CISA practice questions 1,131–1,140

1. Question 1131 · 1459 in bank

   Which of the following presents the GREATEST challenge to the alignment of business and IT?

   • ALack of information security involvement in business strategy development
   • BAn IT steering committee chaired by the chief information officer (CIO)
   • CInsufficient IT budget to execute new business projects
   • DLack of chief information officer (CIO) involvement in board meetings

   Show answer

   Answer: D

   Next question

2. Question 1132 · 1459 in bank

   Which of the following would be of MOST concern when determining if information assets are adequately safeguarded during transport and disposal?

   • ALack of recent awareness training
   • BLack of appropriate labeling
   • CLack of appropriate data classification
   • DLack of password protection

   Show answer

   Answer: C

   Next question

3. Question 1133 · 1459 in bank

   Which of the following provides the BEST evidence that a third-party service provider's information security controls are effective?

   • ADocumentation of the service provider's security configuration controls
   • BAn audit report of the controls by the service provider's external auditor
   • CAn interview with the service provider's information security officer
   • DA review of the service provider's policies and procedures

   Show answer

   Answer: B

   Next question

4. Question 1134 · 1459 in bank

   An IS auditor has completed the fieldwork phase of a network security review and is preparing the initial draft of the audit report. Which of the following findings should be ranked as the HIGHEST risk?

   • ANetwork penetration tests are not performed.
   • BThe network firewall policy has not been approved by the information security officer.
   • CNetwork firewall rules have not been documented.
   • DThe network device inventory is incomplete.

   Show answer

   Answer: D

   Explanation

   An incomplete inventory hampers visibility and management. It can lead to unpatched devices, unauthorized access, and security blind spots. Remember that risk assessment considers both likelihood and impact. In this case, the incomplete inventory poses immediate operational and security risks.

   Source: Adapted from community discussion — dan08

   Next question

5. Question 1135 · 1459 in bank

   Capacity management enables organizations to:

   • Aestablish the capacity of network communication links.
   • Bforecast technology trends.
   • Cidentify the extent to which components need to be upgraded.
   • Ddetermine business transaction volumes.

   Show answer

   Answer: D

   Next question

6. Question 1136 · 1459 in bank

   Which of the following is the MOST effective way for an IS auditor to evaluate whether an organization is well positioned to defend against an advanced persistent threat (APT)?

   • AVerify that the organization has adequate levels of cyber insurance.
   • BReview the validity of external Internet Protocol (IP) addresses accessing the network.
   • CVerify that the organization is using correlated data for security monitoring.
   • DAssess the skill set with in the security function.

   Show answer

   Answer: C

   Next question

7. Question 1137 · 1459 in bank

   A credit card company has decided to outsource the printing of customer statements. It is MOST important for the company to verify whether:

   • Athe provider has alternate service locations.
   • Bthe contract includes compensation for deficient service levels.
   • Cthe provider adheres to the company's data retention policies.
   • Dthe provider's information security controls are aligned with the company's.

   Show answer

   Answer: D

   Next question

8. Question 1138 · 1459 in bank

   An IS auditor notes that IT and the business have different opinions on the availability of their application servers. Which of the following should the IS auditor review FIRST in order to understand the problem?

   • AThe exact definition of the service levels and their measurement
   • BThe regular performance-reporting documentation
   • CThe alerting and measurement process on the application servers
   • DThe actual availability of the servers as part of a substantive test

   Show answer

   Answer: A

   Next question

9. Question 1139 · 1459 in bank

   An organization conducted an exercise to test the security awareness level of users by sending an email offering a cash reward to those who click on a link embedded in the body of the email. Which of the following metrics BEST indicates the effectiveness of awareness training?

   • AThe number of users forwarding the email to their business unit managers
   • BThe number of users clicking on the link to learn more about the sender of the email
   • CThe number of users reporting receipt of the email to the information security team
   • DThe number of users deleting the email without reporting because it is a phishing email

   Show answer

   Answer: C

   Next question

10. Question 1140 · 1459 in bank

    Which of the following is the PRIMARY advantage of parallel processing for a new system implementation?

    • AAssurance that the new system meets functional requirements
    • BSignificant cost savings over other system implementation approaches
    • CMore time for users to complete training for the new system
    • DAssurance that the new system meets performance requirements

    Show answer

    Answer: A

    Explanation

    CISA Study Guide 27th: The purpose of parallel testing is to ensure that the implementation of a new system will meet user requirements.

    Source: Adapted from community discussion — MJORGER

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISA practice, question 1131. 1459 questions available.