CISA Final Assessment 2

An IT balanced scorecard is the MOST effective means of monitoring:

When an IS audit reveals that a firewall was unable to recognize a number of attack attempts, the auditor’s BEST recommendation is to place an intrusion detection system (IDS) between the firewall and:

An organization with many desktop PCs is considering moving to a thin client architecture. Which of the following is the MAJOR advantage?

Which of the following is MOST important for an IS auditor to look for in a project feasibility study?

An IS auditor wants to determine who has oversight of staff performing a specific task and is referencing the organization’s RACI chart. Which of the following roles within the chart would provide this information?

Which of the following should an IS auditor consider the MOST significant risk associated with a new health records system that replaces a legacy system?

During an audit of a multinational bank’s disposal process, an IS auditor notes several findings. Which of the following should be the auditor’s GREATEST concern?

Which of the following BEST enables the effectiveness of an agile project for the rapid development of a new software application?

Which of the following would MOST effectively help to reduce the number of repeated incidents in an organization?

An IS auditor notes that several employees are spending an excessive amount of time using social media sites for personal reasons. Which of the following should the auditor recommend be performed FIRST?

An organization’s software developers need access to personally identifiable information (PII) stored in a particular data format. Which of the following is the BEST way to protect this sensitive information while allowing the developers to use it in development and test environments?

Which of the following is MOST important to verify when determining the completeness of the vulnerability scanning process?

Which of the following is the BEST evidence that an organization’s IT strategy is aligned to its business objectives?

What should be the PRIMARY basis for selecting which IS audits to perform in the coming year?

Which of the following is the BEST method to safeguard data on an organization’s laptop computers?

Which of the following is MOST important to determine during the planning phase of a cloud-based messaging and collaboration platform acquisition?

A new regulation requires organizations to report significant security incidents to the regulator within 24 hours of identification. Which of the following is the IS auditor’s BEST recommendation to facilitate compliance with the regulation?

A finance group recently implemented new technologies and processes. Which type of IS audit would provide the GREATEST level of assurance that the department’s objectives have been met?

Which of the following is the BEST way to verify the effectiveness of a data restoration process?

Which of the following would BEST help to support an auditor’s conclusion about the effectiveness of an implemented data classification program?

An IS auditor notes that not all security tests were completed for an online sales system recently promoted to production. Which of the following is the auditor’s
BEST course of action?

A new system is being developed by a vendor for a consumer service organization. The vendor will provide its proprietary software once system development is completed. Which of the following is the MOST important requirement to include in the vendor contract to ensure continuity?

An auditee disagrees with a recommendation for corrective action that appears in the draft engagement report. Which of the following is the IS auditor’s BEST course of action when preparing the final report?

Which of the following should an IS auditor ensure is classified at the HIGHEST level of sensitivity?

Which of the following is the MOST important reason to classify a disaster recovery plan (DRP) as confidential?

A company has implemented an IT segregation of duties policy. In a role-based environment, which of the following roles may be assigned to an application developer?

Which of the following is the MOST effective way to identify exfiltration of sensitive data by a malicious insider?

What is the PRIMARY purpose of documenting audit objectives when preparing for an engagement?

Which of the following should be the IS auditor’s PRIMARY focus when evaluating an organization’s offsite storage facility?

Which of the following is an example of a preventative control in an accounts payable system?

What is the GREATEST concern for an IS auditor reviewing contracts for licensed software that executes a critical business process?

Which of the following would BEST ensure that a backup copy is available for restoration of mission critical data after a disaster?

An IS auditor would MOST likely recommend that IT management use a balanced scorecard to:

Which of the following would be the BEST process for continuous auditing in a large financial institution?

Which of the following occurs during the issues management process for a system development project?

An IS auditor has been asked to advise on measures to improve IT governance within the organization. Which of the following is the BEST recommendation?

An IS auditor finds that capacity management for a key system is being performed by IT with no input from the business. The auditor’s PRIMARY concern would be:

From an IS auditor’s perspective, which of the following would be the GREATEST risk associated with an incomplete inventory of deployed software in an organization?

An IS auditor finds that firewalls are outdated and not supported by vendors. Which of the following should be the auditor’s NEXT course of action?

A third-party consultant is managing the replacement of an accounting system. Which of the following should be the IS auditor’s GREATEST concern?

Which of the following techniques provides the BEST assurance of server availability over time?

Which of the following is the BEST approach for determining the overall IT risk appetite of an organization when business units use different methods for managing IT risks?

In data warehouse (DW) management, what is the BEST way to prevent data quality issues caused by changes from a source system?

Which of the following would provide an IS auditor with the GREATEST assurance that data disposal controls support business strategic objectives?

Which of the following is MOST helpful for measuring benefits realization for a new system?

Which of the following audit procedures would be MOST conclusive in evaluating the effectiveness of on e-commerce application system’s edit routine?

An IT balanced scorecard is PRIMARILY used for:

Which of the following is the BEST way to sanitize a hard disk for reuse to ensure the organization’s information cannot be accessed?

Which of the following is the BEST indication of effective IT investment management?

Which of the following is MOST important with regard to an application development acceptance test?

Which of the following should be an IS auditor’s GREATEST concern when an international organization intends to roll out a global data privacy policy?

An IS auditor is conducting a physical security audit of a healthcare facility and finds closed-circuit television (CCTV) systems located in a patient care area. Which of the following is the GREATEST concern?

Which of the following is the BEST audit procedure to determine whether a firewall is configured in compliance with the organization’s security policy?

Which of the following would BEST indicate the effectiveness of a security awareness training program?

An organization recently migrated its data warehouse from a legacy system to a different architecture in the cloud. Which of the following should be GREATEST concern to the IS auditor reviewing the new data architecture?

Which of the following is the BEST means of defense against social engineering attacks?

The FIRST step in auditing a data communication system is to determine:

Which of the following is the BEST indicator to measure service quality of change and incident management processes outsourced to an external provider?

For the implementation of a program change in a production environment, the MOST important approval required is from:

An organization that has decided to approve the use of end-user computing (EUC) should FIRST ensure:

During a vendor management database audit, an IS auditor identifies multiple instances of duplicate vendor records. In order to prevent recurrence of the same issue, which of the following is the IS auditor’s BEST recommendation to management?

An organization is modernizing its technology policy framework to demonstrate compliance with external industry standards. Which of the following would be MOST useful to an IS auditor for validating the outcome?

Which of the following system implementation approaches allows for the LONGEST overlap period between the old and new systems?

Which of the following provides the BEST assurance that a new process for purging transactions does not have a detrimental impact on the integrity of the database?

The MOST critical security weakness of a packet level firewall is that it can be circumvented by:

Which of the following should be the FIRST step when conducting an IT risk assessment?

Which of the following BEST enables alignment of IT with business objectives?

At the end of each business day, a business-critical application generates a report of financial transactions greater than a certain value, and an employee then checks these transactions for errors. What type of control is in place?

A data center’s physical access log system captures each visitor’s identification document numbers along with the visitor’s photo. Which of the following sampling methods would be MOST useful to an IS auditor conducting compliance testing for the effectiveness of the system?

Which of the following BEST enables an organization to determine the priority of applications to be recovered in the event of a disaster?

Which of the following methods would BEST ensure that IT strategy is in line with business strategy?

Which of the following has the GREATEST potential impact on the independence of an IS auditor?

Which of the following should an IS auditor do FIRST when assessing the level of compliance for an organization in the banking industry?

Which of the following is the MOST effective control to mitigate against the risk of inappropriate activity by employees?

Which of the following is MOST important for an IS auditor to test when reviewing market data received from external providers?

Who is PRIMARILY responsible for the design of IT controls to meet control objectives?

Which of the following should an organization do to anticipate the effects of a disaster?

Which of the following risk scenarios is BEST addressed by implementing policies and procedures related to full disk encryption?

Which of the following is the BEST indication to an IS auditor that management’s post-implementation review was effective?

Which of the following provides the MOST reliable method of preventing unauthorized logon?

When designing a data analytics process, which of the following should be the stakeholder’s role in automating data extraction and validation?

An organization has an acceptable use policy in place, but users do not formally acknowledge the policy. Which of the following is the MOST significant risk from this finding?

Data from a system of sensors located outside of a network is received by the open ports on a server. Which of the following is the BEST way to ensure the integrity of the data being collected from the sensor system?

The PRIMARY benefit of a risk-based audit methodology is to:

Which of the following is MOST helpful to an IS auditor when assessing the effectiveness of controls?

A bank’s transactional services are exclusively conducted online via Internet and mobile banking. Both its primary and disaster recovery sites are supported by the same Internet service provider (ISP). Which of the following is the BEST way for the bank to minimize risk in this situation?

An IS auditor notes that a mortgage origination team receives customer loan applications via a shared repository. Which of the following findings presents the GREATEST privacy risk for this process?

An IS auditor previously worked in an organization’s IT department and was involved with the design of the business continuity plan (BCP). The IS auditor has now been asked to review this same BCP. What should the auditor do FIRST?

Which of the following is MOST important when evaluating the design effectiveness of multi-factor authentication?

Which of the following technologies has the SMALLEST maximum range for data transmission between devices?

Which of the following is the BEST way for management to ensure the effectiveness of the cybersecurity incident response process?

When reviewing a project to replace multiple manual data entry systems with an artificial intelligence (Al) system, the IS auditor should be MOST concerned with the impact Al will have on:

Which of the following is a core functionality of a configuration and release management system?

In an annual audit cycle, the audit of an organization’s IT department resulted in many findings. Which of the following would be the MOST important consideration when planning the next audit?

An IS auditor finds ad hoc vulnerability scanning is in place with no clear alignment to the organization’s wider security threat and vulnerability management program. Which of the following would BEST enable the organization to work toward improvement in this area?

Which of the following will BEST help detect software licensing issues in a networked environment where all software is purchased and loaded by IT?

Which of the following would be the BEST criteria for monitoring an IT vendor’s service levels?

Which of the following would be the BEST criteria for monitoring an IT vendor’s service levels?

Which of the following is the PRIMARY reason for using a hash function?

A sample for testing must include the 80 largest client balances and a random sample of the rest. What should the IS auditor recommend?

A bank has a combination of corporate customer accounts (higher monetary value) and small business accounts (lower monetary value) as part of online banking. Which of the following is the BEST sampling approach for an IS auditor to use for these accounts?

An organization has established hiring policies and procedures designed specifically to ensure network administrators are well qualified. Which type of control is in place?

A review of IT interface controls finds an organization does not have a process to identify and correct records that do not get transferred to the receiving system.

Which of the following is the IS auditor’s BEST recommendation?

Which of the following would BEST help to ensure that an incident receives attention from appropriate personnel in a timely manner?

A disaster recovery plan (DRP) should include steps for:

The use of which of the following is an inherent risk in the application container infrastructure?

An IS auditor reviewing a job scheduling tool notices performance and reliability problems. Which of the following is MOST likely affecting the tool?

Which of the following is the MOST important consideration when evaluating the data retention policy for a global organization with regional offices in multiple countries?

During a project assessment, an IS auditor finds that business owners have been removed from the project initiation phase. Which of the following should be the auditor’s GREATEST concern with this situation?

When a data center is attempting to restore computing facilities at an alternative site following a disaster, which of the following should be restored FIRST?

The PRIMARY reason to assign data ownership for protection of data is to establish:

In which of the following system development life cycle (SDLC) phases would an IS auditor expect to find that controls have been incorporated into system specifications?

Which of the following is the GREATEST advantage of vulnerability scanning over penetration testing?

A CFO has requested an audit of IT capacity management due to a series of finance system slowdowns during month-end reporting. What would be MOST important to consider before including this audit in the program?

An organization has introduced a capability maturity model to the system development life cycle (SDLC) to measure improvements. Which of the following is the BEST indication of successful process improvement?

Which of the following is a concern associated with virtualization?

An organization is planning to implement a work-from-home policy that allows users to work remotely as needed. Which of the following is the BEST solution for ensuring secure remote access to corporate resources?

An IS auditor is evaluating the progress of a web-based customer service application development project. Which of the following would be MOST helpful for this evaluation?

Which of the following should be of GREATEST concern to an IS auditor assessing the effectiveness of an organization’s release management processes?

Which of the following management decisions presents the GREATEST risk associated with data leakage?

An IS auditor is reviewing an organization’s incident management processes and procedures. Which of the following observations should be the auditor’s GREATEST concern?

Which of the following is the MOST important factor when an organization is developing information security policies and procedures?

What should an IS auditor review FIRST to verify that an organization’s IT strategy is effectively implemented?

Which of the following is MOST important to include in an awareness program focused on information security risk?

Which of the following is a threat to IS auditor independence?

Which of the following BEST supports an organization’s efforts to reduce the impact of ransomware attacks?

Which of the following network topologies will provide the GREATEST fault tolerance?

Which of the following findings should be of GREATEST concern to an IS auditor reviewing an organization’s newly implemented online security awareness program?

Which of the following are used in a firewall to protect the entity’s internal resources?

Which of the following cloud capabilities BEST enables an organization to meet unexpectedly high service demand?

An organization has shifted from a bottom-up approach to a top-down approach in the development of IT policies. This should result in:

Which of the following methods would BEST help detect unauthorized disclosure of confidential documents sent over corporate email?

An organization has engaged a third party to implement an application to perform business-critical calculations. Which of the following is the MOST important process to help ensure the application provides accurate calculations?

Which of the following is the BEST approach to help ensure evidence from a computer forensics investigation is legally admissible?

Evaluating application development projects against a defined maturity model enables an IS auditor to determine whether:

During data conversion, data cleansing is BEST performed prior to:

Which of the following scenarios should raise a concern about auditor independence?

Which of the following is the BEST way for an IS auditor to determine whether an organization’s disaster recovery plan (DRP) is current?

Which of the following BEST enables the authentication of an email from an untrusted network?

When planning an audit, it is acceptable for an IS auditor to rely on a third-party provider’s external audit report on service level management when the:

Which of the following should be the GREATEST concern to an IS auditor reviewing an organization’s job scheduling practices?

Which of the following is the GREATEST benefit to an organization as a result of effective IS audit risk assessments?

A white box testing method is applicable with which of the following testing processes?

Which of the following is the GREATEST risk related to the use of virtualized environments?

Which of the following is a deterrent security control that reduces the likelihood of an insider threat event?

While evaluating the data classification process of an organization, an IS auditor’s PRIMARY focus should be on whether:

Which of the following auditing techniques would be used to detect the validity of a credit card transaction based on time, location, and date of purchase?

Which of the following poses the GREATEST risk to a virtualized environment?

Capacity management tools are PRIMARILY used to ensure that:

Which of the following is an example of personally identifiable information (PII)?