CISA practice questions 1,011–1,020

1. Question 1011 · 1459 in bank

   Which of the following is the BEST reason for an organization to use clustering?

   • ATo decrease system response time
   • BTo improve the recovery time objective (RTO)
   • CTo improve system resiliency
   • DTo facilitate faster backups

   Show answer

   Answer: C

   Explanation

   Clustering is a technique used to group similar objects together based on their characteristics. It is used in many fields such as data science, marketing and sales. The best reason for an organization to use clustering is to improve system resiliency.

   Source: Adapted from community discussion — EBTURK

   Next question

2. Question 1012 · 1459 in bank

   Which of the following is necessary for effective risk management in IT governance?

   • ALocal managers are solely responsible for risk evaluation.
   • BRisk management strategy is approved by the audit committee.
   • CRisk evaluation is embedded in management processes.
   • DIT risk management is separate from corporate risk management.

   Show answer

   Answer: C

   Next question

3. Question 1013 · 1459 in bank

   Which of the following observations noted during a review of the organization's social media practices should be of MOST concern to the IS auditor?

   • ANot all employees using social media have attended the security awareness program.
   • BThe organization does not require approval for social media posts.
   • CThe organization does not have a documented social media policy.
   • DMore than one employee is authorized to publish on social media on behalf of the organization.

   Show answer

   Answer: C

   Explanation

   The most concerning observation noted during a review of the organization’s social media practices for an IS auditor is that the organization does not have a documented social media policy

   Source: Adapted from community discussion — EBTURK

   Next question

4. Question 1014 · 1459 in bank

   Which of the following is the BEST way for an IS auditor to determine how well an information security program has been implemented throughout the organization?

   • AEvaluate the percentage of employees who have taken security awareness training.
   • BReview security awareness training content for completeness.
   • CPerform security risk assessments for the organization's business units.
   • DEvaluate the integration of security best practices into business workflow.

   Show answer

   Answer: D

   Explanation

   While evaluating the percentage of employees who have taken security awareness training (Option A) can provide some insight into the level of awareness within the organization, it does not necessarily reflect the effectiveness of the security program's implementation. On the other hand, evaluating the integration of security best practices into business workflow (Option D) provides a more comprehensive assessment of how well the security program has been integrated into everyday operations. This approach examines whether security measures are effectively applied in the organization's processes, procedures, and systems, indicating a more robust implementation of the security program.

   Source: Adapted from community discussion — Swallows

   Next question

5. Question 1015 · 1459 in bank

   Which of the following is the MOST important feature of access control software?

   • AIdentification
   • BAuthentication
   • CViolation reporting
   • DNonrepudiation

   Show answer

   Answer: B

   Next question

6. Question 1016 · 1459 in bank

   Which of the following is the GREATEST concern associated with control self-assessments (CSAs)?

   • AEmployees may have insufficient awareness of controls.
   • BThe assessment may not provide sufficient assurance to stakeholders.
   • CControls may not be assessed objectively.
   • DCommunication between operational management and senior management may not be effective.

   Show answer

   Answer: C

   Next question

7. Question 1017 · 1459 in bank

   Which of the following BEST demonstrates that IT strategy is aligned with organizational goals and objectives?

   • AIT strategies are communicated to all business stakeholders.
   • BOrganizational strategies are communicated to the chief information officer (CIO).
   • CThe chief information officer (CIO) is involved in approving the organizational strategies.
   • DBusiness stakeholders are involved in approving the IT strategy.

   Show answer

   Answer: D

   Explanation

   The alignment between IT strategy and organizational goals and objectives is essential for ensuring that IT investments are appropriately aligned with the business needs of the organization. This alignment helps ensure that IT resources are utilized optimally, and IT projects deliver value to the organization. Among the given options, the best demonstration that IT strategy is aligned with organizational goals and objectives is when business stakeholders are involved in approving the IT strategy

   Source: Adapted from community discussion — 3008

   Next question

8. Question 1018 · 1459 in bank

   Which of the following is the GREATEST risk associated with lack of IT involvement in the organization's strategic planning initiatives?

   • ABusiness strategies may not consider emerging technologies.
   • BIT strategies may not align with business strategies.
   • CIT strategic goals may not be considered by the business.
   • DBusiness strategies may not align with IT capabilities.

   Show answer

   Answer: B

   Next question

9. Question 1019 · 1459 in bank

   Which of the following should an IS auditor expect to see in a network vulnerability assessment?

   • ASecurity design flaws
   • BMisconfiguration and missing updates
   • CZero-day vulnerabilities
   • DMalicious software and spyware

   Show answer

   Answer: B

   Explanation

   Misconfiguration and missing updates: This refers to vulnerabilities resulting from improper configuration of the network or software, or failure to apply patches and updates to the network and its components. These vulnerabilities are often easy to exploit and can result in a security breach. An IS auditor should expect to see these types of vulnerabilities during a network vulnerability assessment. Security design flaws: Security design flaws refer to vulnerabilities that exist in the network's design, architecture, or configuration. These types of vulnerabilities can be challenging to identify and remediate, but they can have a significant impact on the network's security. An IS auditor should expect to see security design flaws during a network vulnerability assessment. B > A

   Source: Adapted from community discussion — 3008

   Next question

10. Question 1020 · 1459 in bank

    Which of the following is MOST important for an IS auditor to verify during a disaster recovery audit?

    • AThe disaster recovery plan (DRP) is updated on a regular basis.
    • BRoles and responsibilities are documented.
    • CRegular backups are made and stored offsite.
    • DTabletop disaster recovery tests are conducted.

    Show answer

    Answer: A

    Explanation

    While backups are essential for data recovery, the disaster recovery plan outlines the broader strategy and procedures for responding to various disasters. An outdated or incomplete DRP could lead to confusion, inefficiency, and even failure in the event of a disaster. Therefore, ensuring that the DRP is regularly updated and reflects the organization's current needs, technologies, and best practices is fundamental to effective disaster recovery preparedness.

    Source: Adapted from community discussion — Swallows

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISA practice, question 1011. 1459 questions available.