CISA practice questions 1,301–1,310

1. Question 1301 · 1459 in bank

   In an annual audit cycle, the audit of an organization's IT department resulted in many findings. Which of the following would be the MOST important consideration when planning the next audit?

   • ALimiting the review to the deficient areas
   • BFollowing up on the status of all recommendations
   • CVerifying that all recommendations have been implemented
   • DPostponing the review until all of the findings have been rectified

   Show answer

   Answer: B

   Explanation

   B. Following up on the status of all recommendations Accountability: It ensures that the organization's IT department is held accountable for addressing the identified issues and implementing the recommended solutions. Risk Management: By tracking the status of all recommendations, auditors can assess whether the identified risks have been mitigated or if they still pose a threat to the organization. Compliance: Many findings in IT audits may relate to compliance with regulatory requirements or industry standards. Ensuring that all recommendations have been addressed helps the organization maintain compliance. Continuous Improvement: It allows the organization to continuously improve its IT processes, security, and overall performance by addressing deficiencies and learning from past audits.

   Source: Adapted from community discussion — SuperMax

   Next question

2. Question 1302 · 1459 in bank

   An IS auditor finds ad hoc vulnerability scanning is in place with no clear alignment to the organization's wider security threat and vulnerability management program. Which of the following would BEST enable the organization to work toward improvement in this area?

   • AOutsourcing the threat and vulnerability management function to a third party
   • BMaintaining a catalog of vulnerabilities that may impact mission-critical systems
   • CUsing a capability maturity model to identify a path to an optimized program
   • DImplementing security logging to enhance threat and vulnerability management

   Show answer

   Answer: C

   Explanation

   The scenario presented in the question highlights a gap in the organization's security threat and vulnerability management program. The ad hoc vulnerability scanning approach without clear alignment to the program could result in security vulnerabilities being overlooked or not addressed promptly, leaving the organization exposed to potential threats. The BEST option to address this issue is to implement a capability maturity model (CMM) to identify a path to an optimized program. A capability maturity model provides a framework to assess an organization's current level of maturity in a particular area and identify opportunities for improvement. In this case, a CMM for security threat and vulnerability management would enable the organization to evaluate its current practices and identify areas for improvement, leading to the development of a more robust and effective program

   Source: Adapted from community discussion — 3008

   Next question

3. Question 1303 · 1459 in bank

   Which of the following will BEST help detect software licensing issues in a networked environment where all software is purchased and loaded by IT?

   • AComparing the software on each machine to the listing of software purchased
   • BComparing the number of individual software instances installed to the license inventory
   • CReviewing listings of software on each machine for known versions of unlicensed software
   • DReviewing reports demonstrating that metering software is not being used to access per-seat software

   Show answer

   Answer: B

   Explanation

   B. Comparing the number of individual software instances installed to the license inventory. This approach involves verifying that the number of software installations (instances) matches the number of licenses purchased. It directly assesses the compliance with the purchased licenses, making it an effective way to detect licensing issues. If there are more software instances installed than there are licenses purchased, it could indicate potential unlicensed software use, which is a licensing issue. While options A and C involve comparing the software on each machine to the purchased software list or checking for known versions of unlicensed software, they may not provide a complete picture of license compliance and can be time-consuming and error-prone.

   Source: Adapted from community discussion — SuperMax

   Next question

4. Question 1304 · 1459 in bank

   Which of the following would be the BEST criteria for monitoring an IT vendor’s service levels?

   • APerformance metrics
   • BSurprise visit to vendor
   • CService auditor’s report
   • DInterview with vendor

   Show answer

   Answer: A

   Next question

5. Question 1305 · 1459 in bank

   A sample for testing must include the 80 largest client balances and a random sample of the rest. What should the IS auditor recommend?

   • AQuery the database
   • BUse generalized audit software
   • CDevelop an integrated test facility (ITF)
   • DLeverage a random number generator

   Show answer

   Answer: B

   Explanation

   the IS auditor should recommend a combination of options B and D: B. Use generalized audit software: Generalized audit software is specifically designed for auditing purposes and can help in extracting and analyzing data from databases efficiently. It allows for the extraction of data based on specific criteria, such as the 80 largest client balances. D. Leverage a random number generator: A random number generator can be used to select a random sample from the remaining client balances after extracting the 80 largest ones. This ensures that the sample is truly random and not biased. This approach combines the use of specialized software for data extraction and analysis (option B) with a random number generator (option D) to ensure that the sample is both representative and random, as required for testing purposes.

   Source: Adapted from community discussion — SuperMax

   Next question

6. Question 1306 · 1459 in bank

   Which of the following is the MOST important prerequisite for the protection of physical information assets in a data center?

   • AKnowledge of the IT staff regarding data protection requirements
   • BComplete and accurate list of information assets that have been deployed
   • CSegregation of duties between staff ordering and staff receiving information assets
   • DAvailability and testing of onsite backup generators

   Show answer

   Answer: B

   Explanation

   At first an accurate list of info assets is important.. SOD will enhance the security. merely SOD without an underlying accurat elist of alreday deployed assets will not work.

   Source: Adapted from community discussion — Deeplaxmi

   Next question

7. Question 1307 · 1459 in bank

   A bank has a combination of corporate customer accounts (higher monetary value) and small business accounts (lower monetary value) as part of online banking. Which of the following is the BEST sampling approach for an IS auditor to use for these accounts?

   • AUnstratified mean per unit sampling
   • BStratified mean per unit sampling
   • CCustomer unit sampling
   • DDifference estimation sampling

   Show answer

   Answer: B

   Explanation

   Option B: Stratified mean per unit sampling. Stratified mean per unit sampling involves dividing the population into subgroups, or strata, based on relevant characteristics, such as monetary value or risk, and then selecting a sample from each stratum. This approach ensures that the sample represents the entire population and is proportionate to the importance of each stratum.

   Source: Adapted from community discussion — SRJ13

   Next question

8. Question 1308 · 1459 in bank

   An organization has established hiring policies and procedures designed specifically to ensure network administrators are well qualified. Which type of control is in place?

   • ADirective
   • BDetective
   • CCompensating
   • DCorrective

   Show answer

   Answer: A

   Explanation

   A. Directive Control Directive controls are proactive measures that are put in place to prevent issues or risks from occurring. In this case, the organization is taking a proactive approach by implementing hiring policies and procedures to ensure that network administrators are well qualified from the outset, which is a directive control aimed at preventing potential problems related to unqualified administrators.

   Source: Adapted from community discussion — SuperMax

   Next question

9. Question 1309 · 1459 in bank

   A review of IT interface controls finds an organization does not have a process to identify and correct records that do not get transferred to the receiving system. Which of the following is the IS auditor's BEST recommendation?

   • AAutomate the transfer of data between systems as much as feasible.
   • BEnable automatic encryption, decryption, and electronic signing of data files.
   • CHave coders perform manual reconciliation of data between systems.
   • DImplement software to perform automatic reconciliations of data between systems.

   Show answer

   Answer: D

   Next question

10. Question 1310 · 1459 in bank

    Which of the following would BEST help to ensure that an incident receives attention from appropriate personnel in a timely manner?

    • AImplementing incident escalation procedures
    • BCompleting the incident management log
    • CBroadcasting an emergency message
    • DRequiring a dedicated incident response team

    Show answer

    Answer: A

    Explanation

    While having a dedicated incident response team is important, implementing an escalation procedure has a direct impact on timely communication and faster response within an organization. Therefore, implementing an incident escalation procedure is most helpful in ensuring that the right people respond to incidents in a timely manner.

    Source: Adapted from community discussion — Swallows

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISA practice, question 1301. 1459 questions available.