[Mar-2022] Verified ISACA Exam Dumps with CISA Exam Study Guide
Best Quality ISACA CISA Exam Questions TestsDumps Realistic Practice Exams [2022]
NEW QUESTION 258
Network Data Management Protocol (NDMP) technology should be used for backup if:
- A. backup consistency over several related data volumes must be ensured.
- B. a network attached storage (NAS) appliance is required.
- C. file permissions thatcan not be handled by legacy backup systems must be backed up.
- D. the use of TCP/I P must be avoided.
Answer: B
Explanation:
NDMP defines three kind of services: a data service that interfaces with the primary storage to be backed up or restored, a tape service that interfaces with the secondary storage (primarily a tape device), and a translator service performing translations including multiplexing multiple data streams into one data stream and vice versA . NDMP services interact with each other. The result of this interaction is the establishment of an NDMP control session if the session is being used to achieve control for the backup or restore operation. It would result in an NDMP data session if the session is being used to transfer actual file system or volume data (including metadata). Control sessions are always TCP/IP-based, but data streams can be TCP/ lP -or SAN-based. NDMP is more or less NAS-centric and defines a way to back up and restore data from a device, such as a NAS appliance, on which it is difficult to install a backup software agent, in the absence of NDMP, this data must be backed up as a shared drive on the LAN, which is accessed via network file protocols, such as Common Internet File System (CIFS) or Network File System (NFS), degrading backup performance. NDMP works on a block level for transferring payload data (file content)but metadata and traditional file system information needs to be handled by legacy backup systems that initiate NDMP data movement. NDMP does not know about nor takes care of consistency issues regarding related volumes (e.g., a volume to store data
NEW QUESTION 259
Which of the following provides the evidence that network filters are functioning?
D18912E1457D5D1DDCBD40AB3BF70D5D
- A. Analyzing network performance
- B. Reviewing network filtering policy
- C. Performing network port scans
- D. Reviewing network configuration rules
Answer: C
NEW QUESTION 260
Which of the following layer of an OSI model encapsulates packets into frames?
- A. Physical Layer
. - B. Transport Layer
- C. Data Link Layer
- D. Network Layer
Answer: C
Explanation:
Explanation/Reference:
The data link layer provides error-free transfer of data frames from one node to another over the physical layer, allowing layers above it to assume virtually error-free transmission over the link.
For your exam you should know below information about OSI model:
The Open Systems Interconnection model (OSI) is a conceptual model that characterizes and standardizes the internal functions of a communication system by partitioning it into abstraction layers. The model is a product of the Open Systems Interconnection project at the International Organization for Standardization (ISO), maintained by the identification ISO/IEC 7498-1.
The model groups communication functions into seven logical layers. A layer serves the layer above it and is served by the layer below it. For example, a layer that provides error-free communications across a network provides the path needed by applications above it, while it calls the next lower layer to send and receive packets that make up the contents of that path. Two instances at one layer are connected by a horizontal.
OSI Model
Image source: http://www.petri.co.il/images/osi_model.JPG
PHYSICAL LAYER
The physical layer, the lowest layer of the OSI model, is concerned with the transmission and reception of the unstructured raw bit stream over a physical medium. It describes the electrical/optical, mechanical, and functional interfaces to the physical medium, and carries the signals for all of the higher layers. It provides:
Data encoding: modifies the simple digital signal pattern (1s and 0s) used by the PC to better accommodate the characteristics of the physical medium, and to aid in bit and frame synchronization. It determines:
What signal state represents a binary 1
How the receiving station knows when a "bit-time" starts
How the receiving station delimits a frame
DATA LINK LAYER
The data link layer provides error-free transfer of data frames from one node to another over the physical layer, allowing layers above it to assume virtually error-free transmission over the link. To do this, the data link layer provides:
Link establishment and termination: establishes and terminates the logical link between two nodes.
Frame traffic control: tells the transmitting node to "back-off" when no frame buffers are available.
Frame sequencing: transmits/receives frames sequentially.
Frame acknowledgment: provides/expects frame acknowledgments. Detects and recovers from errors that occur in the physical layer by retransmitting non-acknowledged frames and handling duplicate frame receipt.
Frame delimiting: creates and recognizes frame boundaries.
Frame error checking: checks received frames for integrity.
Media access management: determines when the node "has the right" to use the physical medium.
NETWORK LAYER
The network layer controls the operation of the subnet, deciding which physical path the data should take based on network conditions, priority of service, and other factors. It provides:
Routing: routes frames among networks.
Subnet traffic control: routers (network layer intermediate systems) can instruct a sending station to
"throttle back" its frame transmission when the router's buffer fills up.
Frame fragmentation: if it determines that a downstream router's maximum transmission unit (MTU) size is less than the frame size, a router can fragment a frame for transmission and re-assembly at the destination station.
Logical-physical address mapping: translates logical addresses, or names, into physical addresses.
Subnet usage accounting: has accounting functions to keep track of frames forwarded by subnet intermediate systems, to produce billing information.
Communications Subnet
The network layer software must build headers so that the network layer software residing in the subnet intermediate systems can recognize them and use them to route data to the destination address.
This layer relieves the upper layers of the need to know anything about the data transmission and intermediate switching technologies used to connect systems. It establishes, maintains and terminates connections across the intervening communications facility (one or several intermediate systems in the communication subnet).
In the network layer and the layers below, peer protocols exist between a node and its immediate neighbor, but the neighbor may be a node through which data is routed, not the destination station. The source and destination stations may be separated by many intermediate systems.
TRANSPORT LAYER
The transport layer ensures that messages are delivered error-free, in sequence, and with no losses or duplications. It relieves the higher layer protocols from any concern with the transfer of data between them and their peers.
The size and complexity of a transport protocol depends on the type of service it can get from the network layer. For a reliable network layer with virtual circuit capability, a minimal transport layer is required. If the network layer is unreliable and/or only supports datagram's, the transport protocol should include extensive error detection and recovery.
The transport layer provides:
Message segmentation: accepts a message from the (session) layer above it, splits the message into smaller units (if not already small enough), and passes the smaller units down to the network layer. The transport layer at the destination station reassembles the message.
Message acknowledgment: provides reliable end-to-end message delivery with acknowledgments.
Message traffic control: tells the transmitting station to "back-off" when no message buffers are available.
Session multiplexing: multiplexes several message streams, or sessions onto one logical link and keeps track of which messages belong to which sessions (see session layer).
Typically, the transport layer can accept relatively large messages, but there are strict message size limits imposed by the network (or lower) layer. Consequently, the transport layer must break up the messages into smaller units, or frames, pretending a header to each frame.
The transport layer header information must then include control information, such as message start and message end flags, to enable the transport layer on the other end to recognize message boundaries. In addition, if the lower layers do not maintain sequence, the transport header must contain sequence information to enable the transport layer on the receiving end to get the pieces back together in the right order before handing the received message up to the layer above.
End-to-end layers
Unlike the lower "subnet" layers whose protocol is between immediately adjacent nodes, the transport layer and the layers above are true "source to destination" or end-to-end layers, and are not concerned with the details of the underlying communications facility. Transport layer software (and software above it) on the source station carries on a conversation with similar software on the destination station by using message headers and control messages.
SESSION LAYER
The session layer allows session establishment between processes running on different stations. It provides:
Session establishment, maintenance and termination: allows two application processes on different machines to establish, use and terminate a connection, called a session.
Session support: performs the functions that allow these processes to communicate over the network, performing security, name recognition, logging, and so on.
PRESENTATION LAYER
The presentation layer formats the data to be presented to the application layer. It can be viewed as the translator for the network. This layer may translate data from a format used by the application layer into a common format at the sending station, then translate the common format to a format known to the application layer at the receiving station.
The presentation layer provides:
Character code translation: for example, ASCII to EBCDIC.
Data conversion: bit order, CR-CR/LF, integer-floating point, and so on.
Data compression: reduces the number of bits that need to be transmitted on the network.
Data encryption: encrypt data for security purposes. For example, password encryption.
APPLICATION LAYER
The application layer serves as the window for users and application processes to access network services. This layer contains a variety of commonly needed functions:
Resource sharing and device redirection
Remote file access
Remote printer access
Inter-process communication
Network management
Directory services
Electronic messaging (such as mail)
Network virtual terminals
The following were incorrect answers:
Transport layer - The transport layer ensures that messages are delivered error-free, in sequence, and with no losses or duplications. It relieves the higher layer protocols from any concern with the transfer of data between them and their peers.
Network layer - The network layer controls the operation of the subnet, deciding which physical path the data should take based on network conditions, priority of service, and other factors.
Physical Layer - The physical layer, the lowest layer of the OSI model, is concerned with the transmission and reception of the unstructured raw bit stream over a physical medium. It describes the electrical/optical, mechanical, and functional interfaces to the physical medium, and carries the signals for all of the higher layers.
The following reference(s) were/was used to create this question:
CISA review manual 2014 Page number 260
NEW QUESTION 261
The BEST filter rule for protecting a network from being used as an amplifier in a denial of service (DoS)
attack is to deny all:
- A. outgoing traffic with IP source addresses externa! to the network.
- B. incoming traffic with discernible spoofed IP source addresses.
- C. incoming traffic to critical hosts.
- D. incoming traffic with IP options set.
Answer: A
Explanation:
Section: Protection of Information Assets
Explanation:
Outgoing traffic with an IP source address different than the IP range in the network is invalid, in most of
the cases, it signals a DoS attack originated by an internal user or by a previously compromised internal
machine; in both cases, applying this filter will stop the attack.
NEW QUESTION 262
An IS auditor reviewing the use of encryption finds that the symmetric key is sent by an email message between the parties. Which of the following audit responses is correct in this situation?
- A. An audit finding is recorded as the key should be distributed in a secure manner.
- B. An audit finding is recorded, as the key should be asymmetric and therefore changed.
- C. No audit finding is recorded, as it is normal to distribute a key of this nature in this manner.
- D. No audit finding is recorded, as the key can only be used once.
Answer: A
Explanation:
Section: The process of Auditing Information System
NEW QUESTION 263
Which of the following would be the GREATEST concern to an IS auditor reviewing an IT outsourcing arrangement?
- A. Several IT personnel perform the same functions as the vendor.
- B. Development of KPIs that will be used was assigned to the vendor.
- C. The contract does not include a renewal option.
- D. Some penalties were waived during contract negotiations.
Answer: B
NEW QUESTION 264
Which of the following is the MAIN purpose of an information security management system?
- A. To reduce the frequency and impact of information security incidents
- B. To enhance the impact of reports used to monitor information security incidents
- C. To keep information security policies and procedures up-to-date
- D. To identify and eliminate the root causes of information security incidents
Answer: A
NEW QUESTION 265
.Which of the following is an effective method for controlling downloading of files via FTP? Choose the BEST answer.
- A. A circuit-level gateway
- B. An application-layer gateway, or proxy firewall
- C. An application-layer gateway, or proxy firewall, but notstateful inspection firewalls
- D. A first-generation packet-filtering firewall
Answer: B
Explanation:
Application-layer gateways, or proxy firewalls, are an effective method for controlling downloading of files via FTP. Because FTP is an OSI application-layer protocol, the most effective firewall needs to be capable of inspecting through the application layer.
NEW QUESTION 266
Which of the following is MOST important to review when evaluating the performance of a critical web application?
- A. Business-defined application response times
- B. Feedback from customer satisfaction surveys
- C. Roles and responsibilities for reporting
- D. Strategy for application performance monitoring in the cloud
Answer: B
NEW QUESTION 267
Which of the following is protocol data unit (PDU) of data at LAN or WAN interface layer in TCP/IP model?
- A. Data
- B. Frame and bits
- C. Packet
- D. Segment
Answer: B
Explanation:
Explanation/Reference:
For your exam you should know below information about TCP/IP model:
Network Models
Layer 4. Application Layer
Application layer is the top most layer of four layer TCP/IP model. Application layer is present on the top of the Transport layer. Application layer defines TCP/IP application protocols and how host programs interface with Transport layer services to use the network.
Application layer includes all the higher-level protocols like DNS (Domain Naming System), HTTP (Hypertext Transfer Protocol), Telnet, SSH, FTP (File Transfer Protocol), TFTP (Trivial File Transfer Protocol), SNMP (Simple Network Management Protocol), SMTP (Simple Mail Transfer Protocol) , DHCP (Dynamic Host Configuration Protocol), X Windows, RDP (Remote Desktop Protocol) etc.
Layer 3. Transport Layer
Transport Layer is the third layer of the four layer TCP/IP model. The position of the Transport layer is between Application layer and Internet layer. The purpose of Transport layer is to permit devices on the source and destination hosts to carry on a conversation. Transport layer defines the level of service and status of the connection used when transporting data.
The main protocols included at Transport layer are TCP (Transmission Control Protocol) and UDP (User Datagram Protocol).
Layer 2. Internet Layer
Internet Layer is the second layer of the four layer TCP/IP model. The position of Internet layer is between Network Access Layer and Transport layer. Internet layer pack data into data packets known as IP datagram's, which contain source and destination address (logical address or IP address) information that is used to forward the datagram's between hosts and across networks. The Internet layer is also responsible for routing of IP datagram's.
Packet switching network depends upon a connectionless internetwork layer. This layer is known as Internet layer. Its job is to allow hosts to insert packets into any network and have them to deliver independently to the destination. At the destination side data packets may appear in a different order than they were sent. It is the job of the higher layers to rearrange them in order to deliver them to proper network applications operating at the Application layer.
The main protocols included at Internet layer are IP (Internet Protocol), ICMP (Internet Control Message Protocol), ARP (Address Resolution Protocol), RARP (Reverse Address Resolution Protocol) and IGMP (Internet Group Management Protocol).
Layer 1. Network Access Layer
Network Access Layer is the first layer of the four layer TCP/IP model. Network Access Layer defines details of how data is physically sent through the network, including how bits are electrically or optically signaled by hardware devices that interface directly with a network medium, such as coaxial cable, optical fiber, or twisted pair copper wire.
The protocols included in Network Access Layer are Ethernet, Token Ring, FDDI, X.25, Frame Relay etc.
The most popular LAN architecture among those listed above is Ethernet. Ethernet uses an Access Method called CSMA/CD (Carrier Sense Multiple Access/Collision Detection) to access the media, when Ethernet operates in a shared media. An Access Method determines how a host will place data on the medium.
IN CSMA/CD Access Method, every host has equal access to the medium and can place data on the wire when the wire is free from network traffic. When a host wants to place data on the wire, it will check the wire to find whether another host is already using the medium. If there is traffic already in the medium, the host will wait and if there is no traffic, it will place the data in the medium. But, if two systems place data on the medium at the same instance, they will collide with each other, destroying the data. If the data is destroyed during transmission, the data will need to be retransmitted. After collision, each host will wait for a small interval of time and again the data will be retransmitted.
Protocol Data Unit (PDU) :
Protocol Data Unit - PDU
The following answers are incorrect:
Data - Application layer data PDU
Segment - Transport layer data PDU
Packet - Network interface layer data PDU
The following reference(s) were/was used to create this question:
CISA review manual 2014 page number 272
NEW QUESTION 268
When performing an IS strategy audit, an IS auditor should review both short-term (one-year) and long- term (three-to five-year) IS strategies, interview appropriate corporate management personnel, and ensure that the external environment has been considered. The auditor should especially focus on procedures in an audit of IS strategy. True or false?
- A. False
- B. True
Answer: A
Explanation:
Explanation/Reference:
When performing an IS strategy audit, an IS auditor should review both short-term (one-year) and long- term (three-to five-year) IS strategies, interview appropriate corporate management personnel, and ensure that the external environment has been considered.
NEW QUESTION 269
When segregation of duties concerns exists between IT support staff and end users, what would be suitable compensating control?
- A. Restricting physical access to computing equipment
- B. Reviewing transaction and application logs
- C. Locking user sessions after a specified period of inactivity
- D. Performing background checks prior to hiring IT staff
Answer: B
Explanation:
Section: Protection of Information Assets
Explanation:
Only reviewing transaction and application logs directly addresses the threat posed by poor segregation of duties. The review is a means of detecting inappropriate behavior and also discourages abuse, because people who may otherwise be tempted to exploit the situation are aware of the likelihood of being caught.
Inadequate segregation of duties is more likely to be exploited via logical access to data and computing resources rather than physical access. Choice C is a useful control to ensure IT staff are trustworthy and competent but does not directly address the lack of an optimal segregation of duties. Choice D acts to prevent unauthorized users from gaining system access, but the issue of a lack of segregation of duties is more the misuse (deliberately or inadvertently} of access privileges that have officially been granted.
NEW QUESTION 270
The use of object-oriented design and development techniques would MOST likely:
- A. speed up the system development life cycle.
- B. improve system performance.
- C. facilitate the ability to reuse modules.
- D. enhance control effectiveness.
Answer: C
Explanation:
Section: Protection of Information Assets
Explanation:
One of the major benefits of object-oriented design and development is the ability to reuse modules. The other options do not normally benefit from the object-oriented technique.
NEW QUESTION 271
Data flow diagrams are used by IS auditors to:
- A. portray step-by-step details of data generation.
- B. highlight high-level data definitions.
- C. order data hierarchically.
- D. graphically summarize data paths and storage.
Answer: D
Explanation:
Explanation/Reference:
Explanation:
Data flow diagrams are used as aids to graph or chart data flow and storage. They trace the data from its origination to destination, highlighting the paths and storage of datA. They do not order data in any hierarchy. The flow of the data will not necessarily match any hierarchy or data generation order.
NEW QUESTION 272
Which of the following BEST facilitates the management of assets dunng the implementation of an information system?
- A. Quality management controls
- B. Decision support system
- C. Asset procurement system
- D. Configuration management database (CMDB)
Answer: D
NEW QUESTION 273
What is an effective countermeasure for the vulnerability of data entry operators potentially leaving their computers without logging off?
- A. Screensaver passwords
- B. Close supervision
- C. Administrator alerts
- D. Employee security awareness training
Answer: A
Explanation:
Section: Protection of Information Assets
Explanation:
Screensaver passwords are an effective control to implement as a countermeasure for the vulnerability of data entry operators potentially leaving their computers without logging off.
NEW QUESTION 274
The GREATEST advantage of using web services for the exchange of information between two systems is:
- A. improved performance.
- B. secure communications.
- C. enhanced documentation.
- D. efficient interfacing.
Answer: D
Explanation:
Web services facilitate the exchange of information between two systems, regardless of the operating system or programming language used. Communication is not necessarily securer or faster, and there is no documentation benefit in using web services.
NEW QUESTION 275
To confirm integrity for a hashed message, the receiver should use
- A. a different hashing algorithm from the sender s to create a numerical representation of the file
- B. a different hashing algorithm from me sender s to create a binary image of the file
- C. the same hashing algorithm as the tender s to create a numerical representation of the file.
- D. the same hashing algorithm as the sender's to create a binary image of the file.
Answer: D
NEW QUESTION 276
Active radio frequency ID (RFID) tags are subject to which of the following exposures?
- A. Phishing
- B. Malicious code
- C. Eavesdropping
- D. Session hijacking
Answer: C
Explanation:
Explanation/Reference:
Explanation:
Like wireless devices, active RFID tags are subject to eavesdropping. They are by nature not subject to session hijacking, malicious code or phishing.
NEW QUESTION 277
What is the first step in a business process re-engineering project?
- A. Defining the scope of areas to be reviewed
- B. Forming a BPR steering committee
- C. Identifying current business processes
- D. Reviewing the organizational strategic plan
Answer: A
Explanation:
Explanation/Reference:
Defining the scope of areas to be reviewed is the first step in a business process re-engineering project.
NEW QUESTION 278
Which of the following is an oft-cited cause of vulnerability of networks?
- A. single line of defense
- B. software diversification
- C. None of the choices.
- D. multiple DMZ
- E. software monoculture
Answer: E
Explanation:
An oft-cited cause of vulnerability of networks is homogeneity or software monoculture. In particular, Microsoft Windows has such a large share of the market that concentrating on it will enable a cracker to subvert a large number of systems. Introducing inhomogeneity purely for the sake of robustness would however bring high costs in terms of training and maintenance.
NEW QUESTION 279
Which of the following is a distinctive feature of the Secure Electronic Transactions (SET) protocol when used for electronic credit card payments?
- A. The payment process is simplified, as the buyer is not required to enter a credit card number and an expiration date.
- B. The buyer is liable for any transaction involving his/her personal SET certificates.
- C. All personal SET certificates are stored securely in the buyer's computer.
- D. The buyer is assured that neither the merchant nor any other party can misuse their credit card data.
Answer: B
Explanation:
Explanation/Reference:
Explanation:
The usual agreement between the credit card issuer and the cardholder stipulates that the cardholder assumes responsibility for any use of their personal SET certificates for e- commerce transactions.
Depending upon the agreement between the merchant and the buyer's credit card issuer, the merchant will have access to the credit card number and expiration date. Secure data storage in the buyer's computer (local computer security) is not part of the SET standard.
Although the buyer is not required to enter their credit card data, they will have to handle the wallet software.
NEW QUESTION 280
......
Authentic Best resources for CISA: https://www.testsdumps.com/CISA_real-exam-dumps.html
CISA Test Engine Practice Exam: https://drive.google.com/open?id=1EBnekLCVyS_6nrwJIxAPa3ocd0yUj3Gb
