CISA practice questions 1,371–1,380

1. Question 1371 · 1459 in bank

   Which of the following is the GREATEST advantage of maintaining an internal IS audit function within an organization?

   • ABetter understanding of the business and processes
   • BAbility to negotiate recommendations with management
   • CIncreased IS audit staff visibility and availability throughout the year
   • DIncreased independence and impartiality of recommendations

   Show answer

   Answer: A

   Explanation

   The greatest advantage of maintaining an internal IS audit function within an organization is a better understanding of the business and processes. Internal IS auditors have a unique advantage in that they are familiar with the organization's systems, processes, and culture, which enables them to more effectively identify risks and evaluate control effectiveness. This deeper understanding of the organization also enables internal IS auditors to provide more targeted and relevant recommendations, as they are aware of the organization's specific objectives, constraints, and challenges. Additionally, internal IS auditors can work more closely with the business and other stakeholders, which can help build trust and increase the likelihood of management accepting and implementing audit recommendations. This close working relationship can also help internal IS auditors more effectively identify and understand emerging risks and technology trends, and ensure that their audit plans are aligned with the organization's evolving needs.

   Source: Adapted from community discussion — TEC1

   Next question

2. Question 1372 · 1459 in bank

   The MOST appropriate person to chair the steering committee for an enterprise-wide system development should be the:

   • Abusiness analyst
   • Bproject manager
   • CIS director
   • Dexecutive level manager

   Show answer

   Answer: D

   Explanation

   The MOST appropriate person to chair the steering committee for an enterprise-wide system development is: D. executive level manager The steering committee is typically responsible for making high-level decisions, setting priorities, and providing overall direction for a project of this scale. An executive-level manager, such as a Chief Information Officer (CIO) or Chief Technology Officer (CTO), is well-suited to chair the committee because they have the authority and strategic perspective necessary to align the project with the organization's goals and objectives. While business analysts, project managers, and IS directors may play important roles in the development process, the chair of the steering committee should have a broader organizational perspective and decision-making authority.

   Source: Adapted from community discussion — SuperMax

   Next question

3. Question 1373 · 1459 in bank

   Which of the following should be of GREATEST concern to an IS auditor assessing the effectiveness of an organization’s vulnerability scanning program?

   • AScans are performed less frequently than required by the organization’s vulnerability scanning schedule.
   • BSteps taken to address identified vulnerabilities are not formally documented.
   • CResults are not approved by senior management.
   • DResults are not reported to individuals with authority to ensure resolution.

   Show answer

   Answer: D

   Next question

4. Question 1374 · 1459 in bank

   An IS audit reveals an organization has decided not to implement a new regulation by the required deadline because the cost of rapid implementation is higher than the penalty for noncompliance. Which of the following is the auditor’s BEST course of action?

   • AEnsure a gap analysis is conducted
   • BEnsure regulatory reporting is completed
   • CEnsure the risk register is updated
   • DEnsure risk acceptance is documented

   Show answer

   Answer: D

   Explanation

   D. Ensure risk acceptance is documented In this situation, the organization has made a conscious decision not to implement a new regulation by the required deadline because they believe the cost of rapid implementation is higher than the penalty for noncompliance. This represents a risk acceptance decision, where the organization is choosing to accept the risk of noncompliance. To properly address this from an audit perspective, the auditor should ensure that this risk acceptance decision is well-documented. Documenting the risk acceptance decision is important for transparency and accountability within the organization. It ensures that the decision-makers are aware of the risks they are taking and that the reasons for not complying with the regulation are clear. While conducting a gap analysis, updating the risk register, and ensuring regulatory reporting are important tasks, in this specific scenario, documenting the risk acceptance is the most critical action to address the organization's noncompliance decision.

   Source: Adapted from community discussion — SuperMax

   Next question

5. Question 1375 · 1459 in bank

   Cross-site scripting (XSS) attacks are BEST prevented through:

   • Asecure coding practices.
   • Buse of common industry frameworks.
   • Ca three-tier web architecture.
   • Dapplication firewall policy settings.

   Show answer

   Answer: A

   Explanation

   this is a common vulnerability which is avoidable during the development. Secure development process is the best way to prevent this vulnerability. Answer is A

   Source: Adapted from community discussion — MichaelHoang

   Next question

6. Question 1376 · 1459 in bank

   Which of the following is the BEST way for an IS auditor to determine the completeness of data migration?

   • AReview migration logs to identify possible failures.
   • BReview the implemented data cleanup process.
   • CReconcile migrated records with records in the source system.
   • DExamine formal departmental review of the data migration.

   Show answer

   Answer: C

   Explanation

   The BEST way for an IS auditor to determine the completeness of data migration is: C. Reconcile migrated records with records in the source system. Reconciling migrated records with records in the source system involves comparing the data in the target system (after migration) with the data in the source system (before migration). This method allows the auditor to verify that all the data has been successfully migrated and that there are no missing or incomplete records. It provides a direct and concrete way to ensure completeness. Option A (Review migration logs) is important but may not guarantee completeness as it primarily focuses on identifying failures and errors in the migration process. Option B (Review the implemented data cleanup process) is relevant but does not directly address the completeness of the migration. Option D (Examine formal departmental review of the data migration) is useful for understanding the process but may not provide a direct measure of data completeness.

   Source: Adapted from community discussion — SuperMax

   Next question

7. Question 1377 · 1459 in bank

   Which of the following is MOST important to consider when establishing the retention period for customer data within a specific database or application?

   • AEnterprise classification level
   • BSystem performance
   • CHardware capacity
   • DMinimum regulatory requirements

   Show answer

   Answer: D

   Next question

8. Question 1378 · 1459 in bank

   Which of the following is the GREATEST advantage of utilizing guest operating systems in a virtual environment?

   • AThey can be logged into and monitored from any location.
   • BThey prevent access to the greater environment via Transmission Control Protocol/Internet Protocol (TCP/IP)
   • CThey can be wiped quickly in the event of a security breach.
   • DThey are easier to containerize with minimal impact to the rest of the environment

   Show answer

   Answer: D

   Explanation

   **D. The biggest benefit of utilizing guest operating systems in a virtual environment is **D. It is easier to containerize with minimal impact on the rest of the environment. This is because the virtual environment provides an independent execution space, so problems in one environment do not affect the other. This independence also makes it easier to containerize applications to deploy and manage. In addition, the virtual environment has the advantage of being able to monitor at any location (A) and of being able to quickly delete security breaches (C). However, option B is generally not considered a virtual environment advantage because access restrictions over TCP/IP are part of the network security setup and not a function of the virtual environment itself.

   Source: Adapted from community discussion — 3008

   Next question

9. Question 1379 · 1459 in bank

   An IS auditor finds that a system receives identical information from two different upstream sources, even though redundancy is not required. Which of the following would BEST enable the organization to avoid this type of inefficiency?

   • AEnterprise architecture (EA)
   • BNormalized relational databases
   • CCentralized data warehouse
   • DCyber architecture review

   Show answer

   Answer: A

   Next question

10. Question 1380 · 1459 in bank

    A large organization has a centralized infrastructure team and decentralized application support teams reporting into their respective business units. Which of the following is the GREATEST potential issue with his organizational structure?

    • ARedundancy of IT resources used across the organization
    • BFailure to align with industry best practices across the organization
    • CInconsistent allocation of IT spend across the organization
    • DInconsistent IT strategy across the organization

    Show answer

    Answer: D

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISA practice, question 1371. 1459 questions available.