Certified Information Systems Auditor1,459 questions across 146 pages are complete and free, with no account or card.
1459 questions in this bank
Free access · progress saved on this device
An IS auditor's draft report recommends the development of a procedure for IT server backups. During the closing meeting, the IT manager agrees to implement only part of the recommendations in the report. Which action should the auditor take FIRST to address this situation?
Answer: D
Which of the following is the BEST way to mitigate the risk associated with unintentional modifications of complex calculations in end-user computing (EUC)?
Answer: A
Having an independent party review the source calculations provides an additional layer of validation and assurance. This helps ensure the accuracy and integrity of the calculations by having someone separate from the original creator verify the logic, formulas, and assumptions used in the calculations. Independent reviews can help identify errors, inconsistencies, or potential risks in the calculations, reducing the likelihood of unintended modifications causing issues. Overall, independent review adds accountability and improves the quality of the calculations in end-user computing environments.
Source: Adapted from community discussion — Swallows
Which of the following must be in place before an IS auditor initiates audit follow-up activities?
Answer: A
Having a management response in the final report with a committed implementation date is crucial before initiating audit follow-up activities. This response indicates that the management has acknowledged the audit findings and committed to addressing them within a specified timeframe. It provides a clear plan of action for resolving the identified issues and ensures accountability. While supporting evidence for the gaps and recommendations mentioned in the audit report (option C) is also important for validating the findings, the commitment from management with a specific timeline for implementation is a foundational requirement for effective follow-up activities.
Source: Adapted from community discussion — Swallows
The due date of an audit project is approaching, and the audit manager has determined that only 60% of the audit has been completed. Which of the following should the audit manager do FIRST?
Answer: D
D. Determine where delays have occurred. Before taking any action to address the delay in the audit project, it is important for the audit manager to determine the cause of the delay. This will help the audit manager to identify the root cause and make informed decisions on how to address the situation. Understanding where the delays have occurred will help the audit manager to better allocate resources and make changes to the project plan to ensure that the audit is completed on time. Only after the cause of the delay has been determined can the audit manager consider options such as extending the deadline, assigning additional resources, or escalating to the audit committee.
Source: Adapted from community discussion — TEC1
Which of the following backup schemes is the BEST option when storage media is limited?
Answer: B
Which of the following should be of GREATEST concern for an IS auditor reviewing an organization's disaster recovery plan (DRP)?
Answer: A
While formal approval by senior management (option C) is also important for ensuring organizational support and commitment to the DRP, an outdated plan poses a more immediate risk as it may not accurately reflect the organization's current capabilities and requirements for disaster recovery. Therefore, ensuring that the DRP is updated following infrastructure changes should be of the greatest concern for an IS auditor.
Source: Adapted from community discussion — Swallows
Identifying and documenting project-related risks BEST enables project managers to:
Answer: A
A system administrator recently informed the IS auditor about the occurrence of several unsuccessful intrusion attempts from outside the organization. Which of the following is MOST effective in detecting such an intrusion?
Answer: A
Configuring your router as a firewall (option B) is a basic security measure to prevent unauthorized access to your network from outside, but it does nothing to detect intrusion attempts. Firewalls typically provide protection by blocking unauthorized traffic, but they do not generate detailed logs of attempts. Therefore, for the specific purpose of detecting intrusion attempts, the most effective method is to regularly review log files.
Source: Adapted from community discussion — Swallows
According to the three lines of defense model for risk management, the second line of defense includes functions that:
Answer: B
Due to limited storage capacity, an organization has decided to reduce the actual retention period for media containing completed low-value transactions. Which of the following is MOST important for the organization to ensure?
Answer: B
B. The retention period complies with data owner responsibilities. When an organization decides to reduce the retention period for media containing low-value transactions due to limited storage capacity, the most important aspect is to ensure that the new retention period complies with data owner responsibilities (Option B). Data owners are accountable for determining the appropriate retention periods for their data based on legal, regulatory, and business requirements. Ensuring compliance with data owner responsibilities helps maintain legal and regulatory compliance, data integrity, and appropriate management of records, even for low-value transactions.
Source: Adapted from community discussion — lsiau76
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CISA practice, question 1201. 1459 questions available.
Version 1.0.0. How we source questions