CISA practice questions 1,151–1,160

1. Question 1151 · 1459 in bank

   During the discussion of a draft audit report, IT management provided suitable evidence that a process has been implemented for a control that had been concluded by the IS auditor as ineffective. Which of the following is the auditor's BEST action?

   • AExplain to IT management that the new control will be evaluated during follow-up.
   • BAdd comments about the action taken by IT management in the report.
   • CChange the conclusion based on evidence provided by IT management.
   • DRe-perform the audit before changing the conclusion.

   Show answer

   Answer: B

   Explanation

   D should be the answer. By re-performing the audit, the auditor ensures that their conclusion is based on the most up-to-date and accurate information. It allows for a more comprehensive evaluation of the control's effectiveness and provides a more reliable basis for reporting and decision-making. adding comments about the action taken by IT management in the report (option B) may be appropriate actions, they should be accompanied by a thorough REASSESSMENT of the control's effectiveness.

   Source: Adapted from community discussion — JONESKA

   Next question

2. Question 1152 · 1459 in bank

   An organization allows its employees to use personal mobile devices for work. Which of the following would BEST maintain information security without compromising employee privacy?

   • APartitioning the work environment from personal space on devices
   • BPreventing users from adding applications
   • CRestricting the use of devices for personal purposes during working hours
   • DInstalling security software on the devices

   Show answer

   Answer: A

   Next question

3. Question 1153 · 1459 in bank

   An IS auditor who was instrumental in designing an application is called upon to review the application. The auditor should:

   • Ainform audit management of the earlier involvement.
   • Bmodify the scope of the audit.
   • Crefuse the assignment to avoid conflict of interest.
   • Duse the knowledge of the application to carry out the audit.

   Show answer

   Answer: A

   Next question

4. Question 1154 · 1459 in bank

   Documentation of workaround processes to keep a business function operational during recovery of IT systems is a core part of a:

   • Adisaster recovery plan (DRP).
   • Bbusiness continuity plan (BCP).
   • Cthreat and risk assessment.
   • Dbusiness impact analysis (BIA).

   Show answer

   Answer: B

   Next question

5. Question 1155 · 1459 in bank

   An organization has developed mature risk management practices that are followed across all departments. What is the MOST effective way for the audit team to leverage this risk management maturity?

   • AImplementing risk responses on management's behalf
   • BProviding assurances to management regarding risk
   • CFacilitating audit risk identification and evaluation workshops
   • DIntegrating the risk register for audit planning purposes

   Show answer

   Answer: C

   Next question

6. Question 1156 · 1459 in bank

   The MAIN benefit of using an integrated test facility (ITF) as an online auditing technique is that it enables:

   • Athe integration of financial and audit tests.
   • Bauditors to test without impacting production data.
   • Ca cost-effective approach to application controls audit.
   • Dauditors to investigate fraudulent transactions.

   Show answer

   Answer: B

   Explanation

   An ITF is a controlled environment within the production system where auditors can perform tests without affecting actual business transactions. This means that auditors can perform various tests, including auditing and system validation, without the risk of disrupting normal business operations or compromising sensitive data.

   Source: Adapted from community discussion — dan08

   Next question

7. Question 1157 · 1459 in bank

   Which of the following weaknesses would have the GREATEST impact on the effective operation of a perimeter firewall?

   • AAd hoc monitoring of firewall activity
   • BUse of stateful firewalls with default configuration
   • CPotential back doors to the firewall software
   • DMisconfiguration of the firewall rules

   Show answer

   Answer: D

   Explanation

   Under CRM 'Firewall Issues': • Misconfigured firewalls may allow unknown and dangerous services to pass through freely. This is the closest I could reference to what the question is asking.

   Source: Adapted from community discussion — lsiau76

   Next question

8. Question 1158 · 1459 in bank

   Which of the following is MOST important to ensure that electronic evidence collected during a forensic investigation will be admissible in future legal proceedings?

   • ARestricting evidence access to professionally certified forensic investigators
   • BEngaging an independent third party to perform the forensic investigation
   • CPerforming investigative procedures on the original hard drives rather than images of the hard drives
   • DDocumenting evidence handling by personnel throughout the forensic investigation

   Show answer

   Answer: D

   Explanation

   i think D is correct, because D is the chain of custody. If evidence is restricted to forensic investigators, but there is no documentation of who had accessed the evidence, the chain of custody is still not complete

   Source: Adapted from community discussion — ashleycc

   Next question

9. Question 1159 · 1459 in bank

   Which of the following tests would provide the BEST assurance that a health care organization is handling patient data appropriately?

   • ACompliance with industry standards and best practice
   • BCompliance with action plans resulting from recent audits
   • CCompliance with local laws and regulations
   • DCompliance with the organization's policies and procedures

   Show answer

   Answer: C

   Next question

10. Question 1160 · 1459 in bank

    Which of the following is a concern when an organization's disaster recovery strategy utilizes a hot site?

    • AInsufficient environmental controls
    • BSignificant distance from the primary data center
    • CThe lack of networking infrastructure
    • DConflicts due to reciprocal agreements with other organizations

    Show answer

    Answer: D

    Explanation

    While significant distance from the primary data center (option B) may introduce latency or other network performance issues, it is not the primary concern when discussing a hot site. The lack of networking infrastructure (option C) can be a concern, but it is typically part of the planning and implementation process when setting up a hot site. Conflicts due to reciprocal agreements with other organizations (option D) may impact the availability or priority of the hot site, but it is not a concern that directly relates to the functionality or environmental controls of the hot site itself. Therefore, the primary concern when utilizing a hot site for disaster recovery is the potential for insufficient environmental controls at the facility. Answer is A

    Source: Adapted from community discussion — JONESKA

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISA practice, question 1151. 1459 questions available.