CISA practice questions 1–10

1. Question 1 · 1459 in bank

   Which of the following should be of GREATEST concern to an IS auditor reviewing an organization's business continuity plan (BCP)?

   • AThe BCP has not been tested since it was first issued.
   • BThe BCP is not version-controlled.
   • CThe BCP's contact information needs to be updated.
   • DThe BCP has not been approved by senior management.

   Show answer

   Answer: A

   Explanation

   I went to the CISA review manual to solve this, and the main concern should be the lack of testing. First: Senior management create a "business continuity policy" (Ref: Review Manual 27th edition 4.15.4). In general, senior management makes policies, and the plebs below make plans and procedures. Therefore a business continuity plan is not necessarily senior management approved. Furthermore there is a passage in the review manual (4.15.11) regarding auditing business continuity. The passage does not really mention senior management, but it does mention plan testing and obtaining historical results of tests during an audit.

   Source: Adapted from community discussion — GenPatton

   Next question

2. Question 2 · 1459 in bank

   Which of the following is the BEST way to ensure that an application is performing according to its specifications?

   • APilot testing
   • BSystem testing
   • CIntegration testing
   • DUnit testing

   Show answer

   Answer: B

   Explanation

   The correct answer is B. System testing. System testing is the best way to ensure that an application is performing according to its specifications because it: - Involves testing the entire application as a whole - Verifies that all components work together seamlessly - Checks that the application meets all specified requirements and functionality - Simulates real-world scenarios and user interactions Unit Testing: Checking individual components (e.g., a single brick, a window, or a door) to ensure they are defect-free and function correctly. Integration Testing: Testing how individual components work together (e.g., how the bricks are mortared together, how the windows and doors fit into the walls) to ensure a solid structure. System Testing:Inspecting the entire house (e.g., foundation, walls, roof, plumbing, electrical, HVAC) to ensure it's safe, functional, and meets building codes, simulating real-world scenarios (e.g., rain, wind, sunlight).

   Source: Adapted from community discussion — jan1234

   Next question

3. Question 3 · 1459 in bank

   While auditing a small organization's data classification processes and procedures, an IS auditor noticed that data is often classified at the incorrect level. What is the MOST effective way for the organization to improve this situation?

   • AConduct awareness presentations and seminars for information classification policies.
   • BUse automatic document classification based on content.
   • CHave IT security staff conduct targeted training for data owners.
   • DPublish the data classification policy on the corporate web portal.

   Show answer

   Answer: C

   Next question

4. Question 4 · 1459 in bank

   Which of the following should be the GREATEST concern for an IS auditor performing a post-implementation review for a major system upgrade?

   • AChanges are promoted to production by the development group.
   • BDevelopers have access to the testing environment.
   • CObject code can be accessed by the development group.
   • DChange approvals are not formally documented.

   Show answer

   Answer: D

   Explanation

   The correct answer is D, Change approvals are not formally documented. When performing a post-implementation review for a major system upgrade, the greatest concern for an IS auditor should be whether change approvals are formally documented. This is because formal documentation of change approvals is an important control measure that helps to ensure that changes to systems and applications are authorized and properly controlled. If change approvals are not formally documented, there is a risk that unauthorized changes may be made to the system, which could compromise the system's integrity and security.

   Source: Adapted from community discussion — Staanlee

   Next question

5. Question 5 · 1459 in bank

   Which of the following observations noted by an IS auditor reviewing internal IT standards is MOST important to address?

   • AThe standards have no reference to an industry-recognized framework.
   • BThe standards are not detailed in policies and procedures.
   • CThe standards are not readily available to organization-wide users.
   • DThe standards have not been revised within the last year.

   Show answer

   Answer: A

   Explanation

   The most important observation to address among the options listed would typically be option A: "The standards have no reference to an industry-recognized framework." This is crucial because industry-recognized frameworks and standards provide a well-established and widely accepted set of best practices for IT governance and security. Failing to reference such frameworks could mean that the internal IT standards lack the necessary foundation to ensure robust security and compliance. However, it's important to note that the importance of addressing each of these observations may vary depending on the specific context and needs of the organization. In some cases, the other options (B, C, or D) could also be important, but option A generally takes precedence in ensuring a strong foundation for IT standards.

   Source: Adapted from community discussion — SuperMax

   Next question

6. Question 6 · 1459 in bank

   Which of the following is MOST important for an organization to consider when planning to outsource data storage to a third-party provider?

   • AThe cost of delivering the service
   • BThe country in which the provider operates
   • CThe classification levels of the stored data
   • DThe skill set and experience of the provider

   Show answer

   Answer: B

   Explanation

   Understanding the regulatory environment in the provider’s country is fundamental to ensuring that data storage practices align with legal and compliance requirements. This consideration helps mitigate risks related to data breaches, legal issues, and regulatory non-compliance.

   Source: Adapted from community discussion — PurpleParrot

   Next question

7. Question 7 · 1459 in bank

   An IS auditor has been tasked with analyzing an organization's capital expenditures against its repair and maintenance costs. Which of the following is the BEST reason to use a data analytics tool for this purpose?

   • AIt reduces the sample size required to perform the audit.
   • BIt improves the reliability of the data.
   • CIt reduces the error rate.
   • DIt enables the auditor to work with 100% of the transactions.

   Show answer

   Answer: D

   Explanation

   Using a data analytics tool allows the IS auditor to analyze 100% of the transactions, providing a comprehensive view of the data. This is a significant advantage over traditional auditing methods that may involve sampling. Analyzing the entire dataset helps ensure a more accurate and complete assessment of capital expenditures against repair and maintenance costs, improving the effectiveness and reliability of the audit. The best reason for using a data analytics tool in this context.

   Source: Adapted from community discussion — FAGFUR

   Next question

8. Question 8 · 1459 in bank

   Which of the following presents the GREATEST risk associated with end-user computing (EUC) applications over financial reporting?

   • ALack of portability for users
   • BCalculation errors in spreadsheets B. Inability to quickly modify and deploy a solution
   • CLoss of time due to manual processes

   Show answer

   Answer: B

   Explanation

   Calculation errors in spreadsheets Calculation errors in spreadsheets can pose the greatest risk to financial reporting because they can lead to inaccurate financial data and potentially serious financial misstatements. This can have significant legal and financial consequences for an organization. The other options, while important, may not directly impact the accuracy of financial reporting to the same extent as calculation errors.

   Source: Adapted from community discussion — SuperMax

   Next question

9. Question 9 · 1459 in bank

   An IS auditor should look for which of the following to ensure the risk associated with scope creep has been mitigated during software development?

   • ASource code version control
   • BProject change management controls
   • CExistence of an architecture review board
   • DConfiguration management

   Show answer

   Answer: B

   Explanation

   Project change management controls, is the most relevant choice. These controls help ensure that any changes to the project scope are properly documented, reviewed, approved, and incorporated into the project plan. Change management controls help prevent unapproved changes and provide transparency and accountability in the decision-making process.

   Source: Adapted from community discussion — FAGFUR

   Next question

10. Question 10 · 1459 in bank

    Which of the following is MOST important to consider when defining disaster recovery strategies?

    • AMean time to restore (MTTR)
    • BMaximum time between failures (MTBF)
    • CMaximum tolerable downtime (MTD)
    • DMean time to acknowledge (MTTA)

    Show answer

    Answer: C

    Explanation

    C. Maximum tolerable downtime (MTD) MTD represents the maximum amount of time your organization can afford to be without critical systems or services before it significantly impacts your business operations. It helps you set a clear target for your recovery time objectives (RTOs) and is a fundamental consideration in disaster recovery planning.

    Source: Adapted from community discussion — SuperMax

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISA practice, question 1. 1459 questions available.