Certified Information Systems Auditor1,459 questions across 146 pages are complete and free, with no account or card.
1459 questions in this bank
Free access · progress saved on this device
A disaster recovery plan (DRP) should include steps for:
Answer: C
Risk assessment and quantification should be done as a BCP, not a DRP; the DRP should plan and train procedures for obtaining replacement supplies for disaster recovery.
Source: Adapted from community discussion — Swallows
The use of which of the following is an inherent risk in the application container infrastructure?
Answer: C
C. Shared kernel The use of a shared kernel is an inherent risk in application container infrastructure. Containers share the host operating system's kernel, which means they can potentially access and impact the kernel and other containers running on the same host. This shared kernel can lead to security vulnerabilities and isolation challenges if not properly managed and secured.
Source: Adapted from community discussion — SuperMax
An IS auditor reviewing a job scheduling tool notices performance and reliability problems. Which of the following is MOST likely affecting the tool?
Answer: C
C. Maintenance patches and the latest enhancement upgrades are missing. The performance and reliability problems in a job scheduling tool are most likely to be affected by missing maintenance patches and the latest enhancement upgrades. Regular updates and patches are essential to fix known issues, improve performance, and enhance reliability in software applications. Without these updates, the tool may become unstable, less efficient, and more susceptible to security vulnerabilities. Option C is the most likely reason for the problems, as the other options are less directly related to the technical performance and reliability of the tool.
Source: Adapted from community discussion — SuperMax
During a project assessment, an IS auditor finds that business owners have been removed from the project initiation phase. Which of the following should be the auditor’s GREATEST concern with this situation?
Answer: A
When a data center is attempting to restore computing facilities at an alternative site following a disaster, which of the following should be restored FIRST?
Answer: A
Given these considerations, the first component to restore should be A. Operating System. This is because the operating system forms the basic layer of the computing environment, enabling the restoration and functioning of all other components, including applications and data backups. Once the operating system is in place, data backups can be restored, and applications necessary for critical business operations can be set up and configured.
Source: Adapted from community discussion — KAP2HURUF
During an audit of a reciprocal disaster recovery agreement between two companies, the IS auditor would be MOST concerned with the:
Answer: B
I think its B. This is straight from the CISA Review Manual: Reciprocal agreements are agreements between separate, but similar, companies to temporarily share their IT facilities in the event that one company loses processing capability. Reciprocal agreements are not considered a viable option due to the constraining burden of maintaining hardware and software compatibility between the companies, the complications of maintaining security and privacy compliance during shared operations, and the difficulty of enforcing the agreements should a disagreement arise at the time the plan is activated.
Source: Adapted from community discussion — starzuu
An organization has introduced a capability maturity model to the system development life cycle (SDLC) to measure improvements. Which of the following is the BEST indication of successful process improvement?
Answer: A
An organization is planning to implement a work-from-home policy that allows users to work remotely as needed. Which of the following is the BEST solution for ensuring secure remote access to corporate resources?
Answer: B
An IS auditor is evaluating the progress of a web-based customer service application development project. Which of the following would be MOST helpful for this evaluation?
Answer: B
For evaluating the progress of a web-based customer service application development project, the MOST helpful information for an IS auditor would be Critical path analysis reports. Critical path analysis reports provide the auditor with information on the most critical tasks and the dependencies between tasks in the project. This information can help the auditor to assess whether the project is on track and identify any potential delays or bottlenecks in the development process. While developer status reports can provide some information on the progress of individual tasks, they may not provide a holistic view of the project's overall status. Change management logs can be helpful for tracking changes made to the project, but they may not provide insight into the project's current status. Backlog consumption reports can provide information on completed and pending work, but they may not provide a clear picture of the project's overall progress or potential issues.
Source: Adapted from community discussion — TEC1
Which of the following should be of GREATEST concern to an IS auditor assessing the effectiveness of an organization's release management processes?
Answer: A
Answer A Option B raises concerns about releases exceeding the agreed-upon outage window, indicating potential issues with scheduling and resource management within the release management process. While this is indeed a significant concern, it primarily relates to adherence to timelines and service availability rather than the fundamental documentation and procedural aspects of the release management process. On the other hand, Option A highlights the absence of supporting release documentation altogether, which speaks directly to the lack of formalized procedures and documentation standards within the release management process. This deficiency not only affects the organization's ability to track changes but also raises questions about the control and oversight of the release process, potentially leading to unauthorized or undocumented changes with implications for system stability and security.
Source: Adapted from community discussion — a84n
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CISA practice, question 1311. 1459 questions available.
Version 1.0.0. How we source questions