -to-audit clause.

Several vend o r delive r ables m issed the commitment date.

343. IS management has decided to rewrite a leg a cy customer re l ations system using fourth gene r ati o n langu a ges ( 4 GLs).

Which of the following risks i s MO S T o f ten associa t ed with sy s t em development using 4GLs? A. Inadequate screen/report design faciliti e s

B. Complex pro g rammi n g langu a ge subsets

C. Lack of portability ac r oss operating systems D. Inability to perform da t a intensive operations

344. During an audit of the logical access control of an ERP financial syst e m an IS auditor found some

user accounts shared by multiple individuals. The user IDs were based on ro l es rather than individual identities. T h ese accounts allow acc e ss to financi a l transactio n s on the ER P .

What should the IS auditor do next? A. Look for compen s ating controls.

B. Review fi n ancial transactions logs. C. Review the scope of t h e audit.

D. Ask the a dministrator to disable these accounts.

345. A b e n e fit of quality of se r vice (QoS) is that t h e:

entire network's availability and performance will be signi f ica n tly improved.

telecom carrier will provide t he company with accurate service-level compliance repor t s .

participating applications will have guaranteed s ervice lev e ls.

communications link will be s upported by security controls to perform secure online tra n sactions.

346. Which of the following audit r i sk is r elated to material err o rs or misstatements that have occurred that will not be detected by an IS auditor?

Inherent Risk

Control Risk

Detection Risk

Overall Audit Risk

347. A p u r p ose of project cl o sure is to determine the: A. potential risks a f f e cting the quality of deliverables. B. le s sons l e arned for u s e in future projects.

C. project f e asibility requ i rements

D. professional expertise of the project manage r .

348. Which of the following should be the PRIMA R Y consideration when d eveloping an IT strategy?

IT key performance in d icators bas e d on business objectives

Alignment with overall business objectives

Alignment with the IT i nvestment p ortfolio

Short and long-term p l ans for the enterprise IT architecture

349. Which of the following type of a c o mputer network covers a limited area such as a h o me, o f fice or campus?

LAN

W AN

SAN

P AN

350. An IS auditor who w as invol v ed in designing an or g anization ’ s business continuity p lan(BCP) h a s been assigned to audit the plan. The IS auditor should:

decline t h e assignment.

inform m a nagement of the possib l e conflict of interest after c o mpleting the audit assignment.

inform the business c o ntinuity planning (BCP) team of the p ossible conflict of interest prior to begi n ning the assignment.

communicate the possibility of conflict of interest to manage m ent prior to starting the assignment.

Page 36 of 62

351. Which of the following ISO/OSI l a y ers performs transformat i ons on data to provide a standa r dized application i n terface and to provide common communication serv i ces such a s encryptio n ?

Applicati o n layer

S e ssion l a yer

Presentation layer

T ransport layer

352. Which of the following will identify a deviation in the information security managem e nt process fr o m gen e rally accepted standards of good practices?

Gap analysis

Ri s k a s s e ssment

Business impa c t analysis (BIA)

Penetration testing

353. Which of the following is the M O ST e f fect i ve type of antivi r us software? A. Scanners

B. Active monitors

C. integrity checkers

D. V accines

354. Which of the following should be an IS audito r ’ s PRIMA R Y c o nsiderati o n when eva l uating the development and design o f a privacy pro g ram?

Data governance a n d d ata c lassification procedu r es

Policies a nd pro c e d u r es consistent wi t h privacy guideli n es

Industry p ractice and regulatory compliance guidance

Information security and incident management practices

355. Which of the following i s an analytical review pr oc edure for a payroll sy s tem?

Performi n g penetrati o n att e mpts on the payroll system

Evaluating the perfo r mance of the payroll syst e m, using ben c hmarking software

Performing reason a bl e ness tests by multiplying the numb e r o f employees by the average wa g e rate

T esting hours reported on time sheets

356. An IS auditor cond u cting a revi e w of disaster recovery planning ( D RP) at a financial processing org a nization has discove r ed the following:

- The existi n g disaster recovery plan was compiled two years earlier by a systems analyst in the org a nization ' s IT department us i ng transaction flow projections from the ope r ations depar t ment.

- The plan w as presented to the deputy CEO for a p proval and f o rmal issue, b ut it i s still a waiting his/her attention.

- The plan has never been updated, tested or c ircu l ated to key management and sta f f, t h ough interviews show that each would know what a ction to take for i ts area in the event of a disruptive inci d ent.

The basis of an or g anization's d i saster recovery plan is to reestablish live processing at a n alternative site whe r e a simila r , but not identi c al, hardware config u ration is already establis h ed. An IS a u ditor should:

t a ke no a c tion as the l a ck of a current plan is the only signif ic ant finding.

recomm e nd that the hard w are con f iguration at e ach site is i d entical.

perform a review to verify that the second configuration can supp o rt live processing.

report that the financial expenditure on the alternative s i te is wasted with o ut an e f fective plan.

357. W h en auditing security for a data cente r , an IS auditor should look for the presence of a voltage regulator to ensure that the:

hardware is protected against po w er surges.

integrity is maintained if the main power is interrupted.

immediate power will be availab l e if the main power is lost.

hard w are is protected again s t long - term power fluctuations.

358. Which of the following would MO ST e f f e c t i vely aid exec u tive management in achieving IT and business alignment?

Ri s k a s s e ssment

V alue delivery ass e ssment

Balanced scorecard

Performance measur e ment

359. Which of the following would be the MOST e f f e c tive method t o address software license violations o n employee w orkstations?

Restr i c ti n g administrative rights on employee w orkstations

Requiring automated i n s t allation of software

Scanning of workstati o ns daily for u nauth o rized software use

Implementing real-time monit o ring software on employee work s tations

360. An IS auditor is assessing the results of an organization ’ s post-implementation review of a new l y develop e d information system.

Which of the following sh o uld be the a u dito r ’ s MAIN focus? A. The procurement con t ract has been closed.

B. Lessons lear n ed have been id e ntified.

C. The disaster recovery plan has be e n updated.

D. Benefits r ealization a n alysis has been completed.

Page 37 of 62

361. The P RIMA R Y objective of s e r v ice-level m a nagem e nt (SLM) is to: A. define, agree, record a nd mana g e the re q uired l evels of ser v i c e.

B. ensure that servic e s a re mana g ed to deliver the highest ach i evable level of availabilit y . C. keep the costs associated with any serv i ce at a minimum.

D. monitor and re p ort a n y legal noncompliance to business mana g ement.

362. An or g anization is considering us ing production data for t esting a new applicat i on ’ s functionalit y . Which of the following da t a pro t ection techniques would BEST e nsure that p e rsonal data cannot be inadvertently recovered in test environments while also reduci n g the need f o r strict c onfidentiality of t h e data?

Data ano n ymization

Data minimization

Data no r malization

Data encryption

363. After implementing a n inform a tion security govern a nce fram e work, which of the following w ould provide the BEST information to develop an infor m ation securi t y project pl a n?

Balanced scorecard

Recent audit results

Risk heat map

Gap analysis

364. Which of the following is MO S T l ikely to result from a bu s iness process ree n gine e ri n g (BPR) Project?

An increased number of people using technolo g y

Significant cost s a ving, th r ou g h a r e duction the complexity of information technology

A weaker organizational structures and less accountability

Increased information prote c tion (IP) risk will i n crease

365. When performing an IS stra t egy audit, an IS auditor shou l d review both short-t e rm (on e - year) a nd long-term (t h ree-to five-year) IS strate g ies, interview appr o p r iate c orporate m ana g ement p ersonnel, a n d ensure that the external e nvi r onment h as been considered. The auditor shou l d espe c ially focus on procedures in an audit of IS strateg y .

T rue or false? A. T rue

B. False

366. Which of the following would create the GRE A TEST r i s k when migrati n g a critical legacy system to a new system?

Using agile developm e nt methodol o gy

Following a phased a p proach

Following a direct cut-over appr o ach

Maintaining parallel systems

367. A disk management system ’ s PRIMA R Y funct i on is to: A. monitor disk a ccesses for analytical review

B. deny access to di s k resident data files

C. provide data on e f fici e nt disk usage

D. provide the method of control for disk u s age

368. The M AJOR consi d eration for a n IS auditor reviewing an organization's I T project p ortfolio is the: A. IT budget.

B. existing IT environmen t . C. business plan.

D. investme n t plan.

369. The S e cure Sockets Layer (SS L ) protocol ad d resses the con f identiality of a messa g e through: A. symmetric encryption.

B. message authen t ication code. C. hash function.

D. digital si g nature certificates.

370. The F e deral Infor m ation Pro c essing Standa r ds (FIPS) a r e p r imarily for use by (Choose two.): A. all non-military government agencies

B. US gove r nment contractors

C. all military government agencies

D. all private and p u blic colleges in the US E. None of t h e choices.

Page 38 of 62

371. An IS auditor is c onducting a revi e w of a healthcare org a ni z ation ’ s IT policies for handling medical records.

Which of the following is MOST important to veri fy ? A. A documented policy appro v al pro c ess is in place B. Policy writing standar d s are consistent

C. The policies comply with regulatory requi r ements D. IT personnel receive ongoing policy training

372. Wh e n d etermining w hether a p r o j ect in the design phase will meet organizational ob j ectives, what is

BEST to c o mpare against the business case?

Project p l an

Require m ents analysis

Implementation plan

Project budget provisions

373. Which of the following find i ngs should be of GRE A TEST co n c e rn for an IS auditor w h en auditing the e f fectiveness of a phishing simulation test administered for sta f f members?

Sta f f members were not no t ified about the test beforehand.

T est results were not communicated to st a f f members.

Sta f f me m bers who failed the test d i d not receive follow-up e d ucation.

Security awar e ness training was not provided pr i or to the te s t .

374. The control that MOST e f fec t ively addresses the risk of p i ggybacking/tailgating into a restricted ar e a without a d e ad man do o r is:

using bi o metric door locks.

security awar e ness training.

requiri n g employees to wear ID b a dges.

using two-factor authe n tication.

375. Which of the following is a benefit of u sing ca l lback devic e s? A. Provide a n audit trail

B. Can be used in a sw i tchbo a rd envi r onment

C. Permit un l imited user mobility

D. Allow call forwarding

376. Within the confidentialit y , integrit y , and availability (CIA) tri a d, which of t he f o llowing activities BEST

supports the concept of i n tegrity?

E n s uring encryption for data in transit

Implementing a data classification schema

Utilizing a formal change management process

Enforcing service level agr e ements (SLAs)

377. Evaluate and deploy technical cont r ols to mitigate all iden t ified risks during audit. A. 2

B. 3

C. 1

D. 6

378. The l og ical exposure associated with the use of a checkpo i nt restart procedu r e is: A. denial of service.

B. an asy n chron o us attack

C. wire tapp i ng.

D. computer shutdown.

379. Which of the following is normally a respons i bility of the chief security o f ficer (CSO)? A. Periodically reviewing and e v aluati n g the security policy

B. Executing user application and software testing and evaluat i on

C. Granting and revoking user access to IT resources D. Approving access t o data and appl ic ations

380. Li b rary control soft w are restricts source code to: A. Read-only access

B. W rite-only acce s s

C. Full acc e s s

D. Read - write access

Page 39 of 62

381. D uring a disaster r ec overy test, an IS auditor observes t h at the perfo r mance of the disaster recovery site's s erver is s lo w .

T o find the root cause of this, the IS a u ditor should FIRST re v i e w the: A. event error log genera t ed at the disaster recovery site.

B. dis a s ter recovery te s t plan.

C. disaster r ecovery plan (DRP).

D. configurations and alignment of the primary and disaster re c overy s i tes.

382. Which of the following would be MOST t i me and cost e f f i c i e n t when per f orming a co n trol

self-assessment (CSA) for an organiza t ion with a large numb e r o f widely dis p ersed empl oy ees? A. T op-do w n and bottom - up analysis

B. Face-to-f a c e interviews

C. Survey questionnaire D. Facilitated workshops

383. Which of the following is the BEST indication of an e f fec t ive incident managem e nt process? A. Percentage of incidents where root c ause has been identifi e d

B. Percentage of incidents closed without escalation

C. Number o f calls to the help desk

D. Number o f incidents r e viewed by the IT management

384. T o ad d r e ss the issue that perform a nce pressur e s on IT may c onflict with information security c ont r ols, it i s MO S T i mportant that:

the security policy is c h ang e d to accommodate IT performa n ce pressure

noncompliance issues are re p orted senior man a gement

senior managem e nt p r ovides gu i d a nce and dispute resolution

information security mana g e m ent u nderstands b usiness performance issues

385. Wh e n r ev iewing the e f fectivene s s of data cen t er operati o ns, the IS auditor would FIRST establish that s ystem performance:

is monito r ed and r e po r ted aga i nst agre e d service levels.

reflects the expe c ted usage levels e stablished at implementation.

meets the expected targets specified by the manufacture r .

is within generally accepted reliability levels for that sy s tem.

386. The G RE A TEST risk of database denormal i zation is: A. decreased performa n ce.

B. loss of data confidentialit y . C. loss of database integr i t y . D. incorrect metadata.

387. The c o st of ongoing operations when a d i saster recovery p l an is in place, compared to not having a disaster recovery plan, wi l l MOST like l y:

increase.

decrease.

remain the same.

be unpr ed ictable.

388. Which of the following is a good time frame f o r making changes to passwords? A. every 180 to 365 days

B. every 30 to 45 days C. every 10 to 20 days D. every 90 to 120 days E. None of t h e choices.

389. An IS auditor is eval u ating the log managem e nt system for an org a nization with devices and syst e ms in multiple geog r aphic locations.

Which of the following is MOST important for the auditor to ve r ify? A. Log files are encryp t ed and digitally signed.

B. Log files of the ser v ers are synchro n ized.

C. Log files a re review e d in multiple locations. D. Log files a re concurre n tly updated.

390. What is the MOST important r ole of a Certific a te Authority ( CA) when a private key b ecomes

compromised?

Issue a n e w priva t e key to the user

Refresh t h e key information datab a se in the certificate pub l ishing server

Publish t h e certific a te rev o cation lists (CRL) into the repository

Refresh the metadata of the certif ic ates

Page 40 of 62

391. Mitigating the risk a nd impa c t of a disaster or business int e rruption usu a lly t akes priority over transference of risk to a third party such as an insure r .

T rue or false? A. T rue

B. False

392. W h at should an o r g anization do before p r oviding an exter na l agency physical acc e ss to its information processing f a ciliti e s (IP F s ) ?

The processes of the e x ternal age n cy should be subjected to an IS audit by an indep e ndent ag e nc y .

Employees of the external agency should be tra i ned on the security procedures o f the organization.

Any access by an external agency should be limited to the demilitarized z o ne (DMZ).

The orga n ization s hould conduct a risk assessment and design and impl e ment appr op riate controls.

393. Which of the following is the BEST reason to perform root cause analysis after a critical server failure?

T o enable app r opriate c orrective measures

T o enable the gathering of system a v ailability data

T o enable timely follow-up a u dits

T o enable the optimiz a t ion of IT investments

394. Which of the following is the BEST source for describing t h e objectives of an or g anization ’ s information syste m s?

B u s iness process owners

End users

IT management

Information security management

395. Which of the following types of d ata validation editing c h ecks is used to determine i f a field contains data, and not zeros or blanks?

Check di g it

Existence check

Complet e ness check

Reasona b leness check

396. Which of the following is the MOST reliable ne t work connec t ion medium in an enviro n ment where there is strong electro m a g netic interference?

Coaxial cable

Fiber optic cable

Shielded twisted-pair cable

Wireless link

397. Which of the following is NOT a disadvantage of Single Sign On (SSO)? A. Support f o r all major operating syst e m environment is d i f f i c ult

B. The cost associated with SSO development can be signific a nt

C. SSO could be single point of f a ilure and total c o mpromise of an or g anization asset

D. SSO improves an administra t or's ability to manage user's account and authorization to all associated s y stem

398. An IS auditor finds t h at confidential company data has be e n inadverten t ly leaked th r ough social engin e eri n g.

The MOST e f fec t ive way t o help prevent a recurrence of th i s i s s ue is to i mplement: A. penalties to sta f f for s e curity policy breaches.

B. a third-pa r ty intrusion p revention solution. C. a security awa r eness prog r am.

D. data loss prevention ( DLP) software.

399. Which of the following methods should be used to e f fect i vely erase s e nsitive data from portable storage devices that a re to be reuse d ?

Formatti n g the portab l e device

Using m e dia sanitization software

Overwriting the sensitive data

Exposing the portable device to a magnetic field

400. Which of the following would be a result of uti l iz i ng a to p -d ow n maturity model process? A. A means of benchma r king the e f f e ctiveness of similar proces s es with peers

B. Identification of olde r , more established processes to ensure timely re vi ew

C. Identification of processes w i th the most improvement opp ort unities

D. A means of comparing the e f fec t iv e ness of other processes w ithin the enterprise

Page 41 of 62

401. An IS auditor reco m mends that an initial vali d ation control be pr o gra m med into a credit card transaction capture a p plication.

The initial validation pro ce ss would MOST likely:

c heck to ensure that the type of tra n saction i s va l id for t h e card type.

verify the format of the nu m ber e nt e red then loc a te it on t h e d atabase.

ensure that the transaction en t ered is within the cardhol d er's credit limi t .

confirm t h at the card is not shown as lost or stolen on the master file.

402. The inf o rmation in the knowled g e base can be expressed in several ways.

Which of the following w a y uses questionnai r es to lead the user throu g h a series of choices until a conclusion is reached?

Decision tree

Rules

Semantic nets

Knowled g e interface

403. Which of the following would e f f ectively verify the originator of a transaction? A. Using a secret password bet w een the originator and the rec ei ver

B. E n c rypti n g the transaction w i th the receiver's public key

C. Using a portable document for m at (PDF) to encapsulate trans a ction content

D. Digitally s i gning the tr a nsaction with the source's private key

404. An IS auditor learns a serv e r administration t e am regularly applies wor k aro u nds to address rep e ated failures of critic a l data proc e ssing servic e s .

Which of the following would BEST e n able the organization to resolve th i s i s s ue? A. Service l e v el manag e ment

B. Change mana g ement C. Problem managem e nt D. Incident management

405. Which of the following is t he BEST method for c onverting a f i le into a for m at s uitable for data a nalysis in a forensic investigation?

E xtrac t ion

Normalization

Data acquisition

Imaging

406. Which of the following contr o ls would provide the GRE A TEST assurance of da t abase integrity? A. Audit log proced u res

B. T able link/reference c h ecks

C. Query/table access time checks

D. Rollback and roll for w ard data b ase features

407. D uring the requi r ements de f inition phase for a database a p plication, performan c e is listed as a top priorit y .

T o access the DBMS fil e s, which of the following technologies should be r ecommended f or optimal I/O

perform a nce?

Storage a rea net w ork (SAN)

Network A ttached Storage (NAS)

Network file s y s tem ( N FS v2)

Common Internet File Sy s tem (CI F S)

408. Active r adio frequency ID (RFID) tags are subject to which of the following exposur es ? A. S e ssion hijacking

B. E a v esdropping C. Malicious code D. Phishing

409. A senior auditor is reviewing w o rk pap e rs pre p ared by a ju n ior auditor i n dicating that a finding was removed after the auditee said they co r rected the problem.

Which of the following w o uld be the MOST approp r iate course of action for the senior aud i tor? A. Approve the work pa p ers as writt e n

B. Refer the issue to the audit director

C. Have the finding reins t ated D. Ask the a uditee to ret es t

410. Which of the following protocol uses serial interface for c ommunication between two computers in

W AN technology?

Point-to-point protocol

Frame Relay

ISDN

Page 42 of 62

411. Machines that operate as a clos e d sys t em can NEVER be eavesdrop p ed. A. T rue

B. False

412. Wh e n a uditing the IT gove r nance of an organi z ation planni n g to outsource a critical fi n ancial application to a cloud vendo r , the MOST important consideration for the aud i tor should b e :

the cost of the outsourced system.

the inclusion of a service termination clause.

alignment with industry standards.

alignment with business requireme n ts.

413. Which of the following do d i gital signatures provide?

Authentication and integrity of data

Authentication and confidentiality o f data

Confident i ality and integrity of data

Authentication and a v ailability of d ata

414. An IS auditor observes a system performance monitoring tool which states that a server critical to the organization averages high CPU utiliz a tion a c ross a cluster of f o ur virtual servers throughout the audit period.

T o determine if further investigation is requi r ed, an IS auditor s h ould review: A. the s y st e m process a c t i vi t y log

B. system b a selines

C. the number of CPUs allocated to each virtual machine

D. organizational objectives

415. An org a nization developed a c o mpreh e nsive three-year IT st r ategic plan. Halfway into the plan, a major legislative change i mpacting the organization is enacted.

Which of the following sh o uld be man a gement ’ s NEXT course of a c tion?

Develop specific proc e dural docu m entation rela t ed to the changed legislat i on.

Assess t h e legislation to de t ermine wheth e r are requi r ed to the strategic IT plan.

Perform a risk management of the l egislative c h anges.

Develop a new IT strategic plan that encompa s ses the new legislation.

416. The P RIMA R Y purpose of a pe r iodic threat and risk assessment report to senior management is to communicate the:

cost-benefit of s e curity controls.

s tatus of t he security p osture.

probability of future inc i dents.

risk acce p tance criteria.

417. T o ensure an o r ga n i z ation is c o mplying with privacy requirements, an IS aud i tor should FIRST

review:

the IT inf r astructure.

organizational policie s , standards and proce d u r es.

legal and regulat o ry requirem e nts.

the adhe r ence to org a nizational po l icies, stand a rds and pro c edu r es.

418. Which policy helps an auditor to gain a better und e rstand i ng of biometrics s y stem in an org a nization?

B IMS Pol i cy

BO M S P o licy

BMS Pol i c y

BOS Pol ic y

419. An IS auditor is con d ucting a pre- i mplementation review to determine a new system ’ s production readi n ess. T he audit o r ’ s PRIMA R Y concern shou l d be wheth er :

the project adhered to the budget a nd target da t e

users were involved in the quality assurance (QA) testing

there are unreso l ved h igh-risk items

benefits r ealiza t ion h a s been evidenced

420. D u ring a review of the IT st r ategic plan, an IS auditor finds several IT initiatives f o cused on delive r ing new systems and technology are not aligned with the organization ’ s strateg y .

Witch of the following w o u ld be the IS audit o r ’ s BEST recomm e n d ation? A. Reasse s s the return on investment for the IT initiatives

B. Modi f y I T i nitiatives that do not map to business strategies

C. Utilize a b alanced scorecard to align IT initiativ e s to bus i ness strategies

D. Reassess IT initiatives that do not map business strategies

Page 43 of 62

421. The u s e of digital signatu r es:

requires the use of a one-time password g ene r ato r .

provides e ncryption to a message.

validates the source of a message.

ensures message c o nfidentialit y .

422. Which of the following refers to a symmetric k ey cipher which ope r at e s on fixed l ength gro u ps of bits with an unv a rying transformation?

stream ci p her

block cipher

check ci p her

string cip h er

None of t h e choices.

423. An audit of the quality manageme n t system ( Q MS) begins with an evaluation of the: A. organization ’ s QMS p o licy

B. sequence and interaction of QMS p rocesses

C. QMS processes and t h eir application D. QMS document control procedures

424. Which of the following soft w are development methodology uses minimal planni n g and in favor of rapid p r ototyping?

Agile Developments

Software prototyping

Rapid ap p lica t ion development

Compon e nt based development

425. An IS auditor begins an assignment and identifies audit c o m ponents for which the auditor is not qualified to assess.

Which of the following is t he BEST c ourse of acti o n?

Notify audit management for a decision on how t o proceed.

Complete the audit and give full disclosure in the final audit report.

Complete the work ass i gnment to the best of the audito r ’ s abilit y .

Exclude the related t e sts f r om the audit plan a n d continue t he assignment.

426. Which of the following audit r i sk is r elated to exposure of a process or entity to be audited without taking into account the control that mana g ement h as implemented?

Inherent Risk

Control Risk

Detection Risk

Overall Audit Risk

427. Back Orifice is an example of: A. a v iru s .

B. a legitimate remote control software.

C. a backdoor that t a kes the form of a n installed program. D. an eavesdro p p e r .

E. None of t h e choices.

428. A tech n ical lead who was wor k ing on a major project has left the organization. The project manager reports susp i c ious system act i vities on one of the servers that i s accessible to the whole team.

What would be of GRE A TEST concern if discovered duri n g a foren s ic investigation? A. Audit logs are not en a b l ed for the system

B. A logon ID for the tech n ical lead still exists

C. Spyware is installed on the system D. A T rojan is inst a lled on the system

429. Which of the following is the process of feeding test data into two systems C the modified system a nd alternative system and compari n g the result?

Parallel T est

Bl a ck box testing

Regression T esting

Pilot T e s t i ng

430. Auth en tication tec h niques for sending a nd r e ceiving data betwe e n EDI s y s tems is cru c ial to pre v ent which of the following?

Unsy n chronized transactions

Unauthor iz ed transactions

Inaccurate transactions

Incomple t e transactions

Page 44 of 62

431. W h en r eviewing an i ntrusion det ec tion system (IDS), an IS auditor shou l d be MOST concerned about which of the following?

Number of nonthreat e ning even t s identified as threat e ning

Attacks n o t being identified by the system

Reports/logs being pr o du c ed by an automated t o ol

Legitimate tra f fic being blocked by the system

432. Function Point Analysis (F P A ) provides an est i mate of the s ize of an inf o rmation system based o n ly on the num b er and comp l exity o f a system's inpu t s and outputs.

T rue or false? A. T rue

B. False

433. While performing a risk-ba s ed audit, which of the following would BEST enable an IS auditor to identify and categorize risk?

Understanding the control framewo r k

Developing a compre h ensive risk model

Underst a nding the b u siness envir o nment

Adopting qualita t ive risk analysis

434. The P RIMA R Y reason an IS a u d itor perfor m s a functional wa l kthrou g h during the preliminary p hase of an audit assignment is to:

understand the business process.

comply with auditing stand a rds.

identify control weakn e ss.

plan substantive testi n g.

435. Which of the following should an IS auditor use to detect duplicate invoice records within an invoice master file?

Attribute sampling

Generalized audit software (GAS)

T est data

Integrated test fac i li t y ( I TF)

436. Users are issued security t o kens to be used in combination with a PIN to access the corpo r ate virtual private network (VPN).

Reg a rding t h e PIN, what is the MOST important ru l e to be inclu d ed in a security policy? A. Users should not leave tokens where they could be stolen

B. Users must never ke e p the token in the same bag as their laptop computer

C. Users sh o uld select a PIN t hat is completely random, with no rep e ating d igits

D. Users sh o uld never wr i te down their PIN

437. W h at is the BEST a c tion to prevent loss of data integrity or confidentiality in the c a se of an e- commerce application r u nning on a L AN, processing electronic fund transfers (EFT) and orders?

Using virtual private netw o rk (VPN) tunnels for data transf e r

Enabling data encryption within the application

Auditing the access c o ntrol to the network

Logging a ll changes to access lists

438. Se n di n g a message and a mes s age hash e n crypted by t h e sender's p r ivate key will ensure: A. authenticity and integrit y .

B. authenticity and privac y . C. integrity a nd privac y .

D. privacy a n d non r epud ia tion.

439. Which of the following wou l d be the BEST population to take a sample from when t e sting progr a m

changes?

T est library listings

Source program listings

Program change r e q u ests

Production library listi n gs

440. In the absence of te c hnical controls, what would be the BEST way to reduce unaut h orized text messaging on company-supplied mob i le devices?

Update the corporate mobile usage policy to p r ohibit texting.

Conduct a business impact analysis (BIA) and provide the re p ort to management.

Stop providing mobile devi c es until the organ i za t ion is able to implement c ontrols.

Include t h e topic of prohibi t ed texting in security awarene s s training.

Page 45 of 62

441. Which of the following type of a c o mputer network are variation of LAN and are d e dicated to connecting storage devi c es to servers and o t her c o mputing devi c es?

LAN

M AN

SAN

P AN

442. Which of the following attack i s against compu t er network and involv e s fragmented or invalid ICMP

packets sent to the target? A. Nuke att a ck

B. Brute force attack

C. Bu f fer ov e rflow D. Pulsing Zombie

443. The M OST e f f e c tive biomet r ic control system is the one: A. which has the highest equal - er r or r ate (EER).

B. which has the lowest E ER.

C. for which the false-rejection rate (FRR) is equal to the false-acceptance rate ( F AR). D. for which the FRR is equal to the fai l ure-to-enroll rate (F E R).

444. Which of the following should be an IS audito r ’ s FIRST action when assessing the r i sk a ssociat e d with unstructured d ata?

Implement strong enc ry ption for unstructured data.

I mplement user acc e s s controls to unstructured data.

Identify repositories of unstructured data.

Identify appr o priate t o ols for data classification.

445. A virus typically co n s ists o f what major parts (Choose three.):

a m e c hanism that allows them t o infect other fil e s and repr o duce" a trigger that activates delivery o f a "payload""

a payload

a signature

None of the choices.

446. Which of the following is the GRE A TEST r i s k associated with the lack of a n e f fect i v e d ata privacy pro g ram?

Failure to prevent fraudulent transactions

Inability to manage access to p rivate or sensitive data

Inability to obtain cust o mer confidence

Failure to comply with data-re l ated regulati o ns

447. Which of the following disaster recovery/continuity plan c o mponents p r ovides the GRE A TEST

assurance of recovery after a disaster?

The alternate facility w i ll be available until the original information process i ng facility i s r estored.

User ma n agement is involved in the identificati o n of critic a l systems and their associated critical recovery ti m es.

Copies of the plan are kept at t he h omes of k e y decision-ma k ing person n el.

Feedback is provided to manage m ent assuring them that the business co n tinuity plans are ind e ed workable an d that the procedures are current.

448. Which audit technique provides the BEST ev i dence of the segregati o n of duties in a n IS

dep a rtment?

Discussion with management

Review of the organiz a tion chart

Observation and inter v iews

T esting of user access rights

449. A contr a ct bid is digitally signed and electronically mailed. The PRIMA R Y advantage to using a digital signature is that:

the bid cannot be f o rged even if t h e keys are compromised.

the bid and the signature can be copied from one document to anoth e r .

the signature can be a uthenticated even if no encryption is used.

any alteration of the bid will invalidate the signature.

450. Which of the following featu r es can be provi d ed only by a s ymm e tric e ncryption? A. 128-bit k e y length

B. Informati o n privacy C. Data confidentiality D. Nonr e pu d iation

Page 46 of 62

451. Y ou s h ould know t h e di f ference betwe e n an exploit and a vulnerabilit y . Which of the following re f ers to a weakness in the system?

exploit

vulnerabil i ty

both

452. W h o is responsible for restr i cting and monitor i ng access o f a data user? A. Data Owner

B. Data User

C. Data Custodian

D. Security Administrator

453. W h en i s regression testing u s ed to determine wheth e r new application chan g es have introduced any errors in the remaini n g unchan g ed code?

In program development and change management

In program feasibility studies

In program development

In change management

454. An organ i zation plans to deploy Wi-Fi location a nalytics to count the num b er of shopp e rs per day across its v a rious retail outlets.

What should the IS auditor recommend as the FI R ST course of action by IT managem e nt? A. Conduct a privacy im p act assessment

B. Mask media access c o ntrol (MAC) add r esses

C. Survey shopp e rs for f e edback

D. Develop a privacy notice to be displayed to shoppers

455. With r es pect to business continuity stra t egies, an IS aud i tor interviews key st a kehol d ers in an org a nization to determine wheth e r they understand t heir roles and responsibilities.

The IS auditor is attempting to evaluate the:

clarity and simplicity of the business continuity plans.

adequacy of the business continuity plans.

e f fective n ess of the bu s iness continuity plans.

ability of IS and end-user personnel to respond e f fectively in emergencies.

456. Which of the following system a nd data conversion strateg i es provid e s the GRE A TEST

red u nd a ncy?

Direct cu t over

Pilot study

Phased appr o ach

Parallel run

457. An IS auditor inspe c ted a windo w less room c o ntaining p ho ne switching and net w orking equip m e n t and docum e ntation bind e rs. The room was equip p ed with two hand h eld fire extinguishers-one filled with CO2, the other filled with halon.

Which of the following sh o uld be given the HIGHEST priority in the audito r 's report?

The halon extinguisher should be r e moved because halon h a s a negative impact on t h e atmospher i c ozone laye r .

Both fire supp r ession systems present a risk of su f focation w hen used in a closed room.

The CO2 extinguisher should be r e moved, because CO2 is ine f f ective for suppressing fires involvi n g solid combustibles (paper ) .

The documentation binders should be removed from the equipment room to reduce po t ential risks.

458. T o pro v ide protection for media backup stored at an o f fsite location, the storage site should be: A. located on a di f ferent f l oor of the building.

B. easily access i ble by everyone.

C. clearly la b eled for em e rgency acc e ss. D. protected from unaut h orized access.

459. A structured w alk-through test of a disaster recovery plan involves:

representatives from each of the f u nctional are a s coming together to go ov er the plan.

all employees who par t icipate in the day-to-day operations coming togeth e r to practice executing the plan.

moving t h e systems to the alternate processing site and per f orming proc e ssing operations.

distributing copies of the plan to the various functional areas for revie w .

460. O f f-site data backup and storage should be g e ogr a phically separated so as to (fill

in the bla nk) the risk of a widespread physical d isaster s u ch as a hurric a ne or earthquake.

Eliminate

T ransfer

Mitigate

Page 47 of 62

461. Which of the following is an advantage of an integrated t e st facil i ty ( I T F)?

It us e s actual master files or dummies and the IS auditor d o es not have to review the source of the transaction.

Periodic testing does not r equi r e sepa r ate test processes.

It validates application s y stems and tests the ongoing operat i on of the system.

The need to prepa r e te s t data is eliminated.

462. An a ud it charter should:

be dynamic and change often to coincide with the changing n ature of technology and the audit profession.

clearly state audit object i ves fo r , a n d the delega t ion of, autho r ity to the main t enance a n d review of internal cont r ols.

document the audit pr o cedures designed to achieve the plann e d a u dit objectives.

outline the overall authori t y , scope and respon s ibilities of the audit functi o n.

463. Which of the following cloud deployment model can be shared by several organizati o ns? A. Private Cloud

B. Community Cloud

C. Public Cl o ud D. Hybrid Cloud

464. Which of the following is the M O ST important consideration when d esigning infor m ation security architecture?

Risk ma n agement p ar ameters f o r the or g anization are defi ne d.

The existing threat la n dscape is monitored.

The information security ar c hit e ct u re is aligned with industry standards.

The level of security supp o rted is based on business decisi o ns.

465. D uring the evaluation of a firm ’ s newly established whistleblower system, an aud i tor notes seve r al findings.

Which of the following sh o uld be the a u dito r ’ s GRE A TEST concern?

New employees have not been informed of the whistleblower polic y .

The whistleblo w e r ’ s pr i vacy is not protected.

The whist l eblower system does not track the time and date of submission.

The whist l eblower sys t em is only a v ailable during business hours.

466. The M O ST e f ficient way to con f i r m that an E R P system being impleme n ted satisfies business expectations is to util i ze which of the following types of t e sting?

Parallel

P i lot

Sociability

Alpha

467. Which of the following dynamic interaction of a Business Model for Information Security (B M IS) i s a pattern of b e haviors, e f f e c ts, a ssumptions, attitude and ways of doing thing s ?

Governing

Culture

Enabling and supp o rt

Emergence

468. Which of the following wou l d provide the highest degree of server acc e ss control? A. A mantrap-monitored e ntryway to t h e server ro o m

B. Host-based intrusion de t ection combined with C CTV C. Network- b ased intrusion detection

D. A fingerpr i nt scanner facilitating bi o metric access control

469. R eo r g a nization of databases is und e rtaken PRIMARI L Y to: A. reduce backout and recovery times.

B. eliminate duplicates and perform d ata backup.

C. reduce simultaneous update time and index validation. D. improve data access a nd retrieval times.

470. In the ev ent of a data center disaste r , which of the following would be t h e MOST appropriate strategy to e nable a complete re c ove r y of a critical database?

Daily data backup to t a pe and stor a ge at a remote site

Real-time replication to a remote site

Hard disk mirroring to a local serv e r

Real-time data backup to the local storage a r ea network (SAN)

Page 48 of 62

471. A disaster recovery plan for an o rganization should:

reduce the length of the rec o very t i me and the cost of recov e r y .

increase the leng t h of the recovery time and the cost o f re c over y .

reduce the duration of the recovery time and increase the c os t of recover y .

a f fect neither the recovery time nor t he cost of recover y .

472. O n e a d vantage of manag in g an e ntire collecti o n of projects as a portfolio is that it highlights the need to:

identify depen d encies betwe e n pro j ects.

inform users about all ongoi n g pro j ects.

manage the risk of e a c h individual project.

manage the quality of each project.

473. Which of the following message services provides the st r ongest evidence that a s p ecific action has occurred?

Proof of delivery

Nonrep u diation

Proof of s ubmission

Message origin aut h e n tication

474. IS management re c ently replaced its e x isting wired local a rea net w ork (LAN) with a wireless infrastructure to accommodate the increased use of mobile devices within the org a nization. This will increase the risk of which of the following attacks?

Port sca n ning

B a ck door

Man-in-t h e-middle

W ar driving

475. T o overcome the perception that security is a hindr a nce to business a c ti v ities, it is important for an information security manager to:

rely on senior management to enforce security

promote the relevance and contrib u tion of security

reiterate the necessity of securi t y

focus on c ompliance

476. Which of the following reduces the potential impact of so c ial engineer i ng attacks? A. Compliance with regulatory requir e ments

B. Promoting ethical understanding

C. Security awar e ness programs

D. E f fect i ve perf o rm a nce incentives

477. Which of the following imple m entation modes would prov i de the GRE A TEST amo u nt of s e c urity for outbo u nd da t a connecting to the internet?

T ransport mode with authenti c ation head e r (AH) plus encapsu l ating security payload ( ESP)

S e c ure Sockets Layer (SSL) mode

T unnel mode with AH plus ESP

T riple-DES en c ryption mode

478. Followi n g a successful attack on an or g anization ’ s web ser v e r , which of the following actions should be perform e d FIRST?

Review t h e bou n dary configura t i o n rules to ensure that outbo u nd packets a re limited

Evaluate and d e ploy an intrusion detection system

Periodically scan the n etwork for systems with well-known v u l nerabilities

Establish reference systems u s ing cryptograph i c checksum tools

479. Which of the following is of greatest concern when perfor m ing an IS a udit? A. Users' ability to directly modify the database

B. Users' ability to sub m it queries to the database C. Users' ability to ind i rectly modify the database D. Users' ability to di r ectly view the database

480. A w e b server is attacked and compromised.

Which of the following sh o uld be perf or med FIRST to handle the incident? A. Dump the volatile s torage data to a disk.

B. Run the server in a fail-safe mode.

C. Disconnect the web s e rver from the network. D. Shut down the web serve r .

Page 49 of 62

481. The risk of c ommunication failure in an e-commerce enviro n m ent is BEST minimized throu g h the u s e of:

alternative or diverse routing

compression software to mi n imize transmission d uration

a packet filtering firew a ll to reroute messages

functional or message acknowled g ments

482. A com p uter system is no m o re secure than the human systems responsible for its operation. Malicious individuals have regularly p e netrated wel l -design e d, secure comp u ter systems by taking advantage of the carelessness of t rusted individua l s, or by de l iberately deceiving them. zombie computers are being HE A VI L Y relied upon on by which of the f o llowing types of atta c k ?

E a v edro p ping

DoS

DDoS

A TP

S o c ial E n gineer i ng

None of t h e choices.

483. Which of the following is MOST important for an information s ecurity m a nag e r to ensure is included in a business case for a new system?

Intangible benefits of t h e system

Risk ass o ciated with t h e system

E f fectiveness of controls

Audit-logging capabilities

484. O f f-site data storage should be kept synchronized when p r epari n g for recovery of time- sensitive data such as that resulti n g from which of the follow i ng?

Financial r eporting

Sales reporting

Inventory reporting

T ransaction processing

485. Which of the following provides the GRE A TEST assurance that an organization allocates appropr i ate resources to respond to i n formation security events?

I n cident c l assif i cation procedures

Threat analysis and intelligence reports

An appro v ed IT sta f fing plan

Information security policies and standards.

486. An IS auditor is re v iewing the p e rforman c e o utcomes of controls in an agile devel o pment proje c t. Which of the following w o uld pro v ide the MOST relevant evidence for the auditor to consider?

Progress r eport of outstanding w ork

Product b acklog

Number of failed builds

Composition of the sc r um team

487. T o help ensure the a ccuracy and completeness of end-user computing output, it is M OST important to include st r ong:

reconciliation controls.

change mana g ement controls.

access mana g ement controls.

documentation controls.

488. The MAIN considera t ion wh e n designing an inc i dent escalation plan sho u ld be ensuri n g that: A. informati o n assets are class i fied.

B. appropria t e stakeholders are involved. C. high-imp a ct risks have been id e ntified. D. requirem e nts c o ver forensic analysis.

489. What does PKI use to provide some o f the strongest overall control ov e r data confidentialit y , reliabilit y , and integrity for Internet transactions?

A combination of public-key c r y ptography and di g ital certificat e s and two-factor authentication

A combination of public-key c r y ptography and t w o-factor aut h entication

A combination of public-key crypt o gra p hy and d igital certif i c a tes

A combination of digital certificates and two-factor authen t ication

490. E f fective transactional controls are often capable of o f fering which of t h e foll o wing benefits (Choose fou r .):

reduced administrati v e and material costs

shortened contract cycle times

enhanced procureme n t decisions

diminished legal risk

None of t h e choices.

Page 50 of 62

491. In which of the follow i ng pa y ment mode, the p a yer creates payment transfer instructi o ns, s igns it digitally and sends it to issuer?

El e ctronic Money Model

El e ctronics Checks m o del

Electronic transfer model

Electronic withdraw model

492. Which of the following is the M O ST cr i tical step in planni n g an audit? A. Implementing a prescribed a u diting framework such as COBIT

B. Identifying current controls

C. Identifying high-risk audit targets

D. T esting c o ntrols

493. Softwa r e quality assurance (QA) reviews are plann e d as part of system developme n t. At which st a ge in the development pr o cess should the first rev i e w be initiated?

At pre-imple m entation planni n g

As a part of the user require m ents definition

Immediately prior to u ser acceptance testing

During the feasibility study

494. When an employee is terminated from service, the MOST important action is to: A. hand over all of t he employee's files to another d esignated e mployee.

B. complete a backup of the employe e 's work. C. notify other employe e s of the term i nation. D. disable the employee ' s logical access.

495. When p l anning an application aud i t, i t i s MOST important to evaluate risk factors by i n terviewing: A. process owners.

B. applicati o n own e rs. C. IT management.

D. application users.

496. The F I RST step in managi n g the risk of a cyber - attack is t o: A. assess t h e vulnerability impact.

B. evaluate the likelihood of threats. C. identify critical information assets. D. estimate potential d a mage.

497. In a p u blic key infrastructure, a r egistration authority:

verifies information su p plied by the sub j ect requesting a c e rtificate.

issues the certifi c ate after the requi r ed attributes are verified a nd the keys are g e nerat e d.

digitally s i gns a mess a ge to achieve nonrepud i ation of the s igned message.

registers signed messages to prot e ct them from future rep u d i ation.

498. An IS auditor has discovered that unauthoriz e d customer managem e nt software was installed on a workstation. The auditor dete r mines the software has been up l o a ding customer data to an external p art y . Which of the following is the IS audito r ’ s BEST course of acti o n?

Review other w o rkstations to determine the extent of the in c ident.

Determine the number of custom e r records that were u ploa d ed.

Notify the incident response team.

Present t h e issue at the next audit progress meeting.

499. The s e curity l e v el of a p r ivate k e y sys t em depends on the number of: A. encryption key bits.

B. messages sent. C. ke y s.

D. channels used.

500. Which of the following testing met h od examines internal st r ucture or working of an ap p lication? A. White-box testing

B. Parallel T est

C. Regression T esting D. Pilot T e s t i ng

Page 51 of 62

501. D u ring a n audit of a data cente r , an IS audito r ’ s BEST way to gain an u n derstandi n g of physical security c on t rols is to:

review the data cente r ’ s physical secur i ty procedures.

contact the alarm ven d or and id e ntify where ala r ms are installed in the data cente r .

take a to u r of the f a ci l ity and identify phys i cal security c ontrols.

obtain the engine e ring plans for the building a nd identify points of entr y .

502. Which of the following are t he characteristics of a good p a ssword? A. It has mixed-case alp h abetic characters, nu m b e rs, and symbo ls.

B. It has mixed-case alp h abe t ic characters and numbers. C. It has m ix ed-case alphabe t ic characters and symbols.

D. It has m ix ed-case alphabetic characters, nu m bers, and binary codes. E. None of t h e choices.

503. An IS auditor is reviewing the p h ysical security measures of an organi z ation. Reg a rding t h e access ca r d system, t h e IS auditor should be MOST conce r ned that:

nonpers o nalized access cards are given to the cleaning sta f f , who use a sign-in sheet but show no proof of iden t it y .

access c a rds are not l a beled with the or g anization's name a n d address to facilitate easy return of a l ost card.

card issu a nce and righ t s administration for the cards are do n e by di f ferent dep a rtments, causing unnecessary lead time for new cards.

the com p uter system used for pr o gramming t h e cards can only be repl ac ed after three weeks in t