Question 1391 · 1459 in bank
An IS auditor observes that a bank's web page address is prefixed "https://". The auditor would be correct to conclude that:
Show answer
Answer: B
Certified Information Systems Auditor1,459 questions across 146 pages are complete and free, with no account or card.
1459 questions in this bank
Free access · progress saved on this device
An IS auditor observes that a bank's web page address is prefixed "https://". The auditor would be correct to conclude that:
Answer: B
During a routine internal software licensing review, an IS auditor discovers instances where employees shared license keys to critical pieces of business software. Which of the following would be the auditor's BEST course of action?
Answer: D
Which of the following is the MOST effective way to assess the controls over the hardware maintenance process?
Answer: D
D. Identify the required maintenance procedures and ensure the maintenance policy is in alignment. This option is the MOST effective way to assess the controls over the hardware maintenance process. Identifying the required maintenance procedures and ensuring the maintenance policy is in alignment (Option D) involves a comprehensive assessment of the maintenance process. It ensures that the maintenance procedures are not only being followed but also in line with the organization's policies, standards, and best practices. This approach is the most effective way to assess the overall control and effectiveness of the hardware maintenance process.
Source: Adapted from community discussion — SuperMax
When auditing an organization’s software acquisition process, the BEST way for an IS auditor to understand the software benefits to the organization would be to review the:
Answer: B
When auditing an organization's software acquisition process, the IS auditor would want to understand the benefits of the software to the organization. To do this, the BEST way would be to review the business case, which is option B. A business case is a document that outlines the reasons for a proposed project or investment and its expected benefits to the organization. The business case includes an analysis of costs, benefits, risks, and other factors that affect the decision to proceed with the project or investment. By reviewing the business case, the IS auditor can gain a comprehensive understanding of the software's benefits to the organization, which includes the financial, strategic, operational, and technical aspects of the software acquisition. The business case provides a holistic view of the software acquisition process, including the rationale for the software selection, the expected return on investment, and the alignment with the organization's goals and objectives.
Source: Adapted from community discussion — 3008
After delivering an audit report, the audit manager discovers that evidence was overlooked during the audit. This evidence indicates that procedural control may have failed and could contradict a conclusion of the audit. Which of the following risks is MOST affected by this oversight?
Answer: B
Which of the following is MOST effective for controlling visitor access to a data center?
Answer: C
The right answer is B: Because Pre-approval of entry requests involves having visitors request access in advance, which allows the organization to verify their identities and determine if they meet the necessary criteria for entry. This process provides an opportunity for security personnel to perform background checks, review the purpose of the visit, and ensure that only authorized individuals are granted access. Pre-approval helps minimize the risk of unauthorized visitors entering the data center. An for C. Visitors are escorted by an authorized employee: Having authorized employees escort visitors is an additional security measure that can enhance control over visitor access. However, this approach may be resource-intensive, requiring staff members to be available at all times to escort visitors. It may not be practical or scalable for large data centers with a high volume of visitor traffic.
Source: Adapted from community discussion — 007Georgeo
Which of the following observations should be of GREATEST concern to an IS auditor performing an audit of an organization's social media practices?
Answer: B
The use of social media by organizations has become increasingly popular for advertising, brand recognition, and customer engagement. However, social media use can also create security risks for an organization, and it is important for the organization to establish and enforce policies and guidelines to mitigate these risks. Out of the four observations presented in the question, the one that should be of MOST concern to the IS auditor is option D: "The organization does not have a documented social media policy." This is because without a documented policy, the organization does not have clear guidelines for how employees should use social media on behalf of the organization, what types of content are appropriate, and what security measures must be taken to protect the organization's assets and reputation.
Source: Adapted from community discussion — 3008
Which of the following is the PRIMARY reason an IS auditor would recommend offsite backups although critical data is already on a redundant array of inexpensive disks (RAID)?
Answer: A
Which of the following is the BEST control to mitigate attacks that redirect Internet traffic to an unauthorized website?
Answer: D
I think answer should be D because if DNS is hijacked then it then DNS queries are incorrectly resolved in order to unexpectedly redirect users to malicious sites
Source: Adapted from community discussion — MunaM
An organization’s business continuity plan (BCP) should be:
Answer: A
A. Updated based on changes to personnel and environments. The organization's business continuity plan (BCP) should be a dynamic document that reflects the changing needs and circumstances of the organization. Regular updates to the BCP based on changes to personnel, technology, and the environment can help ensure that it remains relevant and effective. Testing the BCP whenever new applications are implemented (B) or after an intrusion attempt (D) can also be important, but it is not enough to rely on these events alone for updating the BCP. Updating the BCP before an independent audit review (C) may be part of the audit preparation process, but it is important to keep the BCP up-to-date on a regular basis, regardless of whether an audit is imminent.
Source: Adapted from community discussion — TEC1
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CISA practice, question 1391. 1459 questions available.
Version 1.0.0. How we source questions