Inspirational journeys

Follow the stories of academics and their research expeditions

CISA—Certified Information Systems Auditor - Part 288

Mary Smith

Thu, 16 Apr 2026

CISA—Certified Information Systems Auditor - Part 288

1. Disabling which of the following would make wireless local area networks more secure against unauthorized access?

A) MAC (Media Access Control) address filtering
B) WPA (Wi-Fi Protected Access Protocol)
C) LEAP (Lightweight Extensible Authentication Protocol)
D) SSID (service set identifier) broadcasting



2. Which of the following is BEST suited for secure communications within a small group?

A) Key distribution center
B) Certification authority
C) Web of trust
D) Kerberos Authentication System



3. Which of the following is the MOST important action in recovering from a cyberattack?

A) Creation of an incident response team
B) Use of cyber forensic investigators
C) Execution of a business continuity plan
D) Filling an insurance claim



4. What method might an IS auditor utilize to test wireless security at branch office locations?

A) War dialing
B) Social engineering
C) War driving
D) Password cracking



5. In a public key infrastructure, a registration authority:

A) verifies information supplied by the subject requesting a certificate.
B) issues the certificate after the required attributes are verified and the keys are generated.
C) digitally signs a message to achieve nonrepudiation of the signed message.
D) registers signed messages to protect them from future repudiation.



1. Right Answer: D
Explanation: Disabling SSID broadcasting adds security by making it more difficult for unauthorized users to find the name of the access point. Disabling MAC address filtering would reduce security. Using MAC filtering makes it more difficult to access a WLAN, because it would be necessary to catch traffic and forge the MAC address.Disabling WPA reduces security. Using WPA adds security by encrypting the traffic. Disabling LEAP reduces security. Using LEAP adds security by encrypting the wireless traffic.

2. Right Answer: C
Explanation: Web of trust is a key distribution method suitable for communication in a small group. It ensures pretty good privacy (PGP) and distributes the public keys of users within a group. Key distribution center is a distribution method suitable for internal communication for a large group within an institution, and it will distribute symmetric keys for each session. Certification authority is a trusted third party that ensures the authenticity of the owner of the certificate. This is necessary for large groups and formal communication. A Kerberos Authentication System extends the function of a key distribution center, by generating 'tickets' to define the facilities on networked machines which are accessible to each user.

3. Right Answer: C
Explanation: The most important key step in recovering from cyberattacks is the execution of a business continuity plan to quickly and cost-effectively recover critical systems, processes and data. The incident response team should exist prior to a cyberattack. When a cyberattack is suspected, cyber forensic investigators should be used to set up alarms, catch intruders within the network, and track and trace them over the Internet. After taking the above steps, an organization may have a residual risk that needs to be insured and claimed for traditional and electronic exposures.

4. Right Answer: C
Explanation: War driving is a technique for locating and gaining access to wireless networks by driving or walking with a wireless equipped computer around a building. War dialing is a technique for gaining access to a computer or a network through the dialing of defined blocks of telephone numbers, with the hope of getting an answer from a modem. Social engineering is a technique used to gather information that can assist an attacker in gaining logical or physical access to data or resources. Social engineering exploits human weaknesses. Password crackers are tools used to guess users' passwords by trying combinations and dictionary words.

5. Right Answer: A
Explanation: A registration authority is responsible for verifying information supplied by the subject requesting a certificate, and verifies the requestor's right to request certificate attributes and that the requestor actually possesses the private key corresponding to the public key being sent.Certification authorities, not registration authorities, actually issue certificates once verification of the information has been completed; because of this, choice B is incorrect. On the other hand, the sender who has control of their private key signs the message, not the registration authority. Registering signed messages is not a task performed by registration authorities.

0 Comments

Leave a comment