CISA practice questions 101–110

1. Question 101 · 1459 in bank

   Which of the following is MOST important to include in a data retention policy to reduce legal liabilities associated with information life cycle management?

   • AEnsuring that unnecessary data is not stored.
   • BReducing the cost of data storage through media sanitization.
   • CEnsuring that personal information is destroyed.
   • DRequiring that data be securely wiped so it cannot be restored for legal discovery.

   Show answer

   Answer: A

   Explanation

   A data retention policy is the first step in helping protect an organization’s data and avoid financial, civil, and criminal penalties that increasingly accompany poor data management practices. By ensuring that unnecessary data is not stored,

   Source: Adapted from community discussion — 3008

   Next question

2. Question 102 · 1459 in bank

   An IS auditor is performing an integrated audit covering payment processing activities using point-of-sale (POS) systems. Which of the following findings related to personal identification numbers (PINs) should be of GREATEST concern?

   • ACardholder PINs are encrypted and stored on the local POS terminal.
   • BCardholders are not required to enter their PINs.
   • CCardholders may select any 4-digit PIN without restrictions.
   • DCardholder PINs are not encrypted on the central computer.

   Show answer

   Answer: D

   Explanation

   The finding of greatest concern would be option D: Cardholder PINs are not encrypted on the central computer. While all the options present potential security risks, the lack of encryption on the central computer is the most serious. This is because the central computer is likely to store the PINs of many cardholders, making it a high-value target for attackers. If an attacker were to gain access to the central computer, they could potentially obtain the PINs of all cardholders, leading to a massive data breach. In contrast, the other options, while still concerning, present less severe risks. For example, option A could lead to a data breach if an individual POS terminal is compromised, but the impact would likely be less severe than a breach of the central computer

   Source: Adapted from community discussion — 3008

   Next question

3. Question 103 · 1459 in bank

   Data from a revenue collection system is uploaded into an enterprise data warehouse to be used for reporting purposes. An IS audit identifies that some revenue transactions were uploaded into the warehouse twice. Which of the following is the GREATEST risk in this situation?

   • AData in the warehouse may not be secure.
   • BReports generated from the data warehouse may lead to incorrect, decisions.
   • CData in the revenue collection system may not match data in the warehouse.
   • DSignificant time may be required to identify double-counted transactions

   Show answer

   Answer: B

   Explanation

   The greatest risk in this situation is that reports generated from the data warehouse may lead to incorrect decisions. Duplicate entries can result in inaccurate financial reporting and analysis, potentially impacting decision-making processes based on the flawed information. Decision-makers relying on these reports may make incorrect judgments, affecting the organization's overall performance and strategy.

   Source: Adapted from community discussion — FAGFUR

   Next question

4. Question 104 · 1459 in bank

   Which of the following is an IS auditor's BEST recommendation to protect an organization from attacks when its file server needs to be accessible to external users?

   • AEnhance internal firewalls.
   • BEnforce a secure tunnel connection.
   • CSet up a demilitarized zone (DMZ).
   • DImplement a secure protocol.

   Show answer

   Answer: B

   Explanation

   The best recommendation to protect an organization from attacks when its file server needs to be accessible to external users is to enforce a secure tunnel connection. This involves using technologies such as VPN or other secure communication protocols to establish an encrypted connection between external users and the file server. This helps protect data during transmission and reduces the risk of unauthorized access or interception.

   Source: Adapted from community discussion — FAGFUR

   Next question

5. Question 105 · 1459 in bank

   Which of the following is the BEST evidence that a project is ready for production?

   • AA parallel test over a full processing cycle has been successful.
   • BA pilot implementation with reduced scope has been tested and approved.
   • CA detailed conversion plan has been rehearsed in two desktop exercises.
   • DRollback procedures have been successfully tested.

   Show answer

   Answer: A

   Explanation

   The best evidence that a project is ready for production is that a parallel test over a full processing cycle has been successful. A parallel test involves running the new system concurrently with the existing system to ensure that they produce consistent and accurate results. Success in a full processing cycle indicates that the new system can handle the workload and perform as expected in a real-world scenario.

   Source: Adapted from community discussion — FAGFUR

   Next question

6. Question 106 · 1459 in bank

   An IS auditor has been tasked to review the processes that prevent fraud within a business expense claim system. Which of the following stakeholders is MOST important to involve in this review?

   • AQuality assurance (QA) manager
   • BBusiness department executive
   • CInformation security manager
   • DBusiness process owner

   Show answer

   Answer: D

   Explanation

   The most important stakeholder to involve in the review of processes that prevent fraud within a business expense claim system is the Business process owner. The business process owner is responsible for the end-to-end management of the business process, and in this case, the owner of the expense claim system. They have a comprehensive understanding of the process, including its objectives, controls, and potential areas of vulnerability to fraud. The business process owner is directly responsible for the system under review and is best positioned to provide in-depth knowledge and context for the audit.

   Source: Adapted from community discussion — FAGFUR

   Next question

7. Question 107 · 1459 in bank

   Which of the following is the MOST likely reason that local area network (LAN) servers can contribute to the rapid distribution of viruses?

   • AUsers of a server often load the same programs.
   • BServer software is the first to be infected.
   • CThe server exchanges data with each workstation at logon time.
   • DThe server's file-sharing function facilitates distribution of files.

   Show answer

   Answer: D

   Explanation

   The most likely reason that LAN servers can contribute to the rapid distribution of viruses is that the server's file-sharing function facilitates the distribution of files. File-sharing features on servers, especially when not properly configured or secured, can enable the rapid spread of viruses and malware across multiple workstations connected to the LAN.

   Source: Adapted from community discussion — FAGFUR

   Next question

8. Question 108 · 1459 in bank

   Which of the following is an example of a preventive control for physical access?

   • AImplementing a fingerprint-based access control system for the building
   • BInstalling closed-circuit television (CCTV) cameras for all ingress and egress points
   • CKeeping log entries for all visitors to the building
   • DImplementing a centralized logging server to record instances of staff logging into workstations

   Show answer

   Answer: A

   Explanation

   Implementing a fingerprint-based access control system for the building is an example of a preventive control for physical access. This type of control prevents unauthorized individuals from gaining physical access to the building by requiring a biometric verification (fingerprint) before allowing entry.

   Source: Adapted from community discussion — FAGFUR

   Next question

9. Question 109 · 1459 in bank

   Which of the following should be considered when examining fire suppression systems as part of a data center environmental controls review?

   • AMaintenance procedures
   • BOnsite replacement availability
   • CInstallation manuals
   • DInsurance coverage

   Show answer

   Answer: A

   Explanation

   When examining fire suppression systems as part of a data center environmental controls review, the most relevant consideration is maintenance procedures. Regular and proper maintenance of fire suppression systems is crucial to ensuring their effectiveness in the event of a fire. This includes routine inspections, testing, and adherence to maintenance schedules.

   Source: Adapted from community discussion — FAGFUR

   Next question

10. Question 110 · 1459 in bank

    Which of the following would be MOST effective to protect information assets in a data center from theft by a vendor?

    • AConceal data devices and information labels.
    • BIssue an access card to the vendor.
    • CMonitor and restrict vendor activities.
    • DRestrict use of portable and wireless devices.

    Show answer

    Answer: C

    Explanation

    Monitoring and restricting vendor activities is a crucial step in ensuring the security of information assets. By closely monitoring the activities of vendors within the data center, organizations can detect and prevent unauthorized access, theft, or misuse of sensitive information. This includes implementing controls such as access controls, surveillance systems, and logging mechanisms.

    Source: Adapted from community discussion — TTH1019

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISA practice, question 101. 1459 questions available.