Question 1171 · 1459 in bank
Which of the following is the MOST effective way for an organization to protect against data loss?
Show answer
Answer: D
Certified Information Systems Auditor1,459 questions across 146 pages are complete and free, with no account or card.
1459 questions in this bank
Free access · progress saved on this device
Which of the following is the MOST effective way for an organization to protect against data loss?
Answer: D
Which of the following is the BEST control to minimize the risk of unauthorized access to lost company-owned mobile devices?
Answer: A
While password/PIN protection (option C) is important for initial access control, device encryption (option A) is the superior control for minimizing the risk of unauthorized access to lost company-owned mobile devices due to its ability to protect data from unauthorized access even if physical possession of the device is compromised.
Source: Adapted from community discussion — Swallows
An IS auditor has found that a vendor has gone out of business and the escrow has an older version of the source code. What is the auditor's BEST recommendation for the organization?
Answer: A
Undertaking an analysis to determine the business risk is the BEST recommendation for the organization. This analysis should include an assessment of the impact of the outdated source code on the organization's operations, security, and compliance. Based on the analysis, the organization can develop a risk management plan that may include options such as seeking alternative vendors, developing a new application, or implementing compensating controls to mitigate the risks associated with the outdated source code
Source: Adapted from community discussion — 3008
An IS auditor is reviewing the installation of a new server. The IS auditor's PRIMARY objective is to ensure that:
Answer: B
An IS auditor finds a high-risk vulnerability in a public-facing web server used to process online customer payments. The IS auditor should FIRST:
Answer: C
Notifying the audit committee (option A) is important, but it is typically done after the immediate risk mitigation steps have been taken. The audit committee may need to be informed about the vulnerability, its impact, and the actions taken or planned to address it.
Source: Adapted from community discussion — Swallows
An IS auditor discovers that an IT organization serving several business units assigns equal priority to all initiatives, creating a risk of delays in securing project funding. Which of the following would be MOST helpful in matching demand for projects and services with available resources in a way that supports business objectives?
Answer: D
Which of the following is the MOST efficient way to identify segregation of duties violations in a new system?
Answer: C
While developing a process (option B) to identify authorization conflicts can be valuable in the long term, it requires more time and effort initially to define the criteria, implement monitoring mechanisms, and ensure ongoing compliance. In contrast, reviewing a security rights report provides immediate insights into segregation of duties issues present in the system. Therefore, option C is the most efficient way for an IS auditor to identify segregation of duties violations in a new system.
Source: Adapted from community discussion — Swallows
Which of the following is the PRIMARY reason for an IS auditor to conduct post-implementation reviews?
Answer: C
While documenting lessons learned (option A) is a secondary benefit, the primary purpose of the post-implementation review is to determine the actual achievement of project objectives. Lessons learned are derived from this assessment to improve future project delivery, but they are not the primary reason for conducting the review.
Source: Adapted from community discussion — Swallows
To confirm integrity for a hashed message, the receiver should use:
Answer: D
the only different between A and D is what value is generated after hashing of message. Normally, to check integrity, hash will be created by receiver using the same algorithm used by sender. The result of hashing will be numerical then we can compare with the original numerical generated by sender to ensure the integrity of the file. Then, I chose D
Source: Adapted from community discussion — MichaelHoang
What is the MAIN reason to use incremental backups?
Answer: D
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CISA practice, question 1171. 1459 questions available.
Version 1.0.0. How we source questions