CISA practice questions 1,001–1,010

1. Question 1001 · 1459 in bank

   Which of the following should be of GREATEST concern to an IS auditor reviewing project documentation for a client relationship management (CRM) system migration project?

   • AFive weeks prior to the target date, there are still numerous defects in the printing functionality.
   • BThe technical migration is planned for a holiday weekend and end users may not be available.
   • CEmployees are concerned that data representation in the new system is completely different from the old system.
   • DA single implementation phase is planned and the legacy system will be immediately decommissioned.

   Show answer

   Answer: D

   Next question

2. Question 1002 · 1459 in bank

   Which of the following is the MOST important prerequisite for implementing a data loss prevention (DLP) tool?

   • AIdentifying where existing data resides and establishing a data classification matrix
   • BRequiring users to save files in secured folders instead of a company-wide shared drive
   • CReviewing data transfer logs to determine historical patterns of data flow
   • DDeveloping a DLP policy and requiring signed acknowledgment by users

   Show answer

   Answer: A

   Next question

3. Question 1003 · 1459 in bank

   Which of the following BEST guards against the risk of attack by hackers?

   • AMessage validation
   • BTunneling
   • CEncryption
   • DFirewalls

   Show answer

   Answer: D

   Explanation

   D. Firewalls Firewalls are the best option among the choices provided to guard against the risk of attack by hackers. A firewall is a network security system that monitors and controls incoming and outgoing network traffic based on predetermined security rules.

   Source: Adapted from community discussion — Alizade

   Next question

4. Question 1004 · 1459 in bank

   Which of the following approaches would utilize data analytics to facilitate the testing of a new account creation process?

   • AReview the business requirements document for date of birth field requirements.
   • BReview new account applications submitted in the past month for invalid dates of birth.
   • CAttempt to submit new account applications with invalid dates of birth.
   • DEvaluate configuration settings for the date of birth field requirements

   Show answer

   Answer: B

   Next question

5. Question 1005 · 1459 in bank

   Which of the following approaches provides the BEST assurance and user confidence when an organization migrates data to a more complex enterprise resource planning (ERP) system?

   • AUser acceptance testing (UAT)
   • BParallel processing
   • CPhased changeover
   • DPilot testing

   Show answer

   Answer: B

   Explanation

   The answer is B because it allows users to compare the outputs to ensure that the new system performs accurately and reliably before fully transitioning. Parallel processing it allows for immediate verification of data integrity and system functionality, which is crucial in complex ERP environments. I feel the key work here is 'data migration' and not development of the complex ERP system. In the case of development, i would choose C as the best approach would be to implement the system in stages.

   Source: Adapted from community discussion — PurpleParrot

   Next question

6. Question 1006 · 1459 in bank

   During an ongoing audit, management requests a briefing on the findings to date. Which of the following is the IS auditor's BEST course of action?

   • ARequest management wait until a final report is ready for discussion.
   • BRequest the auditee provide management responses.
   • CReview working papers with the auditee.
   • DPresent observations for discussion only.

   Show answer

   Answer: D

   Explanation

   the client ( Management) pays the auditor for an audit, and wants an update, even during the audit, from the auditor not from the auditee. Also you never say no to a cient if he wants an update at any period of the audit. So D is the answer, just for discussion.. Nothing formal.

   Source: Adapted from community discussion — cidigi

   Next question

7. Question 1007 · 1459 in bank

   Which of the following provides the MOST assurance over the completeness and accuracy of loan application processing with respect to the implementation of a new system?

   • ARunning historical transactions through the new system
   • BLoading balance and transaction data to the new system
   • CComparing code between old and new systems
   • DReviewing quality assurance (QA) procedures

   Show answer

   Answer: A

   Next question

8. Question 1008 · 1459 in bank

   Which of the following is the PRIMARY concern when negotiating a contract for a hot site?

   • AComplete testing of the recovery plan
   • BAvailability of the site in the event of multiple disaster declarations
   • CReciprocal agreements with other organizations
   • DCoordination with the site staff in the event of multiple disaster declarations

   Show answer

   Answer: B

   Next question

9. Question 1009 · 1459 in bank

   An IS auditor identifies that a legacy application to be decommissioned in three months cannot meet the security requirements established by the current policy. What is the BEST way for the auditor to address this issue?

   • AInform the IT director of the policy noncompliance.
   • BVerify management has approved a policy exception to accept the risk.
   • CRecommend the application be patched to meet requirements.
   • DTake no action since the application will be decommissioned in three months.

   Show answer

   Answer: B

   Next question

10. Question 1010 · 1459 in bank

    Which of the following should be done FIRST when planning a penetration test?

    • ADefine the testing scope.
    • BDetermine reporting requirements for vulnerabilities.
    • CObtain management consent for the testing.
    • DExecute nondisclosure agreements (NDAs).

    Show answer

    Answer: C

    Explanation

    I change my answer to C. According to CRM, chapter 5 page 335, it is imperative to obtain Management’s consent in writing before finalization of the test/ engagement scope. The chosen answer C is correct

    Source: Adapted from community discussion — Rachy

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISA practice, question 1001. 1459 questions available.