Professional Documents
Culture Documents
CISA Practice Questions
CISA Practice Questions
q363
Exam Code: CISA
Exam Name: Certified Information Systems Auditor
Certification Provider: ISACA
Free Question Number: 363
Version: v2021-03-04
# of views: 114
# of Questions views: 3635
https://www.freecram.com/torrent/ISACA.CISA.v2021-03-04.q363.html
NEW QUESTION: 1
Which of the following reports can MOST effectively be used to analyze a systems
performance problem?
A. Database usage log
B. Synchronization report
C. Console log
D. Utilization report
Answer: C (LEAVE A REPLY)
NEW QUESTION: 2
Which of the following it BEST enabled by following a configuration management process
for new applications?
A. Maintaining adequate control over changes to production
B. Deploying approved emergence changes to production
C. Ensuring proper testing of code before deployment
D. Managing successful implementation of acquired software
Answer: A (LEAVE A REPLY)
NEW QUESTION: 3
Which of the following is the BEST way to help ensure the security of privacy-related data
stored by an organization?
A. Publish the data classification scheme.
B. Classify privacy-related data as confidential
C. Encrypt personally identifiable information.
D. Inform data owners of the purpose of collecting information.
Answer: B (LEAVE A REPLY)
NEW QUESTION: 4
Which of the following would be an auditor's GREATEST concern when reviewing data
inputs from spreadsheets into the core finance system?
A. Undocumented code formats data and transmits directly to the database
B. The department data protection policy has not been reviewed or updated for two years
C. There is not a complete inventory of spreadsheets, and file naming is inconsistent
D. Spreadsheets are accessible by all members of the finance department
Answer: D (LEAVE A REPLY)
NEW QUESTION: 5
Which of the following should be an IS auditor's GREATEST consideration when
scheduling follow-up activities for agreed-upon management responses to remediate audit
observations?
A. Availability of responsible IT personnel
B. Business interruption due to remediation
C. IT budgeting constraints
D. Risk rating of original findings
Answer: (SHOW ANSWER)
NEW QUESTION: 6
A recent audit identified duplicate software licenses and technologies Which of the
following would be MOST helpful to prevent this type of duplication in the future?
A. Centralizing IT procurement and approval practices
B. Conducting periodic inventory reviews
C. Establishing a project management office
D. Updating IT procurement policies and procedures
Answer: A (LEAVE A REPLY)
NEW QUESTION: 7
In an IS auditor's review of an organization s configuration management practices for
software, which of the following is MOST important?
A. Organizational policies related to release management
B. Service level agreements (SLAs) between the IT function and users
C. Post-implementation review reports from development efforts
D. Software rental contracts or lease agreements
Answer: (SHOW ANSWER)
NEW QUESTION: 8
Which of the following communication modes should be of GREATEST concern to an IS
auditor evaluating end user networking?
A. System-to-system
B. Client-to-server
C. Peer-to-peer
D. Host-to-host
Answer: C (LEAVE A REPLY)
NEW QUESTION: 9
At which stage of the software development life cycle should an organization identity
privacy considerations?
A. Design
B. Testing
C. Development
D. Requirements
Answer: (SHOW ANSWER)
NEW QUESTION: 10
A technology service organization has recently acquired a new subsidiary. What should be
the IS auditor's NEXT course of action when considering the impact on the development of
the IT audit plan?
A. Perform a risk assessment.
B. Include the new systems in the audit plan.
C. Proceed with the current audit plan.
D. Review the revised business impact analysis (BIA).
Answer: (SHOW ANSWER)
NEW QUESTION: 11
An IS auditor is reviewing an organization's method to transport sensitive data between
offices. Which of the following would cause the auditor MOST concern?
A. The method relies exclusively on the use of public key infrastructure.
B. The method relies exclusively on the use of symmetric encryption algorithms.
C. The method relies exclusively on the use of digital signatures.
D. The method relies exclusively on the use of asymmetric encryption algorithms.
Answer: B (LEAVE A REPLY)
NEW QUESTION: 12
Which of the following should an IS auditor recommend to facilitate the management of
baseline requirements for hardening of firewalls?
A. Capacity management
B. Release management
C. Patch management
D. Configuration management
Answer: (SHOW ANSWER)
NEW QUESTION: 13
Audit software designed to detect invalid data, extreme values, or linear correlations
between data elements can be classified as which type of data analytics tool?
A. Predictive
B. Descriptive
C. Diagnostic
D. Prescriptive
Answer: C (LEAVE A REPLY)
NEW QUESTION: 14
A start-up company acquiring for its order-taking system is unable to predict the volume of
transactions.
Which of the following is MOST important for the company to consider?
A. Compatibility
B. Scalability
C. Configuration
D. Optimization
Answer: B (LEAVE A REPLY)
NEW QUESTION: 15
An auditor is creating an audit program in which the objective is to establish the adequacy
of personal data privacy controls in a payroll process. Which of the following would be
MOST important to include?
A. User access provisioning
B. Audit logging of administrative user activity
C. Segregation of duties controls
D. Approval of data changes
Answer: A (LEAVE A REPLY)
NEW QUESTION: 16
A recent audit concluded that an organization's information security system was weak and
that monitoring would likely fail to detect penetration. Which of the following would be the
MOST appropriate recommendation?
A. Identify and periodically remove sensitive data that is no longer needed
B. Look continually for new criminal behaviour and attacks on sensitive data
C. Encrypt sensitive data while strengthening the system
D. Establish a clear policy related to security and the handling of sensitive data
Answer: C (LEAVE A REPLY)
Valid CISA Dumps shared by Prepawayexam.com for Helping Passing CISA Exam!
Prepawayexam.com now offer the newest CISA exam dumps, the
Prepawayexam.com CISA exam questions have been updated and answers have
been corrected get the newest Prepawayexam.com CISA dumps with Test Engine
here: https://www.prepawayexam.com/ISACA/braindumps.CISA.ete.file.html (855 Q&As
Dumps, 40%OFF Special Discount: freecram)
NEW QUESTION: 17
To help ensure the organization s information assets are adequately protected, which of
the following considerations is MOST important when developing an information
classification and handling policy?
A. The policy is owned by the head of information security, who has the authority to
enforce the policy.
B. The policy has been mapped against industry frameworks for classifying information
assets.
C. The policy specifies requirements to safeguard information assets based on their
importance to the organization
D. The policy is subject to periodic reviews to ensure its provisions are up to date
Answer: (SHOW ANSWER)
NEW QUESTION: 18
A post-implementation review of a system implementation has identified that the defined
objectives were changed several times without the approval of the project board. What
would the IS auditor do NEXT?
A. Determine whether the revised objectives are appropriate
B. Notify the project sponsor and request that the project be reopened.
C. Notify the project management office and raise a finding
D. Ask management to obtain retrospective approvals
Answer: A (LEAVE A REPLY)
NEW QUESTION: 19
An organization has agreed to perform remediation related to high-risk audit findings. The
remediation process involves a complex reorganization of user roles as well as the
Implementation of several compensating controls that may not be completed within the
next audit cycle Which of the following is the BEST way for an IS auditor to follow up on
their activities?
A. Schedule a review of the controls after the projected remediation date
B. Continue to audit the failed controls according to the audit schedule
C. Provide management with a remediation timeline and verity adherence
D. Review the progress of remediation on a regular basis
Answer: (SHOW ANSWER)
NEW QUESTION: 20
An audit group is conducting a risk assessment as part of a risk-based audit strategy. To
help ensure the risk assessment results are relevant to the organization, it is MOST
important to:
A. include operational departments and processes.
B. determine both the inherent risk and detection risk.
C. understand the organization's controls.
D. understand the organization's objectives and risk appetite.
Answer: (SHOW ANSWER)
NEW QUESTION: 21
An IS auditor learns that after each scheduled batch process runs, management performs
a reconciliation between upstream and downstream data. Which of the following is MOST
important for the auditor to investigate?
A. Job failure resolution controls
B. Access to the job scheduler
C. Results of user acceptance testing
D. Change management over job scheduling
Answer: A (LEAVE A REPLY)
NEW QUESTION: 22
An enterprise receiving email should have procedures to control:
A. insufficient connectivity,
B. insufficient end-points.
C. outdated protocols,
D. unsolicited executable code.
Answer: (SHOW ANSWER)
NEW QUESTION: 23
Of the following procedures for testing a disaster recovery plan (DRP), which should be
used MOST frequently?
A. Review of documented backup and recovery procedures
B. Preplanned shutdown of the computing facility during an off-peak period
C. Unannounced shutdown of the primary computing facility
D. Testing at a secondary site using offsite data backups
Answer: A (LEAVE A REPLY)
NEW QUESTION: 24
An organization was recently notified by its regulatory body of significant discrepancies in
its reporting data.
A preliminary investigation revealed that the discrepancies were caused problems with the
organization's data quality. Management has directed the data quality team to enhance
their program. The audit committee has asked internal audit to be visors to the process.
After the data quality team identifies the system data at fault which of the following should
internal audit recommend as the NEXT step m the process?
A. Identity the source data owners
B. Develop an improvement plan.
C. Create business rules that validate data quality
D. Identify the root cause of data quality problems
Answer: C (LEAVE A REPLY)
NEW QUESTION: 25
Which of the following should be restricted from a network administrator's privileges in an
adequately segregated H" environment?
A. Changing existing configurations for applications
B. Ensuring transmission protocols are functioning correctly
C. Opening and closing network ports
D. Monitoring network traffic and detecting anomalies
Answer: C (LEAVE A REPLY)
NEW QUESTION: 26
An IS auditor reviewing a new application for compliance with information privacy
principles should be MOST concerned with:
A. collection limitation.
B. nonrepudiation.
C. awareness.
D. availability.
Answer: A (LEAVE A REPLY)
NEW QUESTION: 27
Which of the following is MOST likely to improve the portability of an application connected
to a database?
A. Analyzing stored procedures and triggers
B. Using a structured query language (SQL)
C. Optimizing the database physical schema
D. Verifying database import and export procedures
Answer: B (LEAVE A REPLY)
NEW QUESTION: 28
An IS auditor reviewing a recently implemented virtual environment notices discrepancies
among similar machine setups. Which of the following should the auditor recommend to
minimize configuration risks?
A. Implement network best practice recommendations.
B. Implement templates to manage rapid deployment of virtual machines.
C. Perform architectural vulnerability analysis to compare current system attributes to a
D. Perform hypervisor software updates with available patches to minimize security
weaknesses.
Answer: B (LEAVE A REPLY)
NEW QUESTION: 29
When introducing a maturity model to the IT management process, it is BEST to align the
maturity level to a point that reflects which of the following?
A. Ideal business production level
B. Maximum risk tolerance level
C. Industry standard practice level
D. Minimum cost expenditure level
Answer: B (LEAVE A REPLY)
NEW QUESTION: 30
Which of the following would BEST enable an IS auditor to perform an audit that requires
testing the full population of data?
A. Experience in database administration
B. Proficiency in the use of data analytics tools
C. Proficiency in programming and coding
D. Expertise in statistical sampling of data
Answer: (SHOW ANSWER)
NEW QUESTION: 31
Which of the following would BEST deter the theft of corporate information from a laptop?
A. Encrypt all data on the hard drive.
B. Protect files with passwords.
C. Encrypt the file allocation table (FAT).
D. Install biometric access controls.
Answer: A (LEAVE A REPLY)
Valid CISA Dumps shared by Prepawayexam.com for Helping Passing CISA Exam!
Prepawayexam.com now offer the newest CISA exam dumps, the
Prepawayexam.com CISA exam questions have been updated and answers have
been corrected get the newest Prepawayexam.com CISA dumps with Test Engine
here: https://www.prepawayexam.com/ISACA/braindumps.CISA.ete.file.html (855 Q&As
Dumps, 40%OFF Special Discount: freecram)
NEW QUESTION: 32
During an audit of information security procedures of a large retailer s online store, an IS
auditor notes that operating system (OS) patches are automatically deployed upon -.
Which of the following should be of GREATEST concern to the auditor?
A. Patches are not reflected in the configuration management database
B. Patches are in conflict with current licensing agreements
C. Patches are pushed from the vendor increasing Internet traffic
D. Patches are not tested before installation on critical servers.
Answer: D (LEAVE A REPLY)
NEW QUESTION: 33
Which the following is MOST critical for the effective implementation of IT governance?
A. Strong risk management practices
B. Supportive corporate culture
C. Documented policies
D. Internal auditor commitment
Answer: B (LEAVE A REPLY)
NEW QUESTION: 34
An IS auditor is assigned to review the IS department's quality procedures. Upon
contacting the IS manager, the auditor finds that there is an informal unwritten set of
standards. Which of the following should be the auditor's NEXT action?
A. Document and test compliance with the informal standards.
B. Make recommendations to IS management as to appropriate quality standards.
C. Finalize the audit and report the finding.
D. Postpone the audit until IS management implements written standards.
Answer: (SHOW ANSWER)
NEW QUESTION: 35
Which of the following is the MOST effective control for a utility program?
A. Installing the program on a separate server
B. Allowing only authorized personnel to use the program
C. Renaming the versions in the programmers libraries
D. Storing the program in a production library
Answer: B (LEAVE A REPLY)
NEW QUESTION: 36
Which of the following is the BEST recommendation for the establishment of an
information security policy?
A. The development and approval should be overseen by business area management.
B. The policy should be developed by the security administrator.
C. The policy and guidelines should bs developed by the human resources department.
D. The policy should be developed by IS management
Answer: (SHOW ANSWER)
NEW QUESTION: 37
Which of the following is the BEST guidance from an IS auditor to an organization planning
an initiative to improve the effectiveness of its IT processes?
A. The organization should use a capability maturity model to identify current maturity
levels for each IT process.
B. IT staff should be surveyed to identify current IT process weaknesses and suggest
improvements.
C. The organization should refer to poor audit reports to identify the specific IT processes
to be improved
D. IT management should include process improvement requirements in staff performance
objectives
Answer: A (LEAVE A REPLY)
NEW QUESTION: 38
Which of the following is the GREATEST risk associated with instant messaging?
A. Data logging is more difficult.
B. Data governance may become ineffective.
C. Data classification procedures may not be followed.
D. Data exfiltration is more likely to occur.
Answer: D (LEAVE A REPLY)
NEW QUESTION: 39
Which of the following is the PRIMARY reason for an IS auditor to map out the narrative of
a business process?
A. To ensure alignment with organizational objectives
B. To identify the resources required to perform the audit
C. To verify the business process is as described in the engagement letter
D. To gain insight into potential risks
Answer: D (LEAVE A REPLY)
NEW QUESTION: 40
A review of Internet security disclosed that users have individual user accounts with
Internet service providers (ISPs) and use these accounts for downloading business data.
The organization wants to ensure that only the corporate network is used. The organization
should FIRST:
A. monitor remote access activities.
B. include a statement in its security policy about Internet use.
C. keep a manual log of Internet access.
D. use a proxy server to filter out Internet sites that should not be accessed.
Answer: (SHOW ANSWER)
NEW QUESTION: 41
Which of the following will BEST protect the confidentiality of data stored on the hard drive
of a laptop computer?
A. Physical locks and alarms
B. A boot password
C. Encryption of the data
D. Biometric access control
Answer: (SHOW ANSWER)
NEW QUESTION: 42
Based on the Guidance of internal audit, an IT steering committee is considering the use of
a balanced scorecard to evaluate its project management process. Which of the following
is the GREATEST advantage to using this approach?
A. Information is provided m a consistent and timely manner.
B. Projects will be prioritized based on value
C. Performance is measured from different perspectives
D. Project scheduled and budget management will improve
Answer: C (LEAVE A REPLY)
NEW QUESTION: 43
Which of the following factors will BEST promote effective information security
management?
A. Security awareness training
B. Identification and risk assessment of sensitive resources
C. Senior management commitment
D. Security policy framework
Answer: (SHOW ANSWER)
NEW QUESTION: 44
While reviewing similar issues in an organization s help desk system, an IS auditor finds
that they were analyzed independently and resolved differently This situation MOST likely
indicates a deficiency in:
A. change management
B. IT service level management
C. problem management
D. configuration management
Answer: C (LEAVE A REPLY)
NEW QUESTION: 45
Before concluding that internal controls can be relied upon, the IS auditor should:
A. discuss the internal control weaknesses with the auditee
B. document application controls.
C. conduct tests of compliance
D. document the system of internal control.
Answer: C (LEAVE A REPLY)
NEW QUESTION: 46
Which of the following is the MOST important difference between end-user computing
(EUC) applications and traditional applications?
A. Traditional applications require periodic patching whereas EUC applications do not.
B. Traditional application input controls are typically more robust than EUC application
input controls.
C. Traditional applications require roll-back procedures whereas EUC applications do not.
D. Traditional application documentation is typically less comprehensive than EUC
application documentation.
Answer: B (LEAVE A REPLY)
Valid CISA Dumps shared by Prepawayexam.com for Helping Passing CISA Exam!
Prepawayexam.com now offer the newest CISA exam dumps, the
Prepawayexam.com CISA exam questions have been updated and answers have
been corrected get the newest Prepawayexam.com CISA dumps with Test Engine
here: https://www.prepawayexam.com/ISACA/braindumps.CISA.ete.file.html (855 Q&As
Dumps, 40%OFF Special Discount: freecram)
NEW QUESTION: 47
Which of the following BEST ensures that only authorized software is moved into a
production environment?
A. Restricting read/write access to production code to computer programmers only
B. A librarian compiling source code into production after independent testing
C. Assigning programming managers to transfer tested programs to production
D. Requiring programming staff to move tested code into production
Answer: B (LEAVE A REPLY)
NEW QUESTION: 48
Which of the following is the MOST effective way to identify anomalous transactions when
performing a payroll fraud audit?
A. Observation of payment processing
B. Substantive testing of payroll files
C. Data analytics on payroll data
D. Sample-based review of pay stubs
Answer: C (LEAVE A REPLY)
NEW QUESTION: 49
Which of the following is the BEST way to evaluate the effectiveness of access controls to
an internal network?
A. Review access rights.
B. Review router configuration tables
C. Test compliance with operating procedures
D. Perform a system penetration rest
Answer: (SHOW ANSWER)
NEW QUESTION: 50
Which of the following controls MOST effectively reduces the risk associated with use of
instant messaging (IM) in the workplace?
A. Blocking peer-to-peer (P2P) clients
B. Session border controllers
C. Network address translation
D. Traffic encryption
Answer: D (LEAVE A REPLY)
NEW QUESTION: 51
The demilitarized zone (DMZ) is the part of a network where servers that are placed are:
A. External to the organization
B. Interacting with the public internet
C. Running internal department applications
D. Running-mission critical, non-web application
Answer: B (LEAVE A REPLY)
NEW QUESTION: 52
When an intrusion into an organizations network is detected, which of the foflomng should
be performed FIRST?
A. Identify nodes that have been compromised
B. Develop a response to the incident
C. Protect information in the compromised systems
D. Block all compromised network nodes
Answer: C (LEAVE A REPLY)
NEW QUESTION: 53
An IT governance body wants to determine whether IT service delivery is based on
consistently efficient and effective processes. Which of the following would be the BEST
approach?
A. Analyze current and future capacity.
B. Implement a balanced scorecard
C. Conduct a gap analysis.
D. Evaluate key performance indicators (KPis).
Answer: D (LEAVE A REPLY)
NEW QUESTION: 54
Which of the following would be considered the BEST compensating control to use when
an emergency process, rather than the established control procedures, is used for
database changes?
A. Using the administrator's own account to make out-of-hours changes
B. Logging user's ID and change details for later review by the administrator
C. Logging detailed before-and-after images for later review by the administrator
D. Using an emergency user account with the access to make changes to the database
Answer: (SHOW ANSWER)
NEW QUESTION: 55
To protect information assets, which of the following should be done FIRST?
A. Back up data.
B. Classify data.
C. Restrict access to data.
D. Encrypt data.
Answer: B (LEAVE A REPLY)
NEW QUESTION: 56
The grants management system is used to calculate grant payments. Once per day, a
batch interface extracts grant amounts and payee details from this system for import into
the once system so payments can be made overnight Which of the following controls
provides the GREATEST assurance of the accuracy and completeness of the imported
payment
A. Performing monthly bank reconciliations in a timely manner
B. Reviewing transaction logs for anomalies
C. Restricting access to the grants and finance systems
D. Reconciling data from both systems
Answer: (SHOW ANSWER)
NEW QUESTION: 57
Which of the following would BEST enable effective IT resource management?
A. Automating business processes
B. Outsourcing IT processes and activities
C. Assessing the risk associated with IT resources
D. Establishing business priorities
Answer: D (LEAVE A REPLY)
NEW QUESTION: 58
A PRIMARY benefit derived by an organization employing control self-assessment (CSA)
techniques s that CSA:
A. Allow management to relinquish responsibilities of control
B. Allows IS auditors 10 independently assess risk
C. Can be used as a replacement for traditional audits
D. Can identify high-risk areas for detailed review
Answer: D (LEAVE A REPLY)
NEW QUESTION: 59
Which of the following is the FIRST consideration when developing a data retention policy?
A. Designing an infrastructure storage strategy
B. Identifying the legal and contractual retention period for data
C. Determining the security access privileges to the data
D. Determining the backup cycle based on retention period
Answer: (SHOW ANSWER)
NEW QUESTION: 60
When planning for the implementation of a new system, an organization will opt for a
parallel run PRIMARILY to:
A. facilitate the training of new personnel
B. validate system processing.
C. ensure that the system meets required user response time.
D. verify that system interfaces were implemented.
Answer: B (LEAVE A REPLY)
NEW QUESTION: 61
Which of the following is the MOST likely cause of a successful firewall penetration?
A. Use of a Trojan to bypass the firewall
B. Loophole m firewall vendor's code
C. Virus infection
D. Firewall misconfiguration by the administrator
Answer: D (LEAVE A REPLY)
Valid CISA Dumps shared by Prepawayexam.com for Helping Passing CISA Exam!
Prepawayexam.com now offer the newest CISA exam dumps, the
Prepawayexam.com CISA exam questions have been updated and answers have
been corrected get the newest Prepawayexam.com CISA dumps with Test Engine
here: https://www.prepawayexam.com/ISACA/braindumps.CISA.ete.file.html (855 Q&As
Dumps, 40%OFF Special Discount: freecram)
NEW QUESTION: 62
Which of the following is the PRIMARY objective of the IS audit function?
A. Perform reviews based on standards developed by professional organizations
B. Report to management on the functioning of internal controls.
C. Certify the accuracy of financial data
D. Facilitate extraction of computer-based data for substantive testing.
Answer: (SHOW ANSWER)
NEW QUESTION: 63
An IS auditor is planning to audit an organization's infrastructure for access, patching, and
change management. Which of the following is the BEST way to prioritize the systems?
A. System hierarchy within the infrastructure
B. Criticality of the system
C. Complexity of the environment
D. System retirement plan
Answer: (SHOW ANSWER)
NEW QUESTION: 64
An IS auditor is evaluating the risks and controls associated with a virtualized environment.
Which of the following observations should be of GREATEST concern?
A. The hypervisor's security settings are not reviewed on a regular basis.
B. The hypervisor's partitioning resources have not been modified from its default settings.
C. Offline and dormant virtual machine Images are not patched on the same cycle as
online ones.
D. The change management process has not been updated to include virtualized
environments.
Answer: D (LEAVE A REPLY)
NEW QUESTION: 65
An IS auditor reviewing security incident processes realizes incidents are resolved and
dosed, but root causes are not investigated Which of the following should be the MAJOR
concern with this situation?
A. Lessons earned have not been property documented.
B. Abuses by employees have not been reported
C. Vulnerabilities have not been properly addressed
D. Security incident policies are out of date
Answer: C (LEAVE A REPLY)
NEW QUESTION: 66
The MOST important reason for documenting all aspects of a digital forensic investigation
is that documentation:
A. provides traceability for independent investigation by third parties.
B. ensures compliance with corporate incident response policies.
C. ensures the process will be repeatable in future investigations.
D. meets IT audit documentation standards.
Answer: (SHOW ANSWER)
NEW QUESTION: 67
To confirm integrity for a hashed message, the receiver should use
A. a different hashing algorithm from me sender s to create a binary image of the file
B. the same hashing algorithm as the sender's to create a binary image of the file.
C. the same hashing algorithm as the tender s to create a numerical representation of the
file.
D. a different hashing algorithm from the sender s to create a numerical representation of
the file
Answer: B (LEAVE A REPLY)
NEW QUESTION: 68
Which of the following should be the MOST important consideration when establishing
data classification standards?
A. The standards comply with relevant regulations.
B. An education campaign is established upon rollout.
C. Management supports the newly developed standards
D. Reporting metrics are established.
Answer: A (LEAVE A REPLY)
NEW QUESTION: 69
The GREATEST risk of database renormalization is:
A. Loss of database integrity
B. Decreased performance
C. Incorrect metadata
D. Loss of data confidentiality
Answer: B (LEAVE A REPLY)
NEW QUESTION: 70
Outsourcing the development of business systems is MOST likely to result in the loss of:
A. control over strategic direction.
B. accountability for end products
C. in-house competencies.
D. responsibility for IT security
Answer: (SHOW ANSWER)
NEW QUESTION: 71
Which of the following is the BEST detective control for a job scheduling process involving
data transmission?
A. Job failure alerts are automatically generated and routed to support personnel
B. Jobs are scheduled to be completed daily end data is transmitted using a secure Fife
Transfer Protocol (FTP)
C. Metrics denoting the volume of monthly job failures are reported and reviewed by senior
management
D. Jobs are scheduled and a log of this activity n retained for subsequent review
Answer: (SHOW ANSWER)
NEW QUESTION: 72
Which of the following is the MOST important activity to undertake to avoid rework later in
a project?
A. Phase review
B. Control review
C. Acceptance testing
D. Risk assessment
Answer: A (LEAVE A REPLY)
NEW QUESTION: 73
An organization with high security requirements is evaluating the effectiveness of biometric
systems. Which of the following performance indicators is MOST important?
A. False-rejection rate (FRR)
B. Equal-error rate (EER)
C. False-acceptance rate (FAR)
D. False-identification rate (FIR)
Answer: C (LEAVE A REPLY)
NEW QUESTION: 74
Management decided to accept the residual risk of an audit finding and not take the
recommended actions. The internal. Audit team believes the acceptance is inappropriate
and has discussed the situation with executive management. After this discussion, there is
still disagreement regarding the decision. Which of the following is the BEST course of
action by internal audit.
A. Schedule another meeting with executive management to convince them of taking
action as recommended.
B. Report this matter to the audit committee without notifying executive management.
C. Report the issue to the audit committee in a joint with execute management for
resolution.
D. Document in the audit report that management has accepted the residual risk and take
no further action.
Answer: (SHOW ANSWER)
NEW QUESTION: 75
A new regulatory standard for data privacy requires an organization to protect personally
identifiable information (Pll). Which of the following is MOST important to include in the
audit engagement plan to assess compliance with the new standard?
A. Review of data protection procedures
B. Review of data loss risk scenarios
C. Identification of IT systems that host Pll
D. Identification of unencrypted Pll
Answer: A (LEAVE A REPLY)
NEW QUESTION: 76
Which of the following is the MAIN purpose of implementing an incident response process?
A. Comply with policies and procedures.
B. Provide substantial audit-trail evidence.
C. Assign roles and responsibilities
D. Manage impact due to breaches.
Answer: (SHOW ANSWER)
Valid CISA Dumps shared by Prepawayexam.com for Helping Passing CISA Exam!
Prepawayexam.com now offer the newest CISA exam dumps, the
Prepawayexam.com CISA exam questions have been updated and answers have
been corrected get the newest Prepawayexam.com CISA dumps with Test Engine
here: https://www.prepawayexam.com/ISACA/braindumps.CISA.ete.file.html (855 Q&As
Dumps, 40%OFF Special Discount: freecram)
NEW QUESTION: 77
A manufacturing company is implementing application software for its sales and
distribution system. Which of the following is the MOST important reason for the company
to choose a centralized online database?
A. Enhanced integrity controls
B. Elimination of multiple points of failure
C. Enhanced data redundancy
D. Elimination of the need for data normalization
Answer: A (LEAVE A REPLY)
NEW QUESTION: 78
Which of the following is the BEST method to assess the adequacy of security awareness
in an organization?
A. Observing employee security behaviors
B. Interviewing employees about security responsibility
C. Confirming a security awareness program exists
D. Administering security survey questionnaires
Answer: A (LEAVE A REPLY)
NEW QUESTION: 79
To test the integrity of the data in the accounts receivable master file, an IS auditor
particularly interested in reviewing customers with balances over $400.000. the selection
technique the IS auditor would use to obtain such a sample is called:
A. Stratification
B. Discovery sampling
C. Systematic selection
D. Random selection
Answer: B (LEAVE A REPLY)
NEW QUESTION: 80
Which of the following is an advantage of using electronic data interchange (EDI)?
A. Contracts with the vendors are simplified.
B. Multiple inputs of the same document are allowed at different locations.
C. Transcription of information is reduced.
D. Data validation is provided by the service provider.
Answer: C (LEAVE A REPLY)
NEW QUESTION: 81
mission-critical applications with a low recovery time objective (RTO). which of the
following is the BEST backup strategy?
A. Frequent back-ups to tape
B. Archiving to conventional disk
C. Use of virtual tape libraries
D. Mirroring
Answer: D (LEAVE A REPLY)
NEW QUESTION: 82
Which of the following is the PRIMARY advantage of using virtualization technology for
corporate applications?
A. Improved disaster recovery
B. Stronger data security
C. Increased application performance
D. Better utilization of resources
Answer: A (LEAVE A REPLY)
NEW QUESTION: 83
Which of the following would be the MOST effective control to mitigate unintentional
misuse of authorized access?
A. Security awareness training
B. Annual sign-off of acceptable use policy
C. Regular monitoring of user access logs
D. Formalized disciplinary action
Answer: A (LEAVE A REPLY)
NEW QUESTION: 84
The quality assurance (QA) function should be prevented from
A. Establishing analysis techniques
B. Developing naming conventions
C. Amending review procedures
D. Changing programs for business functions
Answer: (SHOW ANSWER)
NEW QUESTION: 85
An IS auditor is analysing a sample of assesses recorded on the system log of an
application. The auditor intends to launch an intensive investigation if one exception is
found. Which sampling method would be appropriate?
A. Variable sampling
B. Judgemental sampling
C. Discovery sampling
D. Stratified sampling
Answer: (SHOW ANSWER)
NEW QUESTION: 86
When developing metrics to measure the contribution of IT to the achievement of business
goals, the MOST
A. measure the effectiveness of IT controls in the achievement of IT strategy.
B. are used by similar industries to measure the effect of IT on business strategy.
C. provide quantitative measurement of IT initiatives in relation with business targets,
D. are expressed in terms of how IT risk impacts the achievement of business goals.
Answer: C (LEAVE A REPLY)
NEW QUESTION: 87
During a vulnerability assessment, an IS auditor finds a high-risk vulnerability in a public-
facing web server used to process online customer orders via credit card. The IS auditor
could FIRST:
A. notify management.
B. redesign the customer order process.
C. suspend credit card processing.
D. document the finding in the report
Answer: A (LEAVE A REPLY)
NEW QUESTION: 88
In an online application, which of the following would provide the information about the
transaction audit trail?
A. File layouts
B. Source code documentation
C. System/process flowchart
D. Data architecture
Answer: B (LEAVE A REPLY)
NEW QUESTION: 89
The MOST efficient way to confirm that an ERP system being implemented satisfies
business expectations is to utilize which of the following types of testing?
A. Sociability
B. Pilot
C. Parallel
D. Alpha
Answer: C (LEAVE A REPLY)
NEW QUESTION: 90
During an audit of an organization s incident management process, an IS auditor teams
that the security operations team includes detailed reports of recent attacks in its
communications to employees. Which of the following is the GREATEST concern with this
situation?
A. There is not a documented procedure to communicate the reports
B. Employees may fail to understand the seventy of the threats.
C. The reports may be too complex for a nontechnical audience.
D. Employees may misuse the information in the reports.
Answer: D (LEAVE A REPLY)
NEW QUESTION: 91
Internal audit reports should be PRIMARILY written for and communicated to:
A. auditees, as they will eventually have to implement the recommendations
B. senior management as they should be informed about the identified risks.
C. external auditors, as they provide an opinion on the financial statements.
D. audit management as they are responsible for the quality of the audit.
Answer: B (LEAVE A REPLY)
Valid CISA Dumps shared by Prepawayexam.com for Helping Passing CISA Exam!
Prepawayexam.com now offer the newest CISA exam dumps, the
Prepawayexam.com CISA exam questions have been updated and answers have
been corrected get the newest Prepawayexam.com CISA dumps with Test Engine
here: https://www.prepawayexam.com/ISACA/braindumps.CISA.ete.file.html (855 Q&As
Dumps, 40%OFF Special Discount: freecram)
NEW QUESTION: 92
The business owner's approval of software changes being moved into production is
PRIMARILY necessary to:
A. prevent unauthorized access to data.
B. ensure that an application functionality requirement is satisfied.
C. confirm there is a process to control system changes.
D. inform management of deployments of new functionality.
Answer: (SHOW ANSWER)
NEW QUESTION: 93
Which of the following provides for the GREATEST cost reduction in a large data center?
A. Staff rotation
B. Job-scheduling software
C. Server consolidation
D. Power conditioning
Answer: (SHOW ANSWER)
NEW QUESTION: 94
Which of the following is the MOST efficient solution for a multi-location healthcare
organization that wants to be able to access patient data wherever patients present
themselves for care?
A. Infrastructure as a Service (laaSJ provider
B. Dynamic localization
C. Network segmentation
D. Software as a Service (SaaS) provider
Answer: B (LEAVE A REPLY)
NEW QUESTION: 95
After the release of an application system, an IS auditor wants to verify that the system is
providing value to the organization. The auditor's BEST course of action would be to:
A. Review the results of compliance testing
B. Confirm that risk has declined since the application system release
C. Quantify improvements in client satisfaction
D. Perform a gap analysis against the benefits defined in the business case
Answer: D (LEAVE A REPLY)
NEW QUESTION: 96
What is the BEST population to select from when testing that programs are migrated to
production with proper approval?
A. Completed change request forms
B. Change advisory board meeting minutes
C. List of production programs
D. List of changes provided by application programming managers
Answer: C (LEAVE A REPLY)
NEW QUESTION: 97
What is the PRIMARY advantage of prototyping as part of systems development?
A. Eliminates the need for internal controls
B. Increases accuracy in reporting
C. Reduces the need for compliance testing
D. Maximizes user satisfaction
Answer: D (LEAVE A REPLY)
NEW QUESTION: 98
When evaluating the recent implementation of an intrusion detection system (IDS), an IS
auditor should be MOST concerned with inappropriate:
A. tuning
B. patching
C. training
D. encryption
Answer: A (LEAVE A REPLY)
NEW QUESTION: 99
During an audit, it is discovered that several suppliers with standing orders have been
deleted from the supplier master file Which of the following controls would have BEST
evented such an occurrence?
A. Referential integrity developed
B. Logical relationship check
C. Table look-ups
D. Existence check
Answer: B (LEAVE A REPLY)
Valid CISA Dumps shared by Prepawayexam.com for Helping Passing CISA Exam!
Prepawayexam.com now offer the newest CISA exam dumps, the
Prepawayexam.com CISA exam questions have been updated and answers have
been corrected get the newest Prepawayexam.com CISA dumps with Test Engine
here: https://www.prepawayexam.com/ISACA/braindumps.CISA.ete.file.html (855 Q&As
Dumps, 40%OFF Special Discount: freecram)
Valid CISA Dumps shared by Prepawayexam.com for Helping Passing CISA Exam!
Prepawayexam.com now offer the newest CISA exam dumps, the
Prepawayexam.com CISA exam questions have been updated and answers have
been corrected get the newest Prepawayexam.com CISA dumps with Test Engine
here: https://www.prepawayexam.com/ISACA/braindumps.CISA.ete.file.html (855 Q&As
Dumps, 40%OFF Special Discount: freecram)
Valid CISA Dumps shared by Prepawayexam.com for Helping Passing CISA Exam!
Prepawayexam.com now offer the newest CISA exam dumps, the
Prepawayexam.com CISA exam questions have been updated and answers have
been corrected get the newest Prepawayexam.com CISA dumps with Test Engine
here: https://www.prepawayexam.com/ISACA/braindumps.CISA.ete.file.html (855 Q&As
Dumps, 40%OFF Special Discount: freecram)
Valid CISA Dumps shared by Prepawayexam.com for Helping Passing CISA Exam!
Prepawayexam.com now offer the newest CISA exam dumps, the
Prepawayexam.com CISA exam questions have been updated and answers have
been corrected get the newest Prepawayexam.com CISA dumps with Test Engine
here: https://www.prepawayexam.com/ISACA/braindumps.CISA.ete.file.html (855 Q&As
Dumps, 40%OFF Special Discount: freecram)
Valid CISA Dumps shared by Prepawayexam.com for Helping Passing CISA Exam!
Prepawayexam.com now offer the newest CISA exam dumps, the
Prepawayexam.com CISA exam questions have been updated and answers have
been corrected get the newest Prepawayexam.com CISA dumps with Test Engine
here: https://www.prepawayexam.com/ISACA/braindumps.CISA.ete.file.html (855 Q&As
Dumps, 40%OFF Special Discount: freecram)
Valid CISA Dumps shared by Prepawayexam.com for Helping Passing CISA Exam!
Prepawayexam.com now offer the newest CISA exam dumps, the
Prepawayexam.com CISA exam questions have been updated and answers have
been corrected get the newest Prepawayexam.com CISA dumps with Test Engine
here: https://www.prepawayexam.com/ISACA/braindumps.CISA.ete.file.html (855 Q&As
Dumps, 40%OFF Special Discount: freecram)
Valid CISA Dumps shared by Prepawayexam.com for Helping Passing CISA Exam!
Prepawayexam.com now offer the newest CISA exam dumps, the
Prepawayexam.com CISA exam questions have been updated and answers have
been corrected get the newest Prepawayexam.com CISA dumps with Test Engine
here: https://www.prepawayexam.com/ISACA/braindumps.CISA.ete.file.html (855 Q&As
Dumps, 40%OFF Special Discount: freecram)
NEW QUESTION: 212
An IS auditor discovered that a firewall has more services than needed The IS auditor's
FIRST recommendation should be to:
A. ensure logging is turned on.
B. deploy a network penetration team.
C. review configurations
D. Eliminate services except for HTTPS.
Answer: (SHOW ANSWER)
Valid CISA Dumps shared by Prepawayexam.com for Helping Passing CISA Exam!
Prepawayexam.com now offer the newest CISA exam dumps, the
Prepawayexam.com CISA exam questions have been updated and answers have
been corrected get the newest Prepawayexam.com CISA dumps with Test Engine
here: https://www.prepawayexam.com/ISACA/braindumps.CISA.ete.file.html (855 Q&As
Dumps, 40%OFF Special Discount: freecram)
Valid CISA Dumps shared by Prepawayexam.com for Helping Passing CISA Exam!
Prepawayexam.com now offer the newest CISA exam dumps, the
Prepawayexam.com CISA exam questions have been updated and answers have
been corrected get the newest Prepawayexam.com CISA dumps with Test Engine
here: https://www.prepawayexam.com/ISACA/braindumps.CISA.ete.file.html (855 Q&As
Dumps, 40%OFF Special Discount: freecram)
Valid CISA Dumps shared by Prepawayexam.com for Helping Passing CISA Exam!
Prepawayexam.com now offer the newest CISA exam dumps, the
Prepawayexam.com CISA exam questions have been updated and answers have
been corrected get the newest Prepawayexam.com CISA dumps with Test Engine
here: https://www.prepawayexam.com/ISACA/braindumps.CISA.ete.file.html (855 Q&As
Dumps, 40%OFF Special Discount: freecram)
Valid CISA Dumps shared by Prepawayexam.com for Helping Passing CISA Exam!
Prepawayexam.com now offer the newest CISA exam dumps, the
Prepawayexam.com CISA exam questions have been updated and answers have
been corrected get the newest Prepawayexam.com CISA dumps with Test Engine
here: https://www.prepawayexam.com/ISACA/braindumps.CISA.ete.file.html (855 Q&As
Dumps, 40%OFF Special Discount: freecram)
Valid CISA Dumps shared by Prepawayexam.com for Helping Passing CISA Exam!
Prepawayexam.com now offer the newest CISA exam dumps, the
Prepawayexam.com CISA exam questions have been updated and answers have
been corrected get the newest Prepawayexam.com CISA dumps with Test Engine
here: https://www.prepawayexam.com/ISACA/braindumps.CISA.ete.file.html (855 Q&As
Dumps, 40%OFF Special Discount: freecram)
Valid CISA Dumps shared by Prepawayexam.com for Helping Passing CISA Exam!
Prepawayexam.com now offer the newest CISA exam dumps, the
Prepawayexam.com CISA exam questions have been updated and answers have
been corrected get the newest Prepawayexam.com CISA dumps with Test Engine
here: https://www.prepawayexam.com/ISACA/braindumps.CISA.ete.file.html (855 Q&As
Dumps, 40%OFF Special Discount: freecram)
Valid CISA Dumps shared by Prepawayexam.com for Helping Passing CISA Exam!
Prepawayexam.com now offer the newest CISA exam dumps, the
Prepawayexam.com CISA exam questions have been updated and answers have
been corrected get the newest Prepawayexam.com CISA dumps with Test Engine
here: https://www.prepawayexam.com/ISACA/braindumps.CISA.ete.file.html (855 Q&As
Dumps, 40%OFF Special Discount: freecram)
Valid CISA Dumps shared by Prepawayexam.com for Helping Passing CISA Exam!
Prepawayexam.com now offer the newest CISA exam dumps, the
Prepawayexam.com CISA exam questions have been updated and answers have
been corrected get the newest Prepawayexam.com CISA dumps with Test Engine
here: https://www.prepawayexam.com/ISACA/braindumps.CISA.ete.file.html (855 Q&As
Dumps, 40%OFF Special Discount: freecram)
Valid CISA Dumps shared by Prepawayexam.com for Helping Passing CISA Exam!
Prepawayexam.com now offer the newest CISA exam dumps, the
Prepawayexam.com CISA exam questions have been updated and answers have
been corrected get the newest Prepawayexam.com CISA dumps with Test Engine
here: https://www.prepawayexam.com/ISACA/braindumps.CISA.ete.file.html (855 Q&As
Dumps, 40%OFF Special Discount: freecram)