試験問題と解答はCISA学習ガイド問題を試そう！ [Q314-Q330]

There are costs associated with all activities and disaster recovery planning (DRP) is not an exception. Although there are costs associated with a disaster recovery plan, there are unknown costs that are incurred if a disaster recovery plan is not implemented.

The main goal of a CSA is to involve business units and process owners in assessing the effectiveness of internal controls and managing risks. By doing so, it encourages greater accountability and ownership of controls within the organization, ensuring that those who are closest to the processes are actively involved in maintaining and improving the control environment.
While early detection of risks, potential cost reduction, and other benefits can result from a CSA, the central purpose is to foster control ownership among the business units and process owners.

Section: Information System Acquisition, Development and Implementation
Explanation/Reference:
Warehouse Management Layer -The function of this layer is the scheduling of the tasks necessary to build
and maintain the DW and populate data marts. This layer is also involved in administration of security.
For CISA exam you should know below information about business intelligence:
Business intelligence(BI) is a broad field of IT encompasses the collection and analysis of information to
assist decision making and assess organizational performance. To deliver effective BI, organizations need
to design and implement a data architecture. The complete data architecture consists of two components
The enterprise data flow architecture (EDFA)
A logical data architecture
Various layers/components of this data flow architecture are as follows:
Presentation/desktop access layer – This is where end users directly deal with information. This layer
includes familiar desktop tools such as spreadsheets, direct querying tools, reporting and analysis suits
offered by vendors such as Congas and business objects, and purpose built application such as balanced
source cards and digital dashboards.
Data Source Layer – Enterprise information derives from number of sources:
Operational data – Data captured and maintained by an organization’s existing systems, and usually held in
system-specific database or flat files.
External Data – Data provided to an organization by external sources. This could include data such as
customer demographic and market share information.
Nonoperational data – Information needed by end user that is not currently maintained in a computer
accessible format.
Core data warehouse -This is where all the data of interest to an organization is captured and organized to
assist reporting and analysis. DWs are normally instituted as large relational databases. A property
constituted DW should support three basic form of an inquiry.
Drilling up and drilling down – Using dimension of interest to the business, it should be possible to
aggregate data as well as drill down. Attributes available at the more granular levels of the warehouse can
also be used to refine the analysis.
Drill across – Use common attributes to access a cross section of information in the warehouse such as
sum sales across all product lines by customer and group of customers according to length of association
with the company.
Historical Analysis – The warehouse should support this by holding historical, time variant data. An
example of historical analysis would be to report monthly store sales and then repeat the analysis using
only customer who were preexisting at the start of the year in order to separate the effective new customer
from the ability to generate repeat business with existing customers.
Data Mart Layer- Data mart represents subset of information from the core DW selected and organized to
meet the needs of a particular business unit or business line. Data mart can be relational databases or
some form on-line analytical processing (OLAP) data structure.
Data Staging and quality layer -This layer is responsible for data copying, transformation into DW format
and quality control. It is particularly important that only reliable data into core DW. This layer needs to be
able to deal with problems periodically thrown by operational systems such as change to account number
format and reuse of old accounts and customer numbers.
Data Access Layer -This layer operates to connect the data storage and quality layer with data stores in the
data source layer and, in the process, avoiding the need to know to know exactly how these data stores are
organized. Technology now permits SQL access to data even if it is not stored in a relational database.
Data Preparation layer -This layer is concerned with the assembly and preparation of data for loading into
data marts. The usual practice is to per-calculate the values that are loaded into OLAP data repositories to
increase access speed. Data mining is concern with exploring large volume of data to determine patterns
and trends of information. Data mining often identifies patterns that are counterintuitive due to number and
complexity of data relationships. Data quality needs to be very high to not corrupt the result.
Metadata repository layer – Metadata are data about data. The information held in metadata layer needs to
extend beyond data structure names and formats to provide detail on business purpose and context. The
metadata layer should be comprehensive in scope, covering data as they flow between the various layers,
including documenting transformation and validation rules.
Warehouse Management Layer -The function of this layer is the scheduling of the tasks necessary to build
and maintain the DW and populate data marts. This layer is also involved in administration of security.
Application messaging layer -This layer is concerned with transporting information between the various
layers. In addition to business data, this layer encompasses generation, storage and targeted
communication of control messages.
Internet/Intranet layer – This layer is concerned with basic data communication. Included here are browser
based user interface and TCP/IP networking.
Various analysis models used by data architects/ analysis follows:
Activity or swim-lane diagram – De-construct business processes.
Entity relationship diagram -Depict data entities and how they relate. These data analysis methods
obviously play an important part in developing an enterprise data model. However, it is also crucial that
knowledgeable business operative is involved in the process. This way proper understanding can be
obtained of the business purpose and context of the data. This also mitigates the risk of replication of
suboptimal data configuration from existing systems and database into DW.
The following were incorrect answers:
Desktop access layer or presentation layer is where end users directly deal with information. This layer
includes familiar desktop tools such as spreadsheets, direct querying tools, reporting and analysis suits
offered by vendors such as Congas and business objects, and purpose built application such as balanced
source cards and digital dashboards.
Data preparation layer -This layer is concerned with the assembly and preparation of data for loading into
data marts. The usual practice is to per-calculate the values that are loaded into OLAP data repositories to
increase access speed.
Data access layer – his layer operates to connect the data storage and quality layer with data stores in the
data source layer and, in the process, avoiding the need to know to know exactly how these data stores are
organized. Technology now permits SQL access to data even if it is not stored in a relational database.
The following reference(s) were/was used to create this question:
CISA review manual 2014 Page number 188

Section: Protection of Information Assets
Explanation:
An IT control objective is defined as the statement of the desired result or purpose to be achieved by implementing control procedures in a particular IT activity. They provide the actual objectives for implementing controls and may or may not be the best practices. Techniques are the means of achieving an objective, and a security policy is a subset of IT control objectives.

The IS audit standard for proficiency states that the IS auditor must have the knowledge, skills and experience needed to perform the audit work. This implies that the IS auditor must be competent in both the technical and business aspects of the audit subject matter. Therefore, team member assignments must be based on individual competencies, so that each auditor can perform the tasks that match their qualifications and expertise. This will also ensure that the audit objectives are met and the audit quality is maintained.
Option B is incorrect because technical co-sourcing is not a requirement to meet the IS audit standard for proficiency. Co-sourcing is an option that may be used when the internal audit function lacks the necessary resources or skills to perform the audit work. However, co-sourcing does not guarantee that the new staff will acquire the proficiency needed for the audit. Moreover, co-sourcing may introduce additional risks and challenges, such as confidentiality, independence, communication and coordination issues.
Option C is incorrect because having a globally recognized audit certification does not necessarily mean that the standard for proficiency is met. A certification is an indication of the auditor’s knowledge and competence in a specific domain, but it does not cover all aspects of IS auditing. The auditor must also have relevant experience and continuous learning to maintain and enhance their proficiency. Furthermore, having one certified member does not ensure that the other members are also proficient.
Option D is incorrect because having a supervisor review the new auditors’ work is not sufficient to meet the IS audit standard for proficiency. A supervisor review is a quality assurance measure that helps to ensure that the audit work is performed in accordance with the standards and policies. However, a supervisor review does not substitute for the proficiency of the auditors who perform the work. The auditors must still have the necessary knowledge, skills and experience to conduct the audit tasks effectively and efficiently.
References:
* CISA Online Review Course1, Module 1: The Process of Auditing Information Systems, Lesson 2:
Mandatory Guidance, slide 8-9.
* CISA Review Manual (Digital Version)2, Chapter 1: The Process of Auditing Information Systems, Section 1.3: Mandatory Guidance, p. 24-25.
* CISA Review Manual (Print Version), Chapter 1: The Process of Auditing Information Systems, Section
1.3: Mandatory Guidance, p. 24-25.
* CISA Questions, Answers & Explanations Database3, Question ID: QAE_CISA_711.

Explanation
Encryption is the process of transforming information into an unreadable form using a secret key, so that only authorized parties can access it. Encryption would protect the confidentiality of information sent in email messages, as it would prevent unauthorized parties from intercepting and reading the messages. Secure Hash Algorithm 1 (SHA-1) is a cryptographic hash function that produces a fixed-length output from an input.
SHA-1 does not encrypt information, but rather verifies its integrity by detecting any changes or modifications. Digital signatures are electronic signatures that use encryption and hash functions to authenticate the identity of the sender and the integrity of the message. Digital signatures do not protect the confidentiality of information, but rather ensure its authenticity and non-repudiation. Digital certificates are electronic documents that contain the public key and identity information of an entity, such as a person, organization or device. Digital certificates are issued by trusted third parties called certificate authorities (CAs). Digital certificates do not protect the confidentiality of information, but rather enable secure communication and encryption by verifying the identity and public key of an entity. References:
[Encryption Definition]
[Secure Hash Algorithm 1 (SHA-1) Definition]
[Digital Signature Definition]
[Digital Certificate Definition]

While it is important to properly establish a software development project, quality management should be effectively practiced throughout the project. The major source of unexpected costs on most software projects is rework. The general rule is thatthe earlier in the development life cycle that a defect occurs, and the longer it takes to find and fix that defect, the more effort will be needed to correct it. A well-written quality management plan is a good start, but it must also be actively applied. Simply relying on testing to identify defects is a relatively costly and less effective way of achieving software quality. For example, an error in requirements discovered in the testing phase can result in scrapping significant amounts of work. Capturing lessons learned will be too late for the current project. Additionally, applying quality management techniques throughout a project is likely to yield its own insights into the causes of quality problems and assist in staff development.

Section: Protection of Information Assets
Explanation:
Only reviewing transaction and application logs directly addresses the threat posed by poor segregation of
duties. The review is a means of detecting inappropriate behavior and also discourages abuse, because
people who may otherwise be tempted to exploit the situation are aware of the likelihood of being caught.
Inadequate segregation of duties is more likely to be exploited via logical access to data and computing
resources rather than physical access. Choice C is a useful control to ensure IT staff are trustworthy and
competent but does not directly address the lack of an optimal segregation of duties. Choice D acts to
prevent unauthorized users from gaining system access, but the issue of a lack of segregation of duties is
more the misuse (deliberately or inadvertently} of access privileges that have officially been granted.

Section: Protection of Information Assets
Explanation:
Automated theorem proving (ATP) is the proving of mathematical theorems by a computer program.
Depending on the underlying logic, the problem of deciding the validity of a theorem varies from trivial to impossible. Commercial use of automated theorem proving is mostly concentrated in integrated circuit design and verification.

Section: Protection of Information Assets

The most important thing for an IS auditor to examine when reviewing an organization’s privacy policy is its legitimate purpose for collecting personal data. A legitimate purpose is a clear and specific reason for collecting personal data that is necessary for the organization’s business operations or legal obligations, and that respects the rights and interests of the data subjects. A legitimate purpose is the basis for establishing a lawful and fair processing of personal data, and it should be communicated to the data subjects in the privacy policy. The other options are not as important as the legitimate purpose in reviewing the privacy policy.
Explicit permission from regulators to collect personal data is not always required, as there may be other lawful bases for data collection, such as consent, contract, or public interest. Sharing of personal information with third-party service providers is not prohibited, as long as there are adequate safeguards and agreements in place to protect the data. The encryption mechanism selected by the organization for protecting personal data is a technical control that can enhance data security, but it does not determine the legality or fairness of data collection. References: CISA Review Manual (Digital Version), Chapter 5, Section 5.3.2