CISA practice questions 151–160

1. Question 151 · 1459 in bank

   An IS auditor requests direct access to data required to perform audit procedures instead of asking management to provide the data. Which of the following is the PRIMARY advantage of this approach?

   • AProfessionalism
   • BAudit efficiency
   • CAudit transparency
   • DData confidentiality

   Show answer

   Answer: B

   Explanation

   The primary advantage of an IS auditor directly accessing the data needed to perform audit procedures is audit efficiency. By having direct access, the auditor can retrieve the necessary data in a timely and efficient manner without relying on management to provide it. This reduces delays and streamlines the audit process, allowing the auditor to perform procedures more quickly and effectively.

   Source: Adapted from community discussion — FAGFUR

   Next question

2. Question 152 · 1459 in bank

   An IS auditor finds a segregation of duties issue in an enterprise resource planning (ERP) system. Which of the following is the BEST way to prevent the misconfiguration from recurring?

   • AMonitoring access rights on a regular basis
   • BReferencing a standard user-access matrix
   • CCorrecting the segregation of duties conflicts
   • DGranting user access using a role-based model

   Show answer

   Answer: D

   Explanation

   D: Granting user access using a role-based model. Granting user access using a role-based model: This is the best approach because it involves designing access control based on roles and responsibilities within the organization. A well-designed role-based model should inherently address segregation of duties issues by defining roles that have specific access permissions that align with job functions. By implementing a role-based access control system, you can prevent users from having conflicting permissions, reducing the risk of segregation of duties issues from occurring in the first place. So, option D is the most proactive and effective way to prevent the misconfiguration from recurring.

   Source: Adapted from community discussion — SuperMax

   Next question

3. Question 153 · 1459 in bank

   Which of the following should be the FIRST consideration when deciding whether data should be moved to a cloud provider for storage?

   • AData classification
   • BVendor cloud certification
   • CData storage costs
   • DService level agreements (SLAs)

   Show answer

   Answer: A

   Explanation

   The first consideration when deciding whether data should be moved to a cloud provider for storage should be data classification. Data classification involves categorizing data based on its sensitivity, importance, and regulatory requirements. It helps determine the appropriate level of security controls, access restrictions, and other measures needed to protect the data. Understanding the classification of data is crucial because it guides decisions on where and how the data should be stored, the level of encryption required, and the security measures that need to be in place. Different types of data may have different security and compliance requirements, and this should be assessed before making decisions about cloud storage.

   Source: Adapted from community discussion — FAGFUR

   Next question

4. Question 154 · 1459 in bank

   Which of the following is the MOST cost-effective way to determine the effectiveness of a business continuity plan (BCP)?

   • AStress test
   • BTabletop exercise
   • CFull operational test
   • DPost-implementation review

   Show answer

   Answer: B

   Explanation

   The most cost-effective way to determine the effectiveness of a business continuity plan (BCP) is a tabletop exercise. In a tabletop exercise, participants discuss and simulate various disaster scenarios in a non-disruptive and controlled environment. It involves key stakeholders going through the plan, identifying strengths and weaknesses, and discussing how they would respond to specific events. Tabletop exercises are generally less resource-intensive and less disruptive than full operational tests or stress tests. They provide an opportunity to validate and improve the plan without the need for extensive downtime or resource allocation. This makes them a cost-effective method for assessing the BCP's effectiveness.

   Source: Adapted from community discussion — FAGFUR

   Next question

5. Question 155 · 1459 in bank

   An organization's security policy mandates that all new employees must receive appropriate security awareness training. Which of the following metrics would BEST assure compliance with this policy?

   • ANumber of new hires who have violated enterprise security policies
   • BPercentage of new hires that have completed the training
   • CNumber of reported incidents by new hires
   • DPercentage of new hires who report incidents

   Show answer

   Answer: B

   Explanation

   Not that it's straight forward. But getting the question. Assure compliance to this policy is the key, thus answer is B. But C or D could be the answer if probably asking to measure the effectiveness. My guess.

   Source: Adapted from community discussion — d43268b

   Next question

6. Question 156 · 1459 in bank

   An IT balanced scorecard is BEST used for which of the following purposes?

   • AMonitoring strategic performance
   • BEvaluating IT’s financial position
   • CMeasuring risk in IT processes
   • DEvaluating business processes

   Show answer

   Answer: A

   Explanation

   An IT balanced scorecard is best used for monitoring strategic performance. The balanced scorecard is a strategic management tool that translates an organization's strategy into a set of performance indicators, providing a comprehensive view of its performance from various perspectives. In the context of IT, the IT balanced scorecard focuses on aligning IT activities with business objectives.

   Source: Adapted from community discussion — FAGFUR

   Next question

7. Question 157 · 1459 in bank

   The following findings are the result of an IS auditor’s post-implementation review of a newly implemented system. Which of the following findings is of GREATEST significance?

   • AThe project’s 10% budget overrun was not reported to senior management.
   • BA lessons-learned session was never conducted.
   • CMeasurable benefits were not defined.
   • DMonthly dashboards did not always contain deliverables.

   Show answer

   Answer: C

   Explanation

   Among the given findings, the one of greatest significance is that measurable benefits were not defined. This is because defining measurable benefits is a critical aspect of any project, allowing organizations to assess the success and impact of the implemented system. Without clearly defined measurable benefits, it becomes challenging to determine whether the project achieved its objectives and provided value to the organization.

   Source: Adapted from community discussion — FAGFUR

   Next question

8. Question 158 · 1459 in bank

   A company requires that all program change requests (PCRs) be approved and all modifications be automatically logged. Which of the following IS audit procedures will BEST determine whether unauthorized changes have been made to production programs?

   • AUse source code comparison software to determine whether any changes have been made to a sample of programs since the last audit date.
   • BReview a sample of PCRs for proper approval throughout the program change process.
   • CTrace a sample of complete PCR forms to the log of all program changes.
   • DTrace a sample of program changes from the log to completed PCR forms.

   Show answer

   Answer: D

   Explanation

   proposes tracing a sample of program changes from the log to completed PCR forms. While this is another useful audit procedure, it is also limited in providing assurance that unauthorized changes have not been made. In this case, a change could have been authorized through the PCR process but not recorded in the log, or the log itself could have been tampered with to hide unauthorized changes.

   Source: Adapted from community discussion — 3008

   Next question

9. Question 159 · 1459 in bank

   Which of the following should be restricted from a network administrator’s privileges in an adequately segregated IT environment?

   • AHardening network ports
   • BMonitoring network traffic
   • CChanging existing configurations for applications
   • DEnsuring transmission protocols are functioning correctly

   Show answer

   Answer: C

   Explanation

   In an adequately segregated IT environment, network administrators typically have responsibilities related to managing and maintaining network infrastructure. However, they should not have privileges to change existing configurations for applications. Application configurations are often the responsibility of application administrators or developers who have a deeper understanding of the specific requirements and functionalities of the applications.

   Source: Adapted from community discussion — FAGFUR

   Next question

10. Question 160 · 1459 in bank

    An incident response team has been notified of a virus outbreak in a network subnet. Which of the following should be the NEXT step?

    • ARemove and restore the affected systems.
    • BVerify that the compromised systems are fully functional.
    • CFocus on limiting the damage.
    • DDocument the incident.

    Show answer

    Answer: C

    Explanation

    When responding to a virus outbreak in a network subnet, the next step should be to focus on limiting the damage. This involves taking immediate actions to contain the spread of the virus and prevent further harm to systems and data. Common steps in limiting the damage include isolating infected systems, disconnecting affected segments of the network, and implementing temporary measures to stop the spread.

    Source: Adapted from community discussion — FAGFUR

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISA practice, question 151. 1459 questions available.