CISA Exam Dumps | An IS auditor doing penetration testing during an audit of internet connections would:

<< Prev Question Next Question >>

Question 994/1069

An IS auditor doing penetration testing during an audit of internet connections would:

A. evaluate configurations.

B. examine security settings.

C. ensure virus-scanning software is in use.

D. use tools and techniques available to a hacker.

Question List (1069q): Question 1: A decision support system (DSS):...; Question 2: While observing a full simulation of the business continuity...; Question 3: A lower recovery time objective (RTO) results in:...; Question 4: An IS auditor issues an audit report pointing out the lack o...; Question 5: A company has recently upgraded its purchase system to incor...; Question 6: Which of the following types of attack works by taking advan...; Question 7: Due to changes in IT, the disaster recovery plan of a large ...; Question 8: For locations 3a, 1d and 3d, the diagram indicates hubs with...; Question 9: A manager of a project was not able to implement all audit r...; Question 10: A comprehensive and effective e-mail policy should address t...; Question 11: An organization is using symmetric encryption. Which of the ...; Question 12: A LAN administrator normally would be restricted from:...; Question 13: Which of the following would contribute MOST to an effective...; Question 14: An IS auditor is reviewing the physical security measures of...; Question 15: Everything not explicitly permitted is forbidden has which o...; Question 16: A penetration test performed as part of evaluating network s...; Question 17: An IS auditor conducting an access control review in a clien...; Question 18: Which of the following provides nonrepudiation services for ...; Question 19: A call-back system requires that a user with an id and passw...; Question 20: When performing an audit of a client relationship management...; Question 21: The initial step in establishing an information security pro...; Question 22: During an implementation review of a multiuser distributed a...; Question 23: Which of the following is one most common way that spyware i...; Question 24: ________________ (fill in the blank) is/are are ultimately a...; Question 25: From a risk management point of view, the BEST approach when...; Question 26: An IS auditor evaluates the test results of a modification t...; Question 27: Which of the following is the MOST reasonable option for rec...; Question 28: Corrective action has been taken by an auditee immediately a...; Question 29: Which of the following functions should be performed by the ...; Question 30: During the audit of a database server, which of the followin...; Question 31: In the context of effective information security governance,...; Question 32: Applying a retention date on a file will ensure that:...; Question 33: Which of the following processes are performed during the de...; Question 34: The MOST likely effect of the lack of senior management comm...; Question 35: In an online banking application, which of the following wou...; Question 36: An IS auditor is assigned to perform a postimplementation re...; Question 37: What is the best defense against Local DoS attacks?...; Question 38: Which of the following tests performed by an IS auditor woul...; Question 39: Which of the following is a dynamic analysis tool for the pu...; Question 40: The PRIMARY objective of testing a business continuity plan ...; Question 41: Which of the following is the MOST critical step in planning...; Question 42: Which of the following is of greatest concern when performin...; Question 43: Which of the following is an attribute of the control self-a...; Question 44: Nowadays, computer security comprises mainly "preventive"" m...; Question 45: Which of the following cryptography options would increase o...; Question 46: When an employee is terminated from service, the MOST import...; Question 47: Properly planned risk-based audit programs are often capable...; Question 48: An IS auditor has imported data from the client's database. ...; Question 49: Which of the following acts as a decoy to detect active inte...; Question 50: An IS auditor is reviewing an IT security risk management pr...; Question 51: Which of the following line media would provide the BEST sec...; Question 52: As part of the IEEE 802.11 standard ratified in September 19...; Question 53: An IS auditor conducting a review of disaster recovery plann...; Question 54: Off-site data storage should be kept synchronized when prepa...; Question 55: Which of the following components is responsible for the col...; Question 56: Which of the following should an IS auditor recommend to BES...; Question 57: An IS auditor should expect which of the following items to ...; Question 58: What is the MOST effective method of preventing unauthorized...; Question 59: When planning an audit of a network setup, an IS auditor sho...; Question 60: What is the most common reason for information systems to fa...; Question 61: Which of the following audit techniques would BEST aid an au...; Question 62: The PRIMARY objective of performing a postincident review is...; Question 63: Which of the following is BEST suited for secure communicati...; Question 64: Facilitating telecommunications continuity by providing redu...; Question 65: Which of the following is a function of an IS steering commi...; Question 66: If inadequate, which of the following would be the MOST like...; Question 67: IT best practices for the availability and continuity of IT ...; Question 68: During a human resources (HR) audit, an IS auditor is inform...; Question 69: With Deep packet inspection, which of the following OSI laye...; Question 70: Proper segregation of duties prevents a computer operator (u...; Question 71: Which of the following is a good control for protecting conf...; Question 72: The Secure Sockets Layer (SSL) protocol addresses the confid...; Question 73: Which of the following would an IS auditor consider the MOST...; Question 74: Why is the WAP gateway a component warranting critical conce...; Question 75: Which of the following is the key benefit of control self-as...; Question 76: In a contract with a hot, warm or cold site, contractual pro...; Question 77: Which of the following is the MOST important IS audit consid...; Question 78: What should IS auditors always check when auditing password ...; Question 79: Which of the following is the BEST audit procedure to determ...; Question 80: In a small organization, developers may release emergency ch...; Question 81: Which of the following are valid choices for the Apache/SSL ...; Question 82: A trojan horse simply cannot operate autonomously....; Question 83: Which of the following is the initial step in creating a fir...; Question 84: Naming conventions for system resources are important for ac...; Question 85: When reviewing a project where quality is a major concern, a...; Question 86: You should keep all computer rooms at reasonable temperature...; Question 87: At a hospital, medical personal carry handheld computers whi...; Question 88: A company undertakes a business process reengineering (BPR) ...; Question 89: Which of the following online auditing techniques is most ef...; Question 90: A disaster recovery plan for an organization's financial sys...; Question 91: What is often assured through table link verification and re...; Question 92: Which of the following is a benefit of a risk-based approach...; Question 93: IT control objectives are useful to IS auditors, as they pro...; Question 94: An IS auditor analyzing the audit log of a database manageme...; Question 95: Talking about biometric authentication, physical characteris...; Question 96: An IS auditor reviewing an organization's IS disaster recove...; Question 97: Machines that operate as a closed system can NEVER be eavesd...; Question 98: An IS auditor should review the configuration of which of th...; Question 99: When implementing an IT governance framework in an organizat...; Question 100: In an organization, the responsibilities for IT security are...; Question 101: The use of risk assessment tools for classifying risk factor...; Question 102: What are intrusion-detection systems (IDS) primarily used fo...; Question 103: Which of the following would BEST support 24/7 availability?...; Question 104: An IS auditor reviewing a database application discovers tha...; Question 105: Which of the following is by far the most common prevention ...; Question 106: The PRIMARY objective of a logical access control review is ...; Question 107: Disaster recovery planning (DRP) addresses the:...; Question 108: Which of the following aspects of symmetric key encryption i...; Question 109: How is risk affected if users have direct access to a databa...; Question 110: When participating in a systems-development project, an IS a...; Question 111: Rather than simply reviewing the adequacy of access control,...; Question 112: An IS auditor performing an application maintenance audit wo...; Question 113: IS management has decided to install a level 1 Redundant Arr...; Question 114: The IS auditor learns that when equipment was brought into t...; Question 115: A hard disk containing confidential data was damaged beyond ...; Question 116: A long-term IS employee with a strong technical background a...; Question 117: When reviewing the implementation of a LAN, an IS auditor sh...; Question 118: Which of the following ensures a sender's authenticity and a...; Question 119: An organization has just completed their annual risk assessm...; Question 120: Data edits are implemented before processing and are conside...; Question 121: Which of the following typically consists of a computer, som...; Question 122: Which of the following is the PRIMARY safeguard for securing...; Question 123: Once an organization has finished the business process reeng...; Question 124: The security level of a private key system depends on the nu...; Question 125: The most common problem in the operation of an intrusion det...; Question 126: When should reviewing an audit client's business plan be per...; Question 127: The PRIMARY purpose of an IT forensic audit is:...; Question 128: Relatively speaking, firewalls operated at the physical leve...; Question 129: The PRIMARY advantage of a continuous audit approach is that...; Question 130: The MOST important success factor in planning a penetration ...; Question 131: During the requirements definition phase of a software devel...; Question 132: An IS auditor performing detailed network assessments and ac...; Question 133: A retail outlet has introduced radio frequency identificatio...; Question 134: When reviewing an implementation of a VoIP system over a cor...; Question 135: As compared to understanding an organization's IT process fr...; Question 136: Which of the following would MOST likely indicate that a cus...; Question 137: In a public key infrastructure (PKI), which of the following...; Question 138: To determine which users can gain access to the privileged s...; Question 139: The computer security incident response team (CSIRT) of an o...; Question 140: The FIRST step in managing the risk of a cyber attack is to:...; Question 141: Which of the following kinds of function are particularly vu...; Question 142: A manufacturing firm wants to automate its invoice payment s...; Question 143: Which of the following types of firewalls provide the GREATE...; Question 144: Which of the following applet intrusion issues poses the GRE...; Question 145: An IS auditor is using a statistical sample to inventory the...; Question 146: Which of the following can be thought of as the simplest and...; Question 147: What type(s) of firewalls provide(s) the greatest degree of ...; Question 148: Which of the following provides the BEST single-factor authe...; Question 149: A malicious code that changes itself with each file it infec...; Question 150: Which of the following provides the GREATEST assurance of me...; Question 151: During the planning stage of an IS audit, the PRIMARY goal o...; Question 152: Which of the following systems-based approaches would a fina...; Question 153: To ensure compliance with a security policy requiring that p...; Question 154: A sender of an e-mail message applies a digital signature to...; Question 155: Which of the following should an IS auditor use to detect du...; Question 156: Which of the following would be MOST important for an IS aud...; Question 157: Which of the following would be the BEST overall control for...; Question 158: Which of the following system and data conversion strategies...; Question 159: Which of the following should be included in an organization...; Question 160: A check digit is an effective edit check to:...; Question 161: The GREATEST benefit in implementing an expert system is the...; Question 162: To determine who has been given permission to use a particul...; Question 163: To address an organization's disaster recovery requirements,...; Question 164: The PRIMARY reason an IS auditor performs a functional walkt...; Question 165: The PRIMARY objective of implementing corporate governance b...; Question 166: A disaster recovery plan for an organization should:...; Question 167: The PRIMARY purpose for meeting with auditees prior to forma...; Question 168: An IS auditor is reviewing a project that is using an Agile ...; Question 169: To determine how data are accessed across different platform...; Question 170: What would be the MOST effective control for enforcing accou...; Question 171: What is used to provide authentication of the website and ca...; Question 172: Which of the following results in a denial-of-service attack...; Question 173: Codes from exploit programs are frequently reused in:...; Question 174: Change control for business application systems being develo...; Question 175: Which of the following types of data validation editing chec...; Question 176: Which of the following sampling methods is MOST useful when ...; Question 177: Confidentiality of the data transmitted in a wireless LAN is...; Question 178: The waterfall life cycle model of software development is mo...; Question 179: A critical function of a firewall is to act as a:...; Question 180: An organization is disposing of a number of laptop computers...; Question 181: An IS auditor reviewing database controls discovered that ch...; Question 182: Which of the following is the BEST way to satisfy a two-fact...; Question 183: What is a data validation edit control that matches input da...; Question 184: Which of the following user profiles should be of MOST conce...; Question 185: Failure in which of the following testing stages would have ...; Question 186: IS auditors are MOST likely to perform compliance tests of i...; Question 187: In reviewing the IS short-range (tactical) plan, an IS audit...; Question 188: What is the first step in a business process re-engineering ...; Question 189: The PRIMARY benefit of implementing a security program as pa...; Question 190: During an audit, an IS auditor notes that an organization's ...; Question 191: Which of the following fire suppression systems is MOST appr...; Question 192: Upon receipt of the initial signed digital certificate the u...; Question 193: The frequent updating of which of the following is key to th...; Question 194: Which of the following is the MOST reliable form of single f...; Question 195: An IS auditor interviewing a payroll clerk finds that the an...; Question 196: Iptables is based on which of the following frameworks?...; Question 197: An IS auditor invited to a development project meeting notes...; Question 198: Which of the following is a distinctive feature of the Secur...; Question 199: Buffer overflow aims primarily at corrupting:...; Question 200: The directory system of a database-management system describ...; Question 201: Which of the following is a feature of Wi-Fi Protected Acces...; Question 202: Applying a digital signature to data traveling in a network ...; Question 203: Relatively speaking, firewalls operated at the application l...; Question 204: The MAIN purpose for periodically testing offsite facilities...; Question 205: When two or more systems are integrated, input/output contro...; Question 206: If a database is restored from information backed up before ...; Question 207: When auditing the proposed acquisition of a new computer sys...; Question 208: The MAIN criterion for determining the severity level of a s...; Question 209: What is the most common purpose of a virtual private network...; Question 210: Assessing IT risks is BEST achieved by:...; Question 211: A review of wide area network (WAN) usage discovers that tra...; Question 212: What is an initial step in creating a proper firewall policy...; Question 213: Which of the following is the MOST robust method for disposi...; Question 214: To prevent IP spoofing attacks, a firewall should be configu...; Question 215: A large chain of shops with electronic funds transfer (EFT) ...; Question 216: An example of a direct benefit to be derived from a proposed...; Question 217: What supports data transmission through split cable faciliti...; Question 218: The success of control self-assessment (CSA) highly depends ...; Question 219: Which of the following encryption methods uses a matching pa...; Question 220: When auditing third-party service providers, an IS auditor s...; Question 221: While planning an audit, an assessment of risk should be mad...; Question 222: An organization has implemented a disaster recovery plan. Wh...; Question 223: Which of the following is an advantage of the top-down appro...; Question 224: Which of the following would an IS auditor consider to be th...; Question 225: Which of the following should be seen as one of the most sig...; Question 226: Which of the following BEST reduces the ability of one devic...; Question 227: Which of the following biometrics has the highest reliabilit...; Question 228: To minimize costs and improve service levels an outsourcer s...; Question 229: When developing a formal enterprise security program, the MO...; Question 230: Which of the following is an object-oriented technology char...; Question 231: What can be used to gather evidence of network attacks?...; Question 232: Which of the following is not a good tactic to use against h...; Question 233: What are used as the framework for developing logical access...; Question 234: The GREATEST risk when end users have access to a database a...; Question 235: Which of the following are valid examples of Malware (choose...; Question 236: Which of the following would be the MOST significant audit f...; Question 237: What should regression testing use to obtain accurate conclu...; Question 238: A TCP/IP-based environment is exposed to the Internet. Which...; Question 239: Which of the following is a rewrite of ipfwadm?...; Question 240: Which of the following would MOST effectively control the us...; Question 241: Which of the following are examples of tools for launching D...; Question 242: Which of the following is the GREATEST risk when storage gro...; Question 243: Function Point Analysis (FPA) provides an estimate of the si...; Question 244: What is/are used to measure and ensure proper network capaci...; Question 245: An IS auditor recommends that an initial validation control ...; Question 246: Which of the following is the GREATEST risk of an inadequate...; Question 247: Which of the following would be BEST prevented by a raised f...; Question 248: An IS auditor has been assigned to review IT structures and ...; Question 249: An IS auditor identifies that reports on product profitabili...; Question 250: Which of the following is the GREATEST risk when implementin...; Question 251: Which of the following ensures the availability of transacti...; Question 252: The network of an organization has been the victim of severa...; Question 253: The use of statistical sampling procedures helps minimize:...; Question 254: A number of system failures are occurring when corrections t...; Question 255: An IS auditor has been asked to participate in project initi...; Question 256: What process uses test data as part of a comprehensive test ...; Question 257: If an IS auditor observes that individual modules of a syste...; Question 258: When performing an IS strategy audit, an IS auditor should r...; Question 259: The role of the certificate authority (CA) as a third party ...; Question 260: Which of the following is a concern when data are transmitte...; Question 261: Which of the following would an IS auditor consider a weakne...; Question 262: During a security audit of IT processes, an IS auditor found...; Question 263: A top-down approach to the development of operational polici...; Question 264: In an organization where an IT security baseline has been de...; Question 265: The BEST overall quantitative measure of the performance of ...; Question 266: Which of the following goals would you expect to find in an ...; Question 267: After initial investigation, an IS auditor has reasons to be...; Question 268: An IS auditor usually places more reliance on evidence direc...; Question 269: An IS auditor reviews an organizational chart PRIMARILY for:...; Question 270: Which of the following intrusion detection systems (IDSs) wi...; Question 271: What uses questionnaires to lead the user through a series o...; Question 272: When a new system is to be implemented within a short time f...; Question 273: When auditing security for a data center, an IS auditor shou...; Question 274: Which of the following cryptographic systems is MOST appropr...; Question 275: Who is ultimately responsible for providing requirement spec...; 1 commentQuestion 276: Digital signatures require the sender to "sign" the data by ...; Question 277: Which of the following antivirus software implementation str...; Question 278: When reviewing system parameters, an IS auditor's PRIMARY co...; Question 279: An IS auditor reviewing access controls for a client-server ...; Question 280: The purpose of code signing is to provide assurance that:...; Question 281: Which of the following would be considered an essential feat...; Question 282: Which of the following is a characteristic of timebox manage...; Question 283: Which of the following refers to any program that invites th...; Question 284: Which of the following is the BEST information source for ma...; Question 285: While evaluating software development practices in an organi...; Question 286: When performing an audit of access rights, an IS auditor sho...; Question 287: To minimize the cost of a software project, quality manageme...; Question 288: IS management is considering a Voice-over Internet Protocol ...; Question 289: To protect a VoIP infrastructure against a denial-of-service...; Question 290: Which of the following is the MOST important function to be ...; Question 291: During an audit of the logical access control of an ERP fina...; Question 292: An IS auditor conducting a review of disaster recovery plann...; Question 293: To develop a successful business continuity plan, end user i...; Question 294: Which of the following would impair the independence of a qu...; Question 295: Which of the following exposures associated with the spoolin...; Question 296: During a review of a customer master file, an IS auditor dis...; Question 297: To install backdoors, hackers generally prefer to use:...; Question 298: Broadly speaking, a Trojan horse is any program that invites...; Question 299: Which of the following is often used as a detection and dete...; Question 300: An IS auditor is performing a network security review of a t...; Question 301: After a full operational contingency test, an IS auditor per...; Question 302: By evaluating application development projects against the c...; Question 303: An organization is implementing a new system to replace a le...; Question 304: Introducing inhomogeneity to your network for the sake of ro...; Question 305: Which of the following is the MOST secure and economical met...; Question 306: Which of the following activities performed by a database ad...; Question 307: Allowing application programmers to directly patch or change...; Question 308: If the recovery time objective (RTO) increases:...; Question 309: After reviewing its business processes, a large organization...; Question 310: The reason for establishing a stop or freezing point on the ...; Question 311: Test and development environments should be separated. True ...; Question 312: The use of a GANTT chart can:; Question 313: Which of the following activities should the business contin...; Question 314: Which of the following is a risk of cross-training?...; Question 315: Ideally, stress testing should be carried out in a:...; Question 316: When developing a risk management program, what is the FIRST...; Question 317: To ensure authentication, confidentiality and integrity of a...; Question 318: The advantage of a bottom-up approach to the development of ...; Question 319: An IS auditor reviewing a proposed application software acqu...; Question 320: Following best practices, formal plans for implementation of...; Question 321: Which of the following refers to an important procedure when...; Question 322: You may reduce a cracker's chances of success by (choose all...; Question 323: A perpetrator looking to gain access to and gather informati...; Question 324: Key verification is one of the best controls for ensuring th...; Question 325: An IS auditor finds that user acceptance testing of a new sy...; Question 326: If an IS auditor observes that an IS department fails to use...; Question 327: What would an IS auditor expect to find in the console log? ...; Question 328: To prevent unauthorized entry to the data maintained in a di...; Question 329: For a discretionary access control to be effective, it must:...; Question 330: An IS auditor is evaluating a corporate network for a possib...; Question 331: What topology provides the greatest redundancy of routes and...; Question 332: When an organization is outsourcing their information securi...; Question 333: Which of the following is an appropriate test method to appl...; Question 334: An IS auditor was hired to review e-business security. The I...; Question 335: Which of the following are effective in detecting fraud beca...; Question 336: Which of the following append themselves to files as a prote...; Question 337: In a security server audit, focus should be placed on (choos...; Question 338: Organizations should use off-site storage facilities to main...; Question 339: Processing controls ensure that data is accurate and complet...; Question 340: The BEST filter rule for protecting a network from being use...; Question 341: Who is accountable for maintaining appropriate security meas...; Question 342: An investment advisor e-mails periodic newsletters to client...; Question 343: An installed Ethernet cable run in an unshielded twisted pai...; Question 344: Which of the following reduces the potential impact of socia...; Question 345: Which of the following is a feature of an intrusion detectio...; Question 346: How can minimizing single points of failure or vulnerabiliti...; Question 347: Which of the following types of transmission media provide t...; Question 348: As updates to an online order entry system are processed, th...; Question 349: Which of the following recovery strategies is MOST appropria...; Question 350: Which of the following are often considered as the first def...; Question 351: While reviewing the business continuity plan of an organizat...; Question 352: Which of the following is a good tool to use to help enforci...; Question 353: Many IT projects experience problems because the development...; Question 354: Inadequate programming and coding practices introduce the ri...; Question 355: Of the following alternatives, the FIRST approach to develop...; Question 356: To properly evaluate the collective effect of preventative, ...; Question 357: In a public key infrastructure, a registration authority:...; Question 358: Above almost all other concerns, what often results in the g...; Question 359: What is the key distinction between encryption and hashing a...; Question 360: An IS auditor is reviewing a project to implement a payment ...; Question 361: An organization having a number of offices across a wide geo...; Question 362: When should plans for testing for user acceptance be prepare...; Question 363: A benefit of open system architecture is that it:...; Question 364: Change management procedures are established by IS managemen...; Question 365: A financial services organization is developing and document...; Question 366: What influences decisions regarding criticality of assets?...; Question 367: An IS auditor reviewing an organization's data file control ...; Question 368: Of the three major types of off-site processing facilities, ...; Question 369: The FIRST step in a successful attack to a system would be:...; Question 370: During the collection of forensic evidence, which of the fol...; Question 371: What kind of protocols does the OSI Transport Layer of the T...; Question 372: IS audits should be selected through a risk analysis process...; Question 373: Which of the following is a telecommunication device that tr...; Question 374: Which of the following would MOST effectively reduce social ...; Question 375: The MOST important difference between hashing and encryption...; Question 376: Which of the following reports should an IS auditor use to c...; Question 377: Within a virus, which component is responsible for what the ...; Question 378: When preparing an audit report the IS auditor should ensure ...; Question 379: Screening router inspects traffic through examining:...; Question 380: Which of the following procedures would MOST effectively det...; Question 381: The objective of concurrency control in a database system is...; Question 382: Which of the following is the GREATEST concern when an organ...; Question 383: The management of an organization has decided to establish a...; Question 384: Passwords should be:; Question 385: What is the MOST prevalent security risk when an organizatio...; Question 386: Which of the following database controls would ensure that t...; Question 387: Which of the following represents the GREATEST risk created ...; Question 388: Which significant risk is introduced by running the file tra...; Question 389: An intentional or unintentional disclosure of a password is ...; Question 390: From a control perspective, the key element in job descripti...; Question 391: Which of the following is a data validation edit and control...; Question 392: When segregation of duties concerns exist between IT support...; Question 393: A successful risk-based IT audit program should be based on:...; Question 394: Which of the following controls would be MOST effective in e...; Question 395: Which of the following findings should an IS auditor be MOST...; Question 396: The initial step in establishing an information security pro...; Question 397: Talking about biometric authentication, which of the followi...; Question 398: Which of the following is the MOST likely reason why e-mail ...; Question 399: The MAJOR consideration for an IS auditor reviewing an organ...; Question 400: Which of the following procedures would BEST determine wheth...; Question 401: An IS auditor is told by IS management that the organization...; Question 402: What should an IS auditor do if he or she observes that proj...; Question 403: Whenever business processes have been re-engineered, the IS ...; Question 404: Which of the following correctly describes the purpose of an...; Question 405: A database administrator is responsible for:...; Question 406: The use of residual biometric information to gain unauthoriz...; Question 407: An IS auditor is assigned to audit a software development pr...; Question 408: Squid is an example of:; Question 409: At the end of the testing phase of software development, an ...; Question 410: During an audit of a business continuity plan (BCP), an IS a...; Question 411: IS management recently replaced its existing wired local are...; Question 412: Mitigating the risk and impact of a disaster or business int...; Question 413: An organization provides information to its supply chain par...; Question 414: While reviewing the IT infrastructure, an IS auditor notices...; Question 415: Run-to-run totals can verify data through which stage(s) of ...; Question 416: Which of the following devices extends the network and has t...; Question 417: Which of the following provide(s) near-immediate recoverabil...; Question 418: When performing a database review, an IS auditor notices tha...; Question 419: During a review of a business continuity plan, an IS auditor...; Question 420: The responsibility for authorizing access to a business appl...; Question 421: With respect to the outsourcing of IT services, which of the...; Question 422: Which of the following data validation edits is effective in...; Question 423: Which of the following is a tool you can use to simulate a b...; Question 424: Which of the following is MOST critical for the successful i...; Question 425: Which of the following is a passive attack method used by in...; Question 426: Which audit technique provides the BEST evidence of the segr...; Question 427: Which of the following can degrade network performance? Choo...; Question 428: You should know the difference between an exploit and a vuln...; Question 429: Proper segregation of duties prohibits a system analyst from...; Question 430: Which of the following refers to a symmetric key cipher whic...; Question 431: Which of the following can help detect transmission errors b...; Question 432: In the process of evaluating program change controls, an IS ...; Question 433: After observing suspicious activities in a server, a manager...; Question 434: The knowledge base of an expert system that uses questionnai...; Question 435: Receiving an EDI transaction and passing it through the comm...; Question 436: To verify that the correct version of a data file was used f...; Question 437: An IS auditor should be concerned when a telecommunication a...; Question 438: When performing a computer forensic investigation, in regard...; Question 439: Which of the following would provide the highest degree of s...; Question 440: All Social Engineering techniques are based on flaws in:...; Question 441: Neural networks are effective in detecting fraud because the...; Question 442: When evaluating the controls of an EDI application, an IS au...; Question 443: Which of the following represents the GREATEST potential ris...; Question 444: To ensure that audit resources deliver the best value to the...; Question 445: Online banking transactions are being posted to the database...; Question 446: An offsite information processing facility with electrical w...; Question 447: The PRIMARY goal of a web site certificate is:...; Question 448: During a disaster recovery test, an IS auditor observes that...; Question 449: The PRIMARY reason for using digital signatures is to ensure...; Question 450: In a client-server system, which of the following control te...; Question 451: The purpose of a checksum on an amount field in an electroni...; Question 452: In-house personnel performing IS audits should posses which ...; Question 453: What can be used to help identify and investigate unauthoriz...; Question 454: A transaction journal provides the information necessary for...; Question 455: Which of the following disaster recovery/continuity plan com...; Question 456: Which of the following BEST ensures the integrity of a serve...; Question 457: Which of the following should an IS auditor recommend for th...; Question 458: An IS auditor has identified the lack of an authorization pr...; Question 459: After discovering a security vulnerability in a third-party ...; Question 460: There are several methods of providing telecommunications co...; Question 461: An IS auditor should recommend the use of library control so...; Question 462: An organization has outsourced its wide area network (WAN) t...; Question 463: Reconfiguring which of the following firewall types will pre...; Question 464: A control that detects transmission errors by appending calc...; Question 465: Which of the following would BEST ensure continuity of a wid...; Question 466: Normally, it would be essential to involve which of the foll...; Question 467: A local area network (LAN) administrator normally would be r...; Question 468: IS management has decided to rewrite a legacy customer relat...; Question 469: How does the process of systems auditing benefit from using ...; Question 470: Which of the following would effectively verify the originat...; Question 471: An organization has contracted with a vendor for a turnkey s...; Question 472: For application acquisitions with significant impacts, parti...; Question 473: Which of the following is an example of the defense in-depth...; Question 474: Security should ALWAYS be an all or nothing issue....; Question 475: Which of the following would be the MOST cost-effective reco...; Question 476: When reviewing the IT strategic planning process, an IS audi...; Question 477: Batch control reconciliation is a _____________________ (fil...; Question 478: The implementation of access controls FIRST requires:...; Question 479: An IS auditor is performing an audit of a network operating ...; Question 480: Talking about the different approaches to security in comput...; Question 481: What is often the most difficult part of initial efforts in ...; Question 482: The PRIMARY objective of business continuity and disaster re...; Question 483: Which of the following is the MOST important action in recov...; Question 484: Which of the following should be the MOST important criterio...; Question 485: Which of the following should be the MOST important consider...; Question 486: To aid management in achieving IT and business alignment, an...; Question 487: For which of the following applications would rapid recovery...; Question 488: Which of the following would BEST provide assurance of the i...; Question 489: What is the BEST approach to mitigate the risk of a phishing...; Question 490: An organization has recently installed a security patch, whi...; Question 491: An IS auditor reviewing an accounts payable system discovers...; Question 492: During what process should router access control lists be re...; Question 493: Which of the following controls would an IS auditor look for...; Question 494: Which of the following would be the BEST access control proc...; Question 495: While copying files from a floppy disk, a user introduced a ...; Question 496: Which of the following should an IS auditor review to determ...; Question 497: Which of the following BEST restricts users to those functio...; Question 498: An IS auditor attempting to determine whether access to prog...; Question 499: Which of the following would be the BEST population to take ...; Question 500: An IS auditor examining a biometric user authentication syst...; Question 501: When using a digital signature, the message digest is comput...; Question 502: The application systems of an organization using open-source...; Question 503: What type of fire-suppression system suppresses fire via wat...; Question 504: Which of the following hardware devices relieves the central...; Question 505: To provide protection for media backup stored at an offsite ...; Question 506: Input/output controls should be implemented for which applic...; Question 507: As a driver of IT governance, transparency of IT's cost, val...; Question 508: Which type of major BCP test only requires representatives f...; Question 509: Which of the following risks could result from inadequate so...; Question 510: An appropriate control for ensuring the authenticity of orde...; Question 511: With respect to business continuity strategies, an IS audito...; Question 512: Effective transactional controls are often capable of offeri...; Question 513: The use of digital signatures:; Question 514: Doing which of the following during peak production hours co...; Question 515: Which of the following is a passive attack to a network?...; Question 516: During the review of a web-based software development projec...; Question 517: Overall business risk for a particular threat can be express...; Question 518: An information security policy stating that 'the display of ...; Question 519: A database administrator has detected a performance problem ...; Question 520: An IS auditor can verify that an organization's business con...; Question 521: A major portion of what is required to address nonrepudiatio...; Question 522: While reviewing sensitive electronic work papers, the IS aud...; Question 523: In determining the acceptable time period for the resumption...; Question 524: Which of the following is the BEST method for preventing the...; Question 525: An organization can ensure that the recipients of e-mails fr...; Question 526: Well-written risk assessment guidelines for IS auditing shou...; Question 527: Which of the following is the MOST effective control when gr...; Question 528: What can be implemented to provide the highest level of prot...; Question 529: Which of the following could lead to an unintentional loss o...; Question 530: Which of the following is the MOST important objective of da...; Question 531: Which of the following best characterizes "worms"?...; Question 532: The BEST method of proving the accuracy of a system tax calc...; Question 533: A benefit of quality of service (QoS) is that the:...; Question 534: In auditing a web server, an IS auditor should be concerned ...; Question 535: What is the recommended initial step for an IS auditor to im...; Question 536: Which of the following software tools is often used for stea...; Question 537: Minimum password length and password complexity verification...; Question 538: Which of the following will BEST ensure the successful offsh...; Question 539: A business application system accesses a corporate database ...; Question 540: What process is used to validate a subject's identity?...; Question 541: Data flow diagrams are used by IS auditors to:...; Question 542: An IS auditor reviewing digital rights management (DRM) appl...; Question 543: Using the OSI reference model, what layer(s) is/are used to ...; Question 544: An accuracy measure for a biometric system is:...; Question 545: Which of the following tests is an IS auditor performing whe...; Question 546: An IS auditor's PRIMARY concern when application developers ...; Question 547: In wireless communication, which of the following controls a...; Question 548: The reliability of an application system's audit trail may b...; Question 549: What type of approach to the development of organizational p...; Question 550: IT governance is PRIMARILY the responsibility of the:...; Question 551: What type of cryptosystem is characterized by data being enc...; Question 552: What type of risk is associated with authorized program exit...; Question 553: To reduce the possibility of losing data during processing, ...; Question 554: Which of the following controls would be the MOST comprehens...; Question 555: When storing data archives off-site, what must be done with ...; Question 556: Which of the following implementation modes would provide th...; Question 557: Which of the following refers to the collection of policies ...; Question 558: What should be the GREATEST concern to an IS auditor when em...; Question 559: The most common reason for the failure of information system...; Question 560: Which of the following is the MOST important criterion when ...; Question 561: Which of the following is the BEST practice to ensure that a...; Question 562: Effective IT governance will ensure that the IT plan is cons...; Question 563: Which of the following would BEST maintain the integrity of ...; Question 564: Which of the following provides the strongest authentication...; Question 565: A company has implemented a new client-server enterprise res...; Question 566: Which of the following situations would increase the likelih...; Question 567: One major improvement in WPA over WEP is the use of a protoc...; Question 568: An IS auditor examining the configuration of an operating sy...; Question 569: In a relational database with referential integrity, the use...; Question 570: In order to coordinate the activity of many infected compute...; Question 571: The responsibility for authorizing access to application dat...; Question 572: When reviewing an active project, an IS auditor observed tha...; Question 573: An offsite information processing facility having electrical...; Question 574: IT operations for a large organization have been outsourced....; Question 575: Which of the following would be the BEST method for ensuring...; Question 576: The Trojan.Linux.JBellz Trojan horse runs as a malformed fil...; Question 577: A data administrator is responsible for:...; Question 578: How do modems (modulation/demodulation) function to facilita...; Question 579: Which of the following public key infrastructure (PKI) eleme...; Question 580: When developing a risk-based audit strategy, an IS auditor s...; Question 581: Which of the following programs would a sound information se...; Question 582: Which of the following is the BEST performance criterion for...; Question 583: An IS auditor should use statistical sampling and not judgme...; Question 584: Which of the following will help detect changes made by an i...; Question 585: The rate of change in technology increases the importance of...; Question 586: ALL computer programming languages are vulnerable to command...; Question 587: An IS auditor finds that conference rooms have active networ...; 1 commentQuestion 588: What are used as a countermeasure for potential database cor...; Question 589: Which of the following would an IS auditor use to determine ...; Question 590: Sign-on procedures include the creation of a unique user ID ...; Question 591: Which of the following is a benefit of using callback device...; Question 592: Atomicity enforces data integrity by ensuring that a transac...; Question 593: Which of the following is an effective method for controllin...; Question 594: Which of the following would an IS auditor consider to be th...; Question 595: How does the SSL network protocol provide confidentiality?...; Question 596: In large corporate networks having supply partners across th...; Question 597: After an IS auditor has identified threats and potential imp...; Question 598: Assuming this diagram represents an internal facility and th...; Question 599: Many organizations require an employee to take a mandatory v...; Question 600: Which of the following measures can effectively minimize the...; Question 601: As part of the business continuity planning process, which o...; Question 602: After the merger of two organizations, multiple self-develop...; Question 603: At the completion of a system development project, a postpro...; Question 604: Phishing attack works primarily through:...; Question 605: Which of the following correctly describe the potential prob...; Question 606: The BEST method for assessing the effectiveness of a busines...; Question 607: Which of the following controls will MOST effectively detect...; Question 608: Which of the following refers to the act of creating and usi...; Question 609: An IS auditor performing a telecommunication access control ...; Question 610: Which of the following are the characteristics of a good pas...; Question 611: Which of the following refers to a primary component of corp...; Question 612: In an IS audit of several critical servers, the IS auditor w...; Question 613: An IS auditor selects a server for a penetration test that w...; Question 614: Integrating business continuity planning (BCP) into an IT pr...; Question 615: During the development of an application, the quality assura...; Question 616: Which of the following should be of MOST concern to an IS au...; Question 617: Which of the following is a general operating system access ...; Question 618: Which of the following protocols would be involved in the im...; Question 619: As part of the IEEE 802.11 standard ratified in September 19...; Question 620: What is the recommended minimum length of a good password?...; Question 621: After implementation of a disaster recovery plan, pre-disast...; Question 622: Though management has stated otherwise, an IS auditor has re...; Question 623: What is used as a control to detect loss, corruption, or dup...; Question 624: During a logical access controls review, an IS auditor obser...; Question 625: The ultimate purpose of IT governance is to:...; Question 626: Which of the following should be included in a feasibility s...; Question 627: What is wrong with a Black Box type of intrusion detection s...; Question 628: Responsibility for the governance of IT should rest with the...; Question 629: When reviewing the procedures for the disposal of computers,...; Question 630: Which of the following is an implementation risk within the ...; Question 631: Which of the following penetration tests would MOST effectiv...; Question 632: Which of the following encrypt/decrypt steps provides the GR...; Question 633: An organization has outsourced its help desk. Which of the f...; Question 634: What are trojan horse programs? Choose the BEST answer....; Question 635: Which of the following is a benefit of using a callback devi...; Question 636: Which of the following encryption techniques will BEST prote...; Question 637: The purpose of a deadman door controlling access to a comput...; Question 638: Back Orifice is an example of:; Question 639: What should an organization do before providing an external ...; Question 640: The IS management of a multinational company is considering ...; Question 641: While conducting an audit of a service provider, an IS audit...; Question 642: Which of the following is MOST directly affected by network ...; Question 643: What is a primary high-level goal for an auditor who is revi...; Question 644: What is a risk associated with attempting to control physica...; Question 645: Company.com has contracted with an external consulting firm ...; Question 646: Performance of a biometric measure is usually referred to in...; Question 647: Many WEP systems require a key in a relatively insecure form...; Question 648: Who is ultimately responsible and accountable for reviewing ...; Question 649: What process allows IS management to determine whether the a...; Question 650: The use of object-oriented design and development techniques...; Question 651: Which of the following is the MOST effective type of antivir...; Question 652: Which of the following is the BEST type of program for an or...; Question 653: Which of the following backup techniques is the MOST appropr...; Question 654: An IS auditor who has discovered unauthorized transactions d...; Question 655: An IS auditor notes that patches for the operating system us...; Question 656: An IS auditor performing a review of an application's contro...; Question 657: A PRIMARY benefit derived from an organization employing con...; Question 658: A web server is attacked and compromised. Which of the follo...; Question 659: Cisco IOS based routers perform basic traffic filtering via ...; Question 660: Which of the following fire-suppression methods is considere...; Question 661: Which of the following would be the GREATEST cause for conce...; Question 662: Before implementing controls, management should FIRST ensure...; Question 663: If a database is restored using before-image dumps, where sh...; Question 664: Under the concept of ""defense in depth"", subsystems should...; Question 665: Fault-tolerance is a feature particularly sought-after in wh...; Question 666: An IS auditor should carefully review the functional require...; Question 667: What type of risk results when an IS auditor uses an inadequ...; Question 668: The PRIMARY objective of an audit of IT security policies is...; Question 669: An IS auditor noted that an organization had adequate busine...; Question 670: Which of the following would be of MOST concern to an IS aud...; Question 671: Which of the following methods of suppressing a fire in a da...; Question 672: What is the BEST backup strategy for a large database with d...; Question 673: A structured walk-through test of a disaster recovery plan i...; Question 674: If a programmer has update access to a live system, IS audit...; Question 675: Which of the following issues should be the GREATEST concern...; Question 676: Which of the following is a good time frame for making chang...; Question 677: An advantage of a continuous audit approach is that it can i...; Question 678: What is the BEST action to prevent loss of data integrity or...; Question 679: Which of the following would prevent accountability for an a...; Question 680: Which of the following is the MOST reliable sender authentic...; Question 681: Which of the following is used to evaluate biometric access ...; Question 682: Active radio frequency ID (RFID) tags are subject to which o...; Question 683: Which of the following would have the HIGHEST priority in a ...; Question 684: Which of the following virus prevention techniques can be im...; Question 685: Which of the following BEST limits the impact of server fail...; Question 686: A number of system failures are occurring when corrections t...; Question 687: What is the primary objective of a control self-assessment (...; Question 688: Which of the following is a technique that could be used to ...; Question 689: Human error is being HEAVILY relied upon on by which of the ...; Question 690: Which of the following refers to the proving of mathematical...; Question 691: The feature of a digital signature that ensures the sender c...; Question 692: In an audit of an inventory application, which approach woul...; Question 693: Involvement of senior management is MOST important in the de...; Question 694: Common implementations of strong authentication may use whic...; Question 695: The decisions and actions of an IS auditor are MOST likely t...; Question 696: Digital signatures require the:...; Question 697: Creating which of the following is how a hacker can insure h...; Question 698: Which of the following measures can protect systems files an...; Question 699: Which of the following would be the MOST secure firewall sys...; Question 700: What are often the primary safeguards for systems software a...; Question 701: The reason a certification and accreditation process is perf...; Question 702: When is regression testing used to determine whether new app...; Question 703: Which of the following tasks should be performed FIRST when ...; Question 704: Reverse proxy technology for web servers should be deployed ...; Question 705: Which of the following is the PRIMARY advantage of using com...; Question 706: An organization has an integrated development environment (I...; Question 707: Which of the following should be of PRIMARY concern to an IS...; Question 708: Which of the following BEST describes the necessary document...; Question 709: Which of the following controls would BEST detect intrusion?...; Question 710: When using a universal storage bus (USB) flash drive to tran...; Question 711: Library control software restricts source code to:...; Question 712: Which of the following provides the BEST evidence of an orga...; Question 713: When developing a disaster recovery plan, the criteria for d...; Question 714: The Federal Information Processing Standards (FIPS) are prim...; Question 715: During the requirements definition phase for a database appl...; Question 716: An organization is using an enterprise resource management (...; Question 717: The technique of rummaging through commercial trash to colle...; Question 718: How is the risk of improper file access affected upon implem...; Question 719: What is a common vulnerability, allowing denial-of-service a...; Question 720: When implementing an application software package, which of ...; Question 721: When reviewing the configuration of network devices, an IS a...; Question 722: The MOST effective biometric control system is the one:...; Question 723: An IS auditor reviewing an outsourcing contract of IT facili...; Question 724: Proper segregation of duties normally does not prohibit a LA...; Question 725: A project manager of a project that is scheduled to take 18 ...; Question 726: Which of the following is a continuity plan test that uses a...; Question 727: An IS auditor is reviewing a software-based firewall configu...; Question 728: Which of the following manages the digital certificate life ...; Question 729: Transmitting redundant information with each character or fr...; Question 730: Regarding digital signature implementation, which of the fol...; Question 731: Which of the following would be the MOST effective audit tec...; Question 732: Which of the following data validation edits is effective in...; Question 733: An IS auditor observes a weakness in the tape management sys...; Question 734: The vice president of human resources has requested an audit...; Question 735: A certificate authority (CA) can delegate the processes of:...; Question 736: Which of the following is a mechanism for mitigating risks?...; Question 737: If an IS auditor finds evidence of risk involved in not impl...; Question 738: An internet-based attack using password sniffing can:...; Question 739: An organization's IS audit charter should specify the:...; Question 740: During an application audit, an IS auditor finds several pro...; Question 741: Disabling which of the following would make wireless local a...; Question 742: Which of the following would normally be the MOST reliable e...; Question 743: Which of the following types of audit always takes high prio...; Question 744: A company has contracted with an external consulting firm to...; Question 745: Which of the following is a program evaluation review techni...; Question 746: Which of the following provides the framework for designing ...; Question 747: What is an acceptable recovery mechanism for extremely time-...; Question 748: In the event of a disruption or disaster, which of the follo...; Question 749: Which of the following is the GREATEST advantage of elliptic...; Question 750: Which of the following physical access controls effectively ...; Question 751: Which of the following refers to a method of bypassing norma...; Question 752: Time constraints and expanded needs have been found by an IS...; Question 753: In the course of performing a risk analysis, an IS auditor h...; Question 754: Which of the following terms generally refers to small progr...; Question 755: The MAIN purpose of a transaction audit trail is to:...; Question 756: An advantage in using a bottom-up vs. a top-down approach to...; Question 757: Authentication techniques for sending and receiving data bet...; Question 758: Which of the following will prevent dangling tuples in a dat...; Question 759: Which of the following is the GREATEST risk to the effective...; Question 760: The MAJOR advantage of a component-based development approac...; Question 761: An integrated test facility is considered a useful audit too...; Question 762: What is an edit check to determine whether a field contains ...; Question 763: The PRIMARY objective of Secure Sockets Layer (SSL) is to en...; Question 764: Which of the following should be of MOST concern to an IS au...; Question 765: A virus typically consists of what major parts (choose all t...; Question 766: An offsite information processing facility:...; Question 767: The extent to which data will be collected during an IS audi...; Question 768: The human resources (HR) department has developed a system t...; Question 769: While designing the business continuity plan (BCP) for an ai...; Question 770: During the review of a biometrics system operation, an IS au...; Question 771: Which of the following is a dynamic analysis tool for the pu...; Question 772: Which of the following refers to an anomalous condition wher...; Question 773: Fourth-Generation Languages (4GLs) are most appropriate for ...; Question 774: Network environments often add to the complexity of program-...; Question 775: Which of the following is the MOST important element for the...; Question 776: With the objective of mitigating the risk and impact of a ma...; Question 777: The potential for unauthorized system access by way of termi...; Question 778: Why is one-time pad not always preferable for encryption (ch...; Question 779: An IS auditor notes that IDS log entries related to port sca...; Question 780: In a client-server architecture, a domain name service (DNS)...; Question 781: What can be very helpful to an IS auditor when determining t...; Question 782: An IS auditor is performing an audit of a remotely managed s...; Question 783: When auditing a disaster recovery plan for a critical busine...; Question 784: Information for detecting unauthorized input from a terminal...; Question 785: The MOST effective control for addressing the risk of piggyb...; Question 786: What often results in project scope creep when functional re...; Question 787: When reviewing an organization's approved software product l...; Question 788: The IT balanced scorecard is a business governance tool inte...; Question 789: Which of the following would be an indicator of the effectiv...; Question 790: A clerk changed the interest rate for a loan on a master fil...; Question 791: The optimum business continuity strategy for an entity is de...; Question 792: Which of the following types of attack involves a program th...; Question 793: Which of the following is MOST is critical during the busine...; Question 794: Sophisticated database systems provide many layers and types...; Question 795: After identifying potential security vulnerabilities, what s...; Question 796: Which of the following is BEST characterized by unauthorized...; Question 797: What is a reliable technique for estimating the scope and co...; Question 798: Which of the following should be a concern to an IS auditor ...; Question 799: Which of the following refers to any authentication protocol...; Question 800: Which of the following should concern an IS auditor when rev...; Question 801: Which of the following is a substantive test?...; Question 802: Which of the following BEST characterizes a mantrap or deadm...; Question 803: Which of the following provides the best evidence of the ade...; Question 804: Which of the following is an example of a passive attack ini...; Question 805: A company uses a bank to process its weekly payroll. Time sh...; Question 806: The PRIMARY purpose of audit trails is to:...; Question 807: Gimmes often work through:; Question 808: Which of the following types of attack makes use of common c...; Question 809: Which of the following is the MOST effective method for deal...; Question 810: Which of the following is an advantage of an integrated test...; Question 811: What benefit does using capacity-monitoring software to moni...; Question 812: A proposed transaction processing application will have many...; Question 813: Who should be responsible for network security operations?...; Question 814: Use of asymmetric encryption in an internet e-commerce site,...; Question 815: Which of the following provides the MOST relevant informatio...; Question 816: When using an integrated test facility (ITF), an IS auditor ...; Question 817: Which of the following types of attack makes use of unfilter...; Question 818: When protecting an organization's IT systems, which of the f...; Question 819: What is essential for the IS auditor to obtain a clear under...; Question 820: What should be done to determine the appropriate level of au...; Question 821: An IS auditor inspected a windowless room containing phone s...; Question 822: A company is implementing a dynamic host configuration proto...; Question 823: A hot site should be implemented as a recovery strategy when...; Question 824: Which of the following is the dominating objective of BCP an...; Question 825: Most trojan horse programs are spread through:...; Question 826: When reviewing an intrusion detection system (IDS), an IS au...; Question 827: Is it appropriate for an IS auditor from a company that is c...; Question 828: When reviewing an organization's strategic IT plan an IS aud...; Question 829: After completing the business impact analysis (BIA), what is...; Question 830: Which of the following methods of encryption has been proven...; Question 831: Which of the following are designed to detect network attack...; Question 832: Which of the following is widely accepted as one of the crit...; Question 833: When planning to add personnel to tasks imposing time constr...; Question 834: Responsibility and reporting lines cannot always be establis...; Question 835: In a public key infrastructure (PKI), the authority responsi...; Question 836: Which of the following message services provides the stronge...; Question 837: Which of the following satisfies a two-factor user authentic...; Question 838: An IS auditor finds that, at certain times of the day, the d...; Question 839: Functionality is a characteristic associated with evaluating...; Question 840: An organization has a mix of access points that cannot be up...; Question 841: The cost of ongoing operations when a disaster recovery plan...; Question 842: Which of the following network components is PRIMARILY set u...; Question 843: An IS auditor performing an independent classification of sy...; Question 844: An organization currently using tape backups takes one full ...; Question 845: Regarding a disaster recovery plan, the role of an IS audito...; Question 846: The quality of the metadata produced from a data warehouse i...; Question 847: Which of the following IT governance best practices improves...; Question 848: What must an IS auditor understand before performing an appl...; Question 849: A hub is a device that connects:...; Question 850: Which of the following would help to ensure the portability ...; Question 851: In the context of physical access control, what is known as ...; Question 852: An IS auditor performing a review of the backup processing f...; Question 853: Electromagnetic emissions from a terminal represent an expos...; Question 854: Integer overflow occurs primarily with:...; Question 855: The output of the risk management process is an input for ma...; Question 856: Before implementing an IT balanced scorecard, an organizatio...; Question 857: A programmer maliciously modified a production program to ch...; Question 858: What can ISPs use to implement inbound traffic filtering as ...; Question 859: To detect attack attempts that the firewall is unable to rec...; Question 860: An IS auditor reviewing wireless network security determines...; Question 861: The specific advantage of white box testing is that it:...; Question 862: An IS auditor should be MOST concerned with what aspect of a...; Question 863: The difference between a vulnerability assessment and a pene...; Question 864: A legacy payroll application is migrated to a new applicatio...; Question 865: Which of the following would MOST effectively enhance the se...; Question 866: In which of the following situations is it MOST appropriate ...; Question 867: In regard to moving an application program from the test env...; Question 868: Which of the following types of firewall treats each network...; Question 869: Which of the following BEST supports the prioritization of n...; Question 870: The information security policy that states 'each individual...; Question 871: When transmitting a payment instruction, which of the follow...; Question 872: The GREATEST advantage of using web services for the exchang...; Question 873: A hacker could obtain passwords without the use of computer ...; Question 874: Why is a clause for requiring source code escrow in an appli...; Question 875: Which of the following is the MOST important consideration w...; Question 876: After installing a network, an organization installed a vuln...; Question 877: A company has decided to implement an electronic signature s...; Question 878: An organization has been recently downsized, in light of thi...; Question 879: When using public key encryption to secure data being transm...; Question 880: A virtual private network (VPN) provides data confidentialit...; Question 881: The MOST effective control for reducing the risk related to ...; Question 882: Talking about application system audit, focus should always ...; Question 883: The database administrator (DBA) suggests that DB efficiency...; Question 884: The BEST way to minimize the risk of communication failures ...; Question 885: The most likely error to occur when implementing a firewall ...; Question 886: If senior management is not committed to strategic planning,...; Question 887: Accountability for the maintenance of appropriate security m...; Question 888: Host Based ILD&P primarily addresses the issue of:...; Question 889: When developing a security architecture, which of the follow...; Question 890: When should systems administrators first assess the impact o...; Question 891: An IS auditor reviewing an organization that uses cross-trai...; Question 892: Obtaining user approval of program changes is very effective...; Question 893: When are benchmarking partners identified within the benchma...; Question 894: Which of the following systems or tools can recognize that a...; Question 895: Network ILD&P are typically installed:...; Question 896: Which of the following functions is performed by a virtual p...; Question 897: An IT steering committee should review information systems P...; Question 898: The traditional role of an IS auditor in a control self-asse...; Question 899: As an outcome of information security governance, strategic ...; Question 900: Which of the following will replace system binaries and/or h...; Question 901: Which of the following is the MOST effective control over vi...; Question 902: When reviewing procedures for emergency changes to programs,...; Question 903: The purpose of a mainframe audit is to provide assurance tha...; Question 904: Functional acknowledgements are used:...; Question 905: During a change control audit of a production system, an IS ...; Question 906: Who is ultimately accountable for the development of an IS s...; Question 907: Establishing data ownership is an important first step for w...; Question 908: A digital signature contains a message digest to:...; Question 909: The final decision to include a material finding in an audit...; Question 910: The activation of an enterprise's business continuity plan s...; Question 911: An audit charter should:; Question 912: An organization is migrating from a legacy system to an ente...; Question 913: An IS auditor finds that a DBA has read and write access to ...; Question 914: Which of the following is the BEST way to handle obsolete ma...; Question 915: The Federal Information Processing Standards (FIPS) were dev...; Question 916: An IS auditor conducting a review of software usage and lice...; Question 917: Which of the following is an advantage of prototyping?...; Question 918: Which of the following is an oft-cited cause of vulnerabilit...; Question 919: Which of the following is best suited for searching for addr...; Question 920: Which of the following is a prevalent risk in the developmen...; Question 921: The responsibilities of a disaster recovery relocation team ...; Question 922: During an audit of an enterprise that is dedicated to e-comm...; Question 923: Why does an IS auditor review an organization chart?...; Question 924: The sophistication and formality of IS audit programs may va...; Question 925: Which of the following uses a prototype that can be updated ...; Question 926: An IS auditor finds out-of-range data in some tables of a da...; Question 927: Which of the following would provide the BEST protection aga...; Question 928: Which testing approach is MOST appropriate to ensure that in...; Question 929: When identifying an earlier project completion time, which i...; Question 930: When installing an intrusion detection system (IDS), which o...; Question 931: A substantive test to verify that tape library inventory rec...; Question 932: Which of the following insurance types provide for a loss ar...; Question 933: Which of the following are effective controls for detecting ...; Question 934: The MOST significant level of effort for business continuity...; Question 935: An IS auditor who was involved in designing an organization'...; Question 936: To affix a digital signature to a message, the sender must f...; Question 937: The MOST important reason for an IS auditor to obtain suffic...; Question 938: An IS auditor reviewing an organization's IT strategic plan ...; Question 939: An IS auditor finds that a system under development has 12 l...; Question 940: Which of the following terms is used more generally for desc...; Question 941: Which of the following is the MOST critical and contributes ...; Question 942: Which of the following must exist to ensure the viability of...; Question 943: What is the primary security concern for EDI environments? C...; Question 944: Who assumes ownership of a systems-development project and t...; Question 945: Which of the following BEST describes the concept of ""defen...; Question 946: The ability of the internal IS audit function to achieve des...; Question 947: What is the lowest level of the IT governance maturity model...; Question 948: Which of the following do digital signatures provide?...; Question 949: What would be the major purpose of rootkit?...; Question 950: What method might an IS auditor utilize to test wireless sec...; Question 951: The FIRST step in data classification is to:...; Question 952: The MAJOR advantage of the risk assessment approach over the...; Question 953: Which of the following is MOST likely to result from a busin...; Question 954: In planning an audit, the MOST critical step is the identifi...; Question 955: How is the time required for transaction processing review u...; Question 956: When reviewing input controls, an IS auditor observes that, ...; Question 957: When reviewing an organization's logical access security, wh...; Question 958: A hardware control that helps to detect errors when data are...; Question 959: A financial institution that processes millions of transacti...; Question 960: Business units are concerned about the performance of a newl...; Question 961: In order to properly protect against unauthorized disclosure...; Question 962: Which of the following attacks targets the Secure Sockets La...; Question 963: What type of BCP test uses actual resources to simulate a sy...; Question 964: Web and e-mail filtering tools are PRIMARILY valuable to an ...; Question 965: Which of the following types of firewalls would BEST protect...; Question 966: Although BCP and DRP are often implemented and tested by mid...; Question 967: Which of the following is MOST critical when creating data f...; Question 968: An IS auditor is reviewing access to an application to deter...; Question 969: What determines the strength of a secret key within a symmet...; Question 970: Whenever an application is modified, what should be tested t...; Question 971: To ensure an organization is complying with privacy requirem...; Question 972: To address a maintenance problem, a vendor needs remote acce...; Question 973: Which of the following is the PRIMARY purpose for conducting...; Question 974: During an exit interview, in cases where there is disagreeme...; Question 975: Why does the IS auditor often review the system logs?...; Question 976: During a business continuity audit an IS auditor found that ...; Question 977: When reviewing IS strategies, an IS auditor can BEST assess ...; Question 978: Validated digital signatures in an e-mail software applicati...; Question 979: TEMPEST is a hardware for which of the following purposes?...; Question 980: Two-factor authentication can be circumvented through which ...; Question 981: The technique used to ensure security in virtual private net...; Question 982: An IS auditor finds that not all employees are aware of the ...; Question 983: A medium-sized organization, whose IT disaster recovery meas...; 1 commentQuestion 984: An IS auditor reviewing the implementation of an intrusion d...; Question 985: The development of an IS security policy is ultimately the r...; Question 986: To determine if unauthorized changes have been made to produ...; Question 987: Depending on the complexity of an organization's business co...; Question 988: To address the risk of operations staff's failure to perform...; Question 989: Database snapshots can provide an excellent audit trail for ...; Question 990: During the audit of an acquired software package, an IS audi...; Question 991: When reviewing a digital certificate verification process, w...; Question 992: Users are issued security tokens to be used in combination w...; Question 993: A technical lead who was working on a major project has left...; Question 994: An IS auditor doing penetration testing during an audit of i...; Question 995: Which of the following intrusion detection systems (IDSs) mo...; Question 996: The PRIMARY objective of service-level management (SLM) is t...; Question 997: An IS auditor reviewing the risk assessment process of an or...; Question 998: Which of the following is a network diagnostic tool that mon...; Question 999: With the help of a security officer, granting access to data...; Question 1000: Which of the following is a continuity plan test that uses a...; Question 1001: When reviewing a hardware maintenance program, an IS auditor...; Question 1002: What increases encryption overhead and cost the most?...; Question 1003: Which of the following types of testing would determine whet...; Question 1004: To optimize an organization's business contingency plan (BCP...; Question 1005: In addition to the backup considerations for all systems, wh...; Question 1006: Which of the following should be considered FIRST when imple...; Question 1007: In what way is a common gateway interface (CGI) MOST often u...; Question 1008: An organization has a recovery time objective (RTO) equal to...; Question 1009: Which of the following would prevent unauthorized changes to...; Question 1010: What is a callback system?; Question 1011: Which of the following network configuration options contain...; Question 1012: When should application controls be considered within the sy...; Question 1013: An IS auditor finds that, in accordance with IS policy, IDs ...; Question 1014: Pretexting is an act of:; Question 1015: Over the long term, which of the following has the greatest ...; Question 1016: During the design of a business continuity plan, the busines...; Question 1017: When conducting a penetration test of an organization's inte...; Question 1018: Which of the following may be deployed in a network as lower...; Question 1019: An IS steering committee should:...; Question 1020: What control detects transmission errors by appending calcul...; 1 commentQuestion 1021: An IS auditor discovers that developers have operator access...; Question 1022: An organization is implementing an enterprise resource plann...; Question 1023: Which of the following techniques would BEST help an IS audi...; Question 1024: Which of the following is of greatest concern to the IS audi...; Question 1025: In the event of a data center disaster, which of the followi...; Question 1026: A core tenant of an IS strategy is that it must:...; Question 1027: E-mail message authenticity and confidentiality is BEST achi...; Question 1028: ______________ risk analysis is not always possible because ...; Question 1029: An organization having a number of offices across a wide geo...; Question 1030: The phases and deliverables of a system development life cyc...; Question 1031: Proper segregation of duties does not prohibit a quality con...; Question 1032: In the 2c area of the diagram, there are three hubs connecte...; Question 1033: Which of the following types of spyware was originally desig...; Question 1034: When assessing the design of network monitoring controls, an...; Question 1035: An organization is considering connecting a critical PC-base...; Question 1036: To gain an understanding of the effectiveness of an organiza...; Question 1037: When auditing a proxy-based firewall, an IS auditor should:...; Question 1038: Wi-Fi Protected Access implements the majority of which IEEE...; Question 1039: An organization with extremely high security requirements is...; Question 1040: An integrated test facility is not considered a useful audit...; Question 1041: Network Data Management Protocol (NDMP) technology should be...; Question 1042: During which of the following phases in system development w...; Question 1043: Who is responsible for the overall direction, costs, and tim...; Question 1044: An existing system is being extensively enhanced by extracti...; Question 1045: Which of the following is a control over component communica...; Question 1046: Documentation of a business case used in an IT development p...; Question 1047: Distributed denial-of-service (DDOS) attacks on Internet sit...; Question 1048: While conducting an audit, an IS auditor detects the presenc...; Question 1049: Talking about biometric measurement, which of the following ...; Question 1050: Business process re-engineering often results in ___________...; Question 1051: Software is considered malware based on:...; 1 commentQuestion 1052: E-mail traffic from the Internet is routed via firewall-1 to...; Question 1053: An organization has created a policy that defines the types ...; Question 1054: Which of the following terms refers to systems designed to d...; Question 1055: During a postimplementation review of an enterprise resource...; Question 1056: Which of the following is the most fundamental step in preve...; Question 1057: The majority of software vulnerabilities result from a few k...; Question 1058: Which of the following forms of evidence for the auditor wou...; Question 1059: In an online transaction processing system, data integrity i...; Question 1060: What is the PRIMARY purpose of audit trails?...; 1 commentQuestion 1061: A primary benefit derived from an organization employing con...; Question 1062: An efficient use of public key infrastructure (PKI) should e...; Question 1063: Which of the following exposures could be caused by a line g...; Question 1064: The sender of a public key would be authenticated by a:...; Question 1065: Which of the following is the most important element in the ...; Question 1066: In a small organization, an employee performs computer opera...; Question 1067: Which of the following types of data validation editing chec...; Question 1068: An organization's disaster recovery plan should address earl...; Question 1069: The MAIN reason for requiring that all computer clocks acros...

Question 994/1069

LEAVE A REPLY

Download PDF File