CISA practice questions 141–150

1. Question 141 · 1459 in bank

   Which of the following is the MOST important control for virtualized environments?

   • AHardening for the hypervisor and guest machines
   • BRegular updates of policies for the operation of the virtualized environment
   • CRedundancy of hardware resources and network components
   • DMonitoring utilization of resources at the guest operating system level

   Show answer

   Answer: A

   Explanation

   Hardening involves securing the hypervisor and guest machines by implementing best practices for security configurations. Virtualized environments, which rely on hypervisors to manage multiple virtual machines, require robust hardening measures to prevent security vulnerabilities and unauthorized access. While regular updates of policies, redundancy of hardware resources, and monitoring resource utilization are also important controls, hardening ensures a strong foundational security posture for the virtualized infrastructure.

   Source: Adapted from community discussion — FAGFUR

   Next question

2. Question 142 · 1459 in bank

   Which of the following would aid an IS auditor reviewing the integrity of program changes migrated into production?

   • AConfiguration management system
   • BDatabase schema
   • CTape management system
   • DOperating system log data

   Show answer

   Answer: A

   Explanation

   The configuration management system is specifically designed to manage and control changes to the software and configurations in a systematic manner.

   Source: Adapted from community discussion — FAGFUR

   Next question

3. Question 143 · 1459 in bank

   Which of the following provides the BEST assurance of data integrity after file transfers?

   • ACheek digits
   • BMonetary unit sampling
   • CReasonableness check
   • DHash values

   Show answer

   Answer: D

   Explanation

   Comparing the hash value before and after the transfer allows for the detection of any alterations or corruption in the data.

   Source: Adapted from community discussion — FAGFUR

   Next question

4. Question 144 · 1459 in bank

   Which of the following is the PRIMARY purpose of a post-implementation review?

   • ATo ensure project resources were optimized
   • BTo ensure project deliverables were provided on time
   • CTo determine whether expected benefits were realized from a project
   • DTo calculate a project's actual cost against the projected cost

   Show answer

   Answer: C

   Next question

5. Question 145 · 1459 in bank

   Which of the following is MOST important to consider when reviewing an organization's defined data backup and restoration procedures?

   • AMean time to restore (MTTR)
   • BMean time between failures (MTBF)
   • CRecovery point objective (RPO)
   • DBusiness continuity plan (BCP)

   Show answer

   Answer: C

   Explanation

   The Recovery Point Objective (RPO) is a critical aspect of backup procedures, representing the maximum allowable data loss in the event of a disruption. It defines the point in time to which data must be restored to resume normal operations. Understanding the RPO helps ensure that the organization's backup and restoration procedures align with business requirements for data recovery.

   Source: Adapted from community discussion — FAGFUR

   Next question

6. Question 146 · 1459 in bank

   When assessing a proposed project for the two-way replication of a customer database with a remote call center, the IS auditor should ensure that:

   • Aend users are trained in the replication process.
   • Bthe source database is backed up on both sites.
   • Cuser rights are identical on both databases.
   • Ddatabase conflicts are managed during replication.

   Show answer

   Answer: D

   Explanation

   Two-way replication involves synchronizing data between two databases in both directions. Database conflicts can occur when changes are made to the same data in both databases simultaneously, and managing these conflicts is crucial to ensure data consistency and integrity.

   Source: Adapted from community discussion — FAGFUR

   Next question

7. Question 147 · 1459 in bank

   In which phase of the audit life cycle process are audit observations initially discussed with the client?

   • AFollow-up phase
   • BPlanning phase
   • CExecution phase
   • DReporting phase

   Show answer

   Answer: C

   Explanation

   Throughout the audit, audit clients will be informed of the audit process through regular status meetings and/or communications. The audit team makes every effort to discuss audit observations, potential issues, and proposed recommendations as they are identified. In some instances, it is necessary to work directly with audit clients to determine or validate the root cause and discuss ways to eliminate the root cause.

   Source: Adapted from community discussion — SuperMax

   Next question

8. Question 148 · 1459 in bank

   Management states that a recommendation made during a prior audit has been implemented, but the IS auditor doubts the effectiveness of the actions taken. Which of the following is the auditor’s MOST appropriate course of action?

   • AReport to audit management that the actions taken have not effectively addressed the original risk.
   • BMake an additional recommendation on how to remediate the finding.
   • CPerform testing or other audit procedures to confirm the status of the original risk.
   • DRecommend external verification of management's preferred actions.

   Show answer

   Answer: C

   Explanation

   When there is doubt about the effectiveness of actions taken in response to a prior audit recommendation, the IS auditor's most appropriate course of action is to perform testing or other audit procedures to confirm the status of the original risk. This involves verifying whether the implemented controls are working as intended and have effectively addressed the identified issues. It allows the auditor to gather evidence and assess the adequacy of the measures taken by management.

   Source: Adapted from community discussion — FAGFUR

   Next question

9. Question 149 · 1459 in bank

   Which of the following types of testing BEST ensures business requirements are met prior to software release?

   • ALoad balance testing
   • BUser acceptance testing (UAT)
   • CEnd-to-end testing
   • DFunctional testing

   Show answer

   Answer: B

   Explanation

   User acceptance testing (UAT) is designed to ensure that the software meets business requirements and is acceptable to end users before it is released. During UAT, end users or representatives of the intended audience test the software to verify that it functions correctly and satisfies their needs. This type of testing helps identify any discrepancies between the expected and actual outcomes and allows stakeholders to provide feedback on whether the software meets their business requirements.

   Source: Adapted from community discussion — FAGFUR

   Next question

10. Question 150 · 1459 in bank

    Which of the following methods BEST enforces data leakage prevention in a multi-tenant cloud environment?

    • AMonitoring tools are configured to alert in case of downtime.
    • BA comprehensive security review is performed every quarter.
    • CData for different tenants is segregated by database schema
    • DTenants are required to implement data classification policies.

    Show answer

    Answer: C

    Explanation

    Option C. In a multi-tenant cloud environment, where multiple tenants share the same infrastructure, it is essential to ensure that data is kept separate and secure to prevent data leakage. Segregating data by database schema is a common method for enforcing data leakage prevention in a multi-tenant cloud environment. This method involves creating separate database schemas for each tenant, ensuring that data is stored and managed separately, and access is restricted to authorized users. While monitoring tools, comprehensive security reviews, and data classification policies are all important methods for enforcing data leakage prevention, they are not as effective as segregating data by database schema in a multi-tenant cloud environment. Segregating data by database schema helps ensure that data is kept separate and secure, minimizing the risk of data leakage and protecting the confidentiality and integrity of the data.

    Source: Adapted from community discussion — SRJ13

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISA practice, question 141. 1459 questions available.