CISA practice questions 1,381–1,390

1. Question 1381 · 1459 in bank

   An IS auditor is reviewing an origination’s release management practices and observes inconsistent and inaccurate estimation of the size and complexity of business application development projects. Which of the following should the auditor recommend to address this issue?

   • AAgile development approach
   • BCritical path methodology
   • CRapid application development
   • DFunction point analysis

   Show answer

   Answer: D

   Explanation

   D. Function point analysis Function point analysis is a widely recognized technique for measuring the size and complexity of software applications. It helps in providing a more accurate and standardized way of estimating project size and complexity. By using function points, organizations can establish a common and objective metric for evaluating development efforts, which can lead to more reliable project planning and estimation. While Agile development approaches, Critical Path Methodology (CPM), and Rapid Application Development (RAD) are valuable methodologies for managing and executing software development projects, they don't directly address the issue of inconsistent and inaccurate estimation, which is the primary concern mentioned in the question. Function point analysis, on the other hand, is specifically designed to improve the accuracy of size and complexity estimation in software development projects.

   Source: Adapted from community discussion — SuperMax

   Next question

2. Question 1382 · 1459 in bank

   Which of the following is the BEST way to faster continuous improvement of IS audit processes and practices?

   • AFrequently review IS audit policies, procedures, and instruction manuals.
   • BEstablish and embed quality assurance (QA) within the IS audit function.
   • CInvite external auditors and regulators to perform regular assessment of the IS audit function.
   • DImplement rigorous managerial review and sign-off of IS audit deliverables.

   Show answer

   Answer: B

   Explanation

   The best way to facilitate faster continuous improvement of IS audit processes and practices is option B: Establish and embed quality assurance (QA) within the IS audit function. Option B, establishing and embedding quality assurance within the IS audit function, involves ongoing processes and practices that focus on improving the quality of audits continually. This approach encourages a culture of continuous improvement and self-assessment within the IS audit team, which is essential for driving faster and sustained improvement in IS audit processes and practices.

   Source: Adapted from community discussion — SuperMax

   Next question

3. Question 1383 · 1459 in bank

   An IS auditor is preparing a plan for audits to be carried out over a specified period. Which of the following activities should the IS auditor perform FIRST?

   • AAllocate audit resources.
   • BDetermine the audit universe.
   • CPrioritize risks.
   • DReview prior audit reports.

   Show answer

   Answer: B

   Explanation

   When preparing a plan for audits to be carried out over a specified period, the IS auditor should generally start by determining the audit universe. Therefore, the correct answer is: B. Determine the audit universe. Determining the audit universe involves identifying and defining the scope of the audits to be performed. This step is essential as it helps the IS auditor understand what systems, processes, and areas within the organization need to be audited. Once the audit universe is defined, the IS auditor can then proceed to allocate audit resources, prioritize risks, and review prior audit reports, as these activities are typically based on the knowledge of what is within the audit universe. So, while all the listed activities are important, determining the audit universe is the logical starting point for planning IS audits.

   Source: Adapted from community discussion — SuperMax

   Next question

4. Question 1384 · 1459 in bank

   Prior to a follow-up engagement, an IS auditor learns that management has decided to accept a level of residual risk related to an audit finding without remediation. The IS auditor is concerned about management's decision. Which of the following should be the IS auditor's NEXT course of action?

   • APresent the issue to executive management.
   • BReport the disagreement to the board.
   • CAccept management's decision and continue the follow-up.
   • DReport the issue to IS audit management.

   Show answer

   Answer: D

   Explanation

   D. Report the issue to IS audit management. When an IS auditor learns that management has decided to accept a level of residual risk related to an audit finding without remediation and has concerns about this decision, the next course of action should be to report the issue to IS audit management (Option D). IS audit management can provide guidance on how to proceed, which may include discussing the concern with executive management or considering further steps to address the issue appropriately. It's important to follow internal reporting procedures and seek guidance from higher levels within the audit function before escalating the matter externally.

   Source: Adapted from community discussion — lsiau76

   Next question

5. Question 1385 · 1459 in bank

   An organization has developed processes to recover critical files in the event of a ransomware attack. Which type of control do these processes represent?

   • ACorrective
   • BDetective
   • CPreventive
   • DCompensating

   Show answer

   Answer: A

   Next question

6. Question 1386 · 1459 in bank

   Which of the following is the BEST preventative control to ensure that database integrity is maintained?

   • AMandatory annual user access reviews
   • BBiometric authentication
   • CRole-based access
   • DMandatory password changes

   Show answer

   Answer: C

   Explanation

   C. Role-based access Role-based access control (RBAC) is the best preventative control to ensure that database integrity is maintained. RBAC restricts access to the database based on users' roles and responsibilities within an organization. It ensures that users only have access to the data and functions that are necessary for their job functions, preventing unauthorized access and potential data breaches. RBAC is a fundamental security principle in database management and helps in maintaining data integrity by limiting access to authorized users and roles.

   Source: Adapted from community discussion — SuperMax

   Next question

7. Question 1387 · 1459 in bank

   An IS auditor observes a system performance monitoring too that states that a server critical to the organization averages high CPU utilization across a cluster of four virtual servers throughout the audit period. To determine if further investigation is required an IS auditor should review:

   • Asystem baselines.
   • Bthe system process activity log.
   • Cthe number of CPUs allocated to each virtual machine.
   • Dorganizational objectives.

   Show answer

   Answer: A

   Explanation

   While organizational objectives (option D) are important for setting overall priorities, options A, B, and C are more directly relevant to investigating the observed high CPU utilization issue. Therefore, the IS auditor should primarily review system baselines (option A) and the system process activity log (option B) to understand the situation and potentially consider the CPU allocation (option C) as part of the investigation.

   Source: Adapted from community discussion — SuperMax

   Next question

8. Question 1388 · 1459 in bank

   In a review of the organization standards and guidelines for IT management, which of the following should be included in an IS development methodology?

   • ARisk management techniques
   • BAccess control rules
   • CValue-added activity analysis
   • DIncident management techniques

   Show answer

   Answer: A

   Explanation

   A. Risk management techniques should be included in an IS development methodology. It is important to consider and address the potential risks associated with any new IT system development project to ensure that it is secure and meets the organization's security requirements. Additionally, access control rules (B) and incident management techniques (D) may also be important to consider in the development methodology to ensure secure and effective operation of the system. Value-added activity analysis (C) may be relevant to the overall project management, but it is not specifically related to the IS development methodology.

   Source: Adapted from community discussion — TEC1

   Next question

9. Question 1389 · 1459 in bank

   When using data analytics to perform an audit, the IS auditor should FIRST:

   • Aidentify testing models
   • Bdefine data needs
   • Cidentify data sources
   • Dprepare the data

   Show answer

   Answer: B

   Explanation

   When using data analytics to perform an audit, the IS auditor should first define the data needs. This involves understanding the audit objectives and determining what data is required to meet those objectives. Defining the data needs sets the foundation for the subsequent steps in the data analytics process, as it guides the auditor in identifying which data to collect and how to analyze it.

   Source: Adapted from community discussion — KAP2HURUF

   Next question

10. Question 1390 · 1459 in bank

    An organization outsourced its IS functions. To meet its responsibility for disaster recovery, the organization should:

    • Acoordinate disaster recovery administration with the outsourcing vendor
    • Bdelegate evaluation of disaster recovery to a third party
    • Cdelegate evaluation of disaster recovery to internal audit
    • Ddiscontinue maintenance of the disaster recovery plan (DRP)

    Show answer

    Answer: A

    Explanation

    A. coordinate disaster recovery administration with the outsourcing vendor When an organization outsources its Information Systems (IS) functions, it still retains responsibility for ensuring that critical functions like disaster recovery are adequately addressed. Option A, coordinating disaster recovery administration with the outsourcing vendor, is the most appropriate choice in this context. Options B and C involve delegating the evaluation of disaster recovery to third parties (either a third-party vendor or internal audit), which can be part of the overall disaster recovery strategy but doesn't absolve the organization of its primary responsibility for disaster recovery planning and execution. Option D, discontinuing maintenance of the disaster recovery plan (DRP), is not a responsible choice because disaster recovery planning is crucial for business continuity and risk mitigation, and it should not be abandoned, especially when IT functions are outsourced.

    Source: Adapted from community discussion — SuperMax

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISA practice, question 1381. 1459 questions available.