Certified Information Systems Auditor1,459 questions across 146 pages are complete and free, with no account or card.
1459 questions in this bank
Free access · progress saved on this device
Which of the following is the BEST metric to measure the alignment of IT and business strategy?
Answer: D
Option D is the BEST metric to measure the alignment of IT and business strategy because it provides a direct indication of how well IT initiatives and projects are perceived to support and align with the organization's strategic objectives as judged by key stakeholders.
Source: Adapted from community discussion — Swallows
Which of the following is the MOST important activity in the data classification process?
Answer: C
Identifying the risk associated with the data (option C) is the most important activity in the data classification process. This step involves assessing the potential impact to the organization if the data were to be lost, corrupted, or accessed by unauthorized individuals. The outcome of this risk assessment guides the classification of the data, which in turn determines how the data should be handled, protected, and labeled, and who should be accountable for it. Therefore, identifying risk associated with the data is the most critical step in the data classification process
Source: Adapted from community discussion — 55555hk
A project team has decided to switch to an agile approach to develop a replacement for an existing business application. Which of the following should an IS auditor do FIRST to ensure the effectiveness of the project audit?
Answer: A
During an external review, an IS auditor observes an inconsistent approach in classifying system criticality within the organization. Which of the following should be recommended as the PRIMARY factor to determine system criticality?
Answer: A
This refers to the total time a system can be unavailable before causing unacceptable consequences for the organization. It directly relates to how critical a system is to business operations. A system with a shorter MAD is more critical because its downtime needs to be minimized to avoid significant impact on the organization.
Source: Adapted from community discussion — PurpleParrot
Which of the following is the MOST significant risk that IS auditors are required to consider for each engagement?
Answer: A
The MOST significant risk that IS (Information Systems) auditors are required to consider for each engagement may vary depending on the specific circumstances and nature of the organization being audited. However, among the options provided, one of the key risks that IS auditors typically prioritize is option A: Irregularities and illegal acts. While noncompliance with organizational policies (option B), misalignment with business objectives (option C), and process and resource inefficiencies (option D) are also important considerations, irregularities and illegal acts are often viewed as the most significant risk due to their potential impact on an organization's reputation, financial stability, and legal compliance. IS auditors play a critical role in identifying and mitigating these risks to safeguard an organization's information systems and assets.
Source: Adapted from community discussion — cybervds
An externally facing system containing sensitive data is configured such that users have either read-only or administrator rights. Most users of the system have administrator access. Which of the following is the GREATEST risk associated with this situation?
Answer: D
Which of the following is the GREATEST risk associated with utilizing spreadsheets for financial reporting in end-user computing (EUC)?
Answer: B
An organization's audit charter PRIMARILY:
Answer: A
A. describes the auditor's authority to conduct audits. An audit charter is a formal document that defines the internal audit activity's purpose, authority, and responsibility. It establishes the internal audit activity's position within the organization, including the nature of the chief audit executive’s functional reporting relationship with the board. The audit charter authorizes access to records, personnel, and physical properties relevant to the performance of engagements.
Source: Adapted from community discussion — Broesweelies
When auditing the security architecture of an online application, an IS auditor should FIRST review the:
Answer: A
I am really blown away by everybody saying it is A. The config will tell you where and what the firewall does. Location of firewall means absolutely nothing. Physical location? I mean a firewall ALWAYS sits in front of your business network...
Source: Adapted from community discussion — Broesweelies
Following a security breach in which a hacker exploited a well-known vulnerability in the domain controller, an IS auditor has been asked to conduct a control assessment. The auditor's BEST course of action would be to determine if:
Answer: A
A. the patches were updated. Ensuring that the patches for the domain controller and relevant software have been updated is crucial to addressing the vulnerability that was exploited. Hackers often target known vulnerabilities that can be mitigated through patching. Therefore, verifying the status of patch updates is a fundamental step in responding to such a breach. While the other options (B, C, and D) may also be important security controls, they are not the primary and immediate action to take in response to a known vulnerability being exploited. Monitoring logs (option B), classifying for high availability (option C), and monitoring network traffic (option D) are ongoing security measures, but patching vulnerabilities is typically the first step in mitigating a known security risk.
Source: Adapted from community discussion — SuperMax
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CISA practice, question 1181. 1459 questions available.
Version 1.0.0. How we source questions