CISA practice questions 1,401–1,410

1. Question 1401 · 1459 in bank

   An IS auditor has been asked to review a recently implemented quality management system (QMS). Which of the following should be the auditor’s PRIMARY focus?

   • ATraining materials prepared for coaching employees
   • BProcesses to measure the performance of business-critical transactions
   • CCost-benefit analysis of the development and implementation of the QMS
   • DStability of the implemented QMS system over a period of time

   Show answer

   Answer: B

   Explanation

   The PRIMARY focus of an IS (Information Systems) auditor when reviewing a recently implemented quality management system (QMS) should be on B. Processes to measure the performance of business-critical transactions. While all the options listed are important aspects to consider when auditing a QMS, ensuring that the processes to measure the performance of business-critical transactions are working effectively is essential. This is because the primary goal of a QMS is to ensure that the organization's processes are efficient, effective, and consistently meeting quality standards, especially for critical business operations. Therefore, reviewing and validating the performance measurement processes related to these critical transactions is crucial to determine whether the QMS is achieving its intended objectives.

   Source: Adapted from community discussion — SuperMax

   Next question

2. Question 1402 · 1459 in bank

   Which of the following should be identified FIRST during the risk assessment process?

   • AVulnerability
   • BExisting controls
   • CLegal requirements
   • DInformation assets

   Show answer

   Answer: D

   Explanation

   When conducting a risk assessment, it is generally recommended to start by identifying the information assets (Option D) FIRST. This is because understanding what information assets you have and their value is a foundational step in the risk assessment process. Once you have a clear picture of your information assets, you can then proceed to assess vulnerabilities (Option A), existing controls (Option B), and legal requirements (Option C) that are relevant to those assets.

   Source: Adapted from community discussion — SuperMax

   Next question

3. Question 1403 · 1459 in bank

   Which of the following is MOST important for an IS auditor to confirm when assessing the security of a new cloud-based IT application that is linked with the organization’s existing technology?

   • AThe application programming interfaces (APIs) are adequately secured.
   • BThe on-premise database has adequate encryption at rest.
   • CThe cloud provider shares an external audit report.
   • DThe organization has a flat network structure.

   Show answer

   Answer: A

   Explanation

   A. The application programming interfaces (APIs) are adequately secured. When assessing the security of a new cloud-based IT application linked with an organization's existing technology, the most important concern for an IS (Information Systems) auditor is to confirm that the application programming interfaces (APIs) are adequately secured. APIs play a critical role in connecting different components of a system and often act as gateways for data and functionality. Insecure APIs can pose a significant security risk, potentially allowing unauthorized access, data breaches, or other security vulnerabilities.

   Source: Adapted from community discussion — SuperMax

   Next question

4. Question 1404 · 1459 in bank

   What would be the PRIMARY reason for an IS auditor to recommend using key risk indicators (KRIs)?

   • ATo keep the risk register updated
   • BTo eliminate unnecessary risk
   • CTo determine whether risk is changing
   • DTo align resources with the greatest risk

   Show answer

   Answer: C

   Explanation

   The PRIMARY reason for an IS (Information Systems) auditor to recommend using key risk indicators (KRIs) is: C. To determine whether risk is changing. Key risk indicators (KRIs) are metrics or data points that provide early warning signs of potential changes in risk. They help organizations monitor and assess the evolving risk landscape. By using KRIs, IS auditors can identify shifts in risk levels and take proactive measures to mitigate those risks before they escalate. KRIs provide a way to monitor and track risk in real-time or at regular intervals, making it easier to assess whether risk is increasing, decreasing, or remaining stable. While the other options (A, B, and D) are important considerations in risk management and auditing, the primary purpose of KRIs is to provide insight into the changing nature of risks, allowing organizations to respond effectively.

   Source: Adapted from community discussion — SuperMax

   Next question

5. Question 1405 · 1459 in bank

   A matrix showing the current state and challenges of an organization’s software release management practices is MOST useful for:

   • Awriting up an internal audit report.
   • Bdetermining the overall maturity level.
   • Cimproving the developer experience.
   • Dseeking approval for new tooling.

   Show answer

   Answer: B

   Explanation

   Such a matrix can provide a visual representation of the current state of software release management practices, highlighting areas of strength and weakness. This information is valuable for assessing the maturity level of the organization's processes. It can help identify where improvements are needed and guide efforts to enhance the overall maturity of the software release management practices. This is crucial for organizations looking to optimize their software development and release processes.

   Source: Adapted from community discussion — FAGFUR

   Next question

6. Question 1406 · 1459 in bank

   Which of the following is the BEST way to prevent social engineering incidents?

   • AEnsure user workstations are running the most recent version of antivirus software.
   • BInclude security responsibilities in job descriptions and require signed acknowledgment.
   • CMaintain an onboarding and annual security awareness program.
   • DEnforce strict email security gateway controls.

   Show answer

   Answer: C

   Explanation

   The best way to prevent social engineering incidents is through education and awareness. By maintaining an ongoing security awareness program, organizations can educate employees about the various tactics used in social engineering attacks and empower them to recognize and respond appropriately to potential threats. This approach helps create a security-conscious culture within the organization, making employees more vigilant and less susceptible to social engineering attempts.

   Source: Adapted from community discussion — FAGFUR

   Next question

7. Question 1407 · 1459 in bank

   Which of the following is the BEST way to reduce the attack surface for a server farm?

   • AImplement effective vulnerability management procedures.
   • BUninstall unnecessary applications and services.
   • CEvaluate server configuration periodically.
   • DEnsure applications are periodically patched.

   Show answer

   Answer: B

   Explanation

   B. Uninstall unnecessary applications and services. Uninstall unnecessary applications and services: This is the best option because it directly reduces the attack surface by removing software and services that are not needed. Fewer applications and services mean fewer potential points of entry for attackers, making the environment more secure. In practice, a combination of these measures is typically used to enhance server farm security. However, if you had to choose the single "BEST" way to reduce the attack surface, uninstalling unnecessary applications and services would be the most effective initial step.

   Source: Adapted from community discussion — SuperMax

   Next question

8. Question 1408 · 1459 in bank

   During a follow-up audit, an IS auditor learns that some key management personnel have been replaced since the original audit, and current management has decided not to implement some previously accepted recommendations. What is the auditor's BEST course of action?

   • ARetest the control.
   • BNotify the audit manager.
   • CClose the audit finding.
   • DNotify the chair of the audit committee

   Show answer

   Answer: B

   Explanation

   When management changes and previously accepted recommendations are not being implemented, the IS auditor's best course of action is to notify the audit manager. The audit manager can then discuss the issue with the appropriate personnel to determine the rationale behind the decision and assess the impact on risk

   Source: Adapted from community discussion — SBD600

   Next question

9. Question 1409 · 1459 in bank

   Which of the following is the BEST indication that an IT service desk function needs to improve its incident management processes?

   • AInformation found in many incident records is incomplete
   • BThe service desk spends most of its time on recurring incidents
   • CBack-end releases are the major cause of system disruptions
   • DService level metrics for resolution time have not been met several times

   Show answer

   Answer: D

   Explanation

   D. Service level metrics for resolution time have not been met several times This option suggests that the service desk is consistently failing to meet its service level agreements (SLAs) for incident resolution time. Failing to meet SLAs indicates a systemic issue with incident management processes, which could involve a variety of factors such as inefficient workflows, inadequate resources, or ineffective prioritization. It also directly impacts the quality of service provided to users, making it a key indicator for improvement. While the other options (A, B, and C) may also point to potential issues within the incident management process, they are not as directly tied to the overall effectiveness and impact on service quality as failing to meet SLAs for resolution time.

   Source: Adapted from community discussion — SuperMax

   Next question

10. Question 1410 · 1459 in bank

    The PRIMARY benefit of automating application testing is to:

    • Areduce the time to review code
    • Bprovide test consistency
    • Creplace all manual test processes
    • Dprovide more flexibility

    Show answer

    Answer: B

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISA practice, question 1401. 1459 questions available.