CISA practice questions 1,141–1,150

1. Question 1141 · 1459 in bank

   A review of Internet security disclosed that users have individual user accounts with Internet service providers (ISPs) and use these accounts for downloading business data. The organization wants to ensure that only the corporate network is used. The organization should FIRST:

   • Ause a proxy server to filter out Internet sites that should not be accessed.
   • Bkeep a manual log of Internet access.
   • Cinclude a statement in its security policy about Internet use.
   • Dmonitor remote access activities.

   Show answer

   Answer: A

   Explanation

   C, including a statement in the security policy about Internet use, is important but is not a complete solution in itself. A policy statement alone does not provide a mechanism for enforcing the policy, and it may not be sufficient to prevent users from accessing non-business-related websites or services.

   Source: Adapted from community discussion — 3008

   Next question

2. Question 1142 · 1459 in bank

   Which of the following is the PRIMARY reason to follow a configuration management process to maintain applications?

   • ATo optimize system resources
   • BTo optimize asset management workflows
   • CTo ensure proper change control
   • DTo follow system hardening standards

   Show answer

   Answer: C

   Explanation

   C. To ensure proper change control Configuration management processes help ensure that changes made to applications are controlled, documented, and implemented in a systematic manner. This helps maintain the stability, reliability, and security of the applications while minimizing the risk of unintended consequences from changes. While optimization of system resources (Option A), asset management workflows (Option B), and adherence to system hardening standards (Option D) are important aspects, they are secondary to the core objective of ensuring proper change control in the configuration management process.

   Source: Adapted from community discussion — Yejide03

   Next question

3. Question 1143 · 1459 in bank

   What should an IS auditor do FIRST when management responses to an in-person internal control questionnaire indicate a key internal control is no longer effective?

   • AValidate the overall effectiveness of the internal control.
   • BDetermine the resources required to make the control effective.
   • CVerify the impact of the control no longer being effective.
   • DAscertain the existence of other compensating controls.

   Show answer

   Answer: C

   Explanation

   at first anyone will chek if there are any compensating controls.. in absence of these, then only they will go and check for the impact of not having such control

   Source: Adapted from community discussion — Deeplaxmi

   Next question

4. Question 1144 · 1459 in bank

   Following the implementation of a data loss prevention (DLP) tool, administrators have been overwhelmed with a high number of false positives. Which of the following is the BEST way to address this issue?

   • AEnable monitoring-only mode to permit further tuning of the solution.
   • BEducate staff about the risks of sharing sensitive information outside the organization.
   • CAmend policy rules to match approved and unapproved business information pathways.
   • DEnsure the latest signature files are present and configure regular updates.

   Show answer

   Answer: A

   Explanation

   Should be C. Enabling monitoring-only mode (option A) may provide insights for further tuning, but it does not directly address the issue itself. Educating staff about risks (option B) is important for overall security awareness, but it may not immediately reduce false positives. Ensuring the latest signature files and regular updates (option D) is essential for maintaining the effectiveness of the DLP tool, but it may not directly address the issue of false positives.

   Source: Adapted from community discussion — JONESKA

   Next question

5. Question 1145 · 1459 in bank

   During an exit interview, senior management disagrees with some of the facts presented in the draft audit report and wants them removed from the report. Which of the following would be the auditor's BEST course of action?

   • ARevise the assessment based on senior management's objections
   • BGather evidence to analyze senior management's objections.
   • CEscalate the issue to audit management.
   • DFinalize the draft audit report without changes.

   Show answer

   Answer: B

   Explanation

   yes. Unless it is pointed out that the facts are incorrect, mere disagreement will not do. Should be escalated to Audit management

   Source: Adapted from community discussion — inddir

   Next question

6. Question 1146 · 1459 in bank

   An organization was recently notified by its regulatory body of significant discrepancies in its reporting data. A preliminary investigation revealed that the discrepancies were caused by problems with the organization's data quality. Management has directed the data quality team to enhance their program. The audit committee has asked internal audit to be advisors to the process. To ensure that management concerns are addressed, which data set should internal audit recommend be reviewed FIRST?

   • AData impacting business objectives
   • BData supporting financial statements
   • CData reported to the regulatory body
   • DData with customer personal information

   Show answer

   Answer: C

   Next question

7. Question 1147 · 1459 in bank

   During an internal audit of automated controls, an IS auditor identifies that the integrity of data transfer between systems has not been tested since successful implementation two years ago. Which of the following should the auditor do NEXT?

   • AReview previous system interface testing records.
   • BDocument the finding in the audit report.
   • CReview relevant system changes.
   • DReview IT testing policies and procedures.

   Show answer

   Answer: D

   Explanation

   The first thing you need to do is review the policies and procedures because this may not even be a finding. If testing isn't required within that timeframe then nothing needs to be done.

   Source: Adapted from community discussion — murphseal

   Next question

8. Question 1148 · 1459 in bank

   Audit frameworks can assist the IS audit function by:

   • Aoutlining the specific steps needed to complete audits.
   • Bdefining the authority and responsibility of the IS audit function.
   • Cproviding details on how to execute the audit program.
   • Dproviding direction and information regarding the performance of audits.

   Show answer

   Answer: D

   Explanation

   D is the correct answer. Audit frameworks provide direction and information on how to perform audits, including the audit methodology, audit standards, audit tools, and techniques. These frameworks offer a structured approach to the audit process, providing guidance on the key areas to focus on during an audit and the steps needed to complete the audit successfully. Audit frameworks also help ensure that audits are conducted consistently and in line with industry standards and best practices, thereby enhancing the credibility and effectiveness of the audit function.

   Source: Adapted from community discussion — SRJ13

   Next question

9. Question 1149 · 1459 in bank

   What is the BEST way to evaluate a control environment where the organization and a third party have shared responsibility?

   • AConduct a control self-assessment (CSA).
   • BReview the service level agreement (SLA).
   • CPerform an onsite evaluation.
   • DReview complementary user entity controls.

   Show answer

   Answer: D

   Explanation

   D: Complementary user entity controls (CUECs) are essentially controls provided by a third-party service provider to help achieve the vendor’s control objectives. CUECs can be thought of as a laundry list of controls and activities that customers or clients of a service provider must have in place to receive services. Complementary user entity controls (CUECs) are controls that exist on a user-entity level in a vendor company. CUECs ensure that an agreement to agreed-upon requirements binds clients’ or customers’ access to specific services.

   Source: Adapted from community discussion — BiljaLl

   Next question

10. Question 1150 · 1459 in bank

    Which of the following is the MAIN purpose of an information security management system?

    • ATo enhance the impact of reports used to monitor information security incidents
    • BTo reduce the frequency and impact of information security incidents
    • CTo identify and eliminate the root causes of information security incidents
    • DTo keep information security policies and procedures up-to-date

    Show answer

    Answer: B

    Explanation

    Should be B. Keeping information security policies and procedures up-to-date (option D) is an important aspect of an ISMS, but it is not the main purpose. An ISMS involves a more comprehensive approach to managing information security, encompassing not only policies and procedures but also risk assessment, controls implementation, monitoring, and continuous improvement.

    Source: Adapted from community discussion — JONESKA

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISA practice, question 1141. 1459 questions available.