CISA Online Practice Questions and Answers

Correct Answer: A

The primary area of focus when an organization decides to outsource technical support for its external customers is to align service level agreements (SLAs) with current needs. SLAs are contracts that define the scope, quality, and

expectations of the services provided by the vendor, as well as the remedies or penalties for non-compliance. SLAs are essential for ensuring that the outsourced technical support meets the customer's requirements and satisfaction, as well

as the organization's objectives and standards. By aligning SLAs with current needs, the organization can specify the key performance indicators (KPIs), metrics, and targets that reflect the desired outcomes and value of the technical support.

This can also help to monitor and evaluate the vendor's performance, identify gaps or issues, and implement corrective actions or improvements.

References:

Service Level Agreement (SLA) Examples and Template What is an SLA? Best practices for service-level agreements

Correct Answer: B

The best way to ensure data integrity across system interfaces is to perform reconciliation. Reconciliation is the process of comparing and verifying the data from different sources or systems to ensure that they are consistent, accurate, and complete. Reconciliation can help to identify and resolve any discrepancies, errors, or anomalies in the data that could affect the quality, reliability, or validity of the information. Reconciliation can also help to detect and prevent any unauthorized or fraudulent data manipulation or modification. References: CISA Review Manual (Digital Version) CISA Questions, Answers and Explanations Database

Correct Answer: D

Recovery facilities providing a redundant combination of Internet connections to the local communications loop is an example of last-mile circuit protection. Last-mile circuit protection is a type of telecommunications continuity that ensures the availability and redundancy of the final segment of the network that connects the end-user to the service provider. The local communications loop, also known as the local loop or subscriber line, is the physical link between the customer premises and the nearest central office or point of presence of the service provider. By having multiple Internet connections from different providers or technologies, such as cable, DSL, fiber, wireless, or satellite, the recovery facilities can avoid losing connectivity in case one of the connections fails or is disrupted by a disaster5. References:

9: Last Mile Redundancy - How to Ensure Business Continuity - Multapplied Networks

Correct Answer: C

An organization is shifting to a remote workforce. In preparation, the IT department is performing stress and capacity testing of remote access infrastructure and systems. This type of control is being implemented to direct or guide actions to achieve a desired outcome. Therefore, it is a directive control. Directive controls are proactive controls that seek to prevent undesirable events from occurring. They include policies, standards, procedures, guidelines, training, and testing. Detective controls are reactive controls that seek to identify undesirable events that have already occurred. They include monitoring, logging, auditing, and reporting. Preventive controls are proactive controls that seek to avoid undesirable events from occurring. They include authentication, encryption, firewalls, and antivirus software. Compensating controls are alternative controls that provide a similar level of protection as the primary controls when the primary controls are not feasible or cost-effective. They include segregation of duties, manual reviews, and backup systems. References: CISA Review Manual (Digital Version), [ISACA Glossary of Terms]

Correct Answer: A

Correct Answer: C

A single point of failure is a component or system that, if it fails, will cause the entire system to stop functioning. In virtual environments, the hypervisor is the software layer that enables multiple virtual machines to run on a single physical host.

If the hypervisor is compromised, corrupted, or unavailable, all the virtual machines running on that host will be affected. This can result in data loss, downtime, or security breaches.

References:

ISACA CISA Review Manual, 27th Edition, page 254

Virtualization: What are the security risks?

What Is a Hypervisor? (Definition, Types, Risks)

Correct Answer: C

The best indicator of the performance of a web application is the average response time. This metric measures how long it takes for the web server to process and deliver a request from the client. It reflects the user's perception of how fast or slow the web application is, and it affects the user's satisfaction, engagement, and conversion. A low average response time means that the web application is responsive and efficient, while a high average response time means that the web application is sluggish and unreliable. HTTP server error rate, server thread count, and server uptime are not as good indicators of the performance of a web application as the average response time. HTTP server error rate measures how often the web server fails to handle a request and returns an error code, such as 404 (Not Found) or 500 (Internal Server Error). This metric indicates the reliability and availability of the web application, but it does not capture how fast or slow the web application is. Server thread count measures how many concurrent requests the web server can handle at a given time. This metric indicates the scalability and capacity of the web application, but it does not capture how long each request takes to process. Server uptime measures how long the web server has been running without interruption. This metric indicates the stability and resilience of the web application, but it does not capture how well the web application performs during that time. References: 10 Key Application Performance Metrics and How to Measure Them - Stackify Measuring performance - Learn web development | MDN2 Understanding the Basics of Web Performance | BrowserStack 14 Important Website Performance Metrics You Should Be Analyzing Top 8 Web Application Performance Metrics | MetricFire Blog5 Web Performance Monitoring: A How to Guide for Developers - Stackify

Correct Answer: C

Information security governance is the subset of enterprise governance that provides strategic direction, ensures that objectives are achieved, manages risk appropriately, uses organizational resources responsibly, and monitors the success or failure of the enterprise security program. Information security governance is essential for ensuring that an organization's information assets are protected from internal and external threats, and that the organization complies with relevant laws and standards. Demonstrated support from which of the following roles in an organization has the most influence over information security governance? The answer is C, the board of directors. The board of directors is the highest governing body of an organization, responsible for overseeing its strategic direction, performance, and accountability. The board of directors sets the tone at the top for information security governance by: Establishing a clear vision, mission, and values for information security Approving and reviewing information security policies and standards Allocating sufficient resources and budget for information security Appointing and empowering a chief information security officer (CISO) or equivalent role Holding management accountable for information security performance and compliance Communicating and promoting information security awareness and culture The board of directors has the most influence over information security governance because it has the ultimate authority and responsibility for ensuring that information security is aligned with the organization's business objectives, risks, and stakeholder expectations. References:

10: What is Information Security Governance? -- RiskOptics - Reciprocity

11: Information Security Governance and Risk Management | Moss Adams

12: ISO/IEC 27014:2020 - Information security, cybersecurity and privacy ...

Correct Answer: D

Correct Answer: C