Certified Information Systems Auditor1,459 questions across 146 pages are complete and free, with no account or card.
1459 questions in this bank
Free access · progress saved on this device
Which of the following should be of GREATEST concern to an IS auditor when using data analytics?
Answer: A
Data integrity is paramount when conducting data analytics, as the accuracy and reliability of the results hinge on the quality of the data used.
Source: Adapted from community discussion — FAGFUR
Which of the following BEST indicates that an organization's risk management practices contribute to the effectiveness of internal IS audits?
Answer: B
The correct answer is A, The audit team participates in risk scenario development workshops. The participation of the audit team in risk scenario development workshops is an indication that the organization's risk management practices are contributing to the effectiveness of internal IS audits. Risk scenario development involves identifying and analyzing potential risks and vulnerabilities that could affect the organization's information systems and networks. By participating in risk scenario development workshops, the audit team can gain a better understanding of the organization's risk profile and the potential impact of different types of risks on the organization's operations and objectives. This knowledge can help the audit team to more effectively identify and assess risks during internal IS audits, leading to more accurate and relevant audit findings and recommendations.
Source: Adapted from community discussion — Staanlee
An IS auditor notes that an organization's DevOps team has both production and developer access. The head of IT operations agrees that there is a segregation of duties concern but considers both types of access to be necessary for the team. Which of the following is the auditor's BEST recommendation?
Answer: D
The correct answer is D, Implement an automated control to prevent deployment if the developer is also trying to deploy the change. In this scenario, the IS auditor has identified a segregation of duties concern, which is a principle that is intended to ensure that no single individual has complete control over a process or system. By having both production and developer access, the DevOps team may be able to both develop and deploy changes to the organization's systems, potentially leading to conflicts of interest or the potential for fraud or abuse. To address this concern, the auditor's best recommendation would be to implement an automated control that prevents deployment if the developer is also trying to deploy the change. This would ensure that there is a separation between the development and deployment of changes, and it would help to reduce the risk of potential conflicts of interest or abuse.
Source: Adapted from community discussion — Staanlee
An organization has outsourced the maintenance of its customer database to an external vendor, and the vendor has requested live data to test the performance of the database. Which of the following is MOST important for the IS auditor to recommend?
Answer: D
The correct answer is D, Ensure data transfer details are specified in the service engagement contract. When an organization outsources the maintenance of its customer database to an external vendor, it is important for the IS auditor to ensure that the data transfer details are specified in the service engagement contract. This includes the specific types of data that will be shared with the vendor, the purpose of the data transfer, and any security measures that will be implemented to protect the data during the transfer. By specifying these details in the contract, the organization can ensure that the data transfer is conducted in a secure and transparent manner, and it can help to mitigate the risk of data breaches or unauthorized access to sensitive customer data.
Source: Adapted from community discussion — Staanlee
An IS auditor is verifying the adequacy of an organization's internal controls and is concerned about potential circumvention of regulations. Which of the following is the BEST sampling method to use?
Answer: B
The use of control totals satisfies which of the following control objectives?
Answer: A
The correct answer is A, Processing integrity. Option B, transaction integrity, is not a control objective that is directly related to control totals. Transaction integrity refers to the ability to ensure that individual transactions are recorded and processed accurately, without errors or unauthorized changes. Option C, distribution control, is not a control objective that is directly related to control totals. Distribution control refers to the ability to ensure that authorized users receive the correct information or resources in a timely and secure manner. Option D, system recoverability, is not a control objective that is directly related to control totals. System recoverability refers to the ability to restore a system or application to a known good state after a disruption or failure.
Source: Adapted from community discussion — Staanlee
An organization outsources its IT function to a third-party provider that supplies all hardware and support personnel. Which of the following poses the GREATEST risk that the provider's IT resources may not be available to meet the organization's objectives?
Answer: D
The greatest risk that the provider's IT resources may not be available to meet the organization's objectives is associated with the absence or inadequacy of Service Level Agreements (SLAs). SLAs define the agreed-upon levels of service, including performance expectations, availability targets, response times, and other key metrics. If SLAs are not established or are not properly monitored, there is a significant risk that the service provider may not deliver the expected level of service, leading to potential disruptions in IT resources. The establishment and monitoring of SLAs are crucial for ensuring that the service provider meets the organization's objectives in terms of IT resource availability.
Source: Adapted from community discussion — FAGFUR
Which of the following should be of MOST concern to an IS auditor reviewing a system interface that exchanges data across borders?
Answer: D
Which of the following biometric authentication methods has the LOWEST false acceptance rate?
Answer: C
Which of the following is MOST important for an IS auditor to confirm upon learning that an organization utilizes storage virtualization for key systems in their environment?
Answer: B
The correct answer is B, Redundancy is included in the storage architecture. Storage virtualization is a technique that allows an organization to create a virtualized storage environment by pooling together physical storage resources from multiple devices into a single logical storage unit. This can provide benefits such as increased storage capacity, improved storage utilization, and easier management of storage resources. However, it is important for an IS auditor to confirm that redundancy is included in the storage architecture to ensure that the virtualized storage environment is resilient and can continue to function in the event of a hardware failure or other disruption.
Source: Adapted from community discussion — Staanlee
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CISA practice, question 1421. 1459 questions available.
Version 1.0.0. How we source questions