CISA practice questions 1,191–1,200

1. Question 1191 · 1459 in bank

   What is MOST important to verify during an external assessment of network vulnerability?

   • ARegular review of the network security policy
   • BLocation of intrusion detection systems (IDS)
   • CUpdate of security information event management (SIEM) rules
   • DCompleteness of network asset inventory

   Show answer

   Answer: D

   Explanation

   During an external assessment of network vulnerability, the most important aspect to verify would be: D. Completeness of network asset inventory Verifying the completeness of the network asset inventory is crucial because it ensures that all network devices and systems are properly identified and accounted for. Without an accurate and comprehensive inventory, it would be challenging to assess the security posture of the network effectively. Missing or unaccounted assets can introduce vulnerabilities and potential entry points for attackers. While the other options mentioned are also important considerations, they are not as fundamental as having a complete network asset inventory. Regular review of the network security policy helps ensure that security measures are up to date and aligned with the organization's requirements, but without a proper inventory, it may be difficult to implement those policies consistently.

   Source: Adapted from community discussion — cybervds

   Next question

2. Question 1192 · 1459 in bank

   Which of the following environments is BEST used for copying data and transformation into a compatible data warehouse format?

   • ADevelopment
   • BTesting
   • CReplication
   • DStaging

   Show answer

   Answer: D

   Explanation

   D. Staging The best environment for copying data and transforming it into a compatible data warehouse format is typically the staging environment. In a typical data pipeline, data is first ingested into a staging area where it undergoes necessary transformations, cleaning, and validation before being loaded into the data warehouse. The staging environment serves as an intermediary step between the source data and the final destination in the data warehouse. This allows you to ensure data quality, integrity, and compatibility with the data warehouse schema before it is loaded into the production environment. Development and testing environments are primarily used for software development and testing purposes, while replication is generally associated with creating copies of data for various purposes but may not involve data transformation to the extent that staging does. Staging is specifically designed for the ETL (Extract, Transform, Load) processes required for preparing data for analytics and reporting in a data warehouse.

   Source: Adapted from community discussion — SuperMax

   Next question

3. Question 1193 · 1459 in bank

   Which of the following is the BEST recommendation to include in an organization's bring your own device (BYOD) policy to help prevent data leakage?

   • ASpecify employee responsibilities for reporting lost or stolen BYOD devices.
   • BRequire multi-factor authentication on BYOD devices.
   • CRequire employees to waive privacy rights related to data on BYOD devices.
   • DAllow only registered BYOD devices to access the network.

   Show answer

   Answer: B

   Explanation

   B. Require multi-factor authentication on BYOD devices. Multi-factor authentication (MFA) adds an extra layer of security to ensure that only authorized users can access company data from their BYOD devices. It typically involves something the user knows (like a password) and something the user has (like a smartphone or a hardware token). This helps protect against unauthorized access even if the device is lost or stolen. While the other options (A, C, and D) may also be important elements of a BYOD policy, they do not directly address data leakage prevention as effectively as implementing multi-factor authentication.

   Source: Adapted from community discussion — SuperMax

   Next question

4. Question 1194 · 1459 in bank

   During audit planning, the IS audit manager is considering whether to budget for audits of entities regarded by the business as having low risk. Which of the following is the BEST course of action in this situation?

   • AOutsource low-risk audits to external audit service providers.
   • BChallenge the risk rating and include the low-risk entities in the plan.
   • CConduct limited-scope audits of low-risk business entities.
   • DValidate the low-risk entity ratings and apply professional judgment.

   Show answer

   Answer: D

   Next question

5. Question 1195 · 1459 in bank

   An organization has virtualized its server environment without making any other changes to the network or security infrastructure. Which of the following is the MOST significant risk?

   • AData center environmental controls not aligning with new configuration
   • BSystem documentation not being updated to reflect changes in the environment
   • CVulnerability in the virtualization platform affecting multiple hosts
   • DInability of the network intrusion detection system (IDS) to monitor virtual server-to-server communications.

   Show answer

   Answer: C

   Explanation

   In this scenario, the most significant risk is a vulnerability in the virtualization platform affecting multiple hosts. This vulnerability could potentially compromise the security of all virtualized servers within the environment. Exploiting such a vulnerability could lead to unauthorized access, data breaches, or other malicious activities across multiple hosts, posing a significant threat to the organization's data security, integrity, and availability. Therefore, addressing and mitigating vulnerabilities in the virtualization platform should be a top priority to safeguard the entire virtualized server environment.

   Source: Adapted from community discussion — Swallows

   Next question

6. Question 1196 · 1459 in bank

   During an audit of an organization's risk management practices, an IS auditor finds several documented IT risk acceptances have not been renewed in a timely manner after the assigned expiration date. When assessing the severity of this finding, which mitigating factor would MOST significantly minimize the associated impact?

   • AThere are documented compensating controls over the business processes.
   • BThe risk acceptances with issues reflect a small percentage of the total population.
   • CThe business environment has not significantly changed since the risk acceptances were approved.
   • DThe risk acceptances were previously reviewed and approved by appropriate senior management.

   Show answer

   Answer: C

   Explanation

   You should check whether there are changes to the business environment then check whether the compensating controls are still effective.

   Source: Adapted from community discussion — Jag127

   Next question

7. Question 1197 · 1459 in bank

   Which of the following is MOST important for an IS auditor to consider when performing the risk assessment prior to an audit engagement?

   • AIndustry standards and best practices
   • BThe amount of time since the previous audit
   • CThe results of the previous audit
   • DThe design of controls

   Show answer

   Answer: C

   Explanation

   D. The design of controls - Understanding the design of controls is important for assessing whether they are adequate to mitigate risks, but the effectiveness of these controls in practice, as indicated by the results of the previous audit, is more directly relevant to the risk assessment for the upcoming audit. Therefore, the results of the previous audit (option C) are the most important for an IS auditor to consider when performing the risk assessment prior to an audit engagement, as they provide a historical context and a starting point for identifying areas of potential risk.

   Source: Adapted from community discussion — KAP2HURUF

   Next question

8. Question 1198 · 1459 in bank

   An IS auditor is reviewing the deployment of a new automated system. Which of the following findings presents the MOST significant risk?

   • AUsers have not been trained on the new system.
   • BThe new system is not platform agnostic.
   • CData from the legacy system is not migrated correctly to the new system.
   • DThe new system has resulted in layoffs of key experienced personnel.

   Show answer

   Answer: C

   Explanation

   When reviewing the deployment of a new automated system, the most significant risk among the given options would depend on the specific circumstances and the organization's priorities. However, considering the potential impact on business operations and continuity, as well as the potential for financial and reputational damage, the finding that presents the MOST significant risk would likely be: C. Data from the legacy system is not migrated correctly to the new system. This finding poses several risks. Incorrect migration of data can lead to data loss, data corruption, or data inconsistencies, which can significantly impact business operations, decision-making, and customer satisfaction. It can result in inaccurate financial reporting, legal compliance issues, and a loss of trust from stakeholders. Additionally, rectifying data migration issues can be complex, time-consuming, and expensive.

   Source: Adapted from community discussion — cybervds

   Next question

9. Question 1199 · 1459 in bank

   An organization is planning an acquisition and has engaged an IS auditor to evaluate the IT governance framework of the target company. Which of the following would be MOST helpful in determining the effectiveness of the framework?

   • ARecent third-party IS audit reports
   • BCurrent and previous internal IS audit reports
   • CIT performance benchmarking reports with competitors
   • DSelf-assessment reports of IT capability and maturity

   Show answer

   Answer: A

   Explanation

   A is the correct answear due to the fact that reports from third parties are independent and objective than the one s made by the internal auditors

   Source: Adapted from community discussion — Lilik

   Next question

10. Question 1200 · 1459 in bank

    Which of the following is an executive management concern that could be addressed by the implementation of a security metrics dashboard?

    • AEffectiveness of the security program
    • BTotal number of false positives
    • CTotal number of hours budgeted to security
    • DSecurity incidents vs. industry benchmarks

    Show answer

    Answer: A

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISA practice, question 1191. 1459 questions available.