ISACA. CISA Practice Questions 2009 All
Подождите немного. Документ загружается.
C
、
Web cache server
D
、
Proxy server
ANSWER:B
NOTE:A web content filter accepts or denies web communications according
to the configured rules. To help the administrator properly configure the
tool, organizations and vendors have made available URL blacklists and
classifications for millions of web sites. A stateful inspection firewall
is of little help in filtering web traffic since it does not review the
content of the web site nor does it take into consideration the sites
classification. A web cache server is designed to improve the speed of
retrieving the most common or recently visited web pages. A proxy server
is incorrect because a proxy server is a server which services the request
of its clients by forwarding requests to other servers. Many people
incorrectly use proxy server as a synonym of web proxy server even though
not all web proxy servers have content filtering capabilities.
788
、
An IS auditor reviewing the implementation of an intrusion detection
system (IDS) should be MOST concerned if:
A
、
IDS sensors are placed outside of the firewall.
B
、
a behavior-based IDS is causing many false alarms.
C
、
a signature-based IDS is weak against new types of attacks.
D
、
the IDS is used to detect encrypted traffic.
ANSWER:D
NOTE:An intrusion detection system (IDS) cannot detect attacks within
encrypted traffic, and it would be a concern if someone was misinformed
and thought that the IDS could detect attacks in encrypted traffic. An
organization can place sensors outside of the firewall to detect attacks.
These sensors are placed in highly sensitive areas and on extranets.
Causing many false alarms is normal for a behavior-based IDS, and should
not be a matter of concern. Being weak against new types of attacks is
also expected from a signature-based IDS, because it can only recognize
attacks that have been previously identified.
789
、
What is the BEST approach to mitigate the risk of a phishing attack?
A
、
Implement an intrusion detection system (IDS)
B
、
Assess web site security
C
、
Strong authentication
D
、
User education
ANSWER:D
NOTE:Phishing attacks can be mounted in various ways; intrusion detection
systems (IDSs) and strong authentication cannot mitigate most types of
phishing attacks. Assessing web site security does not mitigate the risk.
Phishing uses a server masquerading as a legitimate server. The best way
to mitigate the risk of phishing is to educate users to take caution with
suspicious Internet communications and not to trust them until verified.
Users require adequate training to recognize suspicious web pages and
e-mail.
790
、
When reviewing an organization's logical access security, which of
the following should be of MOST concern to an IS auditor?
A
、
Passwords are not shared.
B
、
Password files are not encrypted.
C
、
Redundant logon IDs are deleted.
D
、
The allocation of logon IDs is controlled.
ANSWER:B
NOTE:When evaluating the technical aspects of logical security,
unencrypted files represent the greatest risk. The sharing of passwords,
checking for the redundancy of logon IDs and proper logon ID procedures
are essential, but they are less important than ensuring that the password
files are encrypted.
791
、
The PRIMARY advantage of a continuous audit approach is that it:
A
、
does not require an IS auditor to collect evidence on system
reliability while processing is taking place.
B
、
requires the IS auditor to review and follow up immediately on all
information collected.
C
、
can improve system security when used in time-sharing environments
that process a large number of transactions.
D
、
does not depend on the complexity of an organization's computer
systems.
ANSWER:C
NOTE:The use of continuous auditing techniques can improve system security
when used in time-sharing environments that process a large number of
transactions, but leave a scarce paper trail. Choice A is incorrect since
the continuous audit approach often does require an IS auditor to collect
evidence on system reliability while processing is taking place. Choice B
is incorrect since an IS auditor normally would review and follow up only
on material deficiencies or errors detected. Choice D is incorrect since
the use of continuous audit techniques depends on the complexity of an
organization's computer systems.
792
、
During the collection of forensic evidence, which of the following
actions would MOST likely result in the destruction or corruption of
evidence on a compromised system?
A
、
Dumping the memory content to a file
B
、
Generating disk images of the compromised system
C
、
Rebooting the system
D
、
Removing the system from the network
ANSWER:C
NOTE:Rebooting the system may result in a change in the system state and
the loss of files and important evidence stored in memory. The other
choices are appropriate actions for preserving evidence.
793
、
With the help of a security officer, granting access to data is the
responsibility of:
A
、
data owners.
B
、
programmers.
C
、
system analysts.
D
、
librarians.
ANSWER:A
NOTE:Data owners are responsible for the use of data. Written
authorization for users to gain access to computerized information should
be provided by the data owners. Security administration with the owners'
approval sets up access rules stipulating which users or group of users
are authorized to access data or files and the level of authorized access
(e.g., read or update).
794
、
An IS auditor is reviewing a software-based firewall configuration.
Which of the following represents the GREATEST vulnerability? The firewall
software:
A
、
is configured with an implicit deny rule as the last rule in the
rule base.
B
、
is installed on an operating system with default settings.
C
、
has been configured with rules permitting or denying access to
systems or networks.
D
、
is configured as a virtual private network (VPN) endpoint.
ANSWER:B
NOTE:Default settings are often published and provide an intruder with
predictable configuration information, which allows easier system
compromise. To mitigate this risk, firewall software should be installed
on a system using a hardened operating system that has limited
functionality, providing only the services necessary to support the
firewall software. Choices A, C and D are normal or best practices for
firewall configurations.
795
、
In planning an audit, the MOST critical step is the identification
of the:
A
、
areas of high risk.
B
、
skill sets of the audit staff.
C
、
test steps in the audit.
D
、
time allotted for the audit.
ANSWER:A
NOTE:When designing an audit plan, it is important to identify the areas
of highest risk to determine the areas to be audited. The skill sets of
the audit staff should have been considered before deciding and selecting
the audit. Test steps for the audit are not as critical as identifying the
areas of risk, and the time allotted for an audit is determined by the
areas to be audited, which are primarily selected based on the
identification of risks.
796
、
The objective of concurrency control in a database system is to:
A
、
restrict updating of the database to authorized users.
B
、
prevent integrity problems when two processes attempt to update the
same data at the same time.
C
、
prevent inadvertent or unauthorized disclosure of data in the
database.
D
、
ensure the accuracy, completeness and consistency of data.
ANSWER:B
NOTE:Concurrency controls prevent data integrity problems, which can arise
when two update processes access the same data item at the same time.
Access controls restrict updating of the database to authorized users, and
controls such as passwords prevent the inadvertent or unauthorized
disclosure of data from the database. Quality controls, such as edits,
ensure the accuracy, completeness and consistency of data maintained in
the database.
797
、
Which of the following would BEST ensure continuity of a wide area
network (WAN) across the organization?
A
、
Built-in alternative routing
B
、
Completing full system backup daily
C
、
A repair contract with a service provider
D
、
A duplicate machine alongside each server
ANSWER:A
NOTE:Alternative routing would ensure the network would continue if a
server is lost or if a link is severed as message rerouting could be
automatic. System backup will not afford immediate protection. The repair
contract is not as effective as permanent alternative routing. Standby
servers will not provide continuity if a link is severed.
798
、
When selecting audit procedures, an IS auditor should use
professional judgment to ensure that:
A
、
sufficient evidence will be collected.
B
、
all significant deficiencies identified will be corrected within a
reasonable period.
C
、
all material weaknesses will be identified.
D
、
audit costs will be kept at a minimum level.
ANSWER:A
NOTE:Procedures are processes an IS auditor may follow in an audit
engagement. In determining the appropriateness of any specific procedure,
an IS auditor should use professional judgment appropriate to the specific
circumstances. Professional judgment involves a subjective and often
qualitative evaluation of conditions arising in the course of an audit.
Judgment addresses a grey area where binary (yes/no) decisions are not
appropriate and the auditor's past experience plays a key role in making a
judgment. ISACA's guidelines provide information on how to meet the
standards when performing IS audit work. Identifying material weaknesses
is the result of appropriate competence, experience and thoroughness in
planning and executing the audit and not of professional judgment.
Professional judgment is not a primary input to the financial aspects of
the audit.
799
、
Management considered two projections for its business continuity
plan; plan A with two months to recover and plan B with eight months to
recover. The recovery objectives are the same in both plans. It is
reasonable to expect that plan B projected higher:
A
、
downtime costs.
B
、
resumption costs.
C
、
recovery costs.
D
、
walkthrough costs.
ANSWER:A
NOTE:Since the recovery time is longer in plan B, resumption and recovery
costs can be expected to be lower. Walkthrough costs are not a part of
disaster recovery. Since the management considered a higher window for
recovery in plan B, downtime costs included in the plan are likely to be
higher.
800
、
Which of the following would be the BEST population to take a sample
from when testing program changes?
A
、
Test library listings
B
、
Source program listings
C
、
Program change requests
D
、
Production library listings
ANSWER:D
NOTE:The best source from which to draw any sample or test of system
information is the automated system. The production libraries represent
executables that are approved and authorized to process organizational
data. Source program listings would be time intensive. Program change
requests are the documents used to initiate change; there is no guarantee
that the request has been completed for all changes. Test library listings
do not represent the approved and authorized executables.