CISA practice questions 1,251–1,260

1. Question 1251 · 1459 in bank

   Which of the following occurs during the issues management process for a system development project?

   • AConfiguration management
   • BHelp desk management
   • CContingency planning
   • DImpact assessment

   Show answer

   Answer: D

   Explanation

   During the issues management process for a system development project, impact assessment occurs. Impact assessment involves evaluating the potential effects or consequences of identified issues or problems on the project's objectives, schedule, budget, resources, and stakeholders. This assessment helps project teams understand the severity and significance of issues and prioritize them for resolution. It also guides decision-making regarding appropriate corrective actions or mitigation strategies to address the identified issues and minimize their impact on the project's success.

   Source: Adapted from community discussion — Swallows

   Next question

2. Question 1252 · 1459 in bank

   An IS auditor has been asked to advise on measures to improve IT governance within the organization. Which of the following is the BEST recommendation?

   • AImplement annual third-party audits.
   • BRequire executive management to draft IT strategy.
   • CBenchmark organizational performance against industry peers.
   • DImplement key performance indicators (KPIs).

   Show answer

   Answer: D

   Next question

3. Question 1253 · 1459 in bank

   From an IS auditor's perspective, which of the following would be the GREATEST risk associated with an incomplete inventory of deployed software in an organization?

   • AInability to determine the cost of deployed software
   • BInability to close unused ports on critical servers
   • CInability to identify unused licenses within the organization
   • DInability to deploy updated security patches

   Show answer

   Answer: D

   Explanation

   D. Inability to deploy updated security patches. From an IS auditor's perspective, an incomplete inventory of deployed software in an organization poses several risks. However, the greatest risk is the inability to deploy updated security patches. When an organization does not have a complete inventory of its deployed software, it becomes difficult to determine which systems are running specific software applications and therefore, which systems need to be updated with the latest security patches. This can leave the organization vulnerable to security threats and attacks, as attackers can exploit known vulnerabilities in the software that have already been patched by the software vendors. To mitigate this risk, IS auditors would recommend that the organization maintain an up-to-date inventory of its deployed software and regularly deploy security patches to all applicable systems.

   Source: Adapted from community discussion — TEC1

   Next question

4. Question 1254 · 1459 in bank

   An IS auditor finds that firewalls are outdated and not supported by vendors. Which of the following should be the auditor's NEXT course of action?

   • AReport the security posture of the organization.
   • BDetermine the risk of not replacing the firewall.
   • CReport the mitigating controls.
   • DDetermine the value of the firewall.

   Show answer

   Answer: B

   Next question

5. Question 1255 · 1459 in bank

   A third-party consultant is managing the replacement of an accounting system. Which of the following should be the IS auditor's GREATEST concern?

   • AThe replacement is occurring near year-end reporting.
   • BData migration is not part of the contracted activities.
   • CTesting was performed by the third-party consultant.
   • DThe user department will manage access rights.

   Show answer

   Answer: B

   Explanation

   ata migration is a critical aspect of system replacement projects, especially for accounting systems where accurate and complete historical data is essential for financial reporting and auditing purposes. If data migration is not included in the contracted activities, there is a significant risk that important data could be overlooked, lost, or incorrectly transferred. This could lead to inaccuracies in financial reporting, compliance issues, and operational disruptions.

   Source: Adapted from community discussion — Swallows

   Next question

6. Question 1256 · 1459 in bank

   During which process is regression testing MOST commonly used?

   • AUnit testing
   • BSystem modification
   • CStress testing
   • DProgram development

   Show answer

   Answer: B

   Explanation

   Its B. Regression testing seeks for changes or corrections in the program have not introduced any new errors. It's obviously not during A. unit testing / C. stress testing nor D. program development. The answer D is at the beginning stages of SDLC whereas regression testing is near the end.

   Source: Adapted from community discussion — starzuu

   Next question

7. Question 1257 · 1459 in bank

   Which of the following techniques provides the BEST assurance of server availability over time?

   • AAnalyzing logs in the server administration console
   • BReviewing reported downtime from users
   • CEvaluating downtime based on planned outages
   • DManually pinging the server on a daily basis

   Show answer

   Answer: A

   Explanation

   I think should be C. Evaluating downtime based on planned outages is one of the most effective techniques for assessing server availability over time. By considering scheduled maintenance, planned upgrades, and other planned outages, the organization can gain a more accurate understanding of the server's availability and performance.

   Source: Adapted from community discussion — JONESKA

   Next question

8. Question 1258 · 1459 in bank

   Which of the following is the BEST approach for determining the overall IT risk appetite of an organization when business units use different methods for managing IT risks?

   • AAverage the business units' IT risk levels.
   • BIdentify the highest-rated IT risk level among the business units.
   • CEstablish a global IT risk scoring criteria.
   • DPrioritize the organization's IT risk scenarios.

   Show answer

   Answer: C

   Next question

9. Question 1259 · 1459 in bank

   In data warehouse (DW) management, what is the BEST way to prevent data quality issues caused by changes from a source system?

   • ARestrict access to changes in the extract/transfer/load (ETL) process between the two systems
   • BInclude the data warehouse m the impact analysis for any changes in the source system
   • CConfigure data quality alerts to check variances between the data warehouse and the source system
   • DRequire approval for changes in the extract/transfer/load (ETL) process between the two systems

   Show answer

   Answer: B

   Explanation

   This approach ensures that any changes made to the source system are thoroughly analyzed for their potential impact on the data warehouse. By including the data warehouse in the impact analysis process, stakeholders can assess how changes might affect data integrity, structure, or quality within the DW environment. It allows for proactive measures to be taken to mitigate potential risks and maintain data quality standards.

   Source: Adapted from community discussion — Swallows

   Next question

10. Question 1260 · 1459 in bank

    Which of the following audit procedures would be MOST conclusive in evaluating the effectiveness of on e-commerce application system's edit routine?

    • AReview of program documentation
    • BReview of source code
    • CUse of test transactions
    • DInterviews with knowledgeable users

    Show answer

    Answer: B

    Explanation

    Answer B Using test transactions (option C) can indeed be an effective audit procedure for evaluating the effectiveness of an e-commerce application system's edit routine. By executing test transactions with various types of data, auditors can assess how well the edit routine functions in detecting and handling different scenarios, such as invalid inputs, out-of-range values, or inconsistent data. This approach allows auditors to directly observe the behavior of the edit routine in action and identify any potential weaknesses or deficiencies. However, while test transactions provide valuable insights into the system's functionality, they may not always be the MOST conclusive audit procedure on their own. Other audit procedures, such as reviewing program documentation (option A) or reviewing source code (option B), can provide additional details about the design, implementation, and logic of the edit routine, which may complement the insights gained from test transactions

    Source: Adapted from community discussion — a84n

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISA practice, question 1251. 1459 questions available.