CISA practice questions 1,291–1,300

1. Question 1291 · 1459 in bank

   The PRIMARY benefit of a risk-based audit methodology is to:

   • Aidentify key controls
   • Bunderstand business processes
   • Creduce audit scope
   • Dprioritize audit resources

   Show answer

   Answer: D

   Explanation

   D. prioritize audit resources A risk-based audit methodology involves assessing and prioritizing risks within an organization's processes and operations. By doing so, it allows audit teams to allocate their limited resources to areas where the greatest risks exist. This helps ensure that the audit focuses on the most critical areas that have the potential for significant financial, operational, or compliance impact. While identifying key controls and understanding business processes are important aspects of a risk-based audit, the primary goal is to prioritize audit resources effectively based on the level of risk.

   Source: Adapted from community discussion — SuperMax

   Next question

2. Question 1292 · 1459 in bank

   A bank’s transactional services are exclusively conducted online via Internet and mobile banking. Both its primary and disaster recovery sites are supported by the same Internet service provider (ISP). Which of the following is the BEST way for the bank to minimize risk in this situation?

   • AConduct incremental backups of transactional data every two hours.
   • BConduct real-time data synchronization between the primary and disaster recovery sites.
   • CRevise the current contract to require 99.99% connection availability with the current ISP.
   • DEstablish a contractual agreement with a second ISP to cover connection to the disaster recovery site

   Show answer

   Answer: D

   Explanation

   Because C: may help to reduce the risk of downtime due to network outages, but it does not address the issue of a single point of failure.

   Source: Adapted from community discussion — 007Georgeo

   Next question

3. Question 1293 · 1459 in bank

   An IS auditor notes that a mortgage origination team receives customer loan applications via a shared repository. Which of the following findings presents the GREATEST privacy risk for this process?

   • AShared repository lacks dual access controls
   • BCustomer data is not updated in the origination system
   • CLoan documentation is not purged from the system
   • DDuplicate loan applications are not flagged for attention

   Show answer

   Answer: A

   Next question

4. Question 1294 · 1459 in bank

   An IS auditor previously worked in an organization’s IT department and was involved with the design of the business continuity plan (BCP). The IS auditor has now been asked to review this same BCP. What should the auditor do FIRST?

   • ADocument the conflict in the audit report.
   • BReport the conflict of interest to the chief compliance officer.
   • CCommunicate the conflict of interest to the audit manager.
   • DDecline the audit assignment.

   Show answer

   Answer: C

   Explanation

   C. Communicate the conflict of interest to the audit manager. It is essential for auditors to be transparent about any potential conflicts of interest. By communicating this conflict to the audit manager, the auditor is taking the necessary step to disclose the situation. The audit manager can assess the nature and extent of the conflict. They can determine whether the auditor's previous involvement in the BCP design poses a real or perceived bias in the audit process. The audit manager, after evaluating the situation, can make an informed decision about how to proceed. This may involve measures to mitigate the conflict, such as assigning the audit to a different auditor or implementing additional review processes to ensure objectivity.

   Source: Adapted from community discussion — SuperMax

   Next question

5. Question 1295 · 1459 in bank

   Which of the following is MOST important when evaluating the design effectiveness of multi-factor authentication?

   • AReviewing the physical controls related to the storage of the hardware tokens
   • BEnsuring segregation is maintained by storing the two factors in separate databases
   • CDetermining the identification process for each factor and ensuring they are synchronized
   • DEvaluating whether false rejection and false acceptance rates have been adequately defined

   Show answer

   Answer: C

   Explanation

   C. Determining the identification process for each factor and ensuring they are synchronized. Multi-factor authentication relies on the combination of multiple authentication factors to enhance security. It is crucial that these factors are synchronized and work seamlessly together to provide the intended security benefits. If the identification processes for each factor are not well-defined or are not synchronized properly, it can lead to vulnerabilities or authentication issues. While the other options are also important aspects of MFA design, such as reviewing physical controls and ensuring segregation of factors, ensuring synchronization of the identification processes is fundamental to the overall security and effectiveness of the MFA system. Option D, evaluating false rejection and false acceptance rates, is important for assessing the usability and reliability of the MFA system but is not as critical as ensuring the proper synchronization of factors.

   Source: Adapted from community discussion — SuperMax

   Next question

6. Question 1296 · 1459 in bank

   Which of the following technologies has the SMALLEST maximum range for data transmission between devices?

   • AWi-Fi
   • BBluetooth
   • CLong-term evolution (LTE)
   • DNear-field communication (NFC)

   Show answer

   Answer: D

   Next question

7. Question 1297 · 1459 in bank

   An IS auditor follows up on a recent security incident and finds the incident response was not adequate. Which of the following findings should be considered MOST critical?

   • AThe attack could not be traced back to the originating person.
   • BThe attack was not automatically blocked by the intrusion detection system (IDS).
   • CAppropriate response documentation was not maintained.
   • DThe security weakness facilitating the attack was not identified.

   Show answer

   Answer: D

   Next question

8. Question 1298 · 1459 in bank

   Which of the following is the BEST way for management to ensure the effectiveness of the cybersecurity incident response process?

   • APeriodic tabletop exercises involving key stakeholders
   • BPeriodic update of incident response process documentation
   • CPeriodic cybersecurity training for staff involved in incident response
   • DPeriodic reporting of cybersecurity incidents to key stakeholders

   Show answer

   Answer: A

   Next question

9. Question 1299 · 1459 in bank

   When reviewing a project to replace multiple manual data entry systems with an artificial intelligence (Al) system, the IS auditor should be MOST concerned with the impact Al will have on:

   • Afuture task updates.
   • Benterprise architecture (EA).
   • Ctask capacity output
   • Demployee retention

   Show answer

   Answer: B

   Explanation

   B. enterprise architecture (EA). Implementing AI systems can have significant implications for the overall enterprise architecture. AI systems often require integration with existing systems, data sources, and processes. Changes to the enterprise architecture may be necessary to accommodate the AI system's requirements. This includes considerations such as data storage, data flows, security, scalability, and compatibility with existing IT infrastructure. Ensuring that the AI system aligns with the enterprise's architecture is crucial to avoid disruptions and maintain the overall stability and efficiency of the organization's IT environment. All the options are relevant, the IS auditor's primary concern should be how the implementation of AI impacts the organization's enterprise architecture, as this can have widespread effects on IT systems and processes.

   Source: Adapted from community discussion — SuperMax

   Next question

10. Question 1300 · 1459 in bank

    Which of the following is a core functionality of a configuration and release management system?

    • AIdentifying other configuration items that will be impacted by a given change
    • BIdentifying vulnerabilities in configuration settings
    • CDeploying a configuration change to the sandbox environment
    • DManaging privileged access to databases, servers, and infrastructure

    Show answer

    Answer: A

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISA practice, question 1291. 1459 questions available.