CISA practice questions 1,271–1,280

1. Question 1271 · 1459 in bank

   The FIRST step in auditing a data communication system is to determine:

   • Aphysical security for network equipment.
   • Bbusiness use and types of messages to be transmitted.
   • Ctraffic volumes and response-time criteria.
   • Dthe level of redundancy in the various communication paths.

   Show answer

   Answer: B

   Explanation

   B. business use and types of messages to be transmitted. When auditing a data communication system, the first step is typically to understand the business requirements and the types of messages or data that need to be transmitted. This involves assessing the needs of the organization and how data communication supports its goals and operations. Once you have a clear understanding of the business use and data types, you can then proceed with evaluating other aspects such as physical security, traffic volumes, redundancy, and other technical considerations.

   Source: Adapted from community discussion — SuperMax

   Next question

2. Question 1272 · 1459 in bank

   For the implementation of a program change in a production environment, the MOST important approval required is from:

   • Athe security administrator
   • Bthe project manager
   • Cuser management
   • DIS management

   Show answer

   Answer: C

   Explanation

   C. User management represents the stakeholders who will be directly impacted by the change, and their approval ensures that the change aligns with business & user requirements.

   Source: Adapted from community discussion — Rachy

   Next question

3. Question 1273 · 1459 in bank

   Which of the following activities provides an IS auditor with the MOST insight regarding potential single person dependencies that might exist within the organization?

   • AReviewing vacation patterns
   • BInterviewing senior IT management
   • CMapping IT processes to roles
   • DReviewing user activity logs

   Show answer

   Answer: C

   Explanation

   C. Mapping IT processes to roles: By mapping IT processes to specific roles, an IS auditor can identify if any process is overly reliant on a single individual, which can create a single point of failure or a dependency on that individual. If only one role or person is responsible for a critical task, and there is no backup, the organization is vulnerable to that person's absence.

   Source: Adapted from community discussion — babadook13

   Next question

4. Question 1274 · 1459 in bank

   During a vendor management database audit, an IS auditor identifies multiple instances of duplicate vendor records. In order to prevent recurrence of the same issue, which of the following is the IS auditor's BEST recommendation to management?

   • ARun system reports of full vendor listings periodically to identify duplication
   • BPerform system verification checks for unique data values on key fields
   • CRequest senior management approval of all new vendor details.
   • DBuild a segregation of duties control into the vendor creation process.

   Show answer

   Answer: B

   Explanation

   The IS auditor's BEST recommendation to prevent the recurrence of duplicate vendor records is option B: Perform system verification checks for unique data values on key field Option B, performing system verification checks for unique data values on key fields, is a preventive control. By ensuring that key fields used to identify vendors are unique, you can proactively prevent the creation of duplicate vendor records in the first place. This is the most effective way to address the issue and prevent its recurrence.

   Source: Adapted from community discussion — SuperMax

   Next question

5. Question 1275 · 1459 in bank

   Which of the following provides the BEST assurance that a new process for purging transactions does not have a detrimental impact on the integrity of the database?

   • AReviewing the entity relationship diagram of the database
   • BReviewing results of the process in a test environment
   • CAssessing the design of triggers
   • DAnalyzing the database structure

   Show answer

   Answer: B

   Next question

6. Question 1276 · 1459 in bank

   The MOST critical security weakness of a packet level firewall is that it can be circumvented by:

   • Adeciphering the signature information of the packets
   • Busing a dictionary attack of encrypted passwords
   • Cintercepting packets and viewing passwords sent in clear text
   • Dchanging the source address on incoming packets

   Show answer

   Answer: D

   Explanation

   The packet filtering type determines whether to allow packets to pass through to the internal network by referring to packet headers (information such as procotr, source and destination addresses, and port numbers). In other words, in the packet filtering type, access permission/denial is determined based on header information alone. Therefore, as long as the header information clears the access permission definition (policy), it is possible to enter the internal network even if there is unauthorized data in it.

   Source: Adapted from community discussion — Swallows

   Next question

7. Question 1277 · 1459 in bank

   Which of the following BEST enables alignment of IT with business objectives?

   • ABenchmarking against peer organizations
   • BCompleting an IT risk assessment
   • CDeveloping key performance indicators (KPIs)
   • DLeveraging an IT governance framework

   Show answer

   Answer: D

   Explanation

   https://www.itgovernance.co.uk/it_governance#:~:text=IT%20governance%20frameworks%20enable%20organisations,with%20their%20overall%20business%20objectives. IT governance frameworks enable organisations to manage their IT risks effectively and ensure that the activities associated with information and technology are aligned with their overall business objectives.

   Source: Adapted from community discussion — Kentakwong

   Next question

8. Question 1278 · 1459 in bank

   At the end of each business day, a business-critical application generates a report of financial transactions greater than a certain value, and an employee then checks these transactions for errors. What type of control is in place?

   • ADeterrent
   • BPreventive
   • CCorrective
   • DDetective

   Show answer

   Answer: D

   Next question

9. Question 1279 · 1459 in bank

   A data center’s physical access log system captures each visitor’s identification document numbers along with the visitor’s photo. Which of the following sampling methods would be MOST useful to an IS auditor conducting compliance testing for the effectiveness of the system?

   • AAttribute sampling
   • BQuota sampling
   • CVariable sampling
   • DHaphazard sampling

   Show answer

   Answer: A

   Next question

10. Question 1280 · 1459 in bank

    Which of the following metrics is the BEST indicator of the performance of a web application?

    • AServer thread count
    • BServer uptime
    • CHTTP server error rate
    • DAverage response time

    Show answer

    Answer: D

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISA practice, question 1271. 1459 questions available.