GET Real ISACA Cybersecurity-Audit-Certificate Exam Questions With 100% Refund Guarantee Feb 21, 2025 [Q72-Q93]

Rate this post

GET Real ISACA Cybersecurity-Audit-Certificate Exam Questions With 100% Refund Guarantee Feb 21, 2025

Get Special Discount Offer on Cybersecurity-Audit-Certificate Dumps PDF

ISACA Cybersecurity-Audit-Certificate Exam Syllabus Topics:

Topic	Details
Topic 1	Cybersecurity Technology Topics: This section of the exam covers the comprehension of cybersecurity tools, technologies, and their applications.
Topic 2	Cybersecurity and Audit’s Role: In this part of the exam, the topics covered the intersection of cybersecurity and auditing practices.
Topic 3	Cybersecurity Operations: This section of the exam covers hands-on skills for defending against and responding to cyberattacks.
Topic 4	Cybersecurity Governance: This part of the exam covers knowledge of cybersecurity frameworks, policies, and risk management.

NO.72 Which of the following BIST enables continuous identification and mitigation of security threats to an organization?

demit/ and access management (1AM)

Security operations center (SOC)

Security training and awareness

Security information and event management (SEM)

Explanation
A security operations center (SOC) is a centralized unit that monitors, detects, analyzes, and responds to cyber threats and incidents in real time. A SOC enables continuous identification and mitigation of security threats to an organization by using various tools, processes, and expertise.

NO.73 Which of the following is the MOST serious consequence of mobile device loss or theft?

Cost of purchasing replacement devices

Physical damage to devices

Installation of unauthorized applications

Compromise of transient data

The MOST serious consequence of mobile device loss or theft is the compromise of transient data. Transient data is data that is temporarily stored or processed on a mobile device, such as cached data, cookies, browsing history, passwords, or session tokens. Transient data can reveal sensitive information about the user or the organization and can be exploited by attackers to gain access to other systems or networks.

NO.74 Which of the following would provide the BEST basis for allocating proportional protection activities when comprehensive classification is not feasible?

Single classification level allocation

Business process re-engineering

Business dependency assessment

Comprehensive cyber insurance procurement

The BEST basis for allocating proportional protection activities when comprehensive classification is not feasible is a business dependency assessment. This is because a business dependency assessment helps to identify the criticality and sensitivity of business processes and their supporting assets, based on their contribution to the organization’s objectives and value proposition. This allows for prioritizing protection activities according to the level of risk and impact. The other options are not as effective as a business dependency assessment, because they either use a single classification level allocation (A), which does not account for different levels of risk and impact; require a significant amount of time and resources to perform a business process re-engineering (B); or rely on external parties to cover potential losses without reducing the likelihood or impact of incidents (D).

NO.75 Availability can be protected through the use of:

user awareness training and related end-user training.

access controls. We permissions, and encryption.

logging, digital signatures, and write protection.

redundancy, backups, and business continuity management

Explanation
Availability can be protected through the use of redundancy, backups, and business continuity management.
This is because these measures help to ensure that systems, data, and services are accessible and functional at all times, even in the event of a disruption or disaster. The other options are not directly related to protecting availability, but rather focus on enhancing confidentiality (A), integrity C, or awareness (D).

NO.76 What would be an IS auditor’s BEST response to an IT managers statement that the risk associated with the use of mobile devices in an organizational setting is the same as for any other device?

Replication of privileged access and the greater likelihood of physical loss increases risk levels.

The risk associated with mobile devices is less than that of other devices and systems.

The risk associated with mobile devices cannot be mitigated with similar controls for workstations.

The ability to wipe mobile devices and disable connectivity adequately mitigates additional

Explanation
The BEST response to an IT manager’s statement that the risk associated with the use of mobile devices in an organizational setting is the same as for any other device is that replication of privileged access and the greater likelihood of physical loss increases risk levels. Mobile devices pose unique risks to an organization due to their portability, connectivity, and functionality. Mobile devices may store or access sensitive data or systems that require privileged access, which can be compromised if the device is lost, stolen, or hacked. Mobile devices also have a higher chance of being misplaced or taken by unauthorized parties than other devices.

NO.77 Which of the following is the MOST relevant type of audit to conduct when fraud has been detected following an incident?

Cybersecurity audit

Financial audit

Forensics audit

Cyber insurance audit

When fraud has been detected following an incident, a forensics audit is the most relevant type of audit to conduct. A forensics audit is specifically designed to investigate and uncover evidence of fraud, misconduct, or other financial crimes. It involves the use of auditing and investigative skills to examine financial records, identify irregularities, and gather evidence that can be used in legal proceedings1.

NO.78 A data loss prevention (DLP) program helps protect an organization from:

crypto ransomware infection.

unauthorized access to servers and applications.

unauthorized data modification.

exfiltration of sensitive data.

A data loss prevention (DLP) program helps protect an organization from exfiltration of sensitive data. This is because exfiltration of sensitive data is a type of cyberattack that involves stealing or leaking sensitive or confidential information from an organization’s systems or networks to an external destination or party. Exfiltration of sensitive data can cause serious harm to an organization’s reputation, operations, finances, legal compliance, etc. A DLP program helps to prevent exfiltration of sensitive data by detecting and blocking any unauthorized or suspicious attempts to access, copy, transfer, or share sensitive data by users or applications. The other options are not cyberattacks that a DLP program helps protect an organization from, but rather different types of cyberattacks that affect other aspects or objectives of information security, such as crypto ransomware infection (A), unauthorized access to servers and applications (B), or unauthorized data modification C.

NO.79 Which intrusion detection system component is responsible for collecting data in the form of network packets, log files, or system call traces?

Packet filters

Analyzers

Administration modules

Sensors

Explanation
The intrusion detection system component that is responsible for collecting data in the form of network packets, log files, or system call traces is sensors. This is because sensors are components of an intrusion detection system that are deployed on various locations or points of the network or system, such as routers, switches, servers, etc., and that capture and collect data from the network traffic or system activities. Sensors then forward the collected data to another component of the intrusion detection system, such as analyzers, for further processing and analysis. The other options are not components of an intrusion detection system that are responsible for collecting data in the form of network packets, log files, or system call traces, but rather different components or techniques that are related to intrusion detection or prevention, such as packet filters (A), analyzers (B), or administration modules C.

NO.80 in key protection/management, access should be aligned with which of the following?

System limitation

Least privilege

Position responsibilities

Role descriptions

In key protection/management, access should be aligned with the principle of least privilege. This means that users should only have the minimum level of access required to perform their tasks and no more. This reduces the risk of unauthorized access, misuse, or compromise of sensitive data or systems.

NO.81 Strong data loss prevention (DLP) solutions help protect information in which of the following states?

At rest, in transit and in use

Operating system application and database levels

Public restricted, and confidential

Data sent, data received, and data deleted

Strong data loss prevention (DLP) solutions help protect information in all states: at rest, in transit and in use. This is because DLP solutions are technologies or tools that help to prevent unauthorized or accidental disclosure, modification, or deletion of sensitive or confidential information by users or applications. DLP solutions help to protect information in all states, by applying different types of controls or mechanisms depending on the state of the information. For example, DLP solutions can protect information at rest by encrypting or masking the data stored on devices or media; protect information in transit by inspecting or filtering the data transmitted over networks or channels; and protect information in use by restricting or monitoring the access or usage of the data by users or applications. The other options are not states that strong data loss prevention (DLP) solutions help protect information in, but rather different levels (B), classifications C, or actions (D) that are related to information security.

NO.82 Which of the following is a more efficient form of public key cryptography as it demands less computational power and offers more security per bit?

Diffie-Hellman Key Agreement

Digital Signature Standard

Secret Key Cryptography

Elliptic Curve Cryptography

Elliptic curve cryptography (ECC) is a more efficient form of public key cryptography as it demands less computational power and offers more security per bit. ECC is based on the mathematical properties of elliptic curves, which are curves that have a special shape that makes them suitable for cryptography. ECC can achieve the same level of security as other public key algorithms with much smaller key sizes, which reduces storage and bandwidth requirements.

NO.83 Which of the following is a feature of a stateful inspection firewall?

It tracks the destination IP address of each packet that leaves the organization’s internal network.

It is capable of detecting and blocking sophisticated attacks

It prevents any attack initiated and originated by an insider.

It translates the MAC address to the destination IP address of each packet that enters the organization’s internal network.

Explanation
A feature of a stateful inspection firewall is that it is capable of detecting and blocking sophisticated attacks. A stateful inspection firewall is a type of firewall that monitors and analyzes the state and context of network traffic. It keeps track of the source, destination, protocol, port, and session information of each packet and compares it with a set of predefined rules. A stateful inspection firewall can detect and block attacks that exploit the logic or behavior of network protocols or applications, such as fragmentation attacks, session hijacking, or application-layer attacks.

NO.84 Which of the following cloud characteristics refers to resource utilization that can be optimized by leveraging charge-per-use capabilities?

On demand self-service

Elasticity

Measured service

Resource pooling

Explanation
The cloud characteristic that refers to resource utilization that can be optimized by leveraging charge-per-use capabilities is measured service. This is because measured service is a characteristic of cloud computing that involves monitoring, controlling, and reporting on the usage and consumption of cloud resources by cloud providers and consumers. Measured service helps to optimize resource utilization by leveraging charge-per-use capabilities, which means that cloud consumers only pay for the amount of resources that they actually use or consume, rather than paying for fixed or predetermined amounts of resources. The other options are not cloud characteristics that refer to resource utilization that can be optimized by leveraging charge-per-use capabilities, but rather different characteristics of cloud computing that describe other aspects or benefits of cloud services, such as on demand self-service (A), elasticity (B), or resource pooling (D).

NO.85 Cyber threat intelligence aims to research and analyze trends and technical developments in which of the following areas?

Cybersecurity risk scenarios

Cybercrime, hacktism. and espionage

Cybersecurity operations management

Industry-specific security regulator

Explanation
Cyber threat intelligence aims to research and analyze trends and technical developments in the areas of cybercrime, hacktivism, and espionage. These are the main sources of malicious cyber activities that pose risks to organizations and individuals. Cyber threat intelligence helps to understand the motivations, capabilities, tactics, techniques, and procedures of various threat actors and groups.

NO.86 The protection of information from unauthorized access or disclosure is known as:

access control.

cryptograph

media protect on.

confidentiality.

The protection of information from unauthorized access or disclosure is known as confidentiality. This is because confidentiality is one of the three main objectives of information security, along with integrity and availability. Confidentiality ensures that information is accessible and readable only by those who are authorized and intended to do so, and prevents unauthorized or accidental exposure of information to unauthorized parties. The other options are not the protection of information from unauthorized access or disclosure, but rather different concepts or techniques that are related to information security, such as access control (A), cryptography (B), or media protection C.

NO.87 Which of the following is an example of an application security control?

Secure coding

User security awareness training

Security operations center

Intrusion detection

Explanation
An example of an application security control is secure coding. Secure coding is the practice of developing software applications that follow security principles and standards to prevent or mitigate common vulnerabilities and risks. Secure coding involves applying techniques such as input validation, output encoding, error handling, encryption, and testing.

NO.88 What is the FIRST activity associated with a successful cyber attack?

Exploitation

Reconnaissance

Maintaining a presence

Creating attack tools

The FIRST activity associated with a successful cyber attack is reconnaissance. This is because reconnaissance is a phase of the cyber attack lifecycle that involves gathering information about the target organization or system, such as its network topology, IP addresses, open ports, services, vulnerabilities, etc. Reconnaissance helps to identify potential entry points and weaknesses that can be exploited by the attackers in later phases of the attack. The other options are not the first activity associated with a successful cyber attack, but rather follow after reconnaissance in the cyber attack lifecycle, such as exploitation (A), maintaining a presence C, or creating attack tools (D).

NO.89 Which type of tools look for anomalies in user behavior?

Rootkit detection tools

Trend/variance-detection tools

Audit reduction tools

Attack-signature-detection tools

Explanation
Trend/variance-detection tools are tools that look for anomalies in user behavior. These tools use statistical methods to establish a baseline of normal user activity and then compare it with current or historical data to identify deviations or outliers. These tools can help to detect unauthorized access, fraud, insider threats, or other malicious activities.

NO.90 Which of the following is the MOST cost-effective technique for implementing network security for human resources (HR) desktops and internal laptop users in an organization?

Fortified demilitarized zone

Software defined perimeter

Layer 3 virtual private network

Virtual local area network

Explanation
The MOST cost-effective technique for implementing network security for human resources (HR) desktops and internal laptop users in an organization is using a virtual local area network (VLAN). A VLAN is a logical grouping of network devices that share the same broadcast domain regardless of their physical location or connection. A VLAN can enhance network security by isolating different types of traffic or users from each other and applying different security policies or rules based on the VLAN membership. For example, an organization can create a VLAN for HR desktops and internal laptop users that restricts their access to only HR-related systems or resources. A VLAN can also reduce network costs by saving bandwidth, improving performance, and simplifying management.

NO.91 Which of the following is a limitation of intrusion detection systems (IDS)?

Limited evidence on intrusive activity

Application-level vulnerabilities

Lack of Interface with system tools

Weak passwords for the administration console

A limitation of intrusion detection systems (IDS) is that they cannot detect application-level vulnerabilities. An IDS is a tool that monitors network traffic or system activity and alerts on any suspicious or malicious events. However, an IDS cannot analyze the logic or functionality of applications and identify vulnerabilities such as SQL injection, cross-site scripting, or broken authentication.

NO.92 During which incident response phase is evidence obtained and preserved?

Lessons learned

Containment

Eradication

Recovery

During the containment phase, the immediate response to an incident involves limiting its scope and magnitude, which includes preserving evidence. This is crucial for a subsequent forensic analysis and for learning lessons from the incident to prevent future occurrences.
Reference = The containment phase is part of the incident response process as outlined in ISACA’s resources, which include steps such as detection and analysis, containment, eradication, recovery, and post-incident activities12.

NO.93 he MOST significant limitation of vulnerability scanning is the fact that modern scanners only detect:

common vulnerabilities.

unknown vulnerabilities.

known vulnerabilities.

zero-day vulnerabilities.

The MOST significant limitation of vulnerability scanning is the fact that modern scanners only detect known vulnerabilities. This is because vulnerability scanners rely on databases or repositories of known vulnerabilities, such as CVE (Common Vulnerabilities and Exposures), to compare and identify the weaknesses or flaws in systems or applications. Vulnerability scanners cannot detect unknown vulnerabilities, such as zero-day vulnerabilities, that have not been reported or disclosed yet, and may be exploited by attackers before they are patched or fixed. The other options are not the most significant limitation of vulnerability scanning, because they either involve detecting common (A), unknown (B), or zero-day (D) vulnerabilities, which are not the capabilities or limitations of modern scanners.

Loading …