Summer Sale Limited Time 65% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: ecus65

Isaca CISA - Certified Information Systems Auditor

Page: 5 / 9
Total 1404 questions

Which of the following activities provides an IS auditor with the MOST insight regarding potential single person dependencies that might exist within the organization?

A.

Reviewing vacation patterns

B.

Reviewing user activity logs

C.

Interviewing senior IT management

D.

Mapping IT processes to roles

Which of the following are BEST suited for continuous auditing?

A.

Low-value transactions

B.

Real-lime transactions

C.

Irregular transactions

D.

Manual transactions

Which of the following is the BEST indicator of the effectiveness of an organization's incident response program?

A.

Number of successful penetration tests

B.

Percentage of protected business applications

C.

Financial impact per security event

D.

Number of security vulnerability patches

Which of the following should be an IS auditor's GREATEST concern when an international organization intends to roll out a global data privacy policy?

A.

Requirements may become unreasonable.

B.

The policy may conflict with existing application requirements.

C.

Local regulations may contradict the policy.

D.

Local management may not accept the policy.

After the merger of two organizations, which of the following is the MOST important task for an IS auditor to perform?

A.

Verifying that access privileges have been reviewed

B.

investigating access rights for expiration dates

C.

Updating the continuity plan for critical resources

D.

Updating the security policy

Which of the following is the MOST appropriate and effective fire suppression method for an unstaffed computer room?

A.

Water sprinkler

B.

Fire extinguishers

C.

Carbon dioxide (CO2)

D.

Dry pipe

Which of the following weaknesses would have the GREATEST impact on the effective operation of a perimeter firewall?

A.

Use of stateful firewalls with default configuration

B.

Ad hoc monitoring of firewall activity

C.

Misconfiguration of the firewall rules

D.

Potential back doors to the firewall software

An information systems security officer's PRIMARY responsibility for business process applications is to:

A.

authorize secured emergency access

B.

approve the organization's security policy

C.

ensure access rules agree with policies

D.

create role-based rules for each business process

An IS auditor has been asked to audit the proposed acquisition of new computer hardware. The auditor’s PRIMARY concern Is that:

A.

the implementation plan meets user requirements.

B.

a full, visible audit trail will be Included.

C.

a dear business case has been established.

D.

the new hardware meets established security standards

Which of the following metrics would BEST measure the agility of an organization's IT function?

A.

Average number of learning and training hours per IT staff member

B.

Frequency of security assessments against the most recent standards and guidelines

C.

Average time to turn strategic IT objectives into an agreed upon and approved initiative

D.

Percentage of staff with sufficient IT-related skills for the competency required of their roles

Which of the following security risks can be reduced by a property configured network firewall?

A.

SQL injection attacks

B.

Denial of service (DoS) attacks

C.

Phishing attacks

D.

Insider attacks

A project team has decided to switch to an agile approach to develop a replacement for an existing business application. Which of the following should an IS auditor do FIRST to ensure the effectiveness of the protect audit?

A.

Compare the agile process with previous methodology.

B.

Identify and assess existing agile process control

C.

Understand the specific agile methodology that will be followed.

D.

Interview business process owners to compile a list of business requirements

In a RAO model, which of the following roles must be assigned to only one individual?

A.

Responsible

B.

Informed

C.

Consulted

D.

Accountable

Which of the following is the BEST way to verify the effectiveness of a data restoration process?

A.

Performing periodic reviews of physical access to backup media

B.

Performing periodic complete data restorations

C.

Validating off ne backups using software utilities

D.

Reviewing and updating data restoration policies annually

Which of the following is the GREATEST risk if two users have concurrent access to the same database record?

A.

Availability integrity

B.

Data integrity

C.

Entity integrity

D.

Referential integrity

An IS auditor finds that while an organization's IT strategy is heavily focused on research and development, the majority of protects n the IT portfolio focus on operations and maintenance. Which of the Mowing is the BEST recommendation?

A.

Align the IT strategy will business objectives

B.

Review priorities in the IT portfolio

C.

Change the IT strategy to focus on operational excellence.

D.

Align the IT portfolio with the IT strategy.

Which of following is MOST important to determine when conducting a post-implementation review?

A.

Whether the solution architecture compiles with IT standards

B.

Whether success criteria have been achieved

C.

Whether the project has been delivered within the approved budget

D.

Whether lessons teamed have been documented

The PRIMARY purpose of a configuration management system is to:

A.

track software updates.

B.

define baselines for software.

C.

support the release procedure.

D.

standardize change approval.

An IS auditor requests direct access to data required to perform audit procedures instead of asking management to provide the data Which of the following is the PRIMARY advantage of this approach?

A.

Audit transparency

B.

Data confidentiality

C.

Professionalism

D.

Audit efficiency

Which of the following methods will BEST reduce the risk associated with the transition to a new system using technologies that are not compatible with the old system?

A.

Parallel changeover

B.

Modular changeover

C.

Phased operation

D.

Pilot operation

A financial group recently implemented new technologies and processes, Which type of IS audit would provide the GREATEST level of assurance that the department's objectives have been met?

A.

Performance audit

B.

Integrated audit

C.

Cyber audit

D.

Financial audit

Which of the following should be an IS auditor's PRIMARY focus when evaluating the response process for cybercrimes?

A.

Communication with law enforcement

B.

Notification to regulators

C.

Root cause analysis

D.

Evidence collection

An IS auditor is reviewing a bank's service level agreement (SLA) with a third-party provider that hosts the bank's secondary data center, which of the following findings should be of GREATEST concern to the auditor?

A.

The recovery time objective (RTO) has a longer duration than documented in the disaster recovery plan (ORP).

B.

The SLA has not been reviewed in more than a year.

C.

Backup data is hosted online only.

D.

The recovery point objective (RPO) has a shorter duration than documented in the disaster recovery plan (DRP).

Transaction records from a business database were inadvertently deleted, and system operators decided to restore from a snapshot copy. Which of the following provides assurance that the BEST transactions were recovered successfully?

A.

Review transaction recovery logs to ensure no errors were recorded.

B.

Recount the transaction records to ensure no records are missing.

C.

Rerun the process on a backup machine to verify the results are the same.

D.

Compare transaction values against external statements to verify accuracy.

Which of the following is the BEST way to address potential data privacy concerns associated with inadvertent disclosure of machine identifier information contained within security logs?

A.

Unit the use of logs to only those purposes for which they were collected

B.

Restrict the transfer of log files from host machine to online storage

C.

Only collect logs from servers classified as business critical

D.

Limit log collection to only periods of increased security activity

Which of the following is a PRIMARY responsibility of an IT steering committee?

A.

Prioritizing IT projects in accordance with business requirements

B.

Reviewing periodic IT risk assessments

C.

Validating and monitoring the skill sets of IT department staff

D.

Establishing IT budgets for the business

During the discussion of a draft audit report IT management provided suitable evidence that a process has been implemented for a control that had been concluded by the IS auditor as ineffective Which of the following is the auditor's BEST action?

A.

Explain to IT management that the new control will be evaluated during follow-up

B.

Add comments about the action taken by IT management in the report

C.

Change the conclusion based on evidence provided by IT management

D.

Re-perform the audit before changing the conclusion

Users are complaining that a newly released enterprise resource planning (ERP) system is functioning too slowly. Which of the following tests during the quality assurance (QA) phase would have identified this concern?

A.

Stress

B.

Regression

C.

Interface

D.

Integration

Which of the following provides the BEST audit evidence that a firewall is configured in compliance with the organization's security policy?

A.

Analyzing how the configuration changes are performed

B.

Analyzing log files

C.

Reviewing the rule base

D.

Performing penetration testing

In the development of a new financial application, the IS auditor's FIRST involvement should be in the:

A.

control design.

B.

feasibility study.

C.

application design.

D.

system test.

In which of the following system development life cycle (SDLC) phases would an IS auditor expect to find that controls have been incorporated into system specifications?

A.

Implementation

B.

Development

C.

Feasibility

D.

Design

An IT balanced scorecard is PRIMARILY used for:

A.

evaluating the IT project portfolio

B.

measuring IT strategic performance

C.

allocating IT budget and resources

D.

monitoring risk in lT-related processes

Which of the following should be the FIRST consideration when deciding whether data should be moved to a cloud provider for storage?

A.

Data storage costs

B.

Data classification

C.

Vendor cloud certification

D.

Service level agreements (SLAs)

Which of the following is the MOST important consideration when evaluating the data retention policy for a global organization with regional offices in multiple countries?

A.

The policy aligns with corporate policies and practices.

B.

The policy aligns with global best practices.

C.

The policy aligns with business goals and objectives.

D.

The policy aligns with local laws and regulations.

When planning an audit, it is acceptable for an IS auditor to rely on a third-party provider’s external audit report on service level management when the

A.

scope and methodology meet audit requirements

B.

service provider is independently certified and accredited

C.

report confirms that service levels were not violated

D.

report was released within the last 12 months

An auditee disagrees with a recommendation for corrective action that appears in the draft engagement report. Which of the following is the IS auditor's BEST course of action when preparing the final report?

A.

Come to an agreement prior to issuing the final report.

B.

Include the position supported by senior management in the final engagement report

C.

Ensure the auditee's comments are included in the working papers

D.

Exclude the disputed recommendation from the final engagement report

Which of the following is MOST important to consider when developing a service level agreement (SLAP)?

A.

Description of the services from the viewpoint of the provider

B.

Detailed identification of work to be completed

C.

Provisions for regulatory requirements that impact the end users' businesses

D.

Description of the services from the viewpoint of the client organization

Which of the following is the GREATEST advantage of vulnerability scanning over penetration testing?

A.

The testing produces a lower number of false positive results

B.

Network bandwidth is utilized more efficiently

C.

Custom-developed applications can be tested more accurately

D.

The testing process can be automated to cover large groups of assets

Which of the following is the PRIMARY reason for an IS audit manager to review the work performed by a senior IS auditor prior to presentation of a report?

A.

To ensure the conclusions are adequately supported

B.

To ensure adequate sampling methods were used during fieldwork

C.

To ensure the work is properly documented and filed

D.

To ensure the work is conducted according to industry standards

in a post-implantation Nation review of a recently purchased system it is MOST important for the iS auditor to determine whether the:

A.

stakeholder expectations were identified

B.

vendor product offered a viable solution.

C.

user requirements were met.

D.

test scenarios reflected operating activities.

Which of the following findings should be of GREATEST concern to an IS auditor reviewing an organization s newly implemented online security awareness program'?

A.

Only new employees are required to attend the program

B.

Metrics have not been established to assess training results

C.

Employees do not receive immediate notification of results

D.

The timing for program updates has not been determined

Which of the following is the BEST method to delete sensitive information from storage media that will be reused?

A.

Crypto-shredding

B.

Multiple overwriting

C.

Reformatting

D.

Re-partitioning

The PRIMARY benefit of automating application testing is to:

A.

provide test consistency.

B.

provide more flexibility.

C.

replace all manual test processes.

D.

reduce the time to review code.

Which of the following is MOST important for an IS auditor to review when determining whether IT investments are providing value to tie business?

A.

Return on investment (ROI)

B.

Business strategy

C.

Business cases

D.

Total cost of ownership (TCO)

An IS auditor is assigned to review the IS department s quality procedures. Upon contacting the IS manager, the auditor finds that there is an informal unwritten set of standards Which of the following should be the auditor's NEXT action1?

A.

Make recommendations to IS management as to appropriate quality standards

B.

Postpone the audit until IS management implements written standards

C.

Document and lest compliance with the informal standards

D.

Finalize the audit and report the finding

Which of the following provides the MOST useful information regarding an organization's risk appetite and tolerance?

A.

Gap analysis

B.

Audit reports

C.

Risk profile

D.

Risk register

Which of the following provides an IS auditor assurance that the interface between a point-of-sale (POS) system and the general ledger is transferring sales data completely and accurately?

A.

Electronic copies of customer sales receipts are maintained.

B.

Monthly bank statements are reconciled without exception.

C.

Nightly batch processing has been replaced with real-time processing.

D.

The data transferred over the POS interface is encrypted.

When reviewing the functionality of an intrusion detection system (IDS), the IS auditor should be MOST concerned if:

A.

legitimate packets blocked by the system have increased

B.

actual attacks have not been identified

C.

detected events have increased

D.

false positives have been reported

An organization has engaged a third party to implement an application to perform business-critical calculations. Which of the following is the MOST important process to help ensure the application provides accurate calculations?

A.

Key performance indicator (KPI) monitoring

B.

Change management

C.

Configuration management

D.

Quality assurance (QA)

An IS auditor is reviewing an organization's business continuity plan (BCP) following a change in organizational structure with significant impact to business processes. Which of the following findings should be the auditor's GREATEST concern?

A.

Key business process end users did not participate in the business impact " analysis (BIA)

B.

Copies of the BCP have not been distributed to new business unit end users sjnce the reorganization

C.

A test plan for the BCP has not been completed during the last two years