CISA practice questions 1,281–1,290

1. Question 1281 · 1459 in bank

   Which of the following methods would BEST ensure that IT strategy is in line with business strategy?

   • ABreak-even point analysis
   • BBusiness impact analysis (BIA)
   • CCritical path analysis
   • DIT value analysis

   Show answer

   Answer: D

   Explanation

   Value analysis can help organizations to: Identify the critical success factors of the business, which can help in prioritizing IT investments that are most aligned with the business goals. Assess the value of IT investments in terms of the benefits they provide to the organization and their costs. Determine the potential impact of IT investments on the organization's processes and operations. Identify opportunities to improve the value of IT investments by reducing their costs or improving their benefits.

   Source: Adapted from community discussion — 3008

   Next question

2. Question 1282 · 1459 in bank

   Which of the following has the GREATEST potential impact on the independence of an IS auditor?

   • APrior experience in IS audit
   • BPrior relationship with vendors
   • CPrior knowledge of technology
   • DPrior job responsibilities

   Show answer

   Answer: B

   Explanation

   B. Prior relationship with vendors The greatest potential impact on the independence of an IS auditor among the options listed is having a prior relationship with vendors. Independence is a critical concept in auditing, as it ensures that auditors can objectively assess the systems, processes, and controls they are evaluating without being influenced by personal or financial interests. Having a prior relationship with vendors can compromise an auditor's independence because it may create conflicts of interest. While the other options (prior experience in IS audit, prior knowledge of technology, and prior job responsibilities) can also influence an auditor's perspective, they do not inherently create conflicts of interest in the same way that a prior relationship with vendors can. Independence is a fundamental principle in auditing, and auditors must strive to maintain it to ensure the integrity of their work.

   Source: Adapted from community discussion — SuperMax

   Next question

3. Question 1283 · 1459 in bank

   Which of the following should an IS auditor do FIRST when assessing the level of compliance for an organization in the banking industry?

   • AReview internal documentation to evaluate adherence to external requirements.
   • BConfirm there are procedures in place to ensure organizational agreements address legal requirements
   • CDetermine whether the organization has established benchmarks against industry peers for compliance.
   • DIdentify industry-specific requirements that apply to the organization.

   Show answer

   Answer: D

   Next question

4. Question 1284 · 1459 in bank

   Who is PRIMARILY responsible for the design of IT controls to meet control objectives?

   • AIT manager
   • BInternal auditor
   • CBusiness management
   • DRisk management

   Show answer

   Answer: C

   Explanation

   C. Business management is primarily responsible for the design of IT controls to meet control objectives. IT controls are designed to mitigate the risks associated with IT systems and ensure that they operate effectively and efficiently. The responsibility for designing and implementing IT controls lies with the business management responsible for the system in question. Business management should identify the risks associated with the IT system and design IT controls to address those risks. IT managers are responsible for managing the IT system but may not have the necessary understanding of business objectives and risks to design effective IT controls. Internal auditors may review and assess the effectiveness of IT controls but are not responsible for designing them. Risk management may identify and assess risks, but it is ultimately the responsibility of business management to design controls to address those risks.

   Source: Adapted from community discussion — TEC1

   Next question

5. Question 1285 · 1459 in bank

   Which of the following risk scenarios is BEST addressed by implementing policies and procedures related to full disk encryption?

   • AData leakage as a result of employees leaving to work for competitors
   • BPhysical theft of media on which information is stored
   • CUnauthorized logical access to information through an application interface
   • DNoncompliance fines related to storage of regulated information

   Show answer

   Answer: B

   Explanation

   Full disk encryption is a security control that protects data stored on devices such as laptops, desktops, and servers by encrypting the entire hard disk. If a device is stolen or lost, the encrypted data on the disk cannot be accessed without the appropriate decryption key or password. Physical theft of media on which information is stored is a common threat to the confidentiality and integrity of organizational data. By implementing policies and procedures related to full disk encryption, organizations can prevent unauthorized access to sensitive data in the event of a physical theft of a device containing the data. While policies and procedures related to full disk encryption may help prevent other risk scenarios, such as data leakage and unauthorized logical access, other security controls, such as access controls and data loss prevention, are better suited to address these scenarios. Policies and procedures related to full disk encryption are typically implemented to address the risk of physical theft of media on which information is stored.

   Source: Adapted from community discussion — SRJ13

   Next question

6. Question 1286 · 1459 in bank

   Which of the following is the BEST indication to an IS auditor that management's post-implementation review was effective?

   • AInternal audit follow-up was completed without any findings.
   • BLessons learned were documented and applied.
   • CPost-implementation review is a formal phase in the system development life cycle (SDLC).
   • DBusiness and IT stakeholders participated in the post-implementation review.

   Show answer

   Answer: B

   Explanation

   B. Lessons learned were documented and applied. This option indicates that not only were lessons learned during the post-implementation review process, but they were also documented and put into practice. This demonstrates that the review was not just a procedural formality but had a meaningful impact on improving processes and systems. It implies that the organization is committed to continuous improvement and learning from past experiences, which is a key aspect of effective post-implementation reviews.

   Source: Adapted from community discussion — SuperMax

   Next question

7. Question 1287 · 1459 in bank

   An IS auditor suspects an organization's computer may have been used to commit a crime. Which of the following is the auditor's BEST course of action?

   • AContact the incident response team to conduct an investigation.
   • BAdvise management of the crime after the investigation.
   • CExamine the computer to search for evidence supporting the suspicions.
   • DNotify local law enforcement of the potential crime before further investigation.

   Show answer

   Answer: A

   Explanation

   For me, A is indeed correct. The auditor is not a forensic expert. Examining the computer directly may compromise key evidence.

   Source: Adapted from community discussion — oldmagic

   Next question

8. Question 1288 · 1459 in bank

   When designing a data analytics process, which of the following should be the stakeholder's role in automating data extraction and validation?

   • AAllocating the resources necessary to purchase the appropriate software packages
   • BIndicating which data elements are necessary to make informed decisions
   • CDesigning the workflow necessary for the data analytics tool to evaluate the appropriate data
   • DPerforming the business case analysis for the data analytics initiative

   Show answer

   Answer: D

   Explanation

   D. Performing the business case analysis for the data analytics initiative: This is an important role for stakeholders who are responsible for justifying and aligning the data analytics initiative with the organization's strategic goals. Executives and business leaders often perform the business case analysis. So, in the context of automating data extraction and validation: Option B ("Indicating which data elements are necessary to make informed decisions") is directly related to defining the data requirements, which is essential for automation. Option C ("Designing the workflow necessary for the data analytics tool to evaluate the appropriate data") is relevant for the technical implementation of automation. Option A ("Allocating the resources necessary to purchase the appropriate software packages") and Option D ("Performing the business case analysis for the data analytics initiative") are important but may not be directly tied to the automation of data extraction and validation.

   Source: Adapted from community discussion — SuperMax

   Next question

9. Question 1289 · 1459 in bank

   An organization has an acceptable use policy in place, but users do not formally acknowledge the policy. Which of the following is the MOST significant risk from this finding?

   • AViolation of industry standards
   • BLack of data for measuring compliance
   • CNoncompliance with documentation requirements
   • DLack of user accountability

   Show answer

   Answer: D

   Explanation

   The MOST significant risk from the finding that users do not formally acknowledge the acceptable use policy is: D. Lack of user accountability When users do not formally acknowledge the acceptable use policy, it becomes difficult to hold them accountable for their actions. This means that users may not be fully aware of the rules and guidelines outlined in the policy, and they may not feel responsible for adhering to it. This lack of accountability can lead to a wide range of security and compliance issues, including data breaches, misuse of resources, and violations of the policy itself. It also makes it challenging to enforce consequences for policy violations. Therefore, the lack of user accountability is the most significant risk in this scenario.

   Source: Adapted from community discussion — SuperMax

   Next question

10. Question 1290 · 1459 in bank

    Data from a system of sensors located outside of a network is received by the open ports on a server. Which of the following is the BEST way to ensure the integrity of the data being collected from the sensor system?

    • AImplement network address translation on the sensor system
    • BRoute the traffic from the sensor system through a proxy server.
    • CTransmit the sensor data via a virtual private network (VPN) to the server
    • DHash the data that is transmitted from the sensor system

    Show answer

    Answer: D

    Explanation

    The BEST way to ensure the integrity of the data being collected from the sensor system is option D: Hash the data that is transmitted from the sensor system. Here's why: D. Hashing the data that is transmitted from the sensor system is a fundamental technique for ensuring data integrity. By hashing the data at the source and verifying the hash on the receiving end, you can detect any changes or tampering with the data during transit. If the hash values match, you can be reasonably certain that the data hasn't been altered in transit. In summary, while options B and C can enhance security, they don't directly ensure data integrity. Option A is more about network address management. Option D, hashing the data, is the most appropriate choice to verify data integrity.

    Source: Adapted from community discussion — SuperMax

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISA practice, question 1281. 1459 questions available.