Certified Information Systems Auditor1,459 questions across 146 pages are complete and free, with no account or card.
1459 questions in this bank
Free access · progress saved on this device
Which of the following is MOST important for an IS auditor to verify when reviewing a management information system (MIS)?
Answer: B
Data quality is critical for the reliability and effectiveness of the information provided by the MIS. The accuracy, completeness, consistency, and timeliness of data impact the decision-making process and the overall reliability of the system.
Source: Adapted from community discussion — FAGFUR
Which of the following BEST enables an IS auditor to combine and compare access control lists from various applications and devices?
Answer: D
Data analytics is the best option for enabling an IS auditor to combine and compare access control lists from various applications and devices. Data analytics tools can help automate the process of collecting, aggregating, and analyzing access control lists from different sources. This allows the auditor to identify patterns, anomalies, and discrepancies in access controls across the organization.
Source: Adapted from community discussion — FAGFUR
An organization's database administrator (DBA) has implemented native database auditing. Which of the following is the GREATEST concern with this situation?
Answer: C
The greatest concern with implementing native database auditing is that production database performance may be negatively affected. Enabling auditing features at the database level, especially with extensive auditing or for a large number of database activities, can lead to increased system overhead, which may impact the performance of the production database.
Source: Adapted from community discussion — FAGFUR
When protecting the confidentiality of information assets, the MOST effective control practice is the:
Answer: B
The most effective control practice for protecting the confidentiality of information assets is the enforcement of a need-to-know access control philosophy. This principle ensures that individuals have access only to the information necessary to perform their job functions, reducing the risk of unauthorized access and disclosure of sensitive information.
Source: Adapted from community discussion — FAGFUR
Which of the following is the MOST important consideration when relying on the work of the prior auditor?
Answer: B
Assessing the qualifications ensures that the prior auditor had the necessary expertise and ethical standards to conduct a thorough and reliable audit.
Source: Adapted from community discussion — FAGFUR
A bank uses a system that requires monetary amounts found on check images to be input twice by two separate individuals. The system then identifies any mismatches between the first and second input. Which type of control has the bank implemented?
Answer: A
The bank has implemented a Detective control. A Detective control is designed to discover or detect errors or discrepancies after they have occurred. In this case, the system identifies mismatches between the first and second input of monetary amounts on check images, serving as a detective control to catch discrepancies. Corrective controls are implemented to correct or remedy an issue after it has been identified, while Compensating controls offset the lack of effectiveness in other controls. Deterrent controls are implemented to discourage individuals from violating policies or procedures, often through the threat of penalties.
Source: Adapted from community discussion — FAGFUR
An organization is migrating its HR application to an Infrastructure as a Service (IaaS) model in a private cloud. Who is PRIMARILY responsible for the security configurations of the deployed application's operating system?
Answer: D
In an IaaS model in a private cloud, the organization is primarily responsible for the security configurations of the deployed application's operating system. While the cloud provider manages the underlying infrastructure, including the virtualization layer and physical hardware, the organization retains responsibility for configuring and securing the components deployed on top of that infrastructure. The organization needs to configure and manage the operating system, applications, and associated security settings within the virtual machines provided by the cloud infrastructure. This shared responsibility model is a key characteristic of cloud computing, where the organization and the cloud provider have distinct responsibilities for different layers of the infrastructure and services.
Source: Adapted from community discussion — FAGFUR
Which of the following is the BEST way to reduce the risk of vulnerabilities introduced by rapid deployment of applications?
Answer: B
The best way to reduce the risk of vulnerabilities introduced by rapid deployment of applications is to perform security audits during the development life cycle. Integrating security audits into the development life cycle ensures that security considerations are addressed early in the process, helping to identify and remediate vulnerabilities before the application is deployed to production. This proactive approach helps in preventing security issues from being introduced or amplified during rapid deployment.
Source: Adapted from community discussion — FAGFUR
An organization has assigned two new IS auditors to audit a new system implementation. One of the auditors has an IT-related degree, and one has a business degree. Which of the following is MOST important to meet the IS audit standard for proficiency?
Answer: C
CISA emphasizes that audit teams should be comprised of individuals with the competencies necessary to perform the specific audit tasks. In this case, the IT degree equips one auditor with technical knowledge, while the business degree provides understanding of the business context. By assigning team members based on their strengths, the audit leverages their combined expertise to effectively evaluate the new system implementation, adhering to CISA's proficiency standards. Page 21
Source: Adapted from community discussion — Tef_corp
Which of the following is the ULTIMATE objective of performing a phishing simulation test?
Answer: C
Yes, considering the broader perspective and ultimate goal, the answer is: C. To reduce the likelihood of cyber incidents. Phishing simulation tests are conducted primarily to educate employees and improve their ability to recognize phishing attempts, but the ultimate, overarching objective of these exercises is indeed to reduce the overall likelihood of cyber incidents within the organization.
Source: Adapted from community discussion — KAP2HURUF
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CISA practice, question 91. 1459 questions available.
Version 1.0.0. How we source questions