CISA practice questions 1,411–1,420

1. Question 1411 · 1459 in bank

   Which of the following BEST enables an IS auditor to prioritize financial reporting spreadsheets for an end-user computing (EUC) audit?

   • AUnderstanding the purpose of each spreadsheet
   • BAscertaining which spreadsheets are most frequently used
   • CIdentifying the spreadsheets with built-in macros
   • DReviewing spreadsheets based on file size

   Show answer

   Answer: A

   Explanation

   A. Understanding the purpose of each spreadsheet Understanding the purpose of each spreadsheet is crucial because it allows the auditor to assess the relevance and significance of each spreadsheet in the financial reporting process. This understanding helps the auditor identify which spreadsheets are more critical for financial reporting and may have a higher risk associated with them. By knowing the purpose, the auditor can make informed decisions about which spreadsheets should be audited first or receive more attention during the EUC audit. While options B, C, and D can also provide useful information, they are not as comprehensive or as directly related to the significance of the spreadsheets in the financial reporting process as understanding their purpose.

   Source: Adapted from community discussion — SuperMax

   Next question

2. Question 1412 · 1459 in bank

   Which of the following is the MOST critical factor for the successful implementation of an IT governance framework?

   • AAlignment with industry benchmarks
   • BAlignment with business strategy
   • CAlignment with information security standards
   • DAlignment with a risk management framework

   Show answer

   Answer: B

   Explanation

   Aligning the IT governance framework with the business strategy is crucial for its success. IT exists to support and enable the achievement of business objectives. When the IT governance framework is closely aligned with the overall business strategy, it ensures that IT activities and investments are in line with the organization's goals and priorities. This alignment helps in optimizing IT resources, improving decision-making processes, and ensuring that IT initiatives contribute effectively to the success of the business. While alignment with industry benchmarks, information security standards, and risk management frameworks are important, the overarching connection to the business strategy is fundamental.

   Source: Adapted from community discussion — FAGFUR

   Next question

3. Question 1413 · 1459 in bank

   During an investigation, it was determined that an employee leaked company system administrative credentials on a public social media site. What is the IS auditor’s FIRST recommendation?

   • AProsecute the employee
   • BChange privileged passwords
   • CInitiate forensic investigation
   • DInitiate shutdown of the system

   Show answer

   Answer: B

   Explanation

   Changing privileged passwords is a critical first step to mitigate the potential security risks associated with the leaked credentials. This action helps prevent unauthorized access to systems and sensitive information. After changing passwords, further investigation and analysis can be conducted, including a forensic investigation if necessary, to determine the extent of the breach, identify any additional security measures needed, and address any policy violations by the employee. While legal actions like prosecution might be considered later based on the severity and nature of the incident, the immediate focus is on securing the systems by changing passwords.

   Source: Adapted from community discussion — FAGFUR

   Next question

4. Question 1414 · 1459 in bank

   A transaction processing system interfaces with the general ledger. Data analytics has identified that some transactions are being recorded twice in the general ledger. While management states a system fix has been implemented, what should the IS auditor recommend to validate the interface is working in the future?

   • APerform periodic reconciliations.
   • BImprove user acceptance testing (UAT).
   • CEnsure system owner sign-off for the system fix.
   • DConduct functional testing.

   Show answer

   Answer: A

   Explanation

   The IS auditor should recommend option A: Perform periodic reconciliations. Here's why: A. Perform periodic reconciliations: This is the most appropriate recommendation because it involves regularly comparing the data between the transaction processing system and the general ledger to ensure that transactions are not being recorded twice. This ongoing process helps in identifying and resolving any discrepancies promptly, ensuring the interface is working correctly. Reconciliation is a fundamental control for detecting errors and fraud in financial systems.

   Source: Adapted from community discussion — SuperMax

   Next question

5. Question 1415 · 1459 in bank

   Which of the following BEST enables an organization to control which software can be installed on a user’s computer?

   • AAccess list
   • BCapabilities list
   • CBaseline list
   • DBlocked list

   Show answer

   Answer: C

   Explanation

   C. Baseline List: A baseline list, in this context, refers to a list of approved or standard software that is permitted for installation on user computers. Organizations often use such lists to maintain control over the software environment, ensuring that only authorized and vetted applications are installed. This helps in managing security risks, software licensing, and system compatibility.

   Source: Adapted from community discussion — KAP2HURUF

   Next question

6. Question 1416 · 1459 in bank

   Which of the following indicators would BEST demonstrate the efficiency of a help desk operation?

   • AThe percentage of system uptime supported
   • BThe percentage of tickets resolved over a period of time
   • CNumber of calls received per day
   • DThe number of users supported

   Show answer

   Answer: B

   Explanation

   The efficiency of a help desk operation is often best demonstrated by the ability to resolve issues in a timely manner. The percentage of tickets resolved over a period of time, is a KPI that reflects how effectively the help desk is addressing and resolving user-reported issues. The terms of efficiency in issue resolution, the percentage of tickets resolved is a more direct and relevant metric.

   Source: Adapted from community discussion — FAGFUR

   Next question

7. Question 1417 · 1459 in bank

   Which of the following should be identified FIRST when assessing the maturity level of an organization’s vulnerability management practices?

   • AApplicable IT governance framework
   • BKey security team members to interview
   • CApplicable security framework
   • DScope of vulnerability reports

   Show answer

   Answer: C

   Explanation

   The correct answer is C, Applicable security framework. When assessing the maturity level of an organization's vulnerability management practices, it is important to identify the applicable security framework that the organization is using or following. A security framework is a set of guidelines, standards, and best practices that organizations can use to establish and maintain a secure environment for their information systems and networks. There are many different security frameworks available, such as the NIST Cybersecurity Framework (CSF), the ISO 27001 standard, and the Center for Internet Security (CIS) Controls. Identifying the applicable security framework will help to provide a benchmark or reference point for evaluating the organization's current vulnerability management practices and identifying areas for improvement.

   Source: Adapted from community discussion — Staanlee

   Next question

8. Question 1418 · 1459 in bank

   An organization wants an independent measure of an outsourced system's availability. This measure is directly related to contractual payment obligations. Which of the following procedures would an IS auditor MOST likely recommend?

   • ARequiring end users to report any service disruptions
   • BPolling the remote service at regular intervals
   • CScanning for errors or warnings from system logs
   • DComparing downtime to approved maintenance windows

   Show answer

   Answer: B

   Explanation

   The IS auditor would most likely recommend option B: Polling the remote service at regular intervals. Polling the remote service at regular intervals, is a common approach to independently measure the availability of an outsourced system. It involves automated monitoring tools that regularly check the status of the remote service. This approach provides real-time or near-real-time data on availability without relying solely on user reports or internal logs. It offers an objective and independent measure that can be used for contractual payment obligations.

   Source: Adapted from community discussion — SuperMax

   Next question

9. Question 1419 · 1459 in bank

   Which of the following is the MOST efficient approach for backing up large quantities of information in a critical system that must be online 24 hours a day?

   • AFull backup to tape daily and incremental backup weekly
   • BHot site with identical server and storage
   • CFault-tolerant disk-to-disk solution
   • DStorage area network (SAN)

   Show answer

   Answer: C

   Next question

10. Question 1420 · 1459 in bank

    An organization wants to classify database tables according to its data classification scheme. From an IS auditor's perspective, the tables should be classified based on the:

    • Aspecific functional contents of each single table.
    • Bfrequency of updates to the table.
    • Cnumber of end users with access to the table.
    • Ddescriptions of column names in the table.

    Show answer

    Answer: A

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISA practice, question 1411. 1459 questions available.