ISACA CISA Certified Information Systems Auditor Exam Questions and Answers – 16

The latest ISACA CISA (Certified Information Systems Auditor) certification actual real practice exam question and answer (Q&A) dumps are available free, which are helpful for you to pass the ISACA CISA exam and earn ISACA CISA certification.

CISA Question 1681

Question

Which of the following types of attack makes use of unfiltered user input as the format string parameter in the print () function of the C language?

A. buffer overflows
B. format string vulnerabilities
C. integer overflow
D. code injection
E. command injection
F. None of the choices.

Answer

B. format string vulnerabilities

Explanation

Format string attacks are a new class of vulnerabilities recently discovered. It can be used to crash a program or to execute harmful code. The problem stems from the use of unfiltered user input as the format string parameter in certain C functions that perform formatting, such as print (). A malicious user may use the %s and %x format tokens, among others, to print data from the stack or possibly other locations in memory. One may also write arbitrary data to arbitrary locations using the %n format token.

CISA Question 1682

Question

Which of the following measures can effectively minimize the possibility of buffer overflows?

A. Sufficient bounds checking
B. Sufficient memory
C. Sufficient processing capability
D. Sufficient code injection
E. None of the choices

Answer

A. Sufficient bounds checking

Explanation

Buffer overflows may cause a process to crash or produce incorrect results. They can be triggered by inputs specifically designed to execute malicious code or to make the program operate in an unintended way. As such, buffer overflows cause many software vulnerabilities and form the basis of many exploits. Sufficient bounds checking by either the programmer or the compiler can prevent buffer overflows.

CISA Question 1683

Question

Buffer overflow aims primarily at corrupting:

A. system processor
B. network firewall
C. system memory
D. disk storage
E. None of the choices.

Answer

C. system memory

Explanation

A buffer overflow is an anomalous condition where a process attempts to store data beyond the boundaries of a fixed length buffer. The result is that the extra data overwrites adjacent memory locations. The overwritten data may include other buffers, variables and program flow data.

CISA Question 1684

Question

Which of the following refers to an anomalous condition where a process attempts to store data beyond the boundaries of a fixed length buffer?

A. buffer overflow
B. format string vulnerabilities
C. integer misappropriation
D. code injection
E. None of the choices.

Answer

A. buffer overflow

Explanation

A buffer overflow is an anomalous condition where a process attempts to store data beyond the boundaries of a fixed length buffer. The result is that the extra data overwrites adjacent memory locations. The overwritten data may include other buffers, variables and program flow data.

CISA Question 1685

Question

ALL computer programming languages are vulnerable to command injection attack.

A. True
B. False

Answer

B. False

Explanation

The majority of software vulnerabilities result from a few known kinds of coding defects. Common software defects include buffer overflows, format string vulnerabilities, integer overflow, and code/command injection. Some common languages such as C and C++ are vulnerable to all of these defects. Languages such as Java are immune to some of these defects but are still prone to code/ command injection and other software defects which lead to software vulnerabilities.

CISA Question 1686

Question

The majority of software vulnerabilities result from a few known kinds of coding defects, such as (Choose five.):

A. buffer overflows
B. format string vulnerabilities
C. integer overflow
D. code injection
E. command injection
F. None of the choices.

Answer

A. buffer overflows
B. format string vulnerabilities
C. integer overflow
D. code injection
E. command injection

Explanation

The majority of software vulnerabilities result from a few known kinds of coding defects. Common software defects include buffer overflows, format string vulnerabilities, integer overflow, and code/command injection. Some common languages such as C and C++ are vulnerable to all of these defects. Languages such as Java are immune to some of these defects but are still prone to code/ command injection and other software defects which lead to software vulnerabilities.

CISA Question 1687

Question

“Nowadays, computer security comprises mainly “preventive”” measures.”

A. True
B. True only for trusted networks
C. True only for untrusted networks
D. False
E. None of the choices.

Answer

A. True

Explanation

“Nowadays, computer security comprises mainly “”preventive”” measures, like firewalls or an Exit Procedure. A firewall can be defined as a way of filtering network data between a host or a network and another network and is normally implemented as software running on the machine or as physical integrated hardware.”

CISA Question 1688

Question

Which of the following are designed to detect network attacks in progress and assist in post- attack forensics?

A. Intrusion Detection Systems
B. Audit trails
C. System logs
D. Tripwire
E. None of the choices.

Answer

A. Intrusion Detection Systems

Explanation

Intrusion Detection Systems are designed to detect network attacks in progress and assist in post-attack forensics, while audit trails and logs serve a similar function for individual systems.

CISA Question 1689

Question

Which of the following is by far the most common prevention system from a network security perspective?

A. Firewall
B. IDS
C. IPS
D. Hardened OS
E. Tripwire
F. None of the choices.

Answer

A. Firewall

Explanation

User account access controls and cryptography can protect systems files and data, respectively. On the other hand, firewalls are by far the most common prevention systems from a network security perspective as they can shield access to internal network services, and block certain kinds of attacks through packet filtering.

CISA Question 1690

Question

Which of the following measures can protect systems files and data, respectively?

A. User account access controls and cryptography
B. User account access controls and firewall
C. User account access controls and IPS
D. IDS and cryptography
E. Firewall and cryptography
F. None of the choices.

Answer

A. User account access controls and cryptography

Explanation

User account access controls and cryptography can protect systems files and data, respectively. On the other hand, firewalls are by far the most common prevention systems from a network security perspective as they can shield access to internal network services, and block certain kinds of attacks through packet filtering.