CISA Exam Dumps - Certified Information Systems Auditor

Consolidating multiple applications on asingle serverincreases the risk that aserver outagewillimpact multiple applicationssimultaneously.

More Applications Affected by Outage (Correct Answer – B)

Asingle point of failurecoulddisrupt multiple services.

Example:If aconsolidated server crashes, all hosted applications gooffline.

Higher OS License Fees (Incorrect – A)

License feesmay increase, butdowntime risk is a greater concern.

Simplified Asset Management (Incorrect – C)

True, butdoes not outweigh the availability risk.

Fewer Vulnerability Scans (Incorrect – D)

Reducing the number of serversdoes not reduce security risks.

 An IS auditor is conducting a review of a data center. An observation that could indicate an access control issue is muddy footprints directly inside the emergency exit. Access control is a process that ensures that only authorized entities or individuals can access or use an information system or resource, and prevents unauthorized access or use. Access control can be implemented using various methods or mechanisms, such as physical, logical, administrative, etc. Muddy footprints directly inside the emergency exit could indicate an access control issue, as they could suggest that someone has entered the data center through the emergency exit without proper authorization or authentication, and potentially compromised the security or integrity of the data center. Security cameras deployed outside main entrance is not an observation that could indicate an access control issue, but rather a control that could enhance access control, as security cameras are devices that capture and record video footage of the surroundings, and can help monitor and deter unauthorized access or activity. Antistatic mats deployed at the computer room entrance is not an observation that could indicate an access control issue, but rather a control that could prevent static electricity damage, as antistatic mats are devices that dissipate or reduce static charges from people or objects, and can help protect electronic equipment from electrostatic discharge (ESD). Fencing around facility is two meters high is not an observation that could indicate an access control issue, but rather a control that could improve physical security, as fencing is a barrier that encloses or surrounds an area, and can help prevent unauthorized entry or intrusion. 

Answer: B

The correct answer is B. Determine if the business process owner has signed off on the results.

User acceptance testing confirms whether the system meets business requirements and is acceptable for use by the business. For an ERP implementation, business process owners are responsible for validating whether the system supports required business processes, controls, workflows, reports, and transaction processing. Their signoff is the key evidence that the business accepts the system.

Option A is not the best answer because communicating errors is useful, but it does not prove the system was accepted by the business. Option C is not the best answer because system integration testing is normally performed before or alongside UAT, but UAT focuses on business acceptance. Option D is important in an ERP environment, but interface testing is a technical/system testing concern, not the primary focus of UAT review.

This maps to Information Systems Acquisition, Development and Implementation, because ISACA’s CISA Exam Content Outline includes implementation testing, system readiness, requirements validation, and post-implementation activities in Domain 3.

The correct answer is A. To structure IT projects to achieve desired business results.

Enterprise architecture provides a structured view of the organization’s business, information, application, and technology architecture. Its purpose is to ensure that IT initiatives and solutions support the organization’s strategy, mission, business goals, and target operating model.

ISACA explains that enterprise architecture supports a holistic organizational view and helps design business, information, and technology architecture. ISACA also describes EA as a framework used to architect the operating or business model and systems to meet vision, mission, and business goals and deliver enterprise strategy.

Option B is too narrow because EA guides the architecture of systems and capabilities, but it is not mainly about designing and implementing individual systems. Option C is not correct because day-to-day IT operations are handled through IT service management and operations management. Option D is also too narrow because network security is only one part of the broader enterprise architecture.

This question maps to Governance and Management of IT, because enterprise architecture supports IT strategy, business alignment, governance, and IT investment decision-making.

The best method to prevent wire transfer fraud by bank employees is system-enforced dual control. System-enforced dual control is a segregation of duties control that requires two or more individuals to perform or authorize a transaction or activity using a system that enforces this requirement. System-enforced dual control can prevent wire transfer fraud by requiring independent verification and approval of payment requests, amounts, and recipients by different bank employees using a system that does not allow any single employee to complete the transaction alone. The other options are not as effective as system-enforced dual control in preventing wire transfer fraud, as they do not involve independent checks or approvals using a system. Independent reconciliation is a detective control that can help compare and confirm payment records with bank statements, but it does not prevent wire transfer fraud from occurring. Re-keying of wire dollar amounts is an input control that can help detect any errors or discrepancies in payment amounts, but it does not prevent wire transfer fraud from occurring. Two-factor authentication control is an access control that can help verify the identity and authorization of bank employees, but it does not prevent wire transfer fraud from occurring. References: CISA Review Manual (DigitalVersion), Chapter 3, Section 3.2

The most effective method of destroying sensitive data stored on electronic media is physical destruction, which involves breaking, shredding, melting, or incinerating the media to make it unreadable and unrecoverable. Degaussing, random character overwrite, and low-level formatting are methods of sanitizing or erasing data from electronic media, but they do not guarantee complete destruction of data and may leave some traces that can be recovered by advanced techniques. Therefore, physical destruction is the most secure and reliable method of data disposal for sensitive data. References: CISA Review Manual (Digital Version), Chapter 5: Protection of Information Assets, Section 5.4: Data Disposal