CISA practice questions 1,331–1,340

1. Question 1331 · 1459 in bank

   An organization has shifted from a bottom-up approach to a top-down approach in the development of IT policies. This should result in:

   • Agreater consistency across the organization
   • Bgreater adherence to best practices
   • Ca more comprehensive risk assessment plan
   • Da synthesis of existing operational policies

   Show answer

   Answer: A

   Explanation

   A. Greater consistency across the organization: Likely correct. A top-down approach often involves centralized decision-making and enforcement of policies, which can lead to greater consistency in how IT policies are applied across the organization. The most likely outcome of shifting to a top-down approach is greater consistency across the organization (Option A). However, it's important to note that the effectiveness of this shift will depend on how well the top-down approach is implemented and the quality of the policies that are developed and enforced.

   Source: Adapted from community discussion — SuperMax

   Next question

2. Question 1332 · 1459 in bank

   Which of the following methods would BEST help detect unauthorized disclosure of confidential documents sent over corporate email?

   • AMonitoring all emails based on pre-defined criteria
   • BReporting all outgoing emails that are marked as confidential
   • CRequiring all users to encrypt documents before sending
   • DInstalling firewalls on the corporate network

   Show answer

   Answer: A

   Explanation

   The BEST method to detect unauthorized disclosure of confidential documents sent over corporate email would be option A: Monitoring all emails based on pre-defined criteria. This method involves actively monitoring all emails that are sent through the corporate email system and flagging those that meet specific pre-defined criteria for further review. This allows organizations to identify potential unauthorized disclosures in real-time or after the fact. Criteria can include keywords, file types, recipient lists, or other suspicious patterns of communication. While each of these measures can contribute to overall email security, option A is the most effective for detecting unauthorized disclosures specifically. However, organizations often use a combination of these methods to enhance email security comprehensively.

   Source: Adapted from community discussion — SuperMax

   Next question

3. Question 1333 · 1459 in bank

   An organization has engaged a third party to implement an application to perform business-critical calculations. Which of the following is the MOST important process to help ensure the application provides accurate calculations?

   • AQuality assurance (QA)
   • BChange management
   • CKey performance indicator (KPI) monitoring
   • DConfiguration management

   Show answer

   Answer: A

   Next question

4. Question 1334 · 1459 in bank

   Which of the following is the BEST approach to help ensure evidence from a computer forensics investigation is legally admissible?

   • AThe incident response team reviews and analyzes the evidence, and the evidence file is then securely deleted to avoid further damage.
   • BThe relevant data is extracted from system, firewall, and intrusion detection system (IDS) logs, then consolidated as evidence.
   • CThe media involved is preserved using imaging, and further analysis is performed on the image instead of the original.
   • DThe computer suspected of storing the evidence is isolated, and the incident response team is contacted for investigation.

   Show answer

   Answer: C

   Explanation

   C. The media involved is preserved using imaging, and further analysis is performed on the image instead of the original. Preserving the original media through imaging is a fundamental practice in computer forensics. It ensures the integrity of the evidence by creating a bit-for-bit copy of the original media. This copy (the forensic image) can be analyzed and investigated without altering or damaging the original evidence. This approach helps maintain the chain of custody and ensures that the evidence is legally admissible in court because it proves the integrity and authenticity of the data collected during the investigation. Option A is not a good approach because securely deleting evidence can lead to the loss of crucial information and may not be legally acceptable. Option B is a reasonable practice but does not emphasize the importance of preserving the original media through imaging. Option D is also not a good approach because isolating the computer without proper imaging and evidence preservation can result in potential data loss or contamination.

   Source: Adapted from community discussion — SuperMax

   Next question

5. Question 1335 · 1459 in bank

   Evaluating application development projects against a defined maturity model enables an IS auditor to determine whether:

   • Aeffective security requirements have been designed
   • Bthe development function’s processes are efficient
   • Cthe development function follows a robust process
   • Dthe development project is likely to achieve its objectives

   Show answer

   Answer: C

   Explanation

   C. the development function follows a robust process Maturity models, such as the Capability Maturity Model Integration (CMMI), are designed to assess the maturity and effectiveness of processes within an organization, including those related to software development. Evaluating a development project against a maturity model helps determine whether the development function is following a robust and well-defined process, which is a critical aspect of ensuring the success of the project. While the other options (A, B, and D) can also be important factors in evaluating development projects, they are not the primary focus of a maturity model assessment. Effective security requirements (A) may be assessed separately through security audits. The efficiency of development processes (B) can be evaluated, but it's not the primary goal of a maturity model assessment. Whether a development project is likely to achieve its objectives (D) depends on various factors, including project management, but is not the primary focus of a maturity model evaluation.

   Source: Adapted from community discussion — SuperMax

   Next question

6. Question 1336 · 1459 in bank

   During data conversion, data cleansing is BEST performed prior to:

   • Aload
   • Btransformation
   • Cvalidation
   • Dextraction

   Show answer

   Answer: B

   Explanation

   B. transformation is the correct answer. Data cleansing should be completed before data transformation to optimize the quality and reliability of the converted data.

   Source: Adapted from community discussion — Swallows

   Next question

7. Question 1337 · 1459 in bank

   Which of the following scenarios should raise a concern about auditor independence?

   • AThe auditor used to manage the same business process at a different company.
   • BThe auditor consulted on the implementation portion of a project being audited.
   • CThe auditor attended design and development meetings to monitor progress.
   • DThe auditor has a personal relationship with an end user.

   Show answer

   Answer: D

   Explanation

   D. The auditor has a personal relationship with an end user. Auditor independence is a critical aspect of the auditing process to ensure that auditors can provide unbiased and objective opinions about the financial statements and other matters they are auditing. In this context, a personal relationship between the auditor and an end user (client personnel) can raise concerns about independence because it may compromise the auditor's ability to remain impartial and objective when evaluating the client's financial information. Such a relationship can create the perception that the auditor may not be able to provide an unbiased assessment of the client's financial statements or internal controls. Therefore, option D is the scenario that should raise a concern about auditor independence.

   Source: Adapted from community discussion — SuperMax

   Next question

8. Question 1338 · 1459 in bank

   Which of the following is the BEST way for an IS auditor to determine whether an organization’s disaster recovery plan (DRP) is current?

   • AReview critical system documentation and related recovery time objectives (RTOs).
   • BVerify the DRP identifies appropriate staff with up-to-date contact details.
   • CEnsure all staff is trained on business continuity.
   • DVerify the DRP is periodically tested.

   Show answer

   Answer: D

   Explanation

   The BEST way for an IS auditor to determine whether an organization's disaster recovery plan (DRP) is current is option D: Verify the DRP is periodically tested. While all of the options mentioned are important aspects of assessing the effectiveness and currency of a disaster recovery plan (DRP), periodic testing is crucial. A. Reviewing critical system documentation and related recovery time objectives (RTOs) is essential, but it doesn't guarantee that the DRP is current. The documentation may be accurate, but it might not have been tested or updated recently. B. Verifying that the DRP identifies appropriate staff with up-to-date contact details is important for communication during a disaster, but it alone doesn't ensure the effectiveness of the entire plan. C. Ensuring that all staff is trained on business continuity is vital for the execution of the DRP, but it doesn't directly address the currency of the plan itself. Therefore, option D is the best way for an IS auditor to determine whether an organization's DRP is current and capable of serving its intended purpose.

   Source: Adapted from community discussion — SuperMax

   Next question

9. Question 1339 · 1459 in bank

   When planning an audit, it is acceptable for an IS auditor to rely on a third-party provider’s external audit report on service level management when the:

   • Ascope and methodology meet audit requirements
   • Bservice provider is independently certified and accredited
   • Creport was released within the last 12 months
   • Dreport confirms that service levels were not violated

   Show answer

   Answer: A

   Explanation

   When planning an audit, it is acceptable for an IS auditor to rely on a third-party provider’s external audit report on service level management when the scope and methodology meet audit requirements

   Source: Adapted from community discussion — 3008

   Next question

10. Question 1340 · 1459 in bank

    Which of the following should be the FIRST step when developing a data loss prevention (DLP) solution for a large organization?

    • ACreate the DLP policies and templates.
    • BConduct a threat analysis against sensitive data usage.
    • CConduct a data inventory and classification exercise.
    • DIdentify approved data workflows across the enterprise.

    Show answer

    Answer: C

    Explanation

    Before implementing a DLP solution, it is crucial to understand the organization's data landscape. Conducting a data inventory and classification exercise helps identify the types of data that need to be protected and their sensitivity levels. This step involves identifying the locations, formats, and repositories where data resides, as well as categorizing the data based on its sensitivity and regulatory requirements. This exercise forms the foundation for developing effective DLP policies and controls.

    Source: Adapted from community discussion — TTH1019

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISA practice, question 1331. 1459 questions available.