Certified Information Systems Auditor1,459 questions across 146 pages are complete and free, with no account or card.
1459 questions in this bank
Free access · progress saved on this device
A manager identifies active privileged accounts belonging to staff who have left the organization. Which of the following is the threat actor in this scenario?
Answer: C
Answer is D. Terminated staff will include unauthorized access but it's not limited to them. Other people could use those accounts as well
Source: Adapted from community discussion — murphseal
An IS auditor is reviewing a sample of production incidents and notes that a root cause analysis is not being performed. Which of the following is the GREATEST risk associated with this finding?
Answer: A
An IS auditor is reviewing documentation of application systems change control and identifies several patches that were not tested before being put into production. Which of the following is the MOST significant risk from this situation?
Answer: D
An IS audit manager was temporarily tasked with supervising a project manager assigned to the organization's payroll application upgrade. Upon returning to the audit department, the audit manager has been asked to perform an audit to validate the implementation of the payroll application. The audit manager is the only one in the audit department with IT project management experience. What is the BEST course of action?
Answer: C
Please review A1 question 19. It says clearly participating in a project team doesn't influence the auditor independence. I am between C and D. But could be D also if you think like ISACA.
Source: Adapted from community discussion — shalota2
An IS auditor performs a follow-up audit and learns the approach taken by the auditee to fix the findings differs from the agreed-upon approach confirmed during the last audit. Which of the following should be the auditor's NEXT course of action?
Answer: D
For any question asking requirements (SHOULD, BEST action) check the ITAF Standards. For any question asking steps (FIRST, NEXT action) check ITAF Guidelines. From ITAF-4th-Edition, statement 2402.7.4 As part of the follow-up activities, practitioners should evaluate whether unimplemented recommendations are still relevant or have a greater significance. The correct answer is D. Evaluate the appropriateness of the remedial action taken.
Source: Adapted from community discussion — A_Salem
An IS auditor was involved in the design phase for a new system's security architecture. For the planned post-implementation audit, which of the following would be the MOST appropriate course of action for the auditor?
Answer: A
A, which suggests having another auditor review the security architecture, can be a viable solution to ensure the independence and objectivity of the post-implementation audit. By involving another auditor who was not involved in the design phase, the audit can be performed with greater objectivity and independence. > B, which suggests disclosing the independence issues in the audit report, is also an appropriate course of action. By disclosing the independence issues, the stakeholders can be aware of the potential limitations in the audit and can make informed decisions based on the audit results.
Source: Adapted from community discussion — 3008
An IS auditor finds that an organization's data loss prevention (DLP) system is configured to use vendor default settings to identify violations. The auditor's MAIN concern should be that:
Answer: B
Which of the following should be reviewed FIRST when assessing the effectiveness of an organization's network security procedures and controls?
Answer: B
Based on the available options, I believe the best choice is B - the inventory of authorized devices. Before assessing the other controls, it's important to ensure that only authorized devices are on the network. This will help to ensure that any vulnerabilities found are only those on authorized devices, and not on unauthorized devices that should not be there in the first place.
Source: Adapted from community discussion — spar2kle
An IS auditor is reviewing an organization's business continuity plan (BCP) following a change in organizational structure with significant impact to business processes. Which of the following findings should be the auditor's GREATEST concern?
Answer: B
BCP should be reevaluated where significant impact is found (Since significant imapct is found on critical business process, we assume BIA has been done). If test plans are older (before reorg) that means that no testing has been done even after the reorg.. So c could be right
Source: Adapted from community discussion — Deeplaxmi
An IS auditor reviewing a project to acquire an IT-based solution learns the risk associated with project failure has been assessed as high. What is the auditor's BEST course of action?
Answer: D
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CISA practice, question 1061. 1459 questions available.
Version 1.0.0. How we source questions