CISA practice questions 1,231–1,240

1. Question 1231 · 1459 in bank

   An organization's software developers need access to personally identifiable information (PII) stored in a particular data format. Which of the following is the BEST way to protect this sensitive information while allowing the developers to use it in development and test environments?

   • AData masking
   • BData encryption
   • CData tokenization
   • DData abstraction

   Show answer

   Answer: A

   Explanation

   It is C. Data tokenization: Data tokenization involves replacing sensitive data with a token or placeholder value while storing the original data securely elsewhere. This allows developers to work with realistic data without exposing the actual sensitive information. Tokenization maintains data integrity and security while allowing authorized users to use the data in development and test environments. It's a widely adopted method for protecting sensitive information while preserving usability.

   Source: Adapted from community discussion — Binagr8

   Next question

2. Question 1232 · 1459 in bank

   Which of the following is the BEST evidence that an organization's IT strategy is aligned to its business objectives?

   • AThe IT strategy has significant impact on the business strategy.
   • BThe IT strategy is modified in response to organizational changes.
   • CThe IT strategy is based on IT operational best practices.
   • DThe IT strategy is approved by executive management.

   Show answer

   Answer: A

   Explanation

   While the modification of the IT strategy in response to organizational changes (option B) may also indicate alignment to some extent, it does not necessarily guarantee that the IT strategy is directly impacting the business strategy. Option A explicitly states that the IT strategy has a significant impact on the business strategy, making it the best evidence of alignment between IT and business objectives.

   Source: Adapted from community discussion — Swallows

   Next question

3. Question 1233 · 1459 in bank

   Which of the following is the BEST method to safeguard data on an organization's laptop computers?

   • ATwo-factor authentication
   • BFull disk encryption
   • CDisabled USB ports
   • DBiometric access control

   Show answer

   Answer: B

   Next question

4. Question 1234 · 1459 in bank

   Which of the following is MOST important to determine during the planning phase of a cloud-based messaging and collaboration platform acquisition?

   • AProcesses for on-boarding and off-boarding users to the platform
   • BProcesses for reviewing administrator activity
   • CTypes of data that can be uploaded to the platform
   • DRole-based access control policies

   Show answer

   Answer: C

   Explanation

   I think it should be "C. Types of data that can be uploaded to the platform". First to determine what data should be uploaded then decide the role based control identified by the data owner.

   Source: Adapted from community discussion — Hiteshaidasani

   Next question

5. Question 1235 · 1459 in bank

   A new regulation requires organizations to report significant security incidents to the regulator within 24 hours of identification. Which of the following is the IS auditor's BEST recommendation to facilitate compliance with the regulation?

   • AInclude the requirement in the incident management response plan.
   • BEnhance the alert functionality of the intrusion detection system (IDS).
   • CEngage an external security incident response expert for incident handling.
   • DEstablish key performance indicators (KPIs) for timely identification of security incidents.

   Show answer

   Answer: A

   Next question

6. Question 1236 · 1459 in bank

   A finance group recently implemented new technologies and processes. Which type of IS audit would provide the GREATEST level of assurance that the department's objectives have been met?

   • AFinancial audit
   • BPerformance audit
   • CIntegrated audit
   • DCyber audit

   Show answer

   Answer: C

   Explanation

   Given that the finance group has implemented new technologies and processes, an integrated audit is the most suitable choice because it will assess both the financial and IT aspects of these changes, ensuring that the department's objectives are being met in a controlled and compliant manner.

   Source: Adapted from community discussion — KAP2HURUF

   Next question

7. Question 1237 · 1459 in bank

   Which of the following would BEST help to support an auditor's conclusion about the effectiveness of an implemented data classification program?

   • AAccess rights provisioned according to scheme
   • BDetailed data classification scheme
   • CPurchase of information management tools
   • DBusiness use cases and scenarios

   Show answer

   Answer: D

   Next question

8. Question 1238 · 1459 in bank

   The PRIMARY focus of a post-implementation review is to verify that:

   • Aenterprise architecture (EA) has been complied with.
   • Buser requirements have been met.
   • Cacceptance testing has been properly executed.
   • Duser access controls have been adequately designed.

   Show answer

   Answer: B

   Next question

9. Question 1239 · 1459 in bank

   An IS auditor notes that not all security tests were completed for an online sales system recently promoted to production. Which of the following is the auditor's BEST course of action?

   • ADetermine exposure to the business.
   • BIncrease monitoring for security incidents.
   • CHire a third party to perform security testing.
   • DAdjust future testing activities accordingly.

   Show answer

   Answer: A

   Next question

10. Question 1240 · 1459 in bank

    An auditee disagrees with a recommendation for corrective action that appears in the draft engagement report. Which of the following is the IS auditor's BEST course of action when preparing the final report?

    • ACome to an agreement prior to issuing the final report.
    • BEnsure the auditee's comments are included in the working papers.
    • CExclude the disputed recommendation from the final engagement report.
    • DInclude the position supported by senior management in the final engagement report.

    Show answer

    Answer: A

    Explanation

    Option A is the correct answer. The IS auditor should work with the auditee to understand their objections and seek to reach an agreement that is satisfactory to both parties. The final engagement report should reflect the agreed-upon findings and recommendations, along with any necessary modifications or clarifications. Options B, C, and D are not appropriate in this scenario. Ensuring the auditee's comments are included in the working papers is important, but it does not address the issue of the disputed recommendation in the final report. Excluding the disputed recommendation from the final engagement report may compromise the integrity and completeness of the audit findings. Including the position supported by senior management in the final engagement report may be inappropriate and compromise the independence and objectivity of the audit function.

    Source: Adapted from community discussion — SRJ13

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISA practice, question 1231. 1459 questions available.