CISA practice questions 1,071–1,080

1. Question 1071 · 1459 in bank

   An IS auditor is reviewing an industrial control system (ICS) that uses older unsupported technology in the scope of an upcoming audit. What should the auditor consider the MOST significant concern?

   • ATechnical specifications are not documented.
   • BDisaster recovery plans (DRPs) are not in place.
   • CAttack vectors are evolving for industrial control systems.
   • DThere is a greater risk of system exploitation.

   Show answer

   Answer: D

   Explanation

   System exploitation is not the only risk, other risks can be system failure or misconfigurations. System exploitation can be compensated by isolating the system network or using IPS, but if system fails or misconfigured, it can`t be restored without a DRP. B. Disaster recovery plans (DRPs) are not in place.

   Source: Adapted from community discussion — A_Salem

   Next question

2. Question 1072 · 1459 in bank

   An IS auditor is evaluating the access controls for a shared customer relationship management (CRM) system. Which of the following would be the GREATEST concern?

   • AAudit logging is not enabled.
   • BSingle sign-on is not enabled.
   • CComplex passwords are not required.
   • DSecurity baseline is not consistently applied.

   Show answer

   Answer: A

   Explanation

   The greatest concern here is A, If audit login is not enabled , how are we going to trace and maintain customer management

   Source: Adapted from community discussion — Rachy

   Next question

3. Question 1073 · 1459 in bank

   An IS auditor finds the log management system is overwhelmed with false positive alerts. The auditor's BEST recommendation would be to:

   • Arecruit more monitoring personnel.
   • Bestablish criteria for reviewing alerts.
   • Creduce the firewall rules.
   • Dfine tune the intrusion detection system (IDS).

   Show answer

   Answer: D

   Explanation

   B. Establish criteria for reviewing alerts. Establishing criteria for reviewing alerts helps to ensure that only relevant alerts are generated and that false positive alerts are reduced. This can be accomplished by creating rules and thresholds that filter out non-critical alerts or by configuring the system to trigger alerts only when certain conditions are met. By doing so, the log management system will be able to more effectively identify and alert on actual security incidents, reducing the number of false positives.

   Source: Adapted from community discussion — SRJ13

   Next question

4. Question 1074 · 1459 in bank

   An IS auditor reviewing the database controls for a new e-commerce system discovers a security weakness in the database configuration. Which of the following should be the IS auditor's NEXT course of action?

   • ADisclose the findings to senior management.
   • BIdentify existing mitigating controls.
   • CAttempt to exploit the weakness.
   • DAssist in drafting corrective actions.

   Show answer

   Answer: B

   Explanation

   In this situation, the best next course of action for the IS auditor would be B - to identify existing mitigating controls. Before making any recommendations, it's important to understand if any existing controls are already in place to mitigate the risk.

   Source: Adapted from community discussion — spar2kle

   Next question

5. Question 1075 · 1459 in bank

   An IS auditor finds that a recently deployed application has a number of developers with inappropriate update access left over from the testing environment. Which of the following would have BEST prevented the update access from being migrated?

   • AIncluding a step within the SDLC to clean-up access prior to go-live
   • BEstablishing a role-based matrix for provisioning users
   • CHolding the application owner accountable for application security
   • DRe-assigning user access rights in the quality assurance (QA) environment

   Show answer

   Answer: A

   Next question

6. Question 1076 · 1459 in bank

   An IS auditor is asked to review a large organization's change management process. Which of the following practices presents the GREATEST risk?

   • ATransaction data changes can be made by a senior developer.
   • BChange management tickets do not contain specific documentation.
   • CA system administrator performs code migration on planned downtime.
   • DEmergency code changes are promoted without user acceptance testing (UAT).

   Show answer

   Answer: D

   Explanation

   Emergency code changes are promoted without user acceptance testing: This practice presents a significant risk because emergency changes are typically made to address critical issues, and there is often pressure to implement them quickly. In such a scenario, it may be tempting to skip some of the steps in the change management process, such as user acceptance testing. However, if changes are implemented without adequate testing, there is a high risk of introducing errors or other unintended consequences that could negatively impact the organization.

   Source: Adapted from community discussion — 3008

   Next question

7. Question 1077 · 1459 in bank

   An IS auditor is evaluating the security of an organization's data backup process, which includes the transmission of daily incremental backups to a public cloud provider. Which of the following findings poses the GREATEST risk to the organization?

   • ABackup transmissions occasionally fail.
   • BThe archived data log is incomplete.
   • CBackup transmissions are not encrypted.
   • DData recovery testing is conducted quarterly.

   Show answer

   Answer: C

   Next question

8. Question 1078 · 1459 in bank

   An IS auditor performing an application development review attends development team meetings. The IS auditor's independence will be compromised if the IS auditor:

   • Aassists in developing an integrated test facility (ITF) on the system.
   • Bre-performs test procedures used by the development team.
   • Creviews the result of systems tests that were performed by the development team.
   • Ddesigns and executes the user's acceptance test plan.

   Show answer

   Answer: D

   Next question

9. Question 1079 · 1459 in bank

   An IS audit manager is preparing the staffing plan for an audit engagement of a cloud service provider. What should be the manager's PRIMARY concern when made aware that a new auditor in the department previously worked for this provider?

   • AProfessional conduct
   • BCompetency
   • CIntegrity
   • DIndependence

   Show answer

   Answer: D

   Next question

10. Question 1080 · 1459 in bank

    An IS auditor discovers that validation controls in a web application have been moved from the server side into the browser to boost performance. This would MOST likely increase the risk of a successful attack by:

    • Adenial of service (DoS).
    • Bphishing.
    • Cstructured query language (SQL) injection.
    • Dbuffer overflow.

    Show answer

    Answer: C

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISA practice, question 1071. 1459 questions available.