CISA practice questions 1,211–1,220

1. Question 1211 · 1459 in bank

   Which of the following is the MOST appropriate and effective fire suppression method for an unstaffed computer room?

   • AWater sprinkler
   • BFire extinguishers
   • CCarbon dioxide (CO )
   • DDry pipe

   Show answer

   Answer: C

   Explanation

   C. Carbon dioxide (CO2): A CO2 suppression system is a good choice for a computer room because it is a clean agent that does not leave residue or cause damage to equipment. It works by displacing oxygen, effectively removing the oxygen that fuels the fire. This is a preferred option for protecting valuable computer equipment.

   Source: Adapted from community discussion — SuperMax

   Next question

2. Question 1212 · 1459 in bank

   An IS auditor reviewing security incident processes realizes incidents are resolved and closed, but root causes are not investigated. Which of the following should be the MAJOR concern with this situation?

   • ASecurity incident policies are out of date.
   • BLessons learned have not been properly documented.
   • CVulnerabilities have not been properly addressed.
   • DAbuses by employees have not been reported.

   Show answer

   Answer: C

   Explanation

   C. Vulnerabilities have not been properly addressed. Without investigating the root causes of security incidents, organizations cannot identify and rectify the underlying vulnerabilities that led to these incidents in the first place. This can result in a continuous cycle of incidents and potential security breaches, leaving the organization exposed to ongoing risks. Addressing vulnerabilities is a fundamental aspect of maintaining effective cybersecurity, and it should be a top priority for any organization. While the other options (A, B, and D) may also be concerns, they are not as directly related to the failure to investigate root causes of security incidents.

   Source: Adapted from community discussion — SuperMax

   Next question

3. Question 1213 · 1459 in bank

   Which of the following is MOST important for an IS auditor to determine during the detailed design phase of a system development project?

   • AAcceptance test criteria have been developed.
   • BData conversion procedures have been established.
   • CThe design has been approved by senior management.
   • DProgram coding standards have been followed.

   Show answer

   Answer: A

   Explanation

   A. Acceptance test criteria have been developed. During the detailed design phase, it is crucial to ensure that clear and comprehensive acceptance test criteria have been developed. Acceptance testing is a critical phase in system development where the system is evaluated to ensure it meets the specified requirements. This phase helps in validating that the system functions as intended and is ready for deployment. Ensuring the existence and adequacy of acceptance test criteria helps mitigate risks associated with system functionality and performance. The other options (B, C, and D) are also important aspects but may not be as directly tied to the detailed design phase as the development and validation of acceptance test criteria.

   Source: Adapted from community discussion — SuperMax

   Next question

4. Question 1214 · 1459 in bank

   Which of the following should an IS auditor consider FIRST when evaluating firewall rules?

   • AThe firewalls' default settings
   • BThe physical location of the firewalls
   • CThe number of remote nodes
   • DThe organization's security policy

   Show answer

   Answer: D

   Next question

5. Question 1215 · 1459 in bank

   An IS auditor has discovered that a software system still in regular use is years out of date and no longer supported. The auditee has stated that it will take six months until the software is running on the current version. Which of the following is the BEST way to reduce the immediate risk associated with using an unsupported version of the software?

   • AVerify all patches have been applied to the software system's outdated version.
   • BMonitor network traffic attempting to reach the outdated software system.
   • CClose all unused ports on the outdated software system.
   • DSegregate the outdated software system from the main network.

   Show answer

   Answer: D

   Explanation

   It should be D, the question is asking "to reduce", asking for mitigation. Monitoring is not a control. Monitoring and reviewing is a detective control

   Source: Adapted from community discussion — Sayed_Jawad

   Next question

6. Question 1216 · 1459 in bank

   During the planning phase of a data loss prevention (DLP) audit, management expresses a concern about mobile computing. Which of the following should the IS auditor identify as the associated risk?

   • ALack of governance and oversight for IT infrastructure and applications
   • BIncreased need for user awareness training
   • CThe use of the cloud negatively impacting IT availability
   • DIncreased vulnerability due to anytime, anywhere accessibility

   Show answer

   Answer: D

   Next question

7. Question 1217 · 1459 in bank

   Which of the following should an IS auditor be MOST concerned with during a post-implementation review?

   • AThe system does not have a maintenance plan.
   • BThe system contains several minor defects.
   • CThe system deployment was delayed by three weeks.
   • DThe system was over budget by 15%.

   Show answer

   Answer: A

   Explanation

   A. The system does not have a maintenance plan. During a post-implementation review, an IS auditor should be most concerned with the absence of a maintenance plan for the system. A well-designed maintenance plan is crucial to ensuring that the system continues to function effectively and meet the organization's needs over time. The maintenance plan should include regular updates, monitoring, and testing to identify and resolve any issues that arise. Without a maintenance plan, the system may become vulnerable to security threats or may not perform as intended, which could lead to disruptions in business operations or negative impacts on the organization's reputation.

   Source: Adapted from community discussion — survivalkit

   Next question

8. Question 1218 · 1459 in bank

   During a new system implementation, an IS auditor has been assigned to review risk management at each milestone. The auditor finds that several risks to project benefits have not been addressed. Who should be accountable for managing these risks?

   • AProject manager
   • BInformation security officer
   • CProject sponsor
   • DEnterprise risk manager

   Show answer

   Answer: C

   Explanation

   per CRM, Generally, a project sponsor assumes the overall ownership and accountability of the project and chairs the steering committee.

   Source: Adapted from community discussion — [Removed]

   Next question

9. Question 1219 · 1459 in bank

   Which of the following strategies BEST optimizes data storage without compromising data retention practices?

   • AAllowing employees to store large emails on flash drives
   • BAutomatically deleting emails older than one year
   • CMoving emails to a virtual email vault after 30 days
   • DLimiting the size of file attachments being sent via email

   Show answer

   Answer: C

   Explanation

   The emails are not deleted, but are moved to a separate storage area and this does not impact the performance of the primary email system. The other answers are either compromising or not significantly optimizing data storage

   Source: Adapted from community discussion — NotJamesCharles

   Next question

10. Question 1220 · 1459 in bank

    Which of the following will be the MOST effective method to verify that a service vendor keeps control levels as required by the client?

    • AObtain evidence of the vendor's control self-assessment (CSA).
    • BPeriodically review the service level agreement (SLA) with the vendor.
    • CConduct periodic on-site assessments using agreed-upon criteria.
    • DConduct an unannounced vulnerability assessment of vendor's IT systems.

    Show answer

    Answer: D

    Explanation

    isnt "service vendor" really another name for internet service provider. If you want to measure service providers, you use SLA's. So. B

    Source: Adapted from community discussion — ItsBananass

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISA practice, question 1211. 1459 questions available.