CISA EXAM 182questions with
correct answers
A bridge - CORRECT ANSWER-operates at level 2 of the OSI layer and is used to connect two LANs using different protocols (e.g., joining an
ethernet and token network) to form a logical network. Bridges reduce the amount of traffic on a LAN by dividing it into two segments. Bridges
inspect incoming traffic and decide whether to forward or discard it. An Ethernet bridge, for example, inspects each incoming Ethernet frame -
including the source and destination MAC addresses, and sometimes the frame size - in making individual forwarding decisions.
A circuit-level gateway - CORRECT ANSWER-controls access by maintaining state information about established connections. When a permitted
connection is established between two hosts a tunnel is created for the session, allowing packets to flow freely without the need for inspecting
individual packets. Operates at the session layer of the OSI model.
A digital certificate - CORRECT ANSWER-is an electronic "credit card" that establishes your credentials when doing business or other
transactions on the Web. It is issued by a certification authority. It contains your name, a serial number, expiration dates, a copy of the certificate
holder's public key (used for encrypting messages and digital signatures), and the digital signature of the certificate-issuing authority so that a
recipient can verify that the certificate is real.
A digital signature - CORRECT ANSWER-is an electronic signature that can be used to authenticate the identity of the sender of a message or
the signer of a document, and possibly to ensure that the original content of the message or document that has been sent is unchanged. A digital
certificate contains the digital signature of the certificate-issuing authority so that anyone can verify that the certificate is real.
A dual homed gateway (or bastion host) - CORRECT ANSWER-is a system with two network interfaces that sits between an untrusted and
trusted network. A bastion host is typically a hardened system with robust security measures. The dual homed gateway functions as a proxy
server for the trusted network and may be configured to require user authentication. It masks the network structure, but may cause slower
network performance than the screening router alone.
A dual-homed firewall system - CORRECT ANSWER-is a more restrictive form of a screened-host firewall system, configuring one interface for
information servers and another for private network host computers.
A gateway - CORRECT ANSWER-which is a level 7 device, is used to connect a LAN to a WAN.
A hub - CORRECT ANSWER-is a device that connects two segments of a single LAN. A hub is a repeater. It provides transparent connectivity to
users on all segments of the same LAN. It is a level 1 device.
A network switch - CORRECT ANSWER-is a small hardware device that joins multiple computers together within one local area network (LAN).
Technically, network switches operate at layer two (Data Link Layer - Layer 2) of the OSI model.
A packet filtering firewall - CORRECT ANSWER-intercepts all traffic to and from the network and evaluates it against the rules you provide.
Typically the packet filter can assess the source IP address, source port, destination IP address and destination port. It is these criteria that you
can filter on- allowing or disallowing traffic from certain IP addresses or on certain ports. Operates at the network or transport layer of the OSI
model.
A parity check - CORRECT ANSWER-is a hardware control that detects data errors when data are read from one computer to another, from
memory or during transmission.
A proxy server - CORRECT ANSWER-is generally put in place to boost performance of the network, but can act as a sort of firewall as well.
Proxy servers also hide your internal addresses as well so that all communications appear to originate from the proxy server itself. A proxy server
will cache pages that have been requested. If User A goes to Yahoo.com the proxy server actually sends the request to Yahoo.com and retrieves
the web page. If User B then connects to Yahoo.com the proxy server just sends the information it already retrieved for User A so it is returned
much faster than having to get it from Yahoo.com again. You can configure a proxy server to block access to certain web sites and filter certain
port traffic to protect your internal network.
A public key infrastructure consists of - CORRECT ANSWER-• A certificate authority (CA) that issues and verifies digital certificate. A certificate
includes the public key or information about the public key
• A registration authority (RA) that acts as the verifier for the certificate authority before a digital certificate is issued to a requestor
• One or more directories where the certificates (with their public keys) are held
• A certificate management system
A reasonableness check - CORRECT ANSWER-compares data to predefined reasonability limits or occurrence rates established for the data.
, A redundancy check - CORRECT ANSWER-detects transmission errors by appending calculated bits onto the end of each segment of data. This
is an error detection methods but not an error correction method.
A screened host gateway/firewall - CORRECT ANSWER-is a bastion host and an external screening router. The bastion host is the only host
accessible from the untrusted network (providing web services, ftp, etc.). This approach implements basic network layer security (packet filtering)
and application server security (proxy services).
A screened-subnet firewall - CORRECT ANSWER-also used as a demilitarized zone (DMZ), utilizes two packet filtering routers and a bastion
host. This provides the most secure firewall system, since it supports both network- and application-level security while defining a separate DMZ
network. Publicly available services are placed on bastion hosts in the DMZ. Disadvantages include high cost, maintenance and troubleshooting.
A stateful inspection firewall - CORRECT ANSWER-is a type of circuit level gateway that captures data packets at the network layer then reviews
these packets at the upper layers of the OSI model. To beef up packet filtering security, stateful inspection packet filtering, or stateful packet
filtering (SPF) was introduced. Essentially, SPF performs the same as a packet filter, but with a couple of added measures. First, it looks at more
details from each packet to determine what is contained within the packet rather than simply who and where it is from (or allegedly from). Second,
it monitors communications between the two devices and compares the traffic not only to the rules it has been given, but also to the previous
communications. If any communication seems out of context or out of the ordinary based on previous traffic the packet is rejected.
Active Monitors - CORRECT ANSWER-Look for virus like actions, can't distinguish between user and virus requests
ADV of Application Gateway - CORRECT ANSWER-• An application-level gateway is the best way to protect against hacking because it can
define with detail rules that describe the type of user or connection that is or is not permitted. It analyzes in detail each package, not only in layers
one through four of the OSI model but also layers five through seven, which means that it reviews the commands of each higher level protocol
(HTTP, FTP, SNMP, etc.)
• It hides the design of the internal network
• It can be used to implement strong authentication.
ADV of circuit-level gateway - CORRECT ANSWER-• speed of connection
• support for protocols
• maintenance
ADV of Packet filtering firewall - CORRECT ANSWER-• cheap, fast and flexible.
• transparent to users.
Advanced Encryption Standard (AES) - CORRECT ANSWER-a public algorithm (block cipher... not stream) that supports keys from 128 to 256
bits in size, not only provides good security, but provides speed and versatility across a variety of computer platforms. AES runs securely and
efficiently on large computers, desktop computers and even small devices such as smart cards. AES is a symmetric (or private) key cipher.
Alternative Routing - CORRECT ANSWER-The method of routing traffic via an alternative medium such as copper cable or fiber optics. This
involves use of different networks, circuits or end points should the normal network be unavailable.
An application gateway - CORRECT ANSWER-is essentially another sort of proxy server. The internal client first establishes a connection with
the application gateway. The application gateway determines if the connection should be allowed or not and then establishes a connection with
the destination computer. All communications go through two connections- client to application gateway and application gateway to destination.
The application gateway monitors all traffic against its rules before deciding whether or not to forward it. As with the other proxy server types, the
application gateway is the only address seen by the outside world so the internal network is protected.
Asymmetric Key Algorithms - CORRECT ANSWER-In an asymmetric key algorithm (e.g., RSA), there are two separate keys: a public key is
published and enables any sender to perform encryption, while a private key is kept secret by the receiver and enables him to perform decryption.
(PKI)
Attribute sampling - CORRECT ANSWER-selecting items from a population based on a common attribute. Used for compliance testing.
Audit hooks - CORRECT ANSWER-Embedding hooks in application systems to function as red flags to induce auditors to act before an error gets
out of hand.
Audit risk - CORRECT ANSWER-the overall level of risk; the level of risk the auditor is prepared to accept.
Authentication - CORRECT ANSWER-the process of identification verification.
Authorization - CORRECT ANSWER-the process of determining whether a valid identifier is authorized to access a service.
Automated Online Auditing Techniques - CORRECT ANSWER-
Batch Controls and Balancing - CORRECT ANSWER-group input transactions to provide control totals. Can be based on total monetary amount,
total items, or hash totals.
Batch registers - CORRECT ANSWER-manual recording and comparison of batch totals.
Behavior Blockers - CORRECT ANSWER-Looks for patterns of behaviors that are virus-like and flags them, there are a lot of false positives with
this type of AV
Biometric Order of Effectiveness - CORRECT ANSWER-1. Palm
2. Hand Geometry
3. Iris
4. Retina
5. Fingerprint
6. Face
Black box testing - CORRECT ANSWER-Testing the functional operating effectiveness without regard to internal program structure.
Bottom-up approach for policy development - CORRECT ANSWER-begins by defining operational-level requirements and policies which are
derived and implemented as a result of a risk assessment.
Business Risk - CORRECT ANSWER-The likelihood that the system does not meet the user's business needs.
correct answers
A bridge - CORRECT ANSWER-operates at level 2 of the OSI layer and is used to connect two LANs using different protocols (e.g., joining an
ethernet and token network) to form a logical network. Bridges reduce the amount of traffic on a LAN by dividing it into two segments. Bridges
inspect incoming traffic and decide whether to forward or discard it. An Ethernet bridge, for example, inspects each incoming Ethernet frame -
including the source and destination MAC addresses, and sometimes the frame size - in making individual forwarding decisions.
A circuit-level gateway - CORRECT ANSWER-controls access by maintaining state information about established connections. When a permitted
connection is established between two hosts a tunnel is created for the session, allowing packets to flow freely without the need for inspecting
individual packets. Operates at the session layer of the OSI model.
A digital certificate - CORRECT ANSWER-is an electronic "credit card" that establishes your credentials when doing business or other
transactions on the Web. It is issued by a certification authority. It contains your name, a serial number, expiration dates, a copy of the certificate
holder's public key (used for encrypting messages and digital signatures), and the digital signature of the certificate-issuing authority so that a
recipient can verify that the certificate is real.
A digital signature - CORRECT ANSWER-is an electronic signature that can be used to authenticate the identity of the sender of a message or
the signer of a document, and possibly to ensure that the original content of the message or document that has been sent is unchanged. A digital
certificate contains the digital signature of the certificate-issuing authority so that anyone can verify that the certificate is real.
A dual homed gateway (or bastion host) - CORRECT ANSWER-is a system with two network interfaces that sits between an untrusted and
trusted network. A bastion host is typically a hardened system with robust security measures. The dual homed gateway functions as a proxy
server for the trusted network and may be configured to require user authentication. It masks the network structure, but may cause slower
network performance than the screening router alone.
A dual-homed firewall system - CORRECT ANSWER-is a more restrictive form of a screened-host firewall system, configuring one interface for
information servers and another for private network host computers.
A gateway - CORRECT ANSWER-which is a level 7 device, is used to connect a LAN to a WAN.
A hub - CORRECT ANSWER-is a device that connects two segments of a single LAN. A hub is a repeater. It provides transparent connectivity to
users on all segments of the same LAN. It is a level 1 device.
A network switch - CORRECT ANSWER-is a small hardware device that joins multiple computers together within one local area network (LAN).
Technically, network switches operate at layer two (Data Link Layer - Layer 2) of the OSI model.
A packet filtering firewall - CORRECT ANSWER-intercepts all traffic to and from the network and evaluates it against the rules you provide.
Typically the packet filter can assess the source IP address, source port, destination IP address and destination port. It is these criteria that you
can filter on- allowing or disallowing traffic from certain IP addresses or on certain ports. Operates at the network or transport layer of the OSI
model.
A parity check - CORRECT ANSWER-is a hardware control that detects data errors when data are read from one computer to another, from
memory or during transmission.
A proxy server - CORRECT ANSWER-is generally put in place to boost performance of the network, but can act as a sort of firewall as well.
Proxy servers also hide your internal addresses as well so that all communications appear to originate from the proxy server itself. A proxy server
will cache pages that have been requested. If User A goes to Yahoo.com the proxy server actually sends the request to Yahoo.com and retrieves
the web page. If User B then connects to Yahoo.com the proxy server just sends the information it already retrieved for User A so it is returned
much faster than having to get it from Yahoo.com again. You can configure a proxy server to block access to certain web sites and filter certain
port traffic to protect your internal network.
A public key infrastructure consists of - CORRECT ANSWER-• A certificate authority (CA) that issues and verifies digital certificate. A certificate
includes the public key or information about the public key
• A registration authority (RA) that acts as the verifier for the certificate authority before a digital certificate is issued to a requestor
• One or more directories where the certificates (with their public keys) are held
• A certificate management system
A reasonableness check - CORRECT ANSWER-compares data to predefined reasonability limits or occurrence rates established for the data.
, A redundancy check - CORRECT ANSWER-detects transmission errors by appending calculated bits onto the end of each segment of data. This
is an error detection methods but not an error correction method.
A screened host gateway/firewall - CORRECT ANSWER-is a bastion host and an external screening router. The bastion host is the only host
accessible from the untrusted network (providing web services, ftp, etc.). This approach implements basic network layer security (packet filtering)
and application server security (proxy services).
A screened-subnet firewall - CORRECT ANSWER-also used as a demilitarized zone (DMZ), utilizes two packet filtering routers and a bastion
host. This provides the most secure firewall system, since it supports both network- and application-level security while defining a separate DMZ
network. Publicly available services are placed on bastion hosts in the DMZ. Disadvantages include high cost, maintenance and troubleshooting.
A stateful inspection firewall - CORRECT ANSWER-is a type of circuit level gateway that captures data packets at the network layer then reviews
these packets at the upper layers of the OSI model. To beef up packet filtering security, stateful inspection packet filtering, or stateful packet
filtering (SPF) was introduced. Essentially, SPF performs the same as a packet filter, but with a couple of added measures. First, it looks at more
details from each packet to determine what is contained within the packet rather than simply who and where it is from (or allegedly from). Second,
it monitors communications between the two devices and compares the traffic not only to the rules it has been given, but also to the previous
communications. If any communication seems out of context or out of the ordinary based on previous traffic the packet is rejected.
Active Monitors - CORRECT ANSWER-Look for virus like actions, can't distinguish between user and virus requests
ADV of Application Gateway - CORRECT ANSWER-• An application-level gateway is the best way to protect against hacking because it can
define with detail rules that describe the type of user or connection that is or is not permitted. It analyzes in detail each package, not only in layers
one through four of the OSI model but also layers five through seven, which means that it reviews the commands of each higher level protocol
(HTTP, FTP, SNMP, etc.)
• It hides the design of the internal network
• It can be used to implement strong authentication.
ADV of circuit-level gateway - CORRECT ANSWER-• speed of connection
• support for protocols
• maintenance
ADV of Packet filtering firewall - CORRECT ANSWER-• cheap, fast and flexible.
• transparent to users.
Advanced Encryption Standard (AES) - CORRECT ANSWER-a public algorithm (block cipher... not stream) that supports keys from 128 to 256
bits in size, not only provides good security, but provides speed and versatility across a variety of computer platforms. AES runs securely and
efficiently on large computers, desktop computers and even small devices such as smart cards. AES is a symmetric (or private) key cipher.
Alternative Routing - CORRECT ANSWER-The method of routing traffic via an alternative medium such as copper cable or fiber optics. This
involves use of different networks, circuits or end points should the normal network be unavailable.
An application gateway - CORRECT ANSWER-is essentially another sort of proxy server. The internal client first establishes a connection with
the application gateway. The application gateway determines if the connection should be allowed or not and then establishes a connection with
the destination computer. All communications go through two connections- client to application gateway and application gateway to destination.
The application gateway monitors all traffic against its rules before deciding whether or not to forward it. As with the other proxy server types, the
application gateway is the only address seen by the outside world so the internal network is protected.
Asymmetric Key Algorithms - CORRECT ANSWER-In an asymmetric key algorithm (e.g., RSA), there are two separate keys: a public key is
published and enables any sender to perform encryption, while a private key is kept secret by the receiver and enables him to perform decryption.
(PKI)
Attribute sampling - CORRECT ANSWER-selecting items from a population based on a common attribute. Used for compliance testing.
Audit hooks - CORRECT ANSWER-Embedding hooks in application systems to function as red flags to induce auditors to act before an error gets
out of hand.
Audit risk - CORRECT ANSWER-the overall level of risk; the level of risk the auditor is prepared to accept.
Authentication - CORRECT ANSWER-the process of identification verification.
Authorization - CORRECT ANSWER-the process of determining whether a valid identifier is authorized to access a service.
Automated Online Auditing Techniques - CORRECT ANSWER-
Batch Controls and Balancing - CORRECT ANSWER-group input transactions to provide control totals. Can be based on total monetary amount,
total items, or hash totals.
Batch registers - CORRECT ANSWER-manual recording and comparison of batch totals.
Behavior Blockers - CORRECT ANSWER-Looks for patterns of behaviors that are virus-like and flags them, there are a lot of false positives with
this type of AV
Biometric Order of Effectiveness - CORRECT ANSWER-1. Palm
2. Hand Geometry
3. Iris
4. Retina
5. Fingerprint
6. Face
Black box testing - CORRECT ANSWER-Testing the functional operating effectiveness without regard to internal program structure.
Bottom-up approach for policy development - CORRECT ANSWER-begins by defining operational-level requirements and policies which are
derived and implemented as a result of a risk assessment.
Business Risk - CORRECT ANSWER-The likelihood that the system does not meet the user's business needs.
