Certified Information Systems Auditor1,459 questions across 146 pages are complete and free, with no account or card.
1459 questions in this bank
Free access · progress saved on this device
Which of the following management decisions presents the GREATEST risk associated with data leakage?
Answer: A
I say A B would be correct if it was a laptop instead of a desktop. They tricked us. Desktops are not a great concern as there are compensating controls like physical security, cctv, censors and so on ..
Source: Adapted from community discussion — RS66
Which of the following BEST indicates the effectiveness of an organization's risk management program?
Answer: A
Residual risk refers to the level of risk that remains after risk treatment measures (such as implementing controls or mitigation strategies) have been applied. A highly effective risk management program aims to minimize residual risk to an acceptable level, considering the organization's risk appetite and tolerance.
Source: Adapted from community discussion — dan08
An IS auditor is reviewing an organization’s incident management processes and procedures. Which of the following observations should be the auditor’s GREATEST concern?
Answer: D
Which of the following is the MOST important factor when an organization is developing information security policies and procedures?
Answer: D
Compliance with relevant regulations: Compliance with relevant regulations is the most important factor when developing information security policies and procedures. Organizations must comply with laws, regulations, and industry standards that pertain to information security. Failure to comply with relevant regulations could result in legal and financial penalties and damage to an organization's reputation.
Source: Adapted from community discussion — 3008
What should an IS auditor review FIRST to verify that an organization’s IT strategy is effectively implemented?
Answer: B
B. The IT governance framework While the other options (A, C, and D) are also important aspects of IT auditing and governance, they are typically reviewed after assessing the IT governance framework to ensure that the organization's IT strategy is on the right track. For instance: A. Information Security Procedures: These are important components of IT controls, but they are typically assessed in the context of IT general controls and may be part of the IT governance framework. C. Process Maturity of IT General Controls: The maturity of IT general controls is important but is often evaluated as part of a broader assessment of an organization's IT controls and processes, which falls under the purview of IT governance. D. The Most Recent Audit Results: While audit results provide valuable insights, they are a result of past assessments. It's more effective to start by reviewing the framework and current implementation before looking at historical audit results to see if there have been improvements or areas of concern over time.
Source: Adapted from community discussion — SuperMax
Which of the following is a threat to IS auditor independence?
Answer: C
The most significant threat to IS auditor independence is when auditors design remediation plans. This involvement in the remediation process compromises their objectivity and impartiality, as their role should be limited to assessing and reporting on control effectiveness without participating in or influencing the remediation activities.
Source: Adapted from community discussion — KAP2HURUF
Which of the following BEST supports an organization’s efforts to reduce the impact of ransomware attacks?
Answer: D
Which of the following network topologies will provide the GREATEST fault tolerance?
Answer: D
The network topology that provides the GREATEST fault tolerance is the Mesh configuration (option D). In a Mesh configuration, every device is connected to every other device. This means that there are redundant paths for data to travel between devices. If one link or device fails, there are multiple alternative paths available for data to reach its destination. This inherent redundancy makes Mesh topology highly fault-tolerant, as it can withstand multiple failures without significant disruption to the network. In contrast: A. Star configuration relies on a central hub, and if the hub fails, the entire network may go down. B. Bus configuration uses a single main cable, and if this cable is damaged, it can disrupt the entire network. C. Ring configuration can provide some fault tolerance but can be vulnerable if a single link or device in the ring fails, causing a break in the ring. So, while each of these topologies has its own advantages, the Mesh configuration is the most fault-tolerant among them.
Source: Adapted from community discussion — SuperMax
Which of the following findings should be of GREATEST concern to an IS auditor reviewing an organization’s newly implemented online security awareness program?
Answer: D
Option B is the correct answer. A comprehensive and effective security awareness program should be designed to educate all employees, regardless of tenure or job function, on the organization's policies, procedures, and best practices for information security. By limiting the program to only new employees, the organization is failing to address the ongoing need for all employees to remain vigilant and up-to-date on the latest threats and vulnerabilities. This leaves the organization vulnerable to potential security incidents and breaches that could result from employees who are not adequately trained and informed.
Source: Adapted from community discussion — SRJ13
Providing security certification for a new system should include which of the following prior to the system's implementation?
Answer: C
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CISA practice, question 1321. 1459 questions available.
Version 1.0.0. How we source questions