لا تريد أن تفوت شيئا؟

نصائح اجتياز امتحان الشهادة

آخر أخبار الامتحانات ومعلومات الخصم

برعاية وحديثة من قبل خبرائنا

نعم، أرسل لي النشرة الإخبارية

خذ اختبارات أخرى عبر الإنترنت
السؤال #1
Which of the following would be the MOST cost-effective recommendation for reducing the number of defects encountered during software development projects?
A. increase the time allocated for system testing
B. implement formal software inspections
C. increase the development staff
D. Require the sign-off of all project deliverables
عرض الإجابة
اجابة صحيحة: A
السؤال #2
A primary benefit derived from an organization employing control self-assessment (CSA) techniques is that it can:
A. Identify high-risk areas that might need a detailed review later
B. Reduce audit costs
C. Reduce audit time
D. Increase audit accuracy
عرض الإجابة
اجابة صحيحة: C
السؤال #3
Who should be responsible for network security operations?
A. Business unit managers
B. Security administrators
C. Network administrators
D. IS auditors
عرض الإجابة
اجابة صحيحة: C
السؤال #4
An IS auditor conducting a review of software usage and licensing discovers that numerous PCs contain unauthorized software. Which of the following actions should the IS auditor take?
A. Personally delete all copies of the unauthorized softwar
B. Inform the auditee of the unauthorized software, and follow up to confirm deletio
C. Report the use of the unauthorized software and the need to prevent recurrence to auditee managemen
D. Take no action, as it is a commonly accepted practice and operations management is responsible for monitoring such us
عرض الإجابة
اجابة صحيحة: B
السؤال #5
A benefit of open system architecture is that it:
A. facilitates interoperabilit
B. facilitates the integration of proprietary component
C. will be a basis for volume discounts from equipment vendor
D. allows for the achievement of more economies of scale for equipmen
عرض الإجابة
اجابة صحيحة: A
السؤال #6
Which of the following sampling methods is MOST useful when testing for compliance?
A. Attribute sampling
B. Variable sampling
C. Stratified mean per unit
D. Difference estimation
عرض الإجابة
اجابة صحيحة: A
السؤال #7
Which of the following data validation edits is effective in detecting transposition and transcription errors?
A. Range check
B. Check digit
C. Validity check
D. Duplicate check
عرض الإجابة
اجابة صحيحة: B
السؤال #8
A sequence of bits appended to a digital document that is used to secure an e-mail sent through the Internet is called a:
A. digest signatur
B. electronic signatur
C. digital signatur
D. hash signatur
عرض الإجابة
اجابة صحيحة: B
السؤال #9
While conducting an audit, an IS auditor detects the presence of a virus. What should be the IS auditor's next step?
A. Observe the response mechanis
B. Clear the virus from the networ
C. Inform appropriate personnel immediatel
D. Ensure deletion of the viru
عرض الإجابة
اجابة صحيحة: D
السؤال #10
The most common reason for the failure of information systems to meet the needs of users is that:
A. user needs are constantly changin
B. the growth of user requirements was forecast inaccuratel
C. the hardware system limits the number of concurrent user
D. user participation in defining the system's requirements was inadequat
عرض الإجابة
اجابة صحيحة: A
السؤال #11
To assist an organization in planning for IT investments, an IS auditor should recommend the use of:
A. project management tool
B. an object-oriented architectur
C. tactical plannin
D. enterprise architecture (EA)
عرض الإجابة
اجابة صحيحة: C
السؤال #12
Which of the following is a characteristic of timebox management?
A. Not suitable for prototyping or rapid application development (RAD)
B. Eliminates the need for a quality process
C. Prevents cost overruns and delivery delays
D. Separates system and user acceptance testing
عرض الإجابة
اجابة صحيحة: C
السؤال #13
When reviewing an organization's strategic IT plan an IS auditor should expect to find:
A. an assessment of the fit of the organization's application portfolio with business objective
B. actions to reduce hardware procurement cos
C. a listing of approved suppliers of IT contract resource
D. a description of the technical architecture for the organization's network perimeter securit
عرض الإجابة
اجابة صحيحة: A
السؤال #14
An IS auditor has imported data from the client's database. The next step-confirming whether the imported data are complete-is performed by:
A. matching control totals of the imported data to control totals of the original dat
B. sorting the data to confirm whether the data are in the same order as the original dat
C. reviewing the printout of the first 100 records of original data with the first 100 records of imported dat
D. filtering data for different categories and matching them to the original dat
عرض الإجابة
اجابة صحيحة: C
السؤال #15
Effective IT governance will ensure that the IT plan is consistent with the organization's:
A. business pla
B. audit pla
C. security pla
D. investment pla
عرض الإجابة
اجابة صحيحة: A
السؤال #16
A number of system failures are occurring when corrections to previously detected errors are resubmitted for acceptance testing. This would indicate that the maintenance team is probably not adequately performing which of the following types of testing?
A. Unit testing
B. Integration testing
C. Design walk-throughs
D. Configuration management
عرض الإجابة
اجابة صحيحة: B
السؤال #17
A PRIMARY benefit derived from an organization employing control self-assessment (CSA) techniques is that it:
A. can identify high-risk areas that might need a detailed review late
B. allows IS auditors to independently assess ris
C. can be used as a replacement for traditional audit
D. allows management to relinquish responsibility for contro
عرض الإجابة
اجابة صحيحة: A
السؤال #18
A top-down approach to the development of operational policies will help ensure:
A. that they are consistent across the organizatio
B. that they are implemented as a part of risk assessmen
C. compliance with all policie
D. that they are reviewed periodicall
عرض الإجابة
اجابة صحيحة: D
السؤال #19
Which of the following is MOST critical for the successful implementation and maintenance of a security policy?
A. Assimilation of the framework and intent of a written security policy by all appropriate parties
B. Management support and approval for the implementation and maintenance of a security policy
C. Enforcement of security rules by providing punitive actions for any violation of security rules
D. Stringent implementation, monitoring and enforcing of rules by the security officer through access control software
عرض الإجابة
اجابة صحيحة: A
السؤال #20
What is/are used to measure and ensure proper network capacity management and availability of services? Choose the BEST answer.
A. Network performance-monitoring tools
B. Network component redundancy
C. Syslog reporting
D. IT strategic planning
عرض الإجابة
اجابة صحيحة: B
السؤال #21
What are used as a countermeasure for potential database corruption when two processes attempt to simultaneously edit or update the same information? Choose the BEST answer.
A. Referential integrity controls
B. Normalization controls
C. Concurrency controls
D. Run-to-run totals
عرض الإجابة
اجابة صحيحة: B
السؤال #22
Which of the following is a risk of cross-training?
A. Increases the dependence on one employee
B. Does not assist in succession planning
C. One employee may know all parts of a system
D. Does not help in achieving a continuity of operations
عرض الإجابة
اجابة صحيحة: A
السؤال #23
An IS auditor was hired to review e-business security. The IS auditor's first task was to examine each existing e-business application looking for vulnerabilities. What would be the next task?
A. Report the risks to the CIO and CEO immediately
B. Examine e-business application in development
C. Identify threats and likelihood of occurrence
D. Check the budget available for risk management
عرض الإجابة
اجابة صحيحة: A
السؤال #24
Which of the following is the most fundamental step in preventing virus attacks?
A. Adopting and communicating a comprehensive antivirus policy
B. Implementing antivirus protection software on users' desktop computers
C. Implementing antivirus content checking at all network-to-Internet gateways
D. Inoculating systems with antivirus code
عرض الإجابة
اجابة صحيحة: C
السؤال #25
How do modems (modulation/demodulation) function to facilitate analog transmissions to enter a digital network?
A. Modems convert analog transmissions to digital, and digital transmission to analo
B. Modems encapsulate analog transmissions within digital, and digital transmissions within analo
C. Modems convert digital transmissions to analog, and analog transmissions to digita
D. Modems encapsulate digital transmissions within analog, and analog transmissions within digita
عرض الإجابة
اجابة صحيحة: D
السؤال #26
A comprehensive and effective e-mail policy should address the issues of e-mail structure, policy enforcement, monitoring and:
A. recover
B. retentio
C. rebuildin
D. reus
عرض الإجابة
اجابة صحيحة: A
السؤال #27
An organization's IS audit charter should specify the:
A. short- and long-term plans for IS audit engagements
B. objectives and scope of IS audit engagement
C. detailed training plan for the IS audit staf
D. role of the IS audit functio
عرض الإجابة
اجابة صحيحة: C
السؤال #28
When auditing the proposed acquisition of a new computer system, an IS auditor should FIRST establish that:
A. a clear business case has been approved by managemen
B. corporate security standards will be me
C. users will be involved in the implementation pla
D. the new system will meet all required user functionalit
عرض الإجابة
اجابة صحيحة: C
السؤال #29
From a control perspective, the key element in job descriptions is that they:
A. provide instructions on how to do the job and define authorit
B. are current, documented and readily available to the employe
C. communicate management's specific job performance expectation
D. establish responsibility and accountability for the employee's action
عرض الإجابة
اجابة صحيحة: B
السؤال #30
Before implementing an IT balanced scorecard, an organization must:
A. deliver effective and efficient service
B. define key performance indicator
C. provide business value to IT project
D. control IT expense
عرض الإجابة
اجابة صحيحة: A
السؤال #31
Which of the following is a program evaluation review technique that considers different scenarios for planning and control projects?
A. Function Point Analysis (FPA)
B. GANTT
C. Rapid Application Development (RAD)
D. PERT
عرض الإجابة
اجابة صحيحة: C
السؤال #32
An advantage of a continuous audit approach is that it can improve system security when used in time-sharing environments that process a large number of transactions. True or false?
A. True
B. False
عرض الإجابة
اجابة صحيحة: A
السؤال #33
While conducting an audit of a service provider, an IS auditor observes that the service provider has outsourced a part of the work to another provider. Since the work involves confidential information, the IS auditor's PRIMARY concern shouldbe that the:
A. requirement for protecting confidentiality of information could be compromise
B. contract may be terminated because prior permission from the outsourcer was not obtaine
C. other service provider to whom work has been outsourced is not subject to audi
D. outsourcer will approach the other service provider directly for further wor
عرض الإجابة
اجابة صحيحة: B
السؤال #34
During the requirements definition phase of a software development project, the aspects of software testing that should be addressed are developing:
A. test data covering critical application
B. detailed test plan
C. quality assurance test specification
D. user acceptance testing specification
عرض الإجابة
اجابة صحيحة: C
السؤال #35
Information for detecting unauthorized input from a terminal would be BEST provided by the:
A. console log printou
B. transaction journa
C. automated suspense file listin
D. user error repor
عرض الإجابة
اجابة صحيحة: C
السؤال #36
To ensure compliance with a security policy requiring that passwords be a combination of letters and numbers, an IS auditor should recommend that:
A. the company policy be change
B. passwords are periodically change
C. an automated password management tool be use
D. security awareness training is delivere
عرض الإجابة
اجابة صحيحة: D
السؤال #37
How is the risk of improper file access affected upon implementing a database system?
A. Risk varie
B. Risk is reduce
C. Risk is not affecte
D. Risk is increase
عرض الإجابة
اجابة صحيحة: A
السؤال #38
IS management has decided to rewrite a legacycustomer relations system using fourth generation languages (4GLs). Which of the following risks is MOST often associated with system development using 4GLs?
A. Inadequate screen/report design facilities
B. Complex programming language subsets
C. Lack of portability across operating systems
D. Inability to perform data intensive operations
عرض الإجابة
اجابة صحيحة: D
السؤال #39
Function Point Analysis (FPA) provides an estimate of the size of an information system based only on the number and complexity of a system's inputs and outputs. True or false?
A. True
B. False
عرض الإجابة
اجابة صحيحة: C
السؤال #40
Which of the following is the initial step in creating a firewall policy?
A. A cost-benefit analysis of methods for securing the applications
B. Identification of network applications to be externally accessed
C. Identification of vulnerabilities associated with network applications to be externally accessed
D. Creation of an applications traffic matrix showing protection methods
عرض الإجابة
اجابة صحيحة: B
السؤال #41
IT control objectives are useful to IS auditors, as they provide the basis for understanding the:
A. desired result or purpose of implementing specific control procedure
B. best IT security control practices relevant to a specific entit
C. techniques for securing informatio
D. security polic
عرض الإجابة
اجابة صحيحة: C
السؤال #42
A database administrator is responsible for:
A. defining data ownershi
B. establishing operational standards for the data dictionar
C. creating the logical and physical databas
D. establishing ground rules for ensuring data integrity and securit
عرض الإجابة
اجابة صحيحة: B
السؤال #43
What are intrusion-detection systems (IDS) primarily used for?
A. To identify AND prevent intrusion attempts to a network
B. To prevent intrusion attempts to a network
C. Forensic incident response
D. To identify intrusion attempts to a network
عرض الإجابة
اجابة صحيحة: B
السؤال #44
To gain an understanding of the effectiveness of an organization's planning and management of investments in IT assets, an IS auditor should review the:
A. enterprise data mode
B. IT balanced scorecard (BSC)
C. IT organizational structur
D. historical financial statement
عرض الإجابة
اجابة صحيحة: B
السؤال #45
An offsite information processing facility having electrical wiring, air conditioning and flooring, but no computer or communications equipment is a:
A. cold sit
B. warm sit
C. dial-up sit
D. duplicate processing facilit
عرض الإجابة
اجابة صحيحة: A
السؤال #46
What kind of testing should programmers perform following any changes to an application or system?
A. Unit, module, and full regression testing
B. Module testing
C. Unit testing
D. Regression testing
عرض الإجابة
اجابة صحيحة: B
السؤال #47
Rather than simply reviewing the adequacy of access control, appropriateness of access policies, and effectiveness of safeguards and procedures, the IS auditor is more concerned with effectiveness and utilization of assets. True or false?
A. True
B. False
عرض الإجابة
اجابة صحيحة: C
السؤال #48
What can ISPs use to implement inbound traffic filtering as a control to identify IP packets transmitted from unauthorized sources? Choose the BEST answer.
A. OSI Layer 2 switches with packet filtering enabled
B. Virtual Private Networks
C. Access Control Lists (ACL)
D. Point-to-Point Tunneling Protocol
عرض الإجابة
اجابة صحيحة: A
السؤال #49
The purpose of business continuity planning and disaster-recovery planning is to:
A. Transfer the risk and impact of a business interruption or disaster
B. Mitigate, or reduce, the risk and impact of a business interruption or disaster
C. Accept the risk and impact of a business
D. Eliminate the risk and impact of a business interruption or disaster
عرض الإجابة
اجابة صحيحة: A
السؤال #50
If a database is restored from information backed up before the last system image, which of the following is recommended?
A. The system should be restarted after the last transactio
B. The system should be restarted before the last transactio
C. The system should be restarted at the first transactio
D. The system should be restarted on the last transactio
عرض الإجابة
اجابة صحيحة: C
السؤال #51
An IS auditor is assigned to audit a software development project which is more than 80 percent complete, but has already overrun time by 10 percent and costs by 25 percent. Which of the following actions should the IS auditor take?
A. Report that the organization does not have effective project managemen
B. Recommend the project manager be change
C. Review the IT governance structur
D. Review the conduct of the project and the business cas
عرض الإجابة
اجابة صحيحة: D
السؤال #52
To affix a digital signature to a message, the sender must first create a message digest by applying a cryptographic hashing algorithm against:
A. the entire message and thereafter enciphering the message digest using the sender's private ke
B. any arbitrary part of the message and thereafter enciphering the message digest using the sender's private ke
C. the entire message and thereafter enciphering the message using the sender's private ke
D. the entire message and thereafter enciphering the message along with the message digest using the sender's private ke
عرض الإجابة
اجابة صحيحة: C
السؤال #53
An IS auditor who has discovered unauthorized transactions during a review of EDI transactions is likely to recommend improving the:
A. EDI trading partner agreement
B. physical controls for terminal
C. authentication techniques for sending and receiving message
D. program change control procedure
عرض الإجابة
اجابة صحيحة: A
السؤال #54
Which of the following is the MOST critical and contributes the greatest to the quality of data in a data warehouse?
A. Accuracy of the source data
B. Credibility of the data source
C. Accuracy of the extraction process
D. Accuracy of the data transformation
عرض الإجابة
اجابة صحيحة: C
السؤال #55
Which of the following is a control over component communication failure/errors?
A. Restricting operator access and maintaining audit trails
B. Monitoring and reviewing system engineering activity
C. Providing network redundancy
D. Establishing physical barriers to the data transmitted over the network
عرض الإجابة
اجابة صحيحة: B
السؤال #56
The PRIMARY objective of an audit of IT security policies is to ensure that:
A. they are distributed and available to all staf
B. security and control policies support business and IT objective
C. there is a published organizational chart with functional description
D. duties are appropriately segregate
عرض الإجابة
اجابة صحيحة: B
السؤال #57
An organization has an integrated development environment (IDE) on which the program libraries reside on the server, but modification/development and testing are done from PC workstations. Which of the following would be a strength of an IDE?
A. Controls the proliferation of multiple versions of programs
B. Expands the programming resources and aids available
C. Increases program and processing integrity
D. Prevents valid changes from being overwritten by other changes
عرض الإجابة
اجابة صحيحة: C
السؤال #58
When an organization is outsourcing their information security function, which of the following should be kept in the organization?
A. Accountability for the corporate security policy
B. Defining the corporate security policy
C. Implementing the corporate security policy
D. Defining security procedures and guidelines
عرض الإجابة
اجابة صحيحة: B
السؤال #59
What should an IS auditor do if he or she observes that project-approval procedures do not exist?
A. Advise senior management to invest in project-management training for the staff
B. Create project-approval procedures for future project implementations
C. Assign project leaders
D. Recommend to management that formal approval procedures be adopted and documented
عرض الإجابة
اجابة صحيحة: A
السؤال #60
An appropriate control for ensuring the authenticity of orders received in an EDI application is to:
A. acknowledge receipt of electronic orders with a confirmation messag
B. perform reasonableness checks on quantities ordered before filling order
C. verify the identity of senders and determine if orders correspond to contract term
D. encrypt electronic order
عرض الإجابة
اجابة صحيحة: B
السؤال #61
Which of the following is normally a responsibility of the chief security officer (CSO)?
A. Periodically reviewing and evaluating the security policy
B. Executing user application and software testing and evaluation
C. Granting and revoking user access to IT resources
D. Approving access to data and applications
عرض الإجابة
اجابة صحيحة: B
السؤال #62
An IS auditor is performing an audit of a remotely managed server backup. The IS auditor reviews the logs for one day and finds one case where logging on a server has failed with the result that backup restarts cannot be confirmed. What should the auditor do?
A. Issue an audit finding
B. Seek an explanation from IS management
C. Review the classifications of data held on the server
D. Expand the sample of logs reviewed
عرض الإجابة
اجابة صحيحة: A
السؤال #63
Which of the following should be included in an organization's IS security policy?
A. A list of key IT resources to be secured
B. The basis for access authorization
C. Identity of sensitive security features
D. Relevant software security features
عرض الإجابة
اجابة صحيحة: D
السؤال #64
Proper segregation of duties does not prohibit a quality control administrator from also being responsible for change control and problem management. True or false?
A. True
B. False
عرض الإجابة
اجابة صحيحة: B
السؤال #65
Change control for business application systems being developed using prototyping could be complicated by the:
A. iterative nature of prototypin
B. rapid pace of modifications in requirements and desig
C. emphasis on reports and screen
D. lack of integrated tool
عرض الإجابة
اجابة صحيحة: C
السؤال #66
An IS auditor interviewing a payroll clerk finds that the answers do not support job descriptions and documented procedures. Under these circumstances, the IS auditor should:
A. conclude that the controls are inadequat
B. expand the scope to include substantive testin
C. place greater reliance on previous audit
D. suspend the audi
عرض الإجابة
اجابة صحيحة: A
السؤال #67
The risks associated with electronic evidence gathering would MOST likely be reduced by an e-mail:
A. destruction polic
B. security polic
C. archive polic
D. audit polic
عرض الإجابة
اجابة صحيحة: B
السؤال #68
What increases encryption overhead and cost the most?
A. A long symmetric encryption key
B. A long asymmetric encryption key
C. A long Advance Encryption Standard (AES) key
D. A long Data Encryption Standard (DES) key
عرض الإجابة
اجابة صحيحة: A
السؤال #69
Which of the following BEST ensures the integrity of a server's operating system?
A. Protecting the server in a secure location
B. Setting a boot password
C. Hardening the server configuration
D. Implementing activity logging
عرض الإجابة
اجابة صحيحة: D
السؤال #70
Who is ultimately responsible and accountable for reviewing user access to systems?
A. Systems security administrators
B. Data custodians
C. Data owners
D. Information systems auditors
عرض الإجابة
اجابة صحيحة: B
السؤال #71
Which of the following provides the strongest authentication for physical access control?
A. Sign-in logs
B. Dynamic passwords
C. Key verification
D. Biometrics
عرض الإجابة
اجابة صحيحة: A
السؤال #72
What is a callback system?
A. It is a remote-access system whereby the remote-access server immediately calls the user back at a predetermined number if the dial-in connection fail
B. It is a remote-access system whereby the user's application automatically redials the remoteaccess server if the initial connection attempt fail
C. It is a remote-access control whereby the user initially connects to the network systems via dial-up access, only to have the initial connection terminated by the server, which then subsequently dials the user back at a predetermined number stored in the server's configuration databas
D. It is a remote-access control whereby the user initially connects to the network systems via dial-up access, only to have the initial connection terminated by the server, which then subsequently allows the user to call back at an approved number for a limited period of tim
عرض الإجابة
اجابة صحيحة: A

عرض الإجابات بعد التقديم

يرجى إرسال البريد الإلكتروني الخاص بك والواتس اب للحصول على إجابات الأسئلة.

ملحوظة: يرجى التأكد من صلاحية معرف البريد الإلكتروني وWhatsApp حتى تتمكن من الحصول على نتائج الاختبار الصحيحة.

بريد إلكتروني:
رقم الواتس اب/الهاتف:


Copyright © 2024. Designer by SPOTO Official Website. All Rights Reserved.