[2024年06月25日] 最新CISA試験問題集には高得点で一発合格
無料提供中CISAブレーン問題集とCISAリアル試験問題
ISACAのCISA認定は、情報システム監査の分野で最も高く評価され、尊敬されている資格の一つです。この認定は、監査、制御、情報システムのセキュリティの分野での知識と専門知識を示したいと考えている専門家を対象としています。CISA認定は、グローバルに認知され、雇用主から高く評価されるため、個人にとって素晴らしいキャリア投資となります。
CISA認定試験は、情報セキュリティ分野で最も厳しい認定の1つと考えられており、合格率は約50％です。この試験は、情報システムの監査、制御、セキュリティに関する候補者の知識と、この知識を実世界のシナリオに適用する能力をテストするように設計されています。この試験は、4時間以内に完了する必要がある150問の多肢選択問題で構成されています。この試験は、情報セキュリティの分野でガイダンス、認定、トレーニングを提供するグローバルに認知された組織であるISACAによって管理されています。
質問 # 147
Which of the following is a feature of Wi-Fi Protected Access (WPA) in wireless networks?
- A. Session keys are dynamic
- B. Source addresses are not encrypted or authenticated
- C. Private symmetric keys are used
- D. Keys are static and shared
正解：A
解説：
Explanation/Reference:
Explanation:
WPA uses dynamic session keys, achieving stronger encryption than wireless encryption privacy (WEP), which operates with static keys (same key is used for everyone in the wireless network). All other choices are weaknesses of WEP.
質問 # 148
When implementing a software product (middleware) to pass data between local area network (LAN) servers and the mainframe, the MOST critical control consideration is:
- A. time-stamping of transactions to facilitate recovery.
- B. network traffic levels between platforms.
- C. cross-platform authentication.
- D. time synchronization of databases.
正解：C
質問 # 149
What is the first step in a business process re-engineering project?
- A. Defining the scope of areas to be reviewed
- B. Identifying current business processes
- C. Forming a BPR steering committee
- D. Reviewing the organizational strategic plan
正解：A
解説：
Section: Protection of Information Assets
Explanation: Defining the scope of areas to be reviewed is the first step in a business process re-
engineering project.
質問 # 150
Which of the following functionality is NOT performed by the application layer of a TCP/IP model?
- A. Data encryption and compression
- B. End-to-end connection
- C. Dialog management
- D. Print service, application services
正解：B
解説：
Explanation/Reference:
The word NOT is the keyword used in the question, You need to find out a functionality which is not performed by application layer of a TCP/IP model.
End-to-end connection is the Transport layer functionality in TCP/IP model.
For your exam you should know below information about TCP/IP model:
Network Models
Layer 4. Application Layer
Application layer is the top most layer of four layer TCP/IP model. Application layer is present on the top of the Transport layer. Application layer defines TCP/IP application protocols and how host programs interface with Transport layer services to use the network.
Application layer includes all the higher-level protocols like DNS (Domain Naming System), HTTP (Hypertext Transfer Protocol), Telnet, SSH, FTP (File Transfer Protocol), TFTP (Trivial File Transfer Protocol), SNMP (Simple Network Management Protocol), SMTP (Simple Mail Transfer Protocol) , DHCP (Dynamic Host Configuration Protocol), X Windows, RDP (Remote Desktop Protocol) etc.
Layer 3. Transport Layer
Transport Layer is the third layer of the four layer TCP/IP model. The position of the Transport layer is between Application layer and Internet layer. The purpose of Transport layer is to permit devices on the source and destination hosts to carry on a conversation. Transport layer defines the level of service and status of the connection used when transporting data.
The main protocols included at Transport layer are TCP (Transmission Control Protocol) and UDP (User Datagram Protocol).
Layer 2. Internet Layer
Internet Layer is the second layer of the four layer TCP/IP model. The position of Internet layer is between Network Access Layer and Transport layer. Internet layer pack data into data packets known as IP datagram's, which contain source and destination address (logical address or IP address) information that is used to forward the datagram's between hosts and across networks. The Internet layer is also responsible for routing of IP datagram's.
Packet switching network depends upon a connectionless internetwork layer. This layer is known as Internet layer. Its job is to allow hosts to insert packets into any network and have them to deliver independently to the destination. At the destination side data packets may appear in a different order than they were sent. It is the job of the higher layers to rearrange them in order to deliver them to proper network applications operating at the Application layer.
The main protocols included at Internet layer are IP (Internet Protocol), ICMP (Internet Control Message Protocol), ARP (Address Resolution Protocol), RARP (Reverse Address Resolution Protocol) and IGMP (Internet Group Management Protocol).
Layer 1. Network Access Layer
Network Access Layer is the first layer of the four layer TCP/IP model. Network Access Layer defines details of how data is physically sent through the network, including how bits are electrically or optically signaled by hardware devices that interface directly with a network medium, such as coaxial cable, optical fiber, or twisted pair copper wire.
The protocols included in Network Access Layer are Ethernet, Token Ring, FDDI, X.25, Frame Relay etc.
The most popular LAN architecture among those listed above is Ethernet. Ethernet uses an Access Method called CSMA/CD (Carrier Sense Multiple Access/Collision Detection) to access the media, when Ethernet operates in a shared media. An Access Method determines how a host will place data on the medium.
IN CSMA/CD Access Method, every host has equal access to the medium and can place data on the wire when the wire is free from network traffic. When a host wants to place data on the wire, it will check the wire to find whether another host is already using the medium. If there is traffic already in the medium, the host will wait and if there is no traffic, it will place the data in the medium. But, if two systems place data on the medium at the same instance, they will collide with each other, destroying the data. If the data is destroyed during transmission, the data will need to be retransmitted. After collision, each host will wait for a small interval of time and again the data will be retransmitted.
Protocol Data Unit (PDU) :
Protocol Data Unit - PDU
The following answers are incorrect:
The other functionalities described in the options are performed by application layer in TCP/IP model.
The following reference(s) were/was used to create this question:
CISA review manual 2014 page number 272
質問 # 151
Which of the following is the FIRST step when conducting a business impact analysis?
- A. Identifying events impacting continuity of operations
- B. Analyzing past transaction volumes
- C. identifying critical information resources
- D. Creating a data classification scheme
正解：A
質問 # 152
Due to a recent business divestiture, an organization has limited IT resources to deliver critical projects. Reviewing the IT staffing plan against which of the following would BEST guide IT management when estimating resource requirements for future projects?
- A. Peer organization staffing benchmarks
- B. Human resources (HR) sourcing strategy
- C. budgeted forecast for the next financial year
- D. Records of actual time spent on projects
正解：C
質問 # 153
The performance, risks, and capabilities of an IT infrastructure are BEST measured using a:
- A. balanced Scorecard.
- B. service level agreement (SLA).
- C. control self-assessment (CSA).
- D. risk management review.
正解：A
質問 # 154
Which of the following is the MOST effective control to restrict the use of instant messaging (IM) within an organization?
- A. Intrusion detection system (IDS)
- B. Antivirus software
- C. Packet filtering firewall
- D. Application-based firewall
正解：D
解説：
Section: Protection of Information Assets
質問 # 155
Which of the following is the PRIMARY purpose of data classification?
- A. To determine access rights to data
- B. To provide a basis for protecting data
- C. To select encryption technologies
- D. To ensure integrity of data
正解：B
解説：
Section: Protection of Information Assets
質問 # 156
Which of the following insurance types provide for a loss arising from fraudulent acts by employees?
- A. Errors and omissions
- B. Fidelity coverage
- C. Business interruption
- D. Extra expense
正解：B
解説：
Section: Protection of Information Assets
Explanation:
Fidelity insurance covers the loss arising from dishonest or fraudulent acts by employees. Business
interruption insurance covers the loss of profit due to the disruption in the operations of an organization.
Errors and omissions insurance provides legal liability protection in the event that the professional
practitioner commits an act that results in financial loss to a client. Extra expense insurance is designed to
cover the extra costs of continuing operations following a disaster/disruption within an organization.
質問 # 157
Which of the following should be the MOST important consideration when deciding areas of priority for IT governance implementation?
- A. Process maturity
- B. Business risk
- C. Performance indicators
- D. Assurance reports
正解：B
解説：
Priority should be given to those areas which represent a known risk to the enterprise's operations. The level of process maturity, process performance and audit reports will feed into the decision making process. Those areas that represent real risk to the business should be given priority.
質問 # 158
Sophisticated database systems provide many layers and types of security, including (choose all that apply):
- A. Auditing
- B. Compression controls
- C. Integrity controls
- D. Access control
- E. Encryption
正解：A、C、D、E
解説：
Explanation/Reference:
Explanation:
Sophisticated database systems provide many layers and types of security, including Access control, Auditing, Authentication, Encryption and Integrity controls. An important procedure when evaluating database security is performing vulnerability assessments against the database. Database administrators or Information security administrators run vulnerability scans on databases to discover misconfiguration of controls within the layers mentioned above along with known vulnerabilities within the database software.
質問 # 159
Which of the following observations should be of GREATEST concern to an IS auditor reviewing a large organization's virtualization environment?
- A. Host inspection capabilities have been disabled
- B. An unused printer has been left connected to the host system.
- C. Guest tools have been installed without sufficient access control,
- D. A rootkit was found on the host operating system
正解：D
質問 # 160
Which of the following is the BEST justification for deferring remediation testing until the next audit?
- A. The audit environment has changed significantly.
- B. Auditee management has accepted all observations reported by the auditor.
- C. Management's planned actions are sufficient given the relative importance of the observations.
- D. The auditor who conducted the audit and agreed with the timeline has left the organization.
正解：A
解説：
Explanation
Deferring remediation testing until the next audit is justified only when there are significant changes in the audit environment that affect the relevance or validity of the audit observations and recommendations. For example, if there are changes in the business processes, systems, regulations, or risks that require a new audit scope or approach. The other options are not valid justifications for deferring remediation testing, as they do not address the timeliness or quality of the audit follow-up process. The auditor who conducted the audit and agreed with the timeline has left the organization does not affect the responsibility of the audit function to ensure that remediation testing is performed as planned. Management's planned actions are sufficient given the relative importance of the observations does not guarantee that management will actually implement those actions or that they will be effective in addressing the audit issues. Auditee management has accepted all observations reported by the auditor does not eliminate the need for verification of remediation actions by an independent party. References: CISA Review Manual (Digital Version), Chapter 2, Section 2.4
質問 # 161
Which of the following components of a risk assessment is MOST helpful to management in determining the level of risk mitigation to apply?
- A. Impact assessment
- B. Risk classification
- C. Control self-assessment (CSA)
- D. Risk identification
正解：B
質問 # 162
When reviewing an organization's data protection practices, an IS auditor should be MOST concerned with a lack of:
- A. data classification.
- B. training manuals.
- C. data encryption.
- D. a security team.
正解：A
解説：
Section: Protection of Information Assets
質問 # 163
An organization wants to classify database tables according to its data classification scheme.
From an IS auditor's perspective, the tables should be classified based on the:
- A. number of end users with access to the table.
- B. frequency of updates to the table.
- C. descriptions of column names in the table.
- D. specific functional contents of each single table.
正解：D
質問 # 164
While reviewing sensitive electronic work papers, the IS auditor noticed that they were not encrypted. This could compromise the:
- A. confidentiality of the work papers.
- B. audit trail of the versioning of the work papers.
- C. approval of the audit phases.
- D. access rights to the work papers.
正解：A
解説：
Encryption provides confidentiality for the electronic work papers. Audit trails, audit phase approvals and access to the work papers do not, of themselves, affect the confidentiality but are part of the reason for requiring encryption.
質問 # 165
Which of the following would be the MOST effective audit technique for identifying segregation of duties violations in a new enterprise resource planning (ERP) implementation?
- A. Examining recent access rights violation cases
- B. Reviewing a report of security rights in the system
- C. Reviewing the complexities of authorization objects
- D. Building a program to identify conflicts in authorization
正解：D
解説：
Since the objective is to identify violations in segregation of duties, it is necessary to define the logic that will identify conflicts in authorization. A program could be developed to identify these conflicts. A report of security rights in the enterprise resource planning (ERP) system would be voluminous and time consuming to review; therefore, this technique is not as effective as building a program. As complexities increase, it becomes more difficult to verify the effectiveness of the systems and complexity is not, in itself, a link to segregation of duties. It is good practice to review recent access rights violation cases; however, it may require a significant amount of time to truly identify which violations actually resulted froman inappropriate segregation of duties.
質問 # 166
Which of the following is MOST important for an IS auditor to examine when reviewing an organization's privacy policy?
- A. The organization's legitimate purpose for collecting personal data
- B. Whether there is explicit permission from regulators to collect personal data
- C. Whether sharing of personal information with third-party service providers is prohibited
- D. The encryption mechanism selected by the organization for protecting personal data
正解：A
質問 # 167
Which of the following would provide the highest degree of server access control?
- A. Network-based intrusion detection
- B. A mantrap-monitored entryway to the server room
- C. Host-based intrusion detection combined with CCTV
- D. A fingerprint scanner facilitating biometric access control
正解：D
解説：
Explanation/Reference:
Explanation:
A fingerprint scanner facilitating biometric access control can provide a very high degree of server access control.
質問 # 168
The reliability of an application system's audit trail may be questionable if:
- A. the security administrator has read-only rights to the audit file.
- B. date and time stamps are recorded when an action occurs.
- C. users can amend audit trail records when correcting system errors.
- D. user IDs are recorded in the audit trail.
正解：C
解説：
Explanation/Reference:
Explanation:
An audit trail is not effective if the details in it can be amended.
質問 # 169
......
CISA試験を受験するためには、候補者は情報システム監査、コントロール、もしくはセキュリティのプロフェッショナルとして5年以上の実務経験が必要です。または、同等の教育と経験の組み合わせを持つこともできます。これは厳しい認定試験であり、プロフェッショナルな開発や継続的な学習に強いコミットメントが必要です。
CISA合格させる問題集でISACA24時間で試験合格できます：https://jp.fast2test.com/CISA-premium-file.html
ISACA CISA実際の問題とブレーン問題集：https://drive.google.com/open?id=1GTj11b6fQbHmXCqXJXFe7pI54cV7ERIi