CISA practice questions 1,351–1,360

1. Question 1351 · 1459 in bank

   Who would provide an IS auditor with the MOST helpful input during an interview to determine whether business requirements for an application were met?

   • AUser management
   • BProject sponsors
   • CSenior management
   • DProject management

   Show answer

   Answer: A

   Explanation

   Answer: A User management—Assumes ownership of the project and resulting system; allocates qualified representatives to the team; and actively participates in business process redesign, system requirements definition, test case development, acceptance testing and user training. User management should review and approve system deliverables as they are defined and implemented. Project sponsor—Provides funding for the project and works closely with the project manager to define the critical success factors (CSFs) and metrics for measuring the success of the project. Data and application ownership are assigned to a project sponsor. A project sponsor is typically the senior manager in charge of the primary business unit the application will support. Reference: CRM 3.1.3 Project Management Roles and Responsibilities

   Source: Adapted from community discussion — Superman

   Next question

2. Question 1352 · 1459 in bank

   Which of the following should be an IS auditor’s GREATEST concern when assessing an IT service configuration database?

   • AThe database is not encrypted at rest.
   • BThe database is read-accessible for all users.
   • CThe database is executable for all users.
   • DThe database is write-accessible for all users.

   Show answer

   Answer: D

   Explanation

   While executable access for all users (Option C) may also pose security risks, such as the potential for unauthorized code execution or exploitation of vulnerabilities, allowing write-access to the database presents a more direct and immediate threat to data integrity, confidentiality, and the overall reliability of IT services. Therefore, it should be of greatest concern to the IS auditor.

   Source: Adapted from community discussion — Swallows

   Next question

3. Question 1353 · 1459 in bank

   Which of the following is PRIMARY responsibility of an IT steering committee?

   • APrioritizing IT projects in accordance with business requirements
   • BValidating and monitoring the skill sets of IT department staff
   • CEstablishing IT budgets for the business
   • DReviewing periodic IT risk assessments

   Show answer

   Answer: A

   Explanation

   While reviewing periodic IT risk assessments (Option D) may also be a responsibility of the IT steering committee, prioritizing IT projects in accordance with business requirements is typically considered the PRIMARY responsibility. This ensures that IT investments and initiatives contribute directly to the organization's success and strategic objectives.

   Source: Adapted from community discussion — Swallows

   Next question

4. Question 1354 · 1459 in bank

   Which of the following provides an IS auditor assurance that the interface between a point-of-sale (POS) system and the general ledger is transferring sales data completely and accurately?

   • AElectronic copies of customer sales receipts are maintained.
   • BMonthly bank statements are reconciled without exception.
   • CThe data transferred over the POS interface is encrypted.
   • DNightly batch processing has been replaced with real-time processing.

   Show answer

   Answer: B

   Explanation

   Transaction totals and record counts should be sent and reconciled before transaction processing: This control ensures that the number of transactions sent from the sales office to the production warehouse is equal to the number of transactions received at the warehouse. Additionally, the total value of the transactions sent should match the total value of the transactions received. By comparing the transaction totals and record counts before transaction processing, any errors or omissions can be detected and corrected before production begins. This helps to prevent incomplete or inaccurate orders from being processed.

   Source: Adapted from community discussion — 3008

   Next question

5. Question 1355 · 1459 in bank

   Which of the following is the MOST appropriate indicator of change management effectiveness?

   • ATime lag between changes to the configuration and the update of records
   • BNumber of system software changes
   • CNumber of incidents resulting from changes
   • DTime lag between changes and updates of documentation materials

   Show answer

   Answer: C

   Explanation

   Number of Incidents Resulting from Changes: This indicator directly measures the impact of changes on system stability and reliability. A high number of incidents following changes suggests potential issues with the change management process, such as inadequate testing, insufficient change planning, or poor execution. Monitoring incidents resulting from changes provides a clear picture of whether changes are being implemented effectively and whether they are causing unintended issues or disruptions.

   Source: Adapted from community discussion — KAP2HURUF

   Next question

6. Question 1356 · 1459 in bank

   Which of the following should be an IS auditor’s GREATEST concern when reviewing an organization’s capacity management planning?

   • AMany of the resource requirements are based on estimates
   • BThe organization is increasingly dependent on the use of cloud providers
   • CSome planning areas are not well developed
   • DCurrent resource utilization is not monitored

   Show answer

   Answer: D

   Explanation

   Current resource utilization is not monitored: This is a significant concern because effective capacity management relies on the understanding of current resource utilization. Without monitoring current utilization, it is challenging to make informed decisions about scaling, resource allocation, and future capacity needs. This lack of monitoring can lead to underutilization or overutilization of resources, both of which can have serious consequences for the organization's efficiency and effectiveness.

   Source: Adapted from community discussion — KAP2HURUF

   Next question

7. Question 1357 · 1459 in bank

   Which of the following is MOST important for an IS auditor to confirm when reviewing an organization's plans to implement robotic process automation (RPA) to automate routine business tasks?

   • AA benchmarking exercise of industry peers who use RPA has been completed.
   • BThe end-to-end process is understood and documented.
   • CA request for proposal (RFP) has been issued to qualified vendors.
   • DRoles and responsibilities are defined for the business processes in scope.

   Show answer

   Answer: B

   Explanation

   B. The end-to-end process is understood and documented. When reviewing an organization's plans to implement robotic process automation (RPA) to automate routine business tasks, the most important aspect for an IS auditor to confirm is that the end-to-end process is understood and documented (Option B). Before implementing RPA, it's crucial to have a clear understanding of the existing processes, their steps, variations, and potential exceptions. This documentation forms the basis for designing and configuring effective RPA workflows. Without a solid understanding of the process, the automation efforts may not yield the desired results or efficiencies.

   Source: Adapted from community discussion — lsiau76

   Next question

8. Question 1358 · 1459 in bank

   Which of the following is the PRIMARY objective of implementing IT governance?

   • AResource management
   • BPerformance measurement
   • CValue delivery
   • DStrategic planning

   Show answer

   Answer: C

   Explanation

   The PRIMARY objective of implementing IT governance is: C. Value delivery IT governance is primarily focused on ensuring that IT investments and activities deliver value to the organization. While resource management, performance measurement, and strategic planning are important components of IT governance, they are all means to the end of achieving value delivery. Effective IT governance helps organizations make informed decisions about their IT resources, measure performance to ensure alignment with objectives, and plan strategically to maximize value creation.

   Source: Adapted from community discussion — SuperMax

   Next question

9. Question 1359 · 1459 in bank

   During an information security audit of a mid-sized organization, an IS auditor notes that the organization's information security policy is not sufficient. What is the auditor's BEST recommendation for the organization?

   • AObtain an external consultant's support to rewrite the policy.
   • BIdentify and close gaps compared to a best-practice framework.
   • CPerform a benchmark with competitors’ policies.
   • DDefine roles and responsibilities for regularly updating the policy.

   Show answer

   Answer: B

   Next question

10. Question 1360 · 1459 in bank

    The GREATEST limitation of a network-based intrusion detection system (IDS) is that it:

    • Aprovides only for active rather than passive IDS monitoring
    • Bdoes not monitor for denial of service (DoS) attacks
    • Cconsumes excessive network resources for detection
    • Ddoes not detect attacks originating on the server hosting the IDS

    Show answer

    Answer: D

    Explanation

    D. Does not detect attacks originating on the server hosting the IDS: This is a significant limitation. Network-based IDSs are designed to monitor traffic passing through the network. They do not have visibility into activities occurring directly on a server, such as a compromised server initiating attacks or malicious actions. For such detection, a host-based intrusion detection system would be required.Cmiiw

    Source: Adapted from community discussion — KAP2HURUF

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISA practice, question 1351. 1459 questions available.