CISA practice questions 1,241–1,250

1. Question 1241 · 1459 in bank

   Which of the following should an IS auditor ensure is classified at the HIGHEST level of sensitivity?

   • AEmergency change records
   • BPenetration test results
   • CIT security incidents
   • DServer room access history

   Show answer

   Answer: B

   Explanation

   Penetration test results typically contain detailed information about vulnerabilities and weaknesses in an organization's systems, networks, and applications. This information is highly sensitive as it could potentially be exploited by malicious actors to compromise the organization's security. Therefore, penetration test results should be classified at the highest level of sensitivity to ensure proper protection and restricted access to authorized personnel only.

   Source: Adapted from community discussion — Swallows

   Next question

2. Question 1242 · 1459 in bank

   Which of the following is the MOST important reason to classify a disaster recovery plan (DRP) as confidential?

   • AEnsure compliance with the data classification policy.
   • BReduce the risk of data leakage that could lead to an attack.
   • CComply with business continuity best practice.
   • DProtect the plan from unauthorized alteration.

   Show answer

   Answer: B

   Next question

3. Question 1243 · 1459 in bank

   A company has implemented an IT segregation of duties policy. In a role-based environment, which of the following roles may be assigned to an application developer?

   • AEmergency support
   • BSystem administration
   • CIT operator
   • DDatabase administration

   Show answer

   Answer: A

   Explanation

   In a role-based environment with an IT segregation of duties policy, an application developer (Option A) may be assigned the role of emergency support. This involves providing support and troubleshooting assistance during unexpected outages or other incidents that impact the availability of the IT systems. The role of emergency support typically requires a good understanding of the application and the underlying infrastructure, which an application developer is likely to have. The roles of system administration (Option B), IT operator (Option C), and database administration (Option D) typically involve tasks such as configuring, maintaining, and monitoring IT systems, and may require access to sensitive information or critical systems. These roles are typically separated from the role of application development to ensure that the segregation of duties policy is maintained and that critical IT functions are performed by different individuals.

   Source: Adapted from community discussion — TEC1

   Next question

4. Question 1244 · 1459 in bank

   Which of the following is the MOST effective way to identify exfiltration of sensitive data by a malicious insider?

   • AProvide ongoing information security awareness training.
   • BEstablish behavioral analytics monitoring.
   • CReview perimeter firewall logs.
   • DImplement data loss prevention (DLP) software

   Show answer

   Answer: B

   Explanation

   the question focuses in identifying the malicious insider..option B seems the right answer as option D is more about prevention of exfiltration

   Source: Adapted from community discussion — PurpleParrot

   Next question

5. Question 1245 · 1459 in bank

   What is the PRIMARY purpose of documenting audit objectives when preparing for an engagement?

   • ATo identify areas with relatively high probability of material problems
   • BTo help ensure maximum use of audit resources during the engagement
   • CTo help prioritize and schedule auditee meetings
   • DTo address the overall risk associated with the activity under review

   Show answer

   Answer: C

   Explanation

   D. To address the overall risk associated with the activity under review: Documenting audit objectives helps in focusing the audit on areas where risks are highest, ensuring that the audit addresses significant risks that could impact the organization. By clearly defining the objectives, auditors can systematically assess and mitigate the most critical risks associated with the activity under review. This risk-focused approach ensures that the audit is relevant and effective in providing assurance over the key risk areas.

   Source: Adapted from community discussion — Binagr8

   Next question

6. Question 1246 · 1459 in bank

   Which of the following should be the IS auditor's PRIMARY focus when evaluating an organization's offsite storage facility?

   • AAdequacy of physical and environmental controls
   • BResults of business continuity plan (BCP) tests
   • CShared facilities
   • DRetention policy and period

   Show answer

   Answer: A

   Explanation

   Answer A offsite storage facility plays a crucial role in supporting the organization's BCP by providing secure storage for backup data and critical records, the primary focus when evaluating the facility is on assessing the adequacy of physical and environmental controls to safeguard the stored assets. This includes factors such as access controls, surveillance, environmental conditions, and protection against threats like theft, fire, and natural disasters.

   Source: Adapted from community discussion — a84n

   Next question

7. Question 1247 · 1459 in bank

   Which of the following BEST protects an organization's proprietary code during a joint-development activity involving a third party?

   • APrivacy agreement
   • BStatement of work (SOW)
   • CNondisclosure agreement (NDA)
   • DService level agreement (SLA)

   Show answer

   Answer: C

   Explanation

   C, A nondisclosure agreement (NDA) is a legal contract between parties that establishes confidentiality obligations and restricts the disclosure or use of confidential information.

   Source: Adapted from community discussion — Changwha

   Next question

8. Question 1248 · 1459 in bank

   What is the GREATEST concern for an IS auditor reviewing contracts for licensed software that executes a critical business process?

   • AAn operational level agreement (OLA) was not negotiated.
   • BSoftware escrow was not negotiated.
   • CThe contract does not contain a right-to-audit clause.
   • DSeveral vendor deliverables missed the commitment date.

   Show answer

   Answer: C

   Explanation

   A right-to-audit clause allows the organization to conduct audits of the software vendor's performance, including verifying compliance with licensing terms, security standards, and service level agreements. For software that executes critical business processes, ensuring compliance with licensing terms and the reliability of the software is paramount. Without a right-to-audit clause, the organization may lack the ability to verify the vendor's performance, potentially exposing it to risks such as non-compliance, security vulnerabilities, or service disruptions. While software escrow (option B) is also important for mitigating risks associated with vendor non-performance, the absence of a right-to-audit clause presents a more significant concern as it directly impacts the organization's ability to verify and enforce contractual obligations and ensure the integrity of critical business processes.

   Source: Adapted from community discussion — Swallows

   Next question

9. Question 1249 · 1459 in bank

   An IS auditor would MOST likely recommend that IT management use a balanced scorecard to:

   • Aassess IT functions and processes.
   • Bindicate whether the organization meets quality standards.
   • Ctrain and educate IT staff.
   • Densure that IT staff meet performance requirements.

   Show answer

   Answer: A

   Explanation

   A balanced scorecard is a strategic planning and management system used to align business activities to the vision and strategy of the organization. In the context of IT, an IS auditor would recommend the use of a balanced scorecard to assess IT functions and processes because it provides a comprehensive view of IT performance by considering multiple perspectives, such as financial, customer, internal processes, and learning and growth. This allows IT management to assess the overall effectiveness of IT functions and processes in supporting the achievement of the organization's goals and objectives, and identify areas for improvement.

   Source: Adapted from community discussion — TEC1

   Next question

10. Question 1250 · 1459 in bank

    Which of the following would be the BEST process for continuous auditing in a large financial institution?

    • AValidating performance of help desk metrics
    • BTesting encryption standards on the disaster recovery system
    • CPerforming parallel testing between systems
    • DValidating access controls for real time data systems

    Show answer

    Answer: D

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISA practice, question 1241. 1459 questions available.