CISA practice questions 1,081–1,090

1. Question 1081 · 1459 in bank

   An IS auditor notes that application super-user activity was not recorded in system logs. What is the auditor's BEST course of action?

   • AInvestigate the reason for the lack of logging.
   • BReport the issue to the audit manager.
   • CRecommend activation of super-user activity logging.
   • DRecommend a least-privilege access model.

   Show answer

   Answer: A

   Explanation

   recommending activation of super-user activity logging, is not the best course of action because it assumes that the absence of logging is due to a lack of configuration rather than a deeper issue. Before recommending activation of super-user activity logging, it is important to investigate the root cause of the lack of logging to ensure that it is not a deliberate attempt to hide activity.

   Source: Adapted from community discussion — 3008

   Next question

2. Question 1082 · 1459 in bank

   An IS auditor is reviewing security controls related to collaboration tools for a business unit responsible for intellectual property and patents. Which of the following observations should be of MOST concern to the auditor?

   • ATraining was not provided to the department that handles intellectual property and patents.
   • BLogging and monitoring for content filtering is not enabled.
   • CThe collaboration tool is hosted and can only be accessed via an Internet browser.
   • DEmployees can share files with users outside the company through collaboration tools.

   Show answer

   Answer: D

   Next question

3. Question 1083 · 1459 in bank

   Which of the following findings from an IT governance review should be of GREATEST concern?

   • AIT value analysis has not been completed.
   • BAll IT services are provided by third parties.
   • CIT supports two different operating systems.
   • DThe IT budget is not monitored.

   Show answer

   Answer: B

   Explanation

   IT value can be achived when there is alignment btween IT and Business objectives From IT Governance point of view so I think A is correct

   Source: Adapted from community discussion — Otlaadisa

   Next question

4. Question 1084 · 1459 in bank

   An IS auditor has been asked to assess the security of a recently migrated database system that contains personal and financial data for a bank's customers. Which of the following controls is MOST important for the auditor to confirm it in place?

   • AThe default configurations have been changed.
   • BAll tables in the database are normalized.
   • CThe service port used by the database server has been changed.
   • DThe default administration account is used after changing the account password.

   Show answer

   Answer: A

   Explanation

   You have normalised all things but yiu have not changed global default setting then anyone can access the data hence critical is to change default setting

   Source: Adapted from community discussion — Nehalpandya

   Next question

5. Question 1085 · 1459 in bank

   An IS auditor performing a review of a newly purchased software program notes that an escrow agreement has been executed for acquiring the source code. What is MOST important for the IS auditor to verify?

   • AThe source code is being held by an independent third party.
   • BProduct acceptance testing has been completed.
   • CThe vendor is financially viable.
   • DThe source code is being updated for each change.

   Show answer

   Answer: A

   Explanation

   Verifying that the source code is held by an independent third party is crucial because the escrow agreement is a risk management mechanism. In the event that the software vendor goes out of business or is unable to support the software, having the source code held by a third party ensures that the organization can access and maintain the software. This helps to mitigate the risk of losing critical functionality or support in the future. While the other options may also be important, ensuring the independence and reliability of the third party holding the source code is particularly critical for the long-term viability and supportability of the software.

   Source: Adapted from community discussion — FAGFUR

   Next question

6. Question 1086 · 1459 in bank

   An IS auditor notes the transaction processing times in an order processing system have significantly increased after a major release. Which of the following should the IS auditor review FIRST?

   • ACapacity management plan
   • BStress testing results
   • CTraining plans
   • DDatabase conversion results

   Show answer

   Answer: A

   Next question

7. Question 1087 · 1459 in bank

   An IS auditor is executing a risk-based IS audit strategy to ensure that key areas are audited. Which of the following should be of GREATEST concern to the auditor?

   • AThe risk assessment database does not include a complete audit universe.
   • BThe risk assessment methodology does not permit the collection of financial audit data.
   • CThe risk assessment methodology relies on subjective audit judgments at certain points of the process.
   • DThe risk assessment approach has not been approved by the risk manager.

   Show answer

   Answer: A

   Explanation

   I think is A. Let me mark some word from CRM: "Evaluation of the risk factors should be based on objective criteria, although subjectivity cannot be completely avoided."

   Source: Adapted from community discussion — shalota2

   Next question

8. Question 1088 · 1459 in bank

   An IS auditor is assigned to review the IS department's quality procedures. Upon contacting the IS manager, the auditor finds that there is an informal unwritten set of standards. Which of the following should be the auditor's NEXT action?

   • AFinalize the audit and report the finding.
   • BDocument and test compliance with the informal standards.
   • CPostpone the audit until IS management implements written standards.
   • DMake recommendations to IS management as to appropriate quality standards.

   Show answer

   Answer: D

   Explanation

   Documenting and testing compliance with the informal standards (option B) would be a possible action but it would not address the issue of the lack of formal quality procedures. The auditor's role is to provide recommendations for improvement, rather than just test compliance. Therefore, the best course of action is to make recommendations to IS management as to appropriate quality standards (option D). The auditor can provide guidance on industry best practices or established standards such as ISO 9001 or ITIL, which the organization can adopt and document in their procedures. This will help ensure that the quality procedures are consistent and followed consistently across the organization.

   Source: Adapted from community discussion — 3008

   Next question

9. Question 1089 · 1459 in bank

   An IS auditor will be testing accounts payable controls by performing data analytics on the entire population of transactions. Which of the following is MOST important for the auditor to confirm when sourcing the population data?

   • AThe data analysis tools have been recently updated.
   • BThe data can be obtained in a timely manner.
   • CThere is no privacy information in the data.
   • DThe data is taken directly from the system.

   Show answer

   Answer: D

   Explanation

   The integrity and reliability of the data used for analytics are critical. Using data directly from the system helps ensure that the auditor is working with accurate, up-to-date, and unaltered information. This direct access to the system data minimizes the risk of errors or manipulation that might occur if the data were obtained from secondary sources.

   Source: Adapted from community discussion — FAGFUR

   Next question

10. Question 1090 · 1459 in bank

    An IS auditor assessing the controls within a newly implemented call center would FIRST:

    • Agather information from the customers regarding response times and quality of service.
    • Btest the technical infrastructure at the call center.
    • Creview the manual and automated controls in the call center.
    • Devaluate the operational risk associated with the call center.

    Show answer

    Answer: C

    Explanation

    Before gathering information from customers or conducting technical tests, it's important for the auditor to have a clear understanding of the internal controls that are in place. This includes both manual and automated controls that govern the operations of the call center. By reviewing these controls first, the auditor can identify potential weaknesses, gaps, or areas of concern that may need further investigation or testing.

    Source: Adapted from community discussion — FAGFUR

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISA practice, question 1081. 1459 questions available.