CISA Final Assessment 3

Which of the following analytical methods would be MOST useful when trying to identify groups with similar behavior or characteristics in a large population?

Which of the following BEST addresses the availability of an online store?

Who would provide an IS auditor with the MOST helpful input during an interview to determine whether business requirements for an application were met?

Which of the following should be an IS auditor’s GREATEST concern when assessing an IT service configuration database?

Which of the following is PRIMARY responsibility of an IT steering committee?

Which of the following provides an IS auditor assurance that the interface between a point-of-sale (POS) system and the general ledger is transferring sales data completely and accurately?

An IS audit manager is reviewing workpapers for a recently completed audit of the corporate disaster recovery test. Which of the following should the IS audit manager specifically review to substantiate the conclusions?

Which of the following is an indication of possible hacker activity involving voice communications?

Which of the following is the MOST appropriate indicator of change management effectiveness?

Which of the following should be an IS auditor’s GREATEST concern when reviewing an organization’s capacity management planning?

Which of the following is the BEST source of information to determine the required level of data protection on a file server?

Which of the following is the PRIMARY objective of implementing IT governance?

During an information security audit of a mid-sized organization, an IS auditor notes that the organization’s information security policy is not sufficient. What is the auditor’s BEST recommendation for the organization?

The GREATEST limitation of a network-based intrusion detection system (IDS) is that it:

Which of the following is the MOST efficient solution for a multi-location healthcare organization that wants to be able to access patient data wherever patients present themselves for care?

Which of the following would be MOST impacted if an IS auditor were to assist with the implementation of recommended control enhancements?

Which of the following is the BEST report for an IS auditor to reference when tasked with reviewing the security of code written for a newly developed website?

Which of the following observations should be of MOST concern to an IS auditor reviewing an organization’s business impact analysis (BIA) practices?

During an audit, which of the following would be MOST helpful in establishing a baseline for measuring data quality?

Which of the following approaches would BEST enable an e-commerce website to handle unpredictable amounts of traffic?

An organization is permanently transitioning from onsite to fully remote business operations. When should the existing business impact analysis (BIA) be reviewed?

Which of the following is a PRIMARY benefit of a maturity model?

In the development of a new financial application, the IS auditor’s FIRST involvement should be in the:

Which of the following tests would BEST indicate that a software development project is ready to be deployed into the production environment?

Which of the following is the MOST important element of quality control with respect to an audit engagement?

Which of the following threats is mitigated by a firewall?

Which of the following is the GREATEST advantage of maintaining an internal IS audit function within an organization?

The MOST appropriate person to chair the steering committee for an enterprise-wide system development should be the:

Which of the following should be of GREATEST concern to an IS auditor assessing the effectiveness of an organization’s vulnerability scanning program?

An IS audit reveals an organization has decided not to implement a new regulation by the required deadline because the cost of rapid implementation is higher than the penalty for noncompliance. Which of the following is the auditor’s BEST course of action?

Which of the following is the BEST way for an IS auditor to determine the completeness of data migration?

Which of the following is MOST important to consider when establishing the retention period for customer data within a specific database or application?

An organization has decided to purchase a web-based email service from a third-party vendor and eliminate its own email server infrastructure. What type of cloud computing environment would BEST meet the organization’s objective?

Which of the following is the GREATEST advantage of utilizing guest operating systems in a virtual environment?

An IS auditor finds that a system receives identical information from two different upstream sources, even though redundancy is not required. Which of the following would BEST enable the organization to avoid this type of inefficiency?

Which of the following is the BEST way to determine the effectiveness of an organization’s current patch management system?

A large organization has a centralized infrastructure team and decentralized application support teams reporting into their respective business units. Which of the following is the GREATEST potential issue with his organizational structure?

An IS auditor is reviewing an origination’s release management practices and observes inconsistent and inaccurate estimation of the size and complexity of business application development projects. Which of the following should the auditor recommend to address this issue?

Which of the following is the BEST way to faster continuous improvement of IS audit processes and practices?

An IS auditor is preparing a plan for audits to be carried out over a specified period. Which of the following activities should the IS auditor perform FIRST?

During a review of system access, an IS auditor notes that an employee who has recently changed roles within the organization still has previous access rights. The auditor’s NEXT step should be to:

An organization has developed processes to recover critical files in the event of a ransomware attack. Which type of control do these processes represent?

Which type of threat can utilize a large group of automated social media accounts to steal data, send spam, or launch distributed denial of service (DDoS) attacks?

Which of the following is the BEST preventative control to ensure that database integrity is maintained?

During an information security review, an IS auditor learns an organizational policy requires all employees to attend information security training during the first week of each new year What is the auditor’s BEST recommendation to ensure employees hired after January receive adequate guidance regarding security awareness?

An IS auditor observes a system performance monitoring too that states that a server critical to the organization averages high CPU utilization across a cluster of four virtual servers throughout the audit period. To determine if further investigation is required an IS auditor should review:

In a review of the organization standards and guidelines for IT management, which of the following should be included in an IS development methodology?

When using data analytics to perform an audit, the IS auditor should FIRST:

An organization outsourced its IS functions. To meet its responsibility for disaster recovery, the organization should:

Which of the following is a preventive control that can protect against internal fraud in an organization?

During a routine internal software licensing review, an IS auditor discovers instances where employees shared license keys to critical pieces of business software. Which of the following would be the auditor’s BEST course of action?

An organization has implemented segregation of duties with appropriate job definitions and restrictions on overlapping roles. Which type of control has been implemented?

Which of the following is the MOST effective way to assess the controls over the hardware maintenance process?

When auditing an organization’s software acquisition process, the BEST way for an IS auditor to understand the software benefits to the organization would be to review the:

When building or upgrading enterprise cryptographic infrastructure, which of the following is the MOST critical requirement for growing business requirements?

After delivering an audit report, the audit manager discovers that evidence was overlooked during the audit. This evidence indicates that procedural control may have failed and could contradict a conclusion of the audit. Which of the following risks is MOST affected by this oversight?

Which of the following is MOST effective for controlling visitor access to a data center?

When reviewing a business impact analysis (BIA), it is MOST important for an IS auditor to ensure input was obtained from which group of stakeholders?

Which of the following observations should be of GREATEST concern to an IS auditor performing an audit of an organization’s social media practices?

Which of the following is the PRIMARY reason an IS auditor would recommend offsite backups although critical data is already on a redundant array of inexpensive disks (RAID)?

An organization’s business continuity plan (BCP) should be:

An IS auditor has been asked to review a recently implemented quality management system (QMS). Which of the following should be the auditor’s PRIMARY focus?

Which of the following should be of GREATEST concern to an IS auditor assessing the effectiveness of an organization’s release management processes?

An organization’s IT risk assessment should include the identification of:

Which of the following should be identified FIRST during the risk assessment process?

Which of the following is MOST important for an IS auditor to confirm when assessing the security of a new cloud-based IT application that is linked with the organization’s existing technology?

What would be the PRIMARY reason for an IS auditor to recommend using key risk indicators (KRIs)?

A matrix showing the current state and challenges of an organization’s software release management practices is MOST useful for:

Which of the following is the BEST way to prevent social engineering incidents?

Which of the following is the BEST way to reduce the attack surface for a server farm?

Which of the following is the BEST indication that an IT service desk function needs to improve its incident management processes?

The PRIMARY benefit of automating application testing is to:

Which of the following BEST enables an IS auditor to prioritize financial reporting spreadsheets for an end-user computing (EUC) audit?

Which of the following is the MOST critical factor for the successful implementation of an IT governance framework?

During an investigation, it was determined that an employee leaked company system administrative credentials on a public social media site. What is the IS auditor’s FIRST recommendation?

A transaction processing system interfaces with the general ledger. Data analytics has identified that some transactions are being recorded twice in the general ledger. While management states a system fix has been implemented, what should the IS auditor recommend to validate the interface is working in the future?

Which of the following BEST enables an organization to control which software can be installed on a user’s computer?

Which of the following indicators would BEST demonstrate the efficiency of a help desk operation?

Which of the following should be identified FIRST when assessing the maturity level of an organization’s vulnerability management practices?

An organization wants an independent measure of an outsourced system’s availability. This measure is directly related to contractual payment obligations. Which of the following procedures would an IS auditor MOST likely recommend?

Which of the following should be of GREATEST concern to an IS auditor when using data analytics?

Which of the following BEST indicates that an organization’s risk management practices contribute to the effectiveness of internal IS audits?

An IS auditor notes that an organization’s DevOps team has both production and developer access. The head of IT operations agrees that there is a segregation of duties concern but considers both types of access to be necessary for the team. Which of the following is the auditor’s BEST recommendation?

An organization has outsourced the maintenance of its customer database to an external vendor, and the vendor has requested live data to test the performance of the database. Which of the following is MOST important for the IS auditor to recommend?

The use of control totals satisfies which of the following control objectives?

An organization outsources its IT function to a third-party provider that supplies all hardware and support personnel. Which of the following poses the GREATEST risk that the provider’s IT resources may not be available to meet the organization’s objectives?

Which of the following biometric authentication methods has the LOWEST false acceptance rate?

Which of the following is MOST important for an IS auditor to confirm upon learning that an organization utilizes storage virtualization for key systems in their environment?

As part of a payroll department IS audit, which of the following is the PRIMARY reason an IS auditor would recommend that a supervisor review exception reports before authorizing payments?

Which of the following is the PRIMARY objective of enterprise architecture (EA)?

An IS auditor observes that each department follows a different approach for creating and securing spreadsheet macros. Which of the following is the auditor’s BEST recommendation for management in this situation?

Which of the following is the MOST effective method of destroying sensitive data stored on electronic media?

Which of the following BEST enables an organization to verify whether an encrypted message sent by a client has been altered?

Which of the following BEST enables an organization to improve the visibility of end-user computing (EUC) applications that support regulatory reporting?

An IS auditor has been asked to investigate critical business applications that have been producing suspicious results. Which of the following should be done FIRST?

Which of the following should be the FIRST step to successfully implement a corporate data classification program?

Which of the following is BEST supported by enforcing data definition standards within a database?

An IS auditor reviewing an information processing environment decides to conduct external penetration testing. Which of the following is MOST appropriate to include in the audit scope for the organization to distinguish between the auditor’s penetration attacks and actual attacks?

Which of the following BEST protects private health information from data loss for clients that utilize remote health-monitoring devices?

The BEST way to prevent fraudulent payments is to implement segregation of duties between the vendor setup and:

Which of the following should be the GREATEST concern for an IS auditor performing a post-implementation review for a major system upgrade?

Which of the following observations noted by an IS auditor reviewing internal IT standards is MOST important to address?

Which of the following is MOST important for an organization to consider when planning to outsource data storage to a third-party provider?

An IS auditor has been tasked with analyzing an organization’s capital expenditures against its repair and maintenance costs. Which of the following is the BEST reason to use a data analytics tool for this purpose?

Which of the following presents the GREATEST risk associated with end-user computing (EUC) applications over financial reporting?

An IS auditor should look for which of the following to ensure the risk associated with scope creep has been mitigated during software development?

Which of the following is MOST important to consider when defining disaster recovery strategies?

Which of the following is the GREATEST advantage of agile development over waterfall development?

Which of the following controls provides the MOST protection against ransomware attacks?

Which of the following is the BEST control to help ensure that security requirements are considered throughout the life cycle of an agile software development project?

Which of the following is the BEST control to help ensure that security requirements are considered throughout the life cycle of an agile software development project?

Which of the following is the BEST control to help ensure that security requirements are considered throughout the life cycle of an agile software development project?

Which of the following is MOST important when assembling an internal team to perform penetration testing for the organization?

Which of the following would a digital signature MOST likely prevent?

An IS auditor is determining the scope for an upcoming audit. Which of the following BEST enables the auditor to ensure appropriate controls are considered?

A PRIMARY objective of risk management is to keep the total cost of risks below the:

Which of the following should be the role of internal audit in an organization’s move to the cloud?

Which of the following should be the role of internal audit in an organization’s move to the cloud?

How does a switched network reduce the risk of network sniffing?

Which of the following is the MOST effective way for internal audit management to ensure the quality of IS audits is maintained?

In an organization’s feasibility study to acquire hardware to support a new web server, omission of which of the following would be of MOST concern?

Which of the following is MOST helpful for understanding an organization’s key driver to modernize application platforms?

An IS auditor is reviewing results from the testing of an organization’s disaster recovery plan (DRP). Which of the following findings should be of GREATEST concern?

Demonstrated support from which of the following roles in an organization has the MOST influence over information security governance?

An employee performs computer operations and, when the situation demands, program modifications. Which of the following should the IS auditor recommend?

A national bank recently migrated a large number of business-critical applications to the cloud. Which of the following is MOST important to ensuring the resiliency of the applications?

Which of the following should be an IS auditor’s PRIMARY consideration when evaluating the development and design of a privacy program?

Which of the following should be of GREATEST concern to an IS auditor reviewing an organization’s newly established enterprise architecture (EA)?

Which of the following BEST enables an organization to manage unexpected or on-request jobs?

When protecting mobile devices, which of the following is the PRIMARY risk mitigated by authentication controls?

During a review of an organization’s technology policies, which of the following observations should be of MOST concern to the IS auditor?

Which of the following provides a new IS auditor with the MOST useful information to evaluate overall IT performance?

Which risk response has been adopted by a risk owner postponing the implementation of proper controls due to budget constraints?

Before the release of a new application into an organization’s production environment, which of the following should be in place to ensure that proper testing has occurred and rollback plans are in place?

Which of the following BEST describes the role of the IS auditor in a control self-assessment (CSA)?

Which of the following is the BEST indication that there are potential problems within an organization’s IT service desk function?

Which of the following is the PRIMARY objective of cyber resiliency?

During a post-implementation review, which of the following provides the BEST evidence that user requirements have been met?

An IS auditor assessing an organization’s information systems needs to understand management’s approach regarding controls. Which documentation should the auditor review FIRST?

Which of the following is MOST useful for matching records of incoming and outgoing personnel to identify tailgating in physical security logs?

An IS auditor assesses an organization’s backup management practices for optimization potential. Which of the following features of a regular backup tape reorganization job BEST enables the organization to realize cost savings?

Which of the following is MOST important to define within a disaster recovery plan (DRP)?

Which of the following findings should be of MOST concern to an IS auditor assessing agile software development practices?

Which of the following would BEST integrate multiple data warehouses while reducing the workload required for moving data between the warehouses?

A confidential file was sent to a legal entity, and hashing was used on the file. Which type of control has been applied?

An IS auditor is performing a follow-up audit and notes that some critical deficiencies have not been addressed. The auditor’s BEST course of action is to:

Which of the following is the BEST way to help ensure new IT implementations align with enterprise architecture (EA) principles and requirements?

Which of the following is MOST important to confirm when evaluating an IT organization’s structure?

Which feature associated with an Infrastructure as a Service (IaaS) cloud service provider allows for the provisioning of new servers as demand changes?

Which of the following provides the BEST evidence that all elements of a business continuity plan (BCP) are operating effectively?