CISA practice questions 1,431–1,440

1. Question 1431 · 1459 in bank

   As part of a payroll department IS audit, which of the following is the PRIMARY reason an IS auditor would recommend that a supervisor review exception reports before authorizing payments?

   • ATo identify unusual fluctuations or changes in any employee's monthly pay
   • BTo evaluate gaps between employee performance and salary adjustments
   • CTo verify the accuracy of bank account information for payroll deposit
   • DTo collect statistical information in preparation for future pay scale reviews

   Show answer

   Answer: A

   Explanation

   A. To identify unusual fluctuations or changes in any employee's monthly pay. Exception reports typically highlight anomalies or deviations from established norms. In the context of a payroll department, these reports would be used to identify any irregularities or unexpected changes in an employee's monthly pay. This is crucial for fraud detection and ensuring that employees are paid correctly. While the other options (B, C, and D) may also be important aspects of payroll processing, the primary focus of reviewing exception reports is to catch and investigate any unusual or unauthorized changes in employee pay, making option A the most relevant choice.

   Source: Adapted from community discussion — SuperMax

   Next question

2. Question 1432 · 1459 in bank

   Which of the following is the PRIMARY objective of enterprise architecture (EA)?

   • AEnforcing the IT policy across the organization
   • BManaging and planning for IT investments
   • CExecuting customized development and delivery of projects
   • DMaintaining detailed system documentation

   Show answer

   Answer: B

   Next question

3. Question 1433 · 1459 in bank

   Management is concerned about sensitive information being intentionally or unintentionally emailed as attachments outside the organization by employees. What is the MOST important task before implementing any associated email controls?

   • AProvide notification to employees about possible email monitoring.
   • BDevelop an information classification scheme.
   • CDevelop an acceptable use policy for end-user computing (EUC).
   • DRequire all employees to sign nondisclosure agreements (NDAs).

   Show answer

   Answer: B

   Explanation

   It fails to be A because of the last statement in the question, "What is the MOST important task BEFORE implementing any associated email controls?"

   Source: Adapted from community discussion — Ngwenya

   Next question

4. Question 1434 · 1459 in bank

   An IS auditor observes that each department follows a different approach for creating and securing spreadsheet macros. Which of the following is the auditor's BEST recommendation for management in this situation?

   • AProvide end-user training on spreadsheet macro development.
   • BProhibit further development of end-user computing (EUC) applications by end users.
   • CImplement an end-user computing (EUC) governance framework.
   • DSecure the folders where macro-enabled spreadsheets are stored.

   Show answer

   Answer: C

   Explanation

   C. Implement an end-user computing (EUC) governance framework. In a situation where each department follows a different approach for creating and securing spreadsheet macros, the best recommendation for management is to implement an end-user computing (EUC) governance framework. Implementing an EUC governance framework involves creating standardized policies and procedures for the development and use of spreadsheet macros across the organization. It ensures that there are consistent guidelines for macro development, security, and management. This approach not only helps in improving security but also enhances efficiency and reduces risks associated with inconsistent practices.

   Source: Adapted from community discussion — SuperMax

   Next question

5. Question 1435 · 1459 in bank

   Which of the following is the MOST effective method of destroying sensitive data stored on electronic media?

   • APhysical destruction
   • BRandom character overwrite
   • CDegaussing
   • DLow-level formatting

   Show answer

   Answer: A

   Explanation

   A. Physical destruction Physical destruction is typically considered the most effective method of destroying sensitive data stored on electronic media. This involves physically damaging the storage medium, such as hard drives or solid-state drives, to the point where data recovery is practically impossible. Common methods of physical destruction include shredding, crushing, or incinerating the media. While other methods like random character overwrite (often called data wiping or secure erasure), degaussing, and low-level formatting can be effective to some extent, physical destruction ensures that the data cannot be recovered because the underlying storage media is physically destroyed. This is especially important for highly sensitive or classified information where there should be no chance of data recovery.

   Source: Adapted from community discussion — SuperMax

   Next question

6. Question 1436 · 1459 in bank

   Which of the following BEST enables an organization to verify whether an encrypted message sent by a client has been altered?

   • AThe date and time stamp of the received message
   • BThe digital signature
   • CThe sender’s private key
   • DThe message header

   Show answer

   Answer: B

   Explanation

   A digital signature is a cryptographic technique that allows the recipient of a message to verify the authenticity and integrity of the message. When a message is signed with a private key, anyone with the corresponding public key can verify that the message was indeed signed by the entity claiming to be the sender, and that the message has not been altered in transit.

   Source: Adapted from community discussion — FAGFUR

   Next question

7. Question 1437 · 1459 in bank

   Which of the following BEST enables an organization to improve the visibility of end-user computing (EUC) applications that support regulatory reporting?

   • AEUC tests of operational effectiveness
   • BEUC access control matrix
   • CEUC availability controls
   • DEUC inventory

   Show answer

   Answer: D

   Explanation

   The correct answer is D, EUC inventory. An EUC inventory is a list of all the end-user computing (EUC) applications that are used by an organization. EUC applications are software programs that are used by employees or other end users to perform their work duties, such as word processing, spreadsheet management, or data analysis. By maintaining an EUC inventory, an organization can improve the visibility of EUC applications that support regulatory reporting. This can help to ensure that all relevant EUC applications are properly documented and accounted for, and it can help to ensure that the organization is compliant with relevant regulations and standards.

   Source: Adapted from community discussion — Staanlee

   Next question

8. Question 1438 · 1459 in bank

   An IS auditor has been asked to investigate critical business applications that have been producing suspicious results. Which of the following should be done FIRST?

   • AEvaluate control design
   • BEvaluate incident management
   • CReview configuration management
   • DReview user access rights

   Show answer

   Answer: B

   Explanation

   When critical business applications are producing suspicious results, the first step should be to evaluate incident management. Incident management involves the identification, reporting, and resolution of security incidents. Investigating suspicious results in critical business applications falls under the purview of incident management. By evaluating incident management first, the IS auditor can determine how the organization handles and responds to security incidents, including those related to critical applications. This involves understanding the process of detecting and responding to incidents, as well as the procedures in place for investigating and resolving issues with the applications.

   Source: Adapted from community discussion — FAGFUR

   Next question

9. Question 1439 · 1459 in bank

   Which of the following should be the FIRST step to successfully implement a corporate data classification program?

   • ACheck for the required regulatory requirements.
   • BSelect a data loss prevention (DLP) protocol.
   • CConfirm that adequate resources are available for the project.
   • DApprove a data classification policy.

   Show answer

   Answer: A

   Explanation

   The first step to successfully implement a corporate data classification program should be to check for the required regulatory requirements. Understanding the regulatory environment is crucial because it provides the foundation for the data classification program. Different industries and regions may have specific regulations that dictate how certain types of data should be classified, handled, and protected. Once you are aware of the regulatory requirements, you can then move on to other steps such as confirming resource availability, selecting appropriate data loss prevention (DLP) protocols, and ultimately approving a data classification policy. However, starting with a clear understanding of regulatory requirements helps ensure that the data classification program aligns with legal and compliance obligations.

   Source: Adapted from community discussion — FAGFUR

   Next question

10. Question 1440 · 1459 in bank

    Which of the following is BEST supported by enforcing data definition standards within a database?

    • AData confidentiality
    • BData security
    • CData formatting
    • DData retention

    Show answer

    Answer: B

    Explanation

    B. Data security Enforcing data definition standards within a database is primarily aimed at ensuring data security. Data security encompasses various aspects such as data confidentiality, data integrity, and data availability. By implementing data definition standards, you can establish rules and constraints on how data is structured, stored, and accessed within the database. These standards can include access controls, encryption, and authentication mechanisms, which are essential for protecting data from unauthorized access, tampering, or loss. Therefore, while data formatting and retention are important aspects of database management, data security is the primary concern when enforcing data definition standards.

    Source: Adapted from community discussion — SuperMax

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISA practice, question 1431. 1459 questions available.