Section: Protection of Information Assets
Explanation/Reference:
In network security, a screened subnet firewall is a variation of the dual-homed gateway and screened host
firewall. It can be used to separate components of the firewall onto separate systems, thereby achieving
greater throughput and flexibility, although at some cost to simplicity. As each component system of the
screened subnet firewall needs to implement only a specific task, each system is less complex to
configure.
A screened subnet firewall is often used to establish a demilitarized zone (DMZ).
Below are few examples of Firewall implementations:
Screened host Firewall
Utilizing a packet filtering router and a bastion host, this approach implements a basic network layer
security and application server security.
An intruder in this configuration has to penetrate two separate systems before the security of the private
network can be compromised
This firewall system is configured with the bastion host connected to the private network with a packet
filtering router between internet and the bastion host
Dual-homed Firewall
A firewall system that has two or more network interface, each of which is connected to a different network
In a firewall configuration, a dual homed firewall system usually acts to block or filter some or all of the
traffic trying to pass between the network
A dual-homed firewall system is more restrictive form of screened-host firewall system
Demilitarize Zone (DMZ) or screened-subnet firewall
Utilizing two packet filtering routers and a bastion host
This approach creates the most secure firewall system since it supports network and application level
security while defining a separate DMZ network
Typically, DMZs are configured to limit access from the internet and organization’s private network.
The following were incorrect answers:
The other types of firewall mentioned in the option do not utilize two packet filtering routers and a bastion
host.
The following reference(s) were/was used to create this question:
CISA review manual 2014 Page number 346

Section: Protection of Information Assets
Explanation:
Capacity management is the planning and monitoring of computer resources to ensure that available IT resources are used efficiently and effectively. Business criticality must be considered before recommending a disk mirroring solution and offsite storage is unrelated to the problem.
Though data compression may save disk space, it could affect system performance.

Explanation
An acceptable use policy (AUP) is a document that defines the rules and guidelines for using an organization’s IT resources, such as networks, devices, and software. It aims to protect the organization’s assets, security, and productivity. An AUP should be formally acknowledged by users to ensure that they are aware of their responsibilities and obligations when using the IT resources. Without formal acknowledgment, users may not be held accountable for violating the AUP or may claim ignorance of the policy. This can expose the organization to legal, regulatory, reputational, or operational risks. Lack of data for measuring compliance, violation of industry standards, and noncompliance with documentation requirements are also possible risks from not having users acknowledge the AUP, but they are less significant than lack of user accountability. References: Workable: Acceptable use policy template, Wikipedia: Acceptable use policy

Section: Protection of Information Assets
Explanation:
Instead of simply reviewing the effectiveness and utilization of assets, an IS auditor is more concerned with
adequate access control, appropriate access policies, and effectiveness of safeguards and procedures.

Section: Protection of Information Assets
Explanation:
The main function of QoS is to optimize network performance by assigning priority to business applications and end users, through the allocation of dedicated parts of the bandwidth to specific traffic. Choice A is not true because the communication itself will not be improved. While the speed of data exchange for specific applications could be faster, availability will not be improved. The QoS tools that many carriers are using do not provide reports of service levels; however, there are other tools that will generate service-level reports.
Even when QoS is integrated with firewalls, VPNs, encryption tools and others, the tool itself is not intended to provide security controls.

Explanation
The organizational policies and procedures are the first source of guidance for an IS auditor when planning a customer data privacy audit. They provide the framework and objectives for ensuring compliance with legal and regulatory requirements, customer agreements and data classification. The IS auditor should review them first to understand the scope, roles and responsibilities, standards and controls related to customer data privacy in the organization. The other options are also important, but they are secondary sources of information that should be reviewed after the organizational policies and procedures. References: CISA Review Manual (Digital Version) 1, Chapter 2: Governance and Management of Information Technology, Section 2.5: Privacy Principles and Policies.

Explanation/Reference:
Explanation:
Establishing regular meetings is the best way to identify and assess risks in a medium-sized organization, to address responsibilities to the respective management and to keep the risk list and mitigation plans up to date. A medium-sized organization would normally not have a separate IT risk management department.
Moreover, the risks are usually manageable enough so that external help would not be needed. While common risks may be covered by common industry standards, they cannot address the specific situation of an organization. Individual risks will not be discovered without a detailed assessment from within the organization. Splitting the one risk position into several is not sufficient.

Direct observation of results is better than estimations and qualitative information gained from interviews or status reports. Project managers and involved staff tend to underestimate the time needed for completion and the necessary time buffers fordependencies between tasks, while overestimating the completion percentage for tasks underway (80:20 rule). The calculation based on remaining budget does not take into account the speed at which the project has been progressing.

Section: Protection of Information Assets
Explanation:
ESP can be used to provide confidentiality, data origin authentication, connectionless integrity, an anti- replay service (a form of partial sequence integrity), and (limited) traffic flow confidentiality. The set of services provided depends on options selected at the time of Security Association (SA) establishment and on the location of the implementation in a network topology. For your exam you should know the information below about the IPSec protocol:
The IP network layer packet security protocol establishes VPNs via transport and tunnel mode encryption methods.
For the transport method, the data portion of each packet is encrypted, encryption within IPSEC is referred to as the encapsulation security payload (ESP), it is ESP that provides confidentiality over the process.
In the tunnel mode, the ESP payload and its header’s are encrypted. To achieve non-repudiation, an additional authentication header (AH) is applied.
In establishing IPSec sessions in either mode, Security Associations (SAs) are established. SAs defines which security parameters should be applied between communicating parties as encryption algorithms, key initialization vector, life span of keys, etc. Within either ESP or AH header, respectively. An SAs is established when a 32-bit security parameter index (SPI) field is defined within the sending host. The SPI is unique identifier that enables the sending host to reference the security parameter to apply, as specified, on the receiving host.
IPSec can be made more secure by using asymmetric encryption through the use of Internet Security Association and Key Management Protocol/Oakley (ISAKMP/Oakley), which allows automated key management, use of public keys, negotiation, establishment, modification and deletion of SAs and attributes. For authentication, the sender uses digital certificates. The connection is made secure by supporting the generation, authentication, distribution of the SAs and the cryptographic keys.
The following were incorrect answers:
The other options presented are invalid as the transport mode encrypts ESP and the tunnel mode encrypts ESP and its header’s.
Reference:
CISA review manual 2014 Page number 353

A check digit is a numeric value that is calculated mathematically and is appended to data to ensure that the original data have not been altered or an incorrect, but valid, value substituted. This control is effective in detecting transposition and transcription errors.

When designing an audit plan, it is important to identify the areas of highest risk to determine the areas to be audited. The skill sets of the audit staff should have been considered before deciding and selecting the audit. Test steps for the auditare not as critical as identifying the areas of risk, and the time allotted for an audit is determined by the areas to be audited, which are primarily selected based on the identification of risks.

Explanation
The auditor’s best course of action when senior management disagrees with some of the facts presented in the draft audit report is to gather evidence to analyze senior management’s objections. The auditor should not revise the assessment, escalate the issue, or finalize the report without changes until they have evaluated the validity and relevance of senior management’s objections and resolved any discrepancies or misunderstandings. The auditor should maintain a professional and objective attitude and seek to present a fair and accurate audit report based on sufficient and appropriate evidence. References:
CISA Review Manual (Digital Version), page 372
CISA Questions, Answers & Explanations Database, question ID 3338

Section: Information System Acquisition, Development and Implementation
Explanation/Reference:
Presentation/desktop access layer is where end users directly deal with information. This layer includes
familiar desktop tools such as spreadsheets, direct querying tools, reporting and analysis suits offered by
vendors such as Congas and business objects, and purpose built application such as balanced source
cards and digital dashboards.
For CISA exam you should know below information about business intelligence:
Business intelligence(BI) is a broad field of IT encompasses the collection and analysis of information to
assist decision making and assess organizational performance.
To deliver effective BI, organizations need to design and implement a data architecture. The complete data
architecture consists of two components
The enterprise data flow architecture (EDFA)
A logical data architecture
Various layers/components of this data flow architecture are as follows:
Presentation/desktop access layer – This is where end users directly deal with information. This layer
includes familiar desktop tools such as spreadsheets, direct querying tools, reporting and analysis suits
offered by vendors such as Congas and business objects, and purpose built application such as balanced
source cards and digital dashboards.
Data Source Layer – Enterprise information derives from number of sources:
Operational data – Data captured and maintained by an organization’s existing systems, and usually held in
system-specific database or flat files.
External Data – Data provided to an organization by external sources. This could include data such as
customer demographic and market share information.
Nonoperational data – Information needed by end user that is not currently maintained in a computer
accessible format.
Core data warehouse -This is where all the data of interest to an organization is captured and organized to
assist reporting and analysis. DWs are normally instituted as large relational databases. A property
constituted DW should support three basic form of an inquiry.
Drilling up and drilling down – Using dimension of interest to the business, it should be possible to
aggregate data as well as drill down. Attributes available at the more granular levels of the warehouse can
also be used to refine the analysis.
Drill across – Use common attributes to access a cross section of information in the warehouse such as
sum sales across all product lines by customer and group of customers according to length of association
with the company.
Historical Analysis – The warehouse should support this by holding historical, time variant data. An
example of historical analysis would be to report monthly store sales and then repeat the analysis using
only customer who were preexisting at the start of the year in order to separate the effective new customer
from the ability to generate repeat business with existing customers.
Data Mart Layer- Data mart represents subset of information from the core DW selected and organized to
meet the needs of a particular business unit or business line. Data mart can be relational databases or
some form on-line analytical processing (OLAP) data structure.
Data Staging and quality layer -This layer is responsible for data copying, transformation into DW format
and quality control. It is particularly important that only reliable data into core DW. This layer needs to be
able to deal with problems periodically thrown by operational systems such as change to account number
format and reuse of old accounts and customer numbers.
Data Access Layer -This layer operates to connect the data storage and quality layer with data stores in the
data source layer and, in the process, avoiding the need to know to know exactly how these data stores are
organized. Technology now permits SQL access to data even if it is not stored in a relational database.
Data Preparation layer -This layer is concerned with the assembly and preparation of data for loading into
data marts. The usual practice is to per-calculate the values that are loaded into OLAP data repositories to
increase access speed. Data mining is concern with exploring large volume of data to determine patterns
and trends of information. Data mining often identifies patterns that are counterintuitive due to number and
complexity of data relationships. Data quality needs to be very high to not corrupt the result.
Metadata repository layer – Metadata are data about data. The information held in metadata layer needs to
extend beyond data structure names and formats to provide detail on business purpose and context. The
metadata layer should be comprehensive in scope, covering data as they flow between the various layers,
including documenting transformation and validation rules.
Warehouse Management Layer -The function of this layer is the scheduling of the tasks necessary to build
and maintain the DW and populate data marts. This layer is also involved in administration of security.
Application messaging layer -This layer is concerned with transporting information between the various
layers. In addition to business data, this layer encompasses generation, storage and targeted
communication of control messages.
Internet/Intranet layer – This layer is concerned with basic data communication. Included here are browser
based user interface and TCP/IP networking.
Various analysis models used by data architects/ analysis follows:
Activity or swim-lane diagram – De-construct business processes.
Entity relationship diagram -Depict data entities and how they relate. These data analysis methods
obviously play an important part in developing an enterprise data model. However, it is also crucial that
knowledgeable business operative is involved in the process. This way proper understanding can be
obtained of the business purpose and context of the data. This also mitigates the risk of replication of
suboptimal data configuration from existing systems and database into DW.
The following were incorrect answers:
Data mart layer – Data mart represents subset of information from the core DW selected and organized to
meet the needs of a particular business unit or business line. Data mart can be relational databases or
some form on-line analytical processing (OLAP) data structure.
Data access layer – his layer operates to connect the data storage and quality layer with data stores in the
data source layer and, in the process, avoiding the need to know to know exactly how these data stores are
organized. Technology now permits SQL access to data even if it is not stored in a relational database.
Data preparation layer -This layer is concerned with the assembly and preparation of data for loading into
data marts. The usual practice is to per-calculate the values that are loaded into OLAP data repositories to
increase access speed.
The following reference(s) were/was used to create this question:
CISA review manual 2014 Page number 188