CISA practice questions 131–140

1. Question 131 · 1459 in bank

   An organization has implemented a distributed security administration system to replace the previous centralized one. Which of the following presents the GREATEST potential concern?

   • AA distributed security system is inherently a weak security system.
   • BThe new system will require additional resources.
   • CSecurity procedures may be inadequate to support the change.
   • DEnd-user acceptance of the new system may be difficult to obtain.

   Show answer

   Answer: C

   Explanation

   When transitioning from a centralized to a distributed security administration system, it's crucial to ensure that security procedures are updated and aligned with the new system's architecture and requirements. Inadequate security procedures may lead to vulnerabilities, misconfigurations, and increased risks to the organization's information security. It's essential to address security considerations during the implementation to maintain a robust and secure security administration system.

   Source: Adapted from community discussion — FAGFUR

   Next question

2. Question 132 · 1459 in bank

   Which of the following is the GREATEST benefit of adopting an international IT governance framework rather than establishing a new framework based on the actual situation of a specific organization?

   • AComprehensive coverage of fundamental and critical risk and control areas for IT governance
   • BFewer resources expended on trial-and-error attempts to fine-tune implementation methodologies
   • CReadily available resources such as domains and risk and control methodologies
   • DWide acceptance by different business and support units with IT governance objectives

   Show answer

   Answer: A

   Next question

3. Question 133 · 1459 in bank

   Which of the following fire suppression systems needs to be combined with an automatic switch to shut down the electricity supply in the event of activation?

   • AFM-200
   • BDry pipe
   • CCarbon dioxide
   • DHalon

   Show answer

   Answer: B

   Explanation

   Carbon dioxide (CO2) fire suppression systems are designed to extinguish fires by reducing the level of oxygen that supports combustion. However, CO2 systems pose a significant risk to human life because they can lead to suffocation if individuals are present in the area when the system discharges. Due to this risk, CO2 systems are often used in unoccupied spaces or are designed to allow for evacuation before discharge. In addition to the risk to humans, the use of CO2 as a fire suppression agent does not remove the electrical energy that may have caused the fire, potentially allowing the fire to reignite once the CO2 has dissipated. Therefore, it's important that these systems be combined with an automatic switch to shut down the electricity supply in the event of activation. This helps ensure that the electrical source of the fire is also cut off, preventing re-ignition.

   Source: Adapted from community discussion — mdh717

   Next question

4. Question 134 · 1459 in bank

   Which of the following would provide the BEST evidence of the effectiveness of mandated annual security awareness training?

   • ATrending of social engineering test results
   • BSurveys completed by randomly selected employees
   • CNumber of security incidents
   • DResults of a third-party penetration test

   Show answer

   Answer: A

   Explanation

   Trending social engineering test results over time provides a direct measure of how well employees are applying the security awareness training to identify and resist social engineering attacks. Monitoring the success or failure rates of simulated social engineering tests helps gauge the impact of the training on employees' ability to recognize and respond to security threats. This evidence is more specific and directly related to the training's effectiveness compared to other options such as general surveys, the number of security incidents, or third-party penetration test results.

   Source: Adapted from community discussion — FAGFUR

   Next question

5. Question 135 · 1459 in bank

   An organization uses public key infrastructure (PKI) to provide email security. Which of the following would be the MOST efficient method to determine whether email messages have been modified in transit?

   • AThe message is sent along with an encrypted hash of the message.
   • BThe message is sent using Transport Layer Security (TLS) protocol.
   • CThe message is encrypted using a symmetric algorithm.
   • DThe message is encrypted using the private key of the sender.

   Show answer

   Answer: A

   Explanation

   This method involves creating a digital signature by encrypting a hash of the message with the sender's private key. The recipient can then use the sender's public key to decrypt the signature and compare it with a newly computed hash of the received message. If the two hashes match, it indicates that the message has not been modified in transit. Digital signatures provide integrity and authenticity verification for email messages.

   Source: Adapted from community discussion — FAGFUR

   Next question

6. Question 136 · 1459 in bank

   An IT steering committee assists the board of directors in fulfilling IT governance duties by:

   • Aoverseeing major projects and IT resource allocation.
   • Bapproving IT security awareness training content.
   • Cassigning IT services to infrastructure components.
   • Ddeveloping IT policies and procedures for project tracking.

   Show answer

   Answer: A

   Explanation

   The primary role of an IT steering committee is to provide oversight and guidance on major IT projects and resource allocation. It ensures that IT initiatives align with the organization's strategic objectives and priorities. While other activities such as approving IT security awareness training content, assigning IT services to infrastructure components, and developing IT policies and procedures may be important, overseeing major projects and resource allocation is the key responsibility that directly supports the board in fulfilling its IT governance duties.

   Source: Adapted from community discussion — FAGFUR

   Next question

7. Question 137 · 1459 in bank

   Which of the following provides the MOST comprehensive information about inherent risk within an organization?

   • AVulnerability analysis
   • BRisk assessments
   • CRisk-based audit findings
   • DBusiness impact analysis (BIA)

   Show answer

   Answer: B

   Explanation

   Risk assessments involve the identification, analysis, and evaluation of potential risks that an organization faces. They consider various factors, including vulnerabilities, threats, and potential impacts on the business. A thorough risk assessment helps in understanding the inherent risks an organization is exposed to, allowing for informed decision-making and the development of effective risk management strategies.

   Source: Adapted from community discussion — FAGFUR

   Next question

8. Question 138 · 1459 in bank

   Which of the following is MOST critical to the success of an information security program?

   • AUser accountability for information security
   • BAlignment of information security with IT objectives
   • CIntegration of business and information security
   • DManagement’s commitment to information security

   Show answer

   Answer: D

   Explanation

   While user accountability, alignment of information security with IT objectives, and integration of business and information security are important aspects of a robust information security program, without strong commitment and support from top management, it is challenging to implement and sustain effective security measures. Management's commitment ensures the allocation of resources, support for policies and procedures, and a culture of security throughout the organization.

   Source: Adapted from community discussion — FAGFUR

   Next question

9. Question 139 · 1459 in bank

   The MOST important measure of the effectiveness of an organization's security program is the:

   • Acomparison with critical incidents experienced by competitors.
   • Badverse impact of incidents on critical business activities.
   • Cnumber of vulnerability alerts escalated to senior management.
   • Dnumber of new vulnerabilities reported.

   Show answer

   Answer: B

   Explanation

   The effectiveness of a security program is ultimately determined by its ability to minimize the adverse impact of security incidents on critical business activities. While tracking the number of vulnerability alerts and reported vulnerabilities is important, the true measure of success lies in how well the security program mitigates risks and protects the organization's key business functions and assets.

   Source: Adapted from community discussion — FAGFUR

   Next question

10. Question 140 · 1459 in bank

    Which of the following is the MOST important environmental equipment that should be located above the false ceiling of a data center?

    • AAir pressure sensors
    • BMotion detectors
    • CSmoke detectors
    • DHumidity sensors

    Show answer

    Answer: C

    Explanation

    Smoke detectors are crucial for the early detection of potential fires in a data center. Early detection allows for a rapid response to mitigate the risk of fire-related damage to critical IT equipment and infrastructure.

    Source: Adapted from community discussion — FAGFUR

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISA practice, question 131. 1459 questions available.