CISA Final Assessment 1

An IS auditor learns a server administration team regularly applies workarounds to address repeated failures of critical data processing services. Which of the following would BEST enable the organization to resolve this issue?

Service level management

Correct Incorrect Correct answer

Incident management

Correct Incorrect Correct answer

Problem management

Correct Incorrect Correct answer

Change management

Correct Incorrect Correct answer

An IS auditor is informed that several spreadsheets are being used to generate key financial information. What should the auditor verify NEXT?

Whether adequate documentation and training is available for spreadsheet users

Correct Incorrect Correct answer

Whether the spreadsheets meet the minimum IT general controls requirements

Correct Incorrect Correct answer

Whether there is a complete inventory of end-user computing (EUC) spreadsheet

Correct Incorrect Correct answer

Whether the spreadsheets are being formally reviewed by the chief financial officer (CFO)

Correct Incorrect Correct answer

An IS auditor is reviewing a contract for the outsourcing of IT facilities. If missing, which of the following should present the GREATEST concern to the auditor?

Access control requirements

Correct Incorrect Correct answer

Hardware configurations

Correct Incorrect Correct answer

Help desk availability

Correct Incorrect Correct answer

Perimeter network security diagram

Correct Incorrect Correct answer

An IS auditor is reviewing a data conversion project. Which of the following is the auditor’s BEST recommendation prior to go-live?

Automate the test scripts.

Correct Incorrect Correct answer

Conduct a mock conversion test.

Correct Incorrect Correct answer

Review test procedures and scenarios.

Correct Incorrect Correct answer

Establish a configuration baseline.

Correct Incorrect Correct answer

An IS auditor should ensure that an application’s audit trail:

has adequate security.

Correct Incorrect Correct answer

is accessible online.

Correct Incorrect Correct answer

does not impact operational efficiency.

Correct Incorrect Correct answer

logs all database records.

Correct Incorrect Correct answer

Which of the following would provide the BEST evidence of an IT strategy committee’s effectiveness?

The minutes from the IT strategy committee meetings

Correct Incorrect Correct answer

The IT strategy committee charter

Correct Incorrect Correct answer

Synchronization of IT activities with corporate objectives

Correct Incorrect Correct answer

Business unit satisfaction survey results

Correct Incorrect Correct answer

An IS auditor is reviewing the business requirements for the deployment of a new website. Which of the following cryptographic systems would provide the BEST evidence of secure communications on the Internet?

Transport Layer Security (TLS)

Correct Incorrect Correct answer

Wi-Fi Protected Access 2 (WPA2)

Correct Incorrect Correct answer

IP Security (IPSEC)

Correct Incorrect Correct answer

Secure Shell (SSH)

Correct Incorrect Correct answer

An IS auditor is performing a follow-up audit for findings identified in an organization’s user provisioning process. Which of the following is the MOST appropriate population to sample from when testing for remediation?

All users provisioned after management resolved the audit issue

Correct Incorrect Correct answer

All users who have followed user provisioning processes provided by management

Correct Incorrect Correct answer

All users provisioned after the final audit report was issued

Correct Incorrect Correct answer

All users provisioned after the finding was originally identified

Correct Incorrect Correct answer

Which of the following is the BEST method to prevent wire transfer fraud by bank employees?

Two-factor authentication control

Correct Incorrect Correct answer

System-enforced dual control

Correct Incorrect Correct answer

Independent reconciliation

Correct Incorrect Correct answer

Re-keying of wire dollar amounts

Correct Incorrect Correct answer

Which of the following would be MOST useful to an organization planning to adopt a public cloud computing model?

Service level agreement (SLA) performance metrics

Correct Incorrect Correct answer

Management attestation report

Correct Incorrect Correct answer

Independent control assessment

Correct Incorrect Correct answer

Audit report prepared by the service provider

Correct Incorrect Correct answer

Which of the following is the MOST effective control to mitigate unintentional misuse of authorized access?

Regular monitoring of user access logs

Correct Incorrect Correct answer

Security awareness training

Correct Incorrect Correct answer

Annual sign-off of acceptable use policy

Correct Incorrect Correct answer

Formalized disciplinary action

Correct Incorrect Correct answer

In order to be useful, a key performance indicator (KPI) MUST:

be approved by management.

Correct Incorrect Correct answer

be changed frequently to reflect organizational strategy.

Correct Incorrect Correct answer

have a target value.

Correct Incorrect Correct answer

be measurable in percentages

Correct Incorrect Correct answer

Which of the following should be of GREATEST concern to an IS auditor reviewing an organization’s IT process performance reports over the last quarter?

Metrics are not aligned with industry benchmarks.

Correct Incorrect Correct answer

Metrics were defined without stakeholder review.

Correct Incorrect Correct answer

Key performance indicators (KPIs) were met in only one month.

Correct Incorrect Correct answer

Performance reporting includes too many technical terms.

Correct Incorrect Correct answer

Which of the following is MOST important to have in place to build consensus among key stakeholders on the cost-effectiveness of IT?

IT project governance and management

Correct Incorrect Correct answer

Standardized enterprise architecture (EA)

Correct Incorrect Correct answer

IT performance monitoring and reporting

Correct Incorrect Correct answer

A uniform IT chargeback process

Correct Incorrect Correct answer

Which of the following is the PRIMARY benefit of continuous auditing?

It facilitates the use of robotic automation processes.

Correct Incorrect Correct answer

It allows reduced sample sizes for testing.

Correct Incorrect Correct answer

It enables timely detection of anomalies.

Correct Incorrect Correct answer

It deters fraudulent transactions.

Correct Incorrect Correct answer

Which of the following are BEST suited for continuous auditing?

Low-value transactions

Correct Incorrect Correct answer

Irregular transactions

Correct Incorrect Correct answer

Real-time transactions

Correct Incorrect Correct answer

Manual transactions

Correct Incorrect Correct answer

Which of the following is the BEST method to maintain an audit trail of changes made to the source code of a program?

Standardize file naming conventions.

Correct Incorrect Correct answer

Utilize automated version control.

Correct Incorrect Correct answer

Embed details within source code.

Correct Incorrect Correct answer

Document details on a change register.

Correct Incorrect Correct answer

Which of the following is MOST likely to be detected by an IS auditor applying data analytic techniques?

Issues resulting from an unsecured application automatically uploading transactions to the general ledger

Correct Incorrect Correct answer

Unauthorized salary or benefit changes to the payroll system generated by authorized users

Correct Incorrect Correct answer

Potentially fraudulent invoice payments originating within the accounts payable department

Correct Incorrect Correct answer

Completion of inappropriate cross-border transmission of personally identifiable information (PII)

Correct Incorrect Correct answer

An IS auditor is planning an audit of an organization’s accounts payable processes. Which of the following controls is MOST important to assess in the audit?

Segregation of duties between issuing purchase orders and making payments

Correct Incorrect Correct answer

Management review and approval of purchase orders

Correct Incorrect Correct answer

Management review and approval of authorization tiers

Correct Incorrect Correct answer

Segregation of duties between receiving invoices and setting authorization limits

Correct Incorrect Correct answer

An IS auditor discovers that due to resource constraints, a database administrator (DBA) is responsible for developing and executing changes into the production environment. Which of the following should the auditor do FIRST?

Ensure a change management process is followed prior to implementation.

Correct Incorrect Correct answer

Identify whether any compensating controls exist.

Correct Incorrect Correct answer

Determine whether another database administrator (DBA) could make the changes.

Correct Incorrect Correct answer

Report a potential segregation of duties (SoD) violation.

Correct Incorrect Correct answer

An IS auditor is reviewing logical access controls for an organization’s financial business application. Which of the following findings should be of GREATEST concern to the auditor?

Management does not review application user activity logs.

Correct Incorrect Correct answer

Password length is set to eight characters.

Correct Incorrect Correct answer

User accounts are shared between users.

Correct Incorrect Correct answer

Users are not required to change their passwords on a regular basis.

Correct Incorrect Correct answer

An IS auditor has discovered that unauthorized customer management software was installed on a workstation. The auditor determines the software has been uploading customer data to an external party. Which of the following is the IS auditor’s BEST course of action?

Review other workstations to determine the extent of the incident.

Correct Incorrect Correct answer

Determine the number of customer records that were uploaded.

Correct Incorrect Correct answer

Notify the incident response team.

Correct Incorrect Correct answer

Present the issue at the next audit progress meeting.

Correct Incorrect Correct answer

An IS auditor is reviewing an organization’s information asset management process. Which of the following would be of GREATEST concern to the auditor?

Process ownership has not been established.

Correct Incorrect Correct answer

Identification of asset value is not included in the process.

Correct Incorrect Correct answer

The process does not require specifying the physical locations of assets.

Correct Incorrect Correct answer

The process does not include asset review.

Correct Incorrect Correct answer

An IS auditor is conducting a post-implementation review of an enterprise resource planning (ERP) system. End users indicated concerns with the accuracy of critical automatic calculations made by the system. The auditor’s FIRST course of action should be to:

verify completeness of user acceptance testing (UAT).

Correct Incorrect Correct answer

verify results to determine validity of user concerns.

Correct Incorrect Correct answer

review initial business requirements.

Correct Incorrect Correct answer

review recent changes to the system.

Correct Incorrect Correct answer

An IS auditor performing an audit of backup procedures observes that backup tapes are picked up weekly and stored offsite at a third-party hosting facility. Which of the following recommendations would be the BEST way to protect the integrity of the data on the backup tapes?

Ensure that data is encrypted before leaving the facility

Correct Incorrect Correct answer

Confirm that data transfers are logged and recorded.

Correct Incorrect Correct answer

Confirm that data is transported in locked tamper-evident containers.

Correct Incorrect Correct answer

Ensure that the transport company obtains signatures for all shipments.

Correct Incorrect Correct answer

An IS auditor has been asked to perform an assurance review of an organization’s mobile computing security. To ensure the organization is able to centrally manage mobile devices to protect against data disclosure, it is MOST important for the auditor to determine whether:

lost devices can be located remotely.

Correct Incorrect Correct answer

procedures for lost devices include remote wiping of data.

Correct Incorrect Correct answer

a mobile security awareness training program exists.

Correct Incorrect Correct answer

a security policy exists for mobile devices.

Correct Incorrect Correct answer

An IS auditor has been asked to perform a post-implementation assessment of a new corporate human resources (HR) system. Which of the following control areas would be MOST important to review for the protection of employee information?

Data retention practices

Correct Incorrect Correct answer

Authentication mechanisms

Correct Incorrect Correct answer

System architecture

Correct Incorrect Correct answer

Logging capabilities

Correct Incorrect Correct answer

An external IS auditor has been engaged to determine the organization’s cybersecurity posture. Which of the following is MOST useful for this purpose?

Capability maturity assessment

Correct Incorrect Correct answer

Compliance reports

Correct Incorrect Correct answer

Control self-assessment (CSA)

Correct Incorrect Correct answer

Industry benchmark report

Correct Incorrect Correct answer

An IS auditor observes that a business-critical application does not currently have any level of fault tolerance. Which of the following is the GREATEST concern with this situation?

Degradation of services

Correct Incorrect Correct answer

Decreased mean time between failures (MTBF)

Correct Incorrect Correct answer

Limited tolerance for damage

Correct Incorrect Correct answer

Single point of failure

Correct Incorrect Correct answer

An IS auditor is evaluating an organization’s IT strategy and plans. Which of the following would be of GREATEST concern?

IT is not engaged in business strategic planning.

Correct Incorrect Correct answer

The business strategy meeting minutes are not distributed.

Correct Incorrect Correct answer

There is inadequate documentation of IT strategic planning.

Correct Incorrect Correct answer

There is not a defined IT security policy.

Correct Incorrect Correct answer

An IS auditor reviewing the threat assessment for a data center would be MOST concerned if:

neighboring organizations' operations have been included.

Correct Incorrect Correct answer

the exercise was completed by local management.

Correct Incorrect Correct answer

all identified threats relate to external entities.

Correct Incorrect Correct answer

some of the identified threats are unlikely to occur.

Correct Incorrect Correct answer

An IS auditor observes that exceptions have been approved for an organization’s information security policy. Which of the following is MOST important for the auditor to confirm?

Exceptions do not change residual risk.

Correct Incorrect Correct answer

Exceptions are approved for predefined periods.

Correct Incorrect Correct answer

Exceptions require changes to the policy.

Correct Incorrect Correct answer

Exceptions are approved by the board of directors.

Correct Incorrect Correct answer

An IS auditor has found that an organization is unable to add new servers on demand in a cost-efficient manner. Which of the following is the auditor’s BEST recommendation?

Hire temporary contract workers for the IT function.

Correct Incorrect Correct answer

Build a virtual environment.

Correct Incorrect Correct answer

Increase the capacity of existing systems.

Correct Incorrect Correct answer

Upgrade hardware to newer technology.

Correct Incorrect Correct answer

A senior auditor is reviewing work papers prepared by a junior auditor indicating that a finding was removed after the auditee said they corrected the problem.
Which of the following is the senior auditor’s MOST appropriate course of action?

Ask the auditee to retest.

Correct Incorrect Correct answer

Have the finding reinstated.

Correct Incorrect Correct answer

Refer the issue to the audit director.

Correct Incorrect Correct answer

Approve the work papers as written.

Correct Incorrect Correct answer

An IS auditor finds that while an organization’s IT strategy is heavily focused on research and development, the majority of projects in the IT portfolio focus on operations and maintenance. Which of the following is the BEST recommendation?

Review priorities in the IT portfolio.

Correct Incorrect Correct answer

Change the IT strategy to focus on operational excellence.

Correct Incorrect Correct answer

Align the IT portfolio with the IT strategy.

Correct Incorrect Correct answer

Align the IT strategy with business objectives.

Correct Incorrect Correct answer

Which of the following documents should specify roles and responsibilities within an IT audit organization?

Organizational chart

Correct Incorrect Correct answer

Annual audit plan

Correct Incorrect Correct answer

Audit charter

Correct Incorrect Correct answer

Engagement letter

Correct Incorrect Correct answer

Which of the following presents the GREATEST challenge to the alignment of business and IT?

Lack of information security involvement in business strategy development

Correct Incorrect Correct answer

An IT steering committee chaired by the chief information officer (CIO)

Correct Incorrect Correct answer

Insufficient IT budget to execute new business projects

Correct Incorrect Correct answer

Lack of chief information officer (CIO) involvement in board meetings

Correct Incorrect Correct answer

Which of the following would be of MOST concern when determining if information assets are adequately safeguarded during transport and disposal?

Lack of recent awareness training

Correct Incorrect Correct answer

Lack of appropriate labeling

Correct Incorrect Correct answer

Lack of appropriate data classification

Correct Incorrect Correct answer

Lack of password protection

Correct Incorrect Correct answer

Which of the following provides the BEST evidence that a third-party service provider’s information security controls are effective?

Documentation of the service provider's security configuration controls

Correct Incorrect Correct answer

An audit report of the controls by the service provider's external auditor

Correct Incorrect Correct answer

An interview with the service provider's information security officer

Correct Incorrect Correct answer

A review of the service provider's policies and procedures

Correct Incorrect Correct answer

Which of the following is the BEST reason to implement a data retention policy?

To establish a recovery point objective (RPO) for disaster recovery procedures

Correct Incorrect Correct answer

To assign responsibility and owners hip for data protection outside IT

Correct Incorrect Correct answer

To limit the liability associated with storing and protecting information

Correct Incorrect Correct answer

To document business objectives for processing data within the organization

Correct Incorrect Correct answer

Capacity management enables organizations to:

establish the capacity of network communication links.

Correct Incorrect Correct answer

forecast technology trends.

Correct Incorrect Correct answer

identify the extent to which components need to be upgraded.

Correct Incorrect Correct answer

determine business transaction volumes.

Correct Incorrect Correct answer

Which of the following is the MOST effective way for an IS auditor to evaluate whether an organization is well positioned to defend against an advanced persistent threat (APT)?

Verify that the organization has adequate levels of cyber insurance.

Correct Incorrect Correct answer

Review the validity of external Internet Protocol (IP) addresses accessing the network.

Correct Incorrect Correct answer

Verify that the organization is using correlated data for security monitoring.

Correct Incorrect Correct answer

Assess the skill set with in the security function.

Correct Incorrect Correct answer

A credit card company has decided to outsource the printing of customer statements. It is MOST important for the company to verify whether:

the provider has alternate service locations.

Correct Incorrect Correct answer

the contract includes compensation for deficient service levels.

Correct Incorrect Correct answer

the provider adheres to the company's data retention policies.

Correct Incorrect Correct answer

the provider's information security controls are aligned with the company's.

Correct Incorrect Correct answer

An IS auditor is conducting a review of a data center. Which of the following observations could indicate an access control issue?

Security cameras deployed outside main entrance

Correct Incorrect Correct answer

Muddy footprints directly inside the emergency exit

Correct Incorrect Correct answer

Fencing around facility is two meters high

Correct Incorrect Correct answer

Antistatic mats deployed at the computer room entrance

Correct Incorrect Correct answer

An IS auditor notes that IT and the business have different opinions on the availability of their application servers. Which of the following should the IS auditor review FIRST in order to understand the problem?

The exact definition of the service levels and their measurement

Correct Incorrect Correct answer

The regular performance-reporting documentation

Correct Incorrect Correct answer

The alerting and measurement process on the application servers

Correct Incorrect Correct answer

The actual availability of the servers as part of a substantive test

Correct Incorrect Correct answer

Which type of migration process would BEST minimize the risk associated with a payroll application when converting from an old to a new system?

Phased

Correct Incorrect Correct answer

Direct

Correct Incorrect Correct answer

Parallel

Correct Incorrect Correct answer

Simulated

Correct Incorrect Correct answer

Which of the following is MOST important for an IS auditor to verify when reviewing the use of an outsourcer for disposal of storage media?

The contract includes issuance of a certificate of destruction by the vendor.

Correct Incorrect Correct answer

The vendor's process appropriately sanitizes the media before disposal.

Correct Incorrect Correct answer

The vendor has not experienced security incidents in the past

Correct Incorrect Correct answer

The disposal transportation vehicle is fully secure.

Correct Incorrect Correct answer

Which of the following is a detective control?

Verification of hash totals

Correct Incorrect Correct answer

Programmed edit checks for data entry

Correct Incorrect Correct answer

Use of pass cards to gain access to physical facilities

Correct Incorrect Correct answer

Backup procedures

Correct Incorrect Correct answer

Which of the following is the BEST way for an organization to mitigate the risk associated with third-party application performance?

Use analytics within the internal audit function.

Correct Incorrect Correct answer

Ensure the third party allocates adequate resources to meet requirements.

Correct Incorrect Correct answer

Conduct a capacity planning exercise.

Correct Incorrect Correct answer

Utilize performance monitoring tools to verify service level agreements (SLAs).

Correct Incorrect Correct answer

An organization conducted an exercise to test the security awareness level of users by sending an email offering a cash reward to those who click on a link embedded in the body of the email. Which of the following metrics BEST indicates the effectiveness of awareness training?

The number of users forwarding the email to their business unit managers

Correct Incorrect Correct answer

The number of users clicking on the link to learn more about the sender of the email

Correct Incorrect Correct answer

The number of users reporting receipt of the email to the information security team

Correct Incorrect Correct answer

The number of users deleting the email without reporting because it is a phishing email

Correct Incorrect Correct answer

A review of Internet security disclosed that users have individual user accounts with Internet service providers (ISPs) and use these accounts for downloading business data. The organization wants to ensure that only the corporate network is used. The organization should FIRST:

use a proxy server to filter out Internet sites that should not be accessed.

Correct Incorrect Correct answer

keep a manual log of Internet access.

Correct Incorrect Correct answer

include a statement in its security policy about Internet use.

Correct Incorrect Correct answer

monitor remote access activities.

Correct Incorrect Correct answer

Which of the following is MOST important to ensure when developing an effective security awareness program?

Phishing exercises are conducted post-training.

Correct Incorrect Correct answer

Training personnel are information security professionals.

Correct Incorrect Correct answer

Outcome metrics for the program are established.

Correct Incorrect Correct answer

Security threat scenarios are included in the program content.

Correct Incorrect Correct answer

An IS auditor has discovered that a cloud-based application was not included in an application inventory that was used to confirm the scope of an audit. The business process owner explained that the application will be audited by a third party in the next year. The auditor’s NEXT step should be to:

evaluate the impact of the cloud application on the audit scope.

Correct Incorrect Correct answer

revise the audit scope to include the cloud-based application.

Correct Incorrect Correct answer

review the audit report when performed by the third party.

Correct Incorrect Correct answer

report the control deficiency to senior management.

Correct Incorrect Correct answer

While executing follow-up activities, an IS auditor is concerned that management has implemented corrective actions that are different from those originally discussed and agreed with the audit function. In order to resolve the situation, the IS auditor’s BEST course of action would be to:

determine whether the alternative controls sufficiently mitigate the risk.

Correct Incorrect Correct answer

postpone follow-up activities and escalate the alternative controls to senior audit management.

Correct Incorrect Correct answer

re-prioritize the original issue as high risk and escalate to senior management.

Correct Incorrect Correct answer

schedule a follow-up audit in the next audit cycle.

Correct Incorrect Correct answer

Which of the following is the PRIMARY reason to follow a configuration management process to maintain applications?

To optimize system resources

Correct Incorrect Correct answer

To optimize asset management workflows

Correct Incorrect Correct answer

To ensure proper change control

Correct Incorrect Correct answer

To follow system hardening standards

Correct Incorrect Correct answer

What should an IS auditor do FIRST when management responses to an in-person internal control questionnaire indicate a key internal control is no longer effective?

Validate the overall effectiveness of the internal control.

Correct Incorrect Correct answer

Determine the resources required to make the control effective.

Correct Incorrect Correct answer

Verify the impact of the control no longer being effective

Correct Incorrect Correct answer

Ascertain the existence of other compensating controls.

Correct Incorrect Correct answer

Which of the following is the PRIMARY reason for an IS audit manager to review the work performed by a senior IS auditor prior to presentation of a report?

To ensure the conclusions are adequately supported

Correct Incorrect Correct answer

To ensure adequate sampling methods were used during fieldwork

Correct Incorrect Correct answer

To ensure the work is properly documented and filed

Correct Incorrect Correct answer

To ensure the work is conducted according to industry standards

Correct Incorrect Correct answer

Following the implementation of a data loss prevention (DLP) tool, administrators have been overwhelmed with a high number of false positives. Which of the following is the BEST way to address this issue?

Enable monitoring-only mode to permit further tuning of the solution.

Correct Incorrect Correct answer

Educate staff about the risks of sharing sensitive information outside the organization.

Correct Incorrect Correct answer

Amend policy rules to match approved and unapproved business information pathways.

Correct Incorrect Correct answer

Ensure the latest signature files are present and configure regular updates.

Correct Incorrect Correct answer

During an exit interview, senior management disagrees with some of the facts presented in the draft audit report and wants them removed from the report. Which of the following would be the auditor’s BEST course of action?

Revise the assessment based on senior management's objections

Correct Incorrect Correct answer

Gather evidence to analyze senior management's objections.

Correct Incorrect Correct answer

Escalate the issue to audit management.

Correct Incorrect Correct answer

Finalize the draft audit report without changes.

Correct Incorrect Correct answer

An organization was recently notified by its regulatory body of significant discrepancies in its reporting data. A preliminary investigation revealed that the discrepancies were caused by problems with the organization’s data quality. Management has directed the data quality team to enhance their program. The audit committee has asked internal audit to be advisors to the process. To ensure that management concerns are addressed, which data set should internal audit recommend be reviewed FIRST?

Data impacting business objectives

Correct Incorrect Correct answer

Data supporting financial statements

Correct Incorrect Correct answer

Data reported to the regulatory body

Correct Incorrect Correct answer

Data with customer personal information

Correct Incorrect Correct answer

Which of the following BEST minimizes performance degradation of servers used to authenticate users of an e-commerce website?

Configure each authentication server and ensure that the disks of each server form part of a duplex.

Correct Incorrect Correct answer

Configure each authentication server as belonging to a cluster of authentication servers.

Correct Incorrect Correct answer

Configure a single server as a primary authentication server and a second server as a secondary authentication server.

Correct Incorrect Correct answer

Configure each authentication server and ensure that each disk of its RAID is attached to the primary controller.

Correct Incorrect Correct answer

Audit frameworks can assist the IS audit function by:

outlining the specific steps needed to complete audits.

Correct Incorrect Correct answer

defining the authority and responsibility of the IS audit function.

Correct Incorrect Correct answer

providing details on how to execute the audit program.

Correct Incorrect Correct answer

providing direction and information regarding the performance of audits.

Correct Incorrect Correct answer

What is the BEST way to evaluate a control environment where the organization and a third party have shared responsibility?

Conduct a control self-assessment (CSA).

Correct Incorrect Correct answer

Review the service level agreement (SLA).

Correct Incorrect Correct answer

Perform an onsite evaluation.

Correct Incorrect Correct answer

Review complementary user entity controls.

Correct Incorrect Correct answer

Which of the following is the MAIN purpose of an information security management system?

To enhance the impact of reports used to monitor information security incidents

Correct Incorrect Correct answer

To reduce the frequency and impact of information security incidents

Correct Incorrect Correct answer

To identify and eliminate the root causes of information security incidents

Correct Incorrect Correct answer

To keep information security policies and procedures up-to-date

Correct Incorrect Correct answer

During the discussion of a draft audit report, IT management provided suitable evidence that a process has been implemented for a control that had been concluded by the IS auditor as ineffective. Which of the following is the auditor’s BEST action?

Explain to IT management that the new control will be evaluated during follow-up.

Correct Incorrect Correct answer

Add comments about the action taken by IT management in the report.

Correct Incorrect Correct answer

Change the conclusion based on evidence provided by IT management.

Correct Incorrect Correct answer

Re-perform the audit before changing the conclusion.

Correct Incorrect Correct answer

An organization allows its employees to use personal mobile devices for work. Which of the following would BEST maintain information security without compromising employee privacy?

Partitioning the work environment from personal space on devices

Correct Incorrect Correct answer

Preventing users from adding applications

Correct Incorrect Correct answer

Restricting the use of devices for personal purposes during working hours

Correct Incorrect Correct answer

Installing security software on the devices

Correct Incorrect Correct answer

An IS auditor who was instrumental in designing an application is called upon to review the application. The auditor should:

inform audit management of the earlier involvement.

Correct Incorrect Correct answer

modify the scope of the audit.

Correct Incorrect Correct answer

refuse the assignment to avoid conflict of interest.

Correct Incorrect Correct answer

use the knowledge of the application to carry out the audit.

Correct Incorrect Correct answer

Documentation of workaround processes to keep a business function operational during recovery of IT systems is a core part of a:

disaster recovery plan (DRP).

Correct Incorrect Correct answer

business continuity plan (BCP).

Correct Incorrect Correct answer

threat and risk assessment.

Correct Incorrect Correct answer

business impact analysis (BIA).

Correct Incorrect Correct answer

IS audit is asked to explain how local area network (LAN) servers can contribute to a rapid dissemination of viruses. The IS auditor’s BEST response is that:

the server's software is the prime target and is the first to be infected.

Correct Incorrect Correct answer

the server's operating system exchanges data with each station starting at every logon.

Correct Incorrect Correct answer

the server's file sharing function facilitates the distribution of files and applications.

Correct Incorrect Correct answer

users of a given server have similar usage of applications and files.

Correct Incorrect Correct answer

An organization has developed mature risk management practices that are followed across all departments. What is the MOST effective way for the audit team to leverage this risk management maturity?

Implementing risk responses on management's behalf

Correct Incorrect Correct answer

Providing assurances to management regarding risk

Correct Incorrect Correct answer

Facilitating audit risk identification and evaluation workshops

Correct Incorrect Correct answer

Integrating the risk register for audit planning purposes

Correct Incorrect Correct answer

Which of the following is the MOST important reason to implement version control for an end-user computing (EUC) application?

To ensure that only authorized users can access the application

Correct Incorrect Correct answer

To ensure compatibility between different versions of the application

Correct Incorrect Correct answer

To ensure that only the latest approved version of the application is used

Correct Incorrect Correct answer

To ensure that older versions are available for reference

Correct Incorrect Correct answer

One benefit of return on investment (ROI) analysis in IT decision making is that it provides the:

cost of replacing equipment.

Correct Incorrect Correct answer

estimated cost of ownership.

Correct Incorrect Correct answer

basis for allocating financial resources.

Correct Incorrect Correct answer

basis for allocating indirect costs.

Correct Incorrect Correct answer

Which of the following is MOST important for an IS auditor to verify when evaluating an organization’s data conversion and infrastructure migration plan?

A migration steering committee has been formed.

Correct Incorrect Correct answer

A rollback plan is included.

Correct Incorrect Correct answer

A code check review is included.

Correct Incorrect Correct answer

Strategic goals have been considered.

Correct Incorrect Correct answer

Which of the following weaknesses would have the GREATEST impact on the effective operation of a perimeter firewall?

Ad hoc monitoring of firewall activity

Correct Incorrect Correct answer

Use of stateful firewalls with default configuration

Correct Incorrect Correct answer

Potential back doors to the firewall software

Correct Incorrect Correct answer

Misconfiguration of the firewall rules

Correct Incorrect Correct answer

Which of the following is MOST important to ensure that electronic evidence collected during a forensic investigation will be admissible in future legal proceedings?

Restricting evidence access to professionally certified forensic investigators

Correct Incorrect Correct answer

Engaging an independent third party to perform the forensic investigation

Correct Incorrect Correct answer

Performing investigative procedures on the original hard drives rather than images of the hard drives

Correct Incorrect Correct answer

Documenting evidence handling by personnel throughout the forensic investigation

Correct Incorrect Correct answer

The IS auditor has recommended that management test a new system before using it in production mode. The BEST approach for management in developing a test plan is to use processing parameters that are:

randomly selected by a test generator.

Correct Incorrect Correct answer

provided by the vendor of the application.

Correct Incorrect Correct answer

randomly selected by the user.

Correct Incorrect Correct answer

simulated by production entities and customers.

Correct Incorrect Correct answer

Which of the following is the GREATEST risk associated with storing customer data on a web server?

Data integrity

Correct Incorrect Correct answer

Data availability

Correct Incorrect Correct answer

Data redundancy

Correct Incorrect Correct answer

Data confidentiality

Correct Incorrect Correct answer

Which of the following tests would provide the BEST assurance that a health care organization is handling patient data appropriately?

Compliance with industry standards and best practice

Correct Incorrect Correct answer

Compliance with action plans resulting from recent audits

Correct Incorrect Correct answer

Compliance with local laws and regulations

Correct Incorrect Correct answer

Compliance with the organization's policies and procedures

Correct Incorrect Correct answer

Which of the following provides the BEST evidence that outsourced provider services are being properly managed?

The service level agreement (SLA) includes penalties for non-performance.

Correct Incorrect Correct answer

The vendor provides historical data to demonstrate its performance.

Correct Incorrect Correct answer

Internal performance standards align with corporate strategy

Correct Incorrect Correct answer

Adequate action is taken for noncompliance with the service level agreement (SLA).

Correct Incorrect Correct answer

Which of the following is a concern when an organization’s disaster recovery strategy utilizes a hot site?

Insufficient environmental controls

Correct Incorrect Correct answer

Significant distance from the primary data center

Correct Incorrect Correct answer

The lack of networking infrastructure

Correct Incorrect Correct answer

Conflicts due to reciprocal agreements with other organizations

Correct Incorrect Correct answer

What is the BEST method to determine if IT resource spending is aligned with planned project spending?

Return on investment (ROI) analysts

Correct Incorrect Correct answer

Critical path analysis

Correct Incorrect Correct answer

Earned value analysis (EVA)

Correct Incorrect Correct answer

Gantt chart

Correct Incorrect Correct answer

An IS auditor is reviewing the release management process for an in-house software development solution. In which environment is the software version MOST likely to be the same as production?

Development

Correct Incorrect Correct answer

Staging

Correct Incorrect Correct answer

Testing

Correct Incorrect Correct answer

Integration

Correct Incorrect Correct answer

Which of the following would BEST help to ensure that potential security issues are considered by the development team as part of incremental changes to agile- developed software?

Deploy changes in a controlled environment and observe for security defects.

Correct Incorrect Correct answer

Mandate that the change analyses are documented in a standard format.

Correct Incorrect Correct answer

Assign the security risk analysis to a specially trained member of the project management office.

Correct Incorrect Correct answer

Include a mandatory step to analyze the security impact when making changes.

Correct Incorrect Correct answer

The waterfall life cycle model of software development is BEST suited for which of the following situations?

The project will involve the use of new technology.

Correct Incorrect Correct answer

The project intends to apply an object-oriented design approach.

Correct Incorrect Correct answer

The project is subject to time pressures.

Correct Incorrect Correct answer

The project requirements are well understood.

Correct Incorrect Correct answer

Which of the following is the GREATEST impact as a result of the ongoing deterioration of a detective control?

Increased number of false negatives in security logs

Correct Incorrect Correct answer

Decreased effectiveness of root cause analysis

Correct Incorrect Correct answer

Decreased overall recovery time

Correct Incorrect Correct answer

Increased demand for storage space for logs

Correct Incorrect Correct answer

A proper audit trail of changes to server start-up procedures would include evidence of:

program execution.

Correct Incorrect Correct answer

operator overrides.

Correct Incorrect Correct answer

subsystem structure.

Correct Incorrect Correct answer

security control options.

Correct Incorrect Correct answer

An audit identified that a computer system is not assigning sequential purchase order numbers to order requests. The IS auditor is conducting an audit follow-up to determine if management has resolved this finding. Which of the following is the MOST reliable follow-up procedure?

Inquire with management if the system has been configured and tested to generate sequential order numbers.

Correct Incorrect Correct answer

Review the documentation of recent changes to implement sequential order numbering.

Correct Incorrect Correct answer

Inspect the system settings and transaction logs to determine if sequential order numbers are generated.

Correct Incorrect Correct answer

Examine a sample of system generated purchase orders obtained from management.

Correct Incorrect Correct answer

Which of the following is the BEST way to enforce the principle of least privilege on a server containing data with different security classifications?

Limiting access to the data files based on frequency of use

Correct Incorrect Correct answer

Using scripted access control lists to prevent unauthorized access to the server

Correct Incorrect Correct answer

Obtaining formal agreement by users to comply with the data classification policy

Correct Incorrect Correct answer

Applying access controls determined by the data owner

Correct Incorrect Correct answer

Which of the following is the BEST way to determine whether a test of a disaster recovery plan (DRP) was successful?

Analyze whether predetermined test objectives were met.

Correct Incorrect Correct answer

Perform testing at the backup data center.

Correct Incorrect Correct answer

Test offsite backup files.

Correct Incorrect Correct answer

Evaluate participation by key personnel.

Correct Incorrect Correct answer

If enabled within firewall rules, which of the following services would present the GREATEST risk?

File transfer protocol (FTP)

Correct Incorrect Correct answer

Simple object access protocol (SOAP)

Correct Incorrect Correct answer

Hypertext transfer protocol (HTTP)

Correct Incorrect Correct answer

Simple mail transfer protocol (SMTP)

Correct Incorrect Correct answer

Which of the following is the MOST effective way for an organization to protect against data loss?

Conduct periodic security awareness training.

Correct Incorrect Correct answer

Limit employee Internet access.

Correct Incorrect Correct answer

Review firewall logs for anomalies.

Correct Incorrect Correct answer

Implement data classification procedures.

Correct Incorrect Correct answer

Which of the following is the BEST control to minimize the risk of unauthorized access to lost company-owned mobile devices?

Device encryption

Correct Incorrect Correct answer

Device tracking software

Correct Incorrect Correct answer

Password/PIN protection

Correct Incorrect Correct answer

Periodic backup

Correct Incorrect Correct answer

In a RACI model, which of the following roles must be assigned to only one individual?

Responsible

Correct Incorrect Correct answer

Accountable

Correct Incorrect Correct answer

Informed

Correct Incorrect Correct answer

Consulted

Correct Incorrect Correct answer

An IS auditor has found that a vendor has gone out of business and the escrow has an older version of the source code. What is the auditor’s BEST recommendation for the organization?

Perform an analysis to determine the business risk.

Correct Incorrect Correct answer

Develop a maintenance plan to support the application using the existing code.

Correct Incorrect Correct answer

Bring the escrow version up to date.

Correct Incorrect Correct answer

Analyze a new application that meets the current requirements.

Correct Incorrect Correct answer

An IS auditor is reviewing the installation of a new server. The IS auditor’s PRIMARY objective is to ensure that:

security parameters are set in accordance with the manufacturer's standards.

Correct Incorrect Correct answer

security parameters are set in accordance with the organization's policies.

Correct Incorrect Correct answer

a detailed business case was formally approved prior to the purchase.

Correct Incorrect Correct answer

the procurement project invited tenders from at least three different suppliers.

Correct Incorrect Correct answer

An IS auditor finds a high-risk vulnerability in a public-facing web server used to process online customer payments. The IS auditor should FIRST:

notify the audit committee.

Correct Incorrect Correct answer

review security incident reports.

Correct Incorrect Correct answer

identify compensating controls.

Correct Incorrect Correct answer

document the exception in an audit report.

Correct Incorrect Correct answer

An IS auditor discovers that an IT organization serving several business units assigns equal priority to all initiatives, creating a risk of delays in securing project funding. Which of the following would be MOST helpful in matching demand for projects and services with available resources in a way that supports business objectives?

Risk assessment results

Correct Incorrect Correct answer

IT governance framework

Correct Incorrect Correct answer

Project management

Correct Incorrect Correct answer

Portfolio management

Correct Incorrect Correct answer

Which of the following is the MOST efficient way to identify segregation of duties violations in a new system?

Observe the performance of business processes.

Correct Incorrect Correct answer

Develop a process to identify authorization conflicts.

Correct Incorrect Correct answer

Review a report of security rights in the system.

Correct Incorrect Correct answer

Examine recent system access rights violations.

Correct Incorrect Correct answer

An internal audit team is deciding whether to use an audit management application hosted by a third party in a different country. What should be the MOST important consideration related to the uploading of payroll audit documentation in the hosted application?

Per-unit cost charged by the hosting services provider for storage

Correct Incorrect Correct answer

Privacy regulations affecting the organization

Correct Incorrect Correct answer

Financial regulations affecting the organization

Correct Incorrect Correct answer

Data center physical access controls where the application is hosted

Correct Incorrect Correct answer

Which of the following is the PRIMARY reason for an IS auditor to conduct post-implementation reviews?

To document lessons learned to improve future project delivery

Correct Incorrect Correct answer

To align project objectives with business needs

Correct Incorrect Correct answer

To determine whether project objectives in the business case have been achieved

Correct Incorrect Correct answer

To ensure key stakeholder sign-off has been obtained

Correct Incorrect Correct answer

Which of the following is the BEST metric to measure the alignment of IT and business strategy?

Frequency of business process capability maturity assessments

Correct Incorrect Correct answer

Percentage of enterprise risk assessments that include IT-related risk

Correct Incorrect Correct answer

Percentage of staff satisfied with their IT-related roles

Correct Incorrect Correct answer

Level of stakeholder satisfaction with the scope of planned IT projects

Correct Incorrect Correct answer

Which of the following is the MOST important activity in the data classification process?

Determining accountability of data owners

Correct Incorrect Correct answer

Labeling the data appropriately

Correct Incorrect Correct answer

Identifying risk associated with the data

Correct Incorrect Correct answer

Determining the adequacy of privacy controls

Correct Incorrect Correct answer

Which of the following is MOST appropriate to prevent unauthorized retrieval of confidential information stored in a business application system?

Implement segregation of duties.

Correct Incorrect Correct answer

Enforce an internal data access policy.

Correct Incorrect Correct answer

Enforce the use of digital signatures

Correct Incorrect Correct answer

Apply single sign-on for access control.

Correct Incorrect Correct answer

A project team has decided to switch to an agile approach to develop a replacement for an existing business application. Which of the following should an IS auditor do FIRST to ensure the effectiveness of the project audit?

Understand the specific agile methodology that will be followed.

Correct Incorrect Correct answer

Interview business process owners to compile a list of business requirements.

Correct Incorrect Correct answer

Compare the agile process with previous methodology.

Correct Incorrect Correct answer

Identify and assess existing agile process controls.

Correct Incorrect Correct answer

During an external review, an IS auditor observes an inconsistent approach in classifying system criticality within the organization. Which of the following should be recommended as the PRIMARY factor to determine system criticality?

Maximum allowable downtime (MAD)

Correct Incorrect Correct answer

Mean time to restore (MTTR)

Correct Incorrect Correct answer

Recovery point objective (RPO)

Correct Incorrect Correct answer

Key performance indicators (KPIs)

Correct Incorrect Correct answer

Which of the following is the MOST significant risk that IS auditors are required to consider for each engagement?

Irregularities and illegal acts

Correct Incorrect Correct answer

Noncompliance with organizational policies

Correct Incorrect Correct answer

Misalignment with business objectives

Correct Incorrect Correct answer

Process and resource inefficiencies

Correct Incorrect Correct answer

An externally facing system containing sensitive data is configured such that users have either read-only or administrator rights. Most users of the system have administrator access. Which of the following is the GREATEST risk associated with this situation?

Users can make unauthorized changes.

Correct Incorrect Correct answer

Users can export application logs.

Correct Incorrect Correct answer

Users can install open-licensed software.

Correct Incorrect Correct answer

Users can view sensitive data.

Correct Incorrect Correct answer

Which of the following is the GREATEST risk associated with utilizing spreadsheets for financial reporting in end-user computing (EUC)?

Lack of password protection

Correct Incorrect Correct answer

Lack of processing integrity

Correct Incorrect Correct answer

Increase in operational incidents

Correct Incorrect Correct answer

Increase in regulatory violations

Correct Incorrect Correct answer

The decision to accept an IT control risk related to data quality should be the responsibility of the:

IS audit manager.

Correct Incorrect Correct answer

chief information officer (CIO).

Correct Incorrect Correct answer

information security team.

Correct Incorrect Correct answer

business owner.

Correct Incorrect Correct answer

An organization’s audit charter PRIMARILY:

describes the auditor's authority to conduct audits.

Correct Incorrect Correct answer

formally records the annual and quarterly audit plans.

Correct Incorrect Correct answer

documents the audit process and reporting standards.

Correct Incorrect Correct answer

defines the auditors' code of conduct.

Correct Incorrect Correct answer

Following a security breach in which a hacker exploited a well-known vulnerability in the domain controller, an IS auditor has been asked to conduct a control assessment. The auditor’s BEST course of action would be to determine if:

the patches were updated.

Correct Incorrect Correct answer

the logs were monitored.

Correct Incorrect Correct answer

the domain controller was classified for high availability.

Correct Incorrect Correct answer

the network traffic was being monitored.

Correct Incorrect Correct answer

What is MOST important to verify during an external assessment of network vulnerability?

Regular review of the network security policy

Correct Incorrect Correct answer

Location of intrusion detection systems (IDS)

Correct Incorrect Correct answer

Update of security information event management (SIEM) rules

Correct Incorrect Correct answer

Completeness of network asset inventory

Correct Incorrect Correct answer

Which of the following environments is BEST used for copying data and transformation into a compatible data warehouse format?

Development

Correct Incorrect Correct answer

Testing

Correct Incorrect Correct answer

Replication

Correct Incorrect Correct answer

Staging

Correct Incorrect Correct answer

Which of the following is the BEST recommendation to include in an organization’s bring your own device (BYOD) policy to help prevent data leakage?

Specify employee responsibilities for reporting lost or stolen BYOD devices.

Correct Incorrect Correct answer

Require multi-factor authentication on BYOD devices.

Correct Incorrect Correct answer

Require employees to waive privacy rights related to data on BYOD devices.

Correct Incorrect Correct answer

Allow only registered BYOD devices to access the network.

Correct Incorrect Correct answer

Which type of testing BEST determines whether a new system meets business requirements and is ready to be placed into production?

Load testing

Correct Incorrect Correct answer

User acceptance testing (UAT)

Correct Incorrect Correct answer

Volume testing

Correct Incorrect Correct answer

Performance testing

Correct Incorrect Correct answer

During audit planning, the IS audit manager is considering whether to budget for audits of entities regarded by the business as having low risk. Which of the following is the BEST course of action in this situation?

Outsource low-risk audits to external audit service providers.

Correct Incorrect Correct answer

Challenge the risk rating and include the low-risk entities in the plan.

Correct Incorrect Correct answer

Conduct limited-scope audits of low-risk business entities.

Correct Incorrect Correct answer

Validate the low-risk entity ratings and apply professional judgment.

Correct Incorrect Correct answer

An organization has virtualized its server environment without making any other changes to the network or security infrastructure. Which of the following is the
MOST significant risk?

Data center environmental controls not aligning with new configuration

Correct Incorrect Correct answer

System documentation not being updated to reflect changes in the environment

Correct Incorrect Correct answer

Vulnerability in the virtualization platform affecting multiple hosts

Correct Incorrect Correct answer

Inability of the network intrusion detection system (IDS) to monitor virtual server-to-server communications.

Correct Incorrect Correct answer

During an audit of an organization’s risk management practices, an IS auditor finds several documented IT risk acceptances have not been renewed in a timely manner after the assigned expiration date. When assessing the severity of this finding, which mitigating factor would MOST significantly minimize the associated impact?

There are documented compensating controls over the business processes.

Correct Incorrect Correct answer

The risk acceptances with issues reflect a small percentage of the total population.

Correct Incorrect Correct answer

The business environment has not significantly changed since the risk acceptances were approved.

Correct Incorrect Correct answer

The risk acceptances were previously reviewed and approved by appropriate senior management.

Correct Incorrect Correct answer

Which of the following is MOST important for an IS auditor to consider when performing the risk assessment prior to an audit engagement?

Industry standards and best practices

Correct Incorrect Correct answer

The amount of time since the previous audit

Correct Incorrect Correct answer

The results of the previous audit

Correct Incorrect Correct answer

The design of controls

Correct Incorrect Correct answer

An IS auditor is reviewing the deployment of a new automated system. Which of the following findings presents the MOST significant risk?

Users have not been trained on the new system.

Correct Incorrect Correct answer

The new system is not platform agnostic.

Correct Incorrect Correct answer

Data from the legacy system is not migrated correctly to the new system.

Correct Incorrect Correct answer

The new system has resulted in layoffs of key experienced personnel.

Correct Incorrect Correct answer

Which of the following is an executive management concern that could be addressed by the implementation of a security metrics dashboard?

Effectiveness of the security program

Correct Incorrect Correct answer

Total number of false positives

Correct Incorrect Correct answer

Total number of hours budgeted to security

Correct Incorrect Correct answer

Security incidents vs. industry benchmarks

Correct Incorrect Correct answer

Which of the following is the BEST way to mitigate the risk associated with unintentional modifications of complex calculations in end-user computing (EUC)?

Have an independent party review the source calculations

Correct Incorrect Correct answer

Verify EUC results through manual calculations.

Correct Incorrect Correct answer

Execute copies of EUC programs out of a secure library.

Correct Incorrect Correct answer

Implement complex password controls.

Correct Incorrect Correct answer

Which of the following must be in place before an IS auditor initiates audit follow-up activities?

A management response in the final report with a committed implementation date

Correct Incorrect Correct answer

A heat map with the gaps and recommendations displayed in terms of risk

Correct Incorrect Correct answer

Supporting evidence for the gaps and recommendations mentioned in the audit report

Correct Incorrect Correct answer

Available resources for the activities included in the action plan

Correct Incorrect Correct answer

Which of the following is the BEST way to address segregation of duties issues in an organization with budget constraints?

Perform an independent audit.

Correct Incorrect Correct answer

Implement compensating controls.

Correct Incorrect Correct answer

Hire temporary staff.

Correct Incorrect Correct answer

Rotate job duties periodically.

Correct Incorrect Correct answer

The due date of an audit project is approaching, and the audit manager has determined that only 60% of the audit has been completed. Which of the following should the audit manager do FIRST?

Extend the audit deadline.

Correct Incorrect Correct answer

Escalate to the audit committee.

Correct Incorrect Correct answer

Assign additional resources to supplement the audit.

Correct Incorrect Correct answer

Determine where delays have occurred.

Correct Incorrect Correct answer

During a security audit, an IS auditor is tasked with reviewing log entries obtained from an enterprise intrusion prevention system (IPS). Which type of risk would be associated with the potential for the auditor to miss a sequence of logged events that could indicate an error in the IPS configuration?

Detection risk

Correct Incorrect Correct answer

Control risk

Correct Incorrect Correct answer

Sampling risk

Correct Incorrect Correct answer

Inherent risk

Correct Incorrect Correct answer

Which of the following backup schemes is the BEST option when storage media is limited?

Real-time backup

Correct Incorrect Correct answer

Differential backup

Correct Incorrect Correct answer

Virtual backup

Correct Incorrect Correct answer

Full backup

Correct Incorrect Correct answer

Which of the following should be of GREATEST concern for an IS auditor reviewing an organization’s disaster recovery plan (DRP)?

The DRP has not been updated since an IT infrastructure upgrade

Correct Incorrect Correct answer

The DRP has not been distributed to end users.

Correct Incorrect Correct answer

The DRP has not been formally approved by senior management.

Correct Incorrect Correct answer

The DRP contains recovery procedures for critical servers only.

Correct Incorrect Correct answer

A system administrator recently informed the IS auditor about the occurrence of several unsuccessful intrusion attempts from outside the organization. Which of the following is MOST effective in detecting such an intrusion?

Periodically reviewing log files

Correct Incorrect Correct answer

Configuring the router as a firewall

Correct Incorrect Correct answer

Installing biometrics-based authentication

Correct Incorrect Correct answer

Using smart cards with one-time passwords

Correct Incorrect Correct answer

According to the three lines of defense model for risk management, the second line of defense includes functions that:

own risks.

Correct Incorrect Correct answer

oversee risks.

Correct Incorrect Correct answer

define risk appetite.

Correct Incorrect Correct answer

provide independent assurance.

Correct Incorrect Correct answer

Which of the following should be an IS auditor’s PRIMARY focus when developing a risk-based IS audit program?

Business processes

Correct Incorrect Correct answer

Business plans

Correct Incorrect Correct answer

Portfolio management

Correct Incorrect Correct answer

IT strategic plans

Correct Incorrect Correct answer

Which of the following is the MOST appropriate and effective fire suppression method for an unstaffed computer room?

Water sprinkler

Correct Incorrect Correct answer

Fire extinguishers

Correct Incorrect Correct answer

Carbon dioxide (CO )

Correct Incorrect Correct answer

Dry pipe

Correct Incorrect Correct answer

Which of the following is MOST important for an IS auditor to examine when reviewing an organization’s privacy policy?

Whether there is explicit permission from regulators to collect personal data

Correct Incorrect Correct answer

The organization's legitimate purpose for collecting personal data

Correct Incorrect Correct answer

The encryption mechanism selected by the organization for protecting personal data

Correct Incorrect Correct answer

Whether sharing of personal information with third-party service providers is prohibited

Correct Incorrect Correct answer

An IS auditor reviewing security incident processes realizes incidents are resolved and closed, but root causes are not investigated. Which of the following should be the MAJOR concern with this situation?

Security incident policies are out of date.

Correct Incorrect Correct answer

Lessons learned have not been properly documented.

Correct Incorrect Correct answer

Vulnerabilities have not been properly addressed.

Correct Incorrect Correct answer

Abuses by employees have not been reported.

Correct Incorrect Correct answer

Which of the following provides the MOST assurance of the integrity of a firewall log?

The log is retained per policy.

Correct Incorrect Correct answer

Authorized access is required to view the log.

Correct Incorrect Correct answer

The log cannot be modified.

Correct Incorrect Correct answer

The log is reviewed on a monthly basis.

Correct Incorrect Correct answer

Which of the following is MOST important for an IS auditor to determine during the detailed design phase of a system development project?

Acceptance test criteria have been developed.

Correct Incorrect Correct answer

Data conversion procedures have been established.

Correct Incorrect Correct answer

The design has been approved by senior management.

Correct Incorrect Correct answer

Program coding standards have been followed.

Correct Incorrect Correct answer

Which of the following should an IS auditor consider FIRST when evaluating firewall rules?

The firewalls' default settings

Correct Incorrect Correct answer

The physical location of the firewalls

Correct Incorrect Correct answer

The number of remote nodes

Correct Incorrect Correct answer

The organization's security policy

Correct Incorrect Correct answer

An IS auditor has discovered that a software system still in regular use is years out of date and no longer supported. The auditee has stated that it will take six months until the software is running on the current version. Which of the following is the BEST way to reduce the immediate risk associated with using an unsupported version of the software?

Verify all patches have been applied to the software system's outdated version.

Correct Incorrect Correct answer

Monitor network traffic attempting to reach the outdated software system.

Correct Incorrect Correct answer

Close all unused ports on the outdated software system.

Correct Incorrect Correct answer

Segregate the outdated software system from the main network.

Correct Incorrect Correct answer

The PRIMARY purpose of running a new system in parallel is to:

validate the operation of the new system against its predecessor.

Correct Incorrect Correct answer

determine which of the two systems is more efficient and effective.

Correct Incorrect Correct answer

resolve any errors in the program and file interfaces.

Correct Incorrect Correct answer

provide the basis for comprehensive unit and system testing.

Correct Incorrect Correct answer

During the planning phase of a data loss prevention (DLP) audit, management expresses a concern about mobile computing. Which of the following should the IS auditor identify as the associated risk?

Lack of governance and oversight for IT infrastructure and applications

Correct Incorrect Correct answer

Increased need for user awareness training

Correct Incorrect Correct answer

The use of the cloud negatively impacting IT availability

Correct Incorrect Correct answer

Increased vulnerability due to anytime, anywhere accessibility

Correct Incorrect Correct answer

An organization has recently acquired and implemented intelligent-agent software for granting loans to customers. During the post-implementation review, which of the following is the MOST important procedure for the IS auditor to perform?

Review signed approvals to ensure responsibilities for decisions of the system are well defined.

Correct Incorrect Correct answer

Review system documentation to ensure completeness.

Correct Incorrect Correct answer

Review system and error logs to verify transaction accuracy.

Correct Incorrect Correct answer

Review input and output control reports to verify the accuracy of the system decisions.

Correct Incorrect Correct answer

During a new system implementation, an IS auditor has been assigned to review risk management at each milestone. The auditor finds that several risks to project benefits have not been addressed. Who should be accountable for managing these risks?

Project manager

Correct Incorrect Correct answer

Information security officer

Correct Incorrect Correct answer

Project sponsor

Correct Incorrect Correct answer

Enterprise risk manager

Correct Incorrect Correct answer

In a post-implementation review of a recently purchased system, it is MOST important for the IS auditor to determine whether the:

vendor product offered a viable solution.

Correct Incorrect Correct answer

user requirements were met.

Correct Incorrect Correct answer

test scenarios reflected operating activities.

Correct Incorrect Correct answer

stakeholder expectations were identified.

Correct Incorrect Correct answer

Which of the following strategies BEST optimizes data storage without compromising data retention practices?

Allowing employees to store large emails on flash drives

Correct Incorrect Correct answer

Automatically deleting emails older than one year

Correct Incorrect Correct answer

Moving emails to a virtual email vault after 30 days

Correct Incorrect Correct answer

Limiting the size of file attachments being sent via email

Correct Incorrect Correct answer

Which of the following will be the MOST effective method to verify that a service vendor keeps control levels as required by the client?

Obtain evidence of the vendor's control self-assessment (CSA).

Correct Incorrect Correct answer

Periodically review the service level agreement (SLA) with the vendor.

Correct Incorrect Correct answer

Conduct periodic on-site assessments using agreed-upon criteria.

Correct Incorrect Correct answer

Conduct an unannounced vulnerability assessment of vendor's IT systems.

Correct Incorrect Correct answer

An IS auditor is reviewing the maturity of a large organization’s IT governance. Which of the following BEST demonstrates that IT governance has been effectively implemented?

The board reviews compliance with legal and regulatory requirements.

Correct Incorrect Correct answer

The board monitors adherence to the organization's information security policy.

Correct Incorrect Correct answer

The board reviews strategic IT key performance indicators (KPIs).

Correct Incorrect Correct answer

The board approves necessary resources for IT security reviews.

Correct Incorrect Correct answer

What should an IS auditor do FIRST upon discovering that a service provider did not notify its customers of a security breach?

Notify law enforcement of the finding.

Correct Incorrect Correct answer

Require the third party to notify customers.

Correct Incorrect Correct answer

Issue the audit report with a significant finding.

Correct Incorrect Correct answer

Notify audit management of the finding.

Correct Incorrect Correct answer

An IS auditor is reviewing an organization’s primary router access control list. Which of the following should result in a finding?

There are conflicting permit and deny rules for the IT group.

Correct Incorrect Correct answer

There is only one rule per group with access privileges.

Correct Incorrect Correct answer

Individual permissions are overriding group permissions.

Correct Incorrect Correct answer

The network security group can change network address translation (NAT).

Correct Incorrect Correct answer

Which of the following is the GREATEST risk of using a reciprocal site for disaster recovery?

Inability to utilize the site when required

Correct Incorrect Correct answer

Inability to test the recovery plans onsite

Correct Incorrect Correct answer

Mismatched organizational security policies

Correct Incorrect Correct answer

Equipment compatibility issues at the site

Correct Incorrect Correct answer

Which of the following BEST enables the timely identification of risk exposure?

Control self-assessment (CSA)

Correct Incorrect Correct answer

Internal audit review

Correct Incorrect Correct answer

Stress testing

Correct Incorrect Correct answer

External audit review

Correct Incorrect Correct answer

CISA Final Assessment 1

Quiz Summary

Information

Results

Results

Categories

1. Question

2. Question

3. Question

4. Question

5. Question

6. Question

7. Question

8. Question

9. Question

10. Question

11. Question

12. Question

13. Question

14. Question

15. Question

16. Question

17. Question

18. Question

19. Question

20. Question

21. Question

22. Question

23. Question

24. Question

25. Question

26. Question

27. Question

28. Question

29. Question

30. Question

31. Question

32. Question

33. Question

34. Question

35. Question

36. Question

37. Question

38. Question

39. Question

40. Question

41. Question

42. Question

43. Question

44. Question

45. Question

46. Question

47. Question

48. Question

49. Question

50. Question

51. Question

52. Question

53. Question

54. Question

55. Question

56. Question

57. Question

58. Question

59. Question

60. Question

61. Question

62. Question

63. Question

64. Question

65. Question

66. Question

67. Question

68. Question

69. Question

70. Question

71. Question

72. Question

73. Question