CISA practice questions 1,221–1,230

1. Question 1221 · 1459 in bank

   An IS auditor is reviewing the maturity of a large organization's IT governance. Which of the following BEST demonstrates that IT governance has been effectively implemented?

   • AThe board reviews compliance with legal and regulatory requirements.
   • BThe board monitors adherence to the organization's information security policy.
   • CThe board reviews strategic IT key performance indicators (KPIs).
   • DThe board approves necessary resources for IT security reviews.

   Show answer

   Answer: C

   Explanation

   Option C stands out as the BEST demonstration of effective IT governance because strategic IT KPIs provide insights into the organization's IT performance, alignment with business objectives, and value delivery. When the board reviews and assesses strategic IT KPIs, it indicates a holistic understanding of IT's contribution to the organization's success and reflects the successful implementation of IT governance practices.

   Source: Adapted from community discussion — JONESKA

   Next question

2. Question 1222 · 1459 in bank

   An IS auditor is reviewing an organization's primary router access control list. Which of the following should result in a finding?

   • AThere are conflicting permit and deny rules for the IT group.
   • BThere is only one rule per group with access privileges.
   • CIndividual permissions are overriding group permissions.
   • DThe network security group can change network address translation (NAT).

   Show answer

   Answer: A

   Explanation

   A. There are conflicting permit and deny rules for the IT group. Conflicting permit and deny rules for the IT group in the primary router's access control list would be considered a finding during the IS auditor's review. Access control lists (ACLs) are used to control network traffic and determine which packets are allowed or denied based on specified criteria. Conflicting rules for the same group could lead to inconsistent and unpredictable access permissions, potentially resulting in unauthorized access or unintended restrictions. Option C, individual permissions overriding group permissions, might not be a finding in itself as it can be a deliberate configuration choice. However, it could be a concern if the individual permissions are not adequately controlled or documented.

   Source: Adapted from community discussion — cybervds

   Next question

3. Question 1223 · 1459 in bank

   Which of the following is the GREATEST risk of using a reciprocal site for disaster recovery?

   • AInability to utilize the site when required
   • BInability to test the recovery plans onsite
   • CMismatched organizational security policies
   • DEquipment compatibility issues at the site

   Show answer

   Answer: A

   Explanation

   The primary purpose of a reciprocal site for disaster recovery is to serve as a backup location to resume critical business operations in the event of a disaster. If the site cannot be accessed or utilized when needed due to various factors such as technical issues, contractual disputes, or resource constraints, the organization may face significant challenges in recovering from the disaster. This can lead to prolonged downtime, loss of revenue, damage to reputation, and potentially even business failure. Therefore, the inability to utilize the site when required represents the greatest risk to the effectiveness of the organization's disaster recovery strategy.

   Source: Adapted from community discussion — Swallows

   Next question

4. Question 1224 · 1459 in bank

   Which of the following BEST enables the timely identification of risk exposure?

   • AControl self-assessment (CSA)
   • BInternal audit review
   • CStress testing
   • DExternal audit review

   Show answer

   Answer: A

   Next question

5. Question 1225 · 1459 in bank

   Which of the following is the PRIMARY basis on which audit objectives are established?

   • AAudit risk
   • BConsideration of risks
   • CAssessment of prior audits
   • DBusiness strategy

   Show answer

   Answer: B

   Explanation

   The primary basis for setting audit objectives is the consideration of risk. This includes the identification and assessment of risks that may prevent the organization from achieving its goals.

   Source: Adapted from community discussion — Swallows

   Next question

6. Question 1226 · 1459 in bank

   When an IS audit reveals that a firewall was unable to recognize a number of attack attempts, the auditor's BEST recommendation is to place an intrusion detection system (IDS) between the firewall and:

   • Athe organization's web server.
   • Bthe demilitarized zone (DMZ).
   • Cthe Internet.
   • Dthe organization's network.

   Show answer

   Answer: C

   Explanation

   Correction - D is the correct answer since firewall is unable to recognize the attack attempts, IDS should be placed between the firewall and organization's network so as to alert the organization about such threats. Placing IDS between internet and firewall in this case will lead to attack attempts recognized by the IDS but allowed by the firewall

   Source: Adapted from community discussion — [Removed]

   Next question

7. Question 1227 · 1459 in bank

   An organization with many desktop PCs is considering moving to a thin client architecture. Which of the following is the MAJOR advantage?

   • AAdministrative security can be provided for the client.
   • BSystem administration can be better managed.
   • CThe security of the desktop PC is enhanced.
   • DDesktop application software will never have to be upgraded.

   Show answer

   Answer: B

   Explanation

   The advantage of option D, "No need to upgrade desktop application software," is not directly relevant to the thin-client transition. Application software still needs to be upgraded in a thin-client environment, and software updates are required just like on a regular desktop. Therefore, the primary advantages of a thin-client architecture are more efficient system management and enhanced security.

   Source: Adapted from community discussion — Swallows

   Next question

8. Question 1228 · 1459 in bank

   Which of the following is MOST important for an IS auditor to look for in a project feasibility study?

   • AAn assessment indicating the benefits will exceed the investment
   • BAn assessment indicating security controls will operate effectively
   • CAn assessment of whether the expected benefits can be achieved
   • DAn assessment of whether requirements will be fully met

   Show answer

   Answer: C

   Explanation

   A. An assessment indicating the benefits will exceed the investment is important, but it is more of a financial justification rather than a comprehensive feasibility check. While it is critical to demonstrate that the benefits exceed the investment (often referred to as a cost-benefit analysis), this alone does not guarantee that the project is feasible. A project can have a favorable cost-benefit ratio but still fail due to practical issues, such as technical challenges, resource limitations, or unrealistic timelines.

   Source: Adapted from community discussion — KAP2HURUF

   Next question

9. Question 1229 · 1459 in bank

   Which of the following would MOST effectively help to reduce the number of repeated incidents in an organization?

   • ALinking incidents to problem management activities
   • BTraining incident management teams on current incident trends
   • CPrioritizing incidents after impact assessment
   • DTesting incident response plans with a wide range of scenarios

   Show answer

   Answer: A

   Explanation

   Should be A. Problem management is the process of identifying the underlying causes of incidents and finding permanent solutions to prevent them from recurring. By linking incidents to problem management activities, the organization can identify patterns, root causes, and trends that contribute to repeated incidents. This approach allows for a deeper understanding of the underlying issues and enables the implementation of long-term solutions to prevent similar incidents from happening again in the future.

   Source: Adapted from community discussion — JONESKA

   Next question

10. Question 1230 · 1459 in bank

    An IS auditor is following up on prior period items and finds management did not address an audit finding. Which of the following should be the IS auditor's NEXT course of action?

    • ANote the exception in a new report as the item was not addressed by management.
    • BInterview management to determine why the finding was not addressed.
    • CRecommend alternative solutions to address the repeat finding.
    • DConduct a risk assessment of the repeat finding.

    Show answer

    Answer: B

    Explanation

    the answer wasnt consistent in my point of view, there had one and requires for assessing the risk but this one asked reaching the management team.

    Source: Adapted from community discussion — Eric0223

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISA practice, question 1221. 1459 questions available.