CISA practice questions 161–170

1. Question 161 · 1459 in bank

   Which of the following is the BEST source of information for examining the classification of new data?

   • ACurrent level of protection
   • BInput by data custodians
   • CSecurity policy requirements
   • DRisk assessment results

   Show answer

   Answer: C

   Explanation

   The best source of information for examining the classification of new data is security policy requirements. Security policies typically provide guidelines and criteria for classifying and handling different types of data based on sensitivity, confidentiality, and other factors. These policies establish the framework for data classification and help ensure consistency in how information is protected.

   Source: Adapted from community discussion — FAGFUR

   Next question

2. Question 162 · 1459 in bank

   Which of the following should be of GREATEST concern to an IS auditor who is assessing an organization’s configuration and release management process?

   • AThe organization does not use an industry-recognized methodology.
   • BChanges and change approvals are not documented.
   • CThere is no centralized configuration management database (CMDB).
   • DAll changes require middle and senior management approval.

   Show answer

   Answer: B

   Explanation

   B. Changes and change approvals are not documented. This is because the lack of documentation for changes and approvals can lead to a lack of accountability, traceability, and control. It can also make it difficult to verify that changes have been properly implemented and approved. This could potentially lead to unauthorized changes being made, which could impact the stability and security of the system. Therefore, it is crucial for an organization to document all changes and approvals as part of their configuration and release management process.

   Source: Adapted from community discussion — 3008

   Next question

3. Question 163 · 1459 in bank

   A web proxy server for corporate connections to external resources reduces organizational risk by:

   • Aload balancing traffic to optimize data pathways.
   • Bproviding multi-factor authentication for additional security.
   • Canonymizing users through changed IP addresses.
   • Dproviding faster response than direct access.

   Show answer

   Answer: C

   Explanation

   C. anonymizing users through changed IP addresses. A web proxy server can help reduce organizational risk by anonymizing users through changed IP addresses. This means that when employees access external resources through the proxy server, their actual IP addresses are hidden, and only the IP address of the proxy server is visible to external websites and services. This can provide an additional layer of security and privacy, making it more difficult for external entities to track or target individual users within the organization. This can help protect against various forms of cyber threats, including reconnaissance attacks and data leakage. While the other options mentioned (load balancing, multi-factor authentication, and faster response) can be benefits of using a web proxy server, they do not directly address the aspect of risk reduction associated with user anonymity.

   Source: Adapted from community discussion — SuperMax

   Next question

4. Question 164 · 1459 in bank

   An organization is planning to hire a third party to develop software. What is the MOST appropriate way for the organization to ensure access to code if the software development company goes out of business?

   • AEstablish a software escrow agreement.
   • BRequest a copy of the software.
   • CEstablish a service level agreement (SLA).
   • DRequest software licenses.

   Show answer

   Answer: A

   Explanation

   The most appropriate way for an organization to ensure access to code if the software development company goes out of business is to establish a software escrow agreement. A software escrow agreement involves depositing the source code and other critical materials related to the software with a neutral third party, known as the escrow agent. If the software development company faces financial difficulties, bankruptcy, or goes out of business, the escrow agent releases the source code to the organization, ensuring continued access and the ability to maintain and support the software.

   Source: Adapted from community discussion — FAGFUR

   Next question

5. Question 165 · 1459 in bank

   An organization is enhancing the security of a client-facing web application following a proposal to acquire personal information for a business purpose. Which of the following is MOST important to review before implementing this initiative?

   • AData ownership assignments
   • BRegulatory compliance requirements
   • CCustomer notification procedures
   • DEncryption capabilities

   Show answer

   Answer: B

   Next question

6. Question 166 · 1459 in bank

   Which of the following business continuity activities prioritizes the recovery of critical functions?

   • ABusiness impact analysis (BIA)
   • BRisk assessment
   • CBusiness continuity plan (BCP) testing
   • DDisaster recovery plan (DRP) testing

   Show answer

   Answer: A

   Explanation

   The BIA is explicitly designed to identify and prioritize critical business functions and their required recovery times. This is a strategic assessment that informs both the Business Continuity Plan (BCP) and the Disaster Recovery Plan (DRP). DRP testing is a tactical exercise that ensures the recovery procedures for IT systems work as intended. It verifies that the systems prioritized by the BIA can be recovered within the required timeframes. Again, another question I cannot agree with results

   Source: Adapted from community discussion — analuisamoreira

   Next question

7. Question 167 · 1459 in bank

   An organization is considering using production data for testing a new application’s functionality. Which of the following data protection techniques would BEST ensure that personal data cannot be inadvertently recovered in test environments while also reducing the need for strict confidentiality of the data?

   • AData normalization
   • BData encryption
   • CData minimization
   • DData anonymization

   Show answer

   Answer: D

   Explanation

   D. Data anonymization Data anonymization involves the process of converting or masking personal data in a way that it cannot be linked back to the individual it belongs to. It allows you to use data for testing and analytical purposes without exposing sensitive information. This technique provides a high level of privacy protection while still allowing for the effective use of data in various non-confidential use cases, such as testing new applications' functionality.

   Source: Adapted from community discussion — SuperMax

   Next question

8. Question 168 · 1459 in bank

   What should an IS auditor evaluate FIRST when reviewing an organization’s response to new privacy legislation?

   • AImplementation plan for restricting the collection of personal information
   • BAnalysis of systems that contain privacy components
   • CPrivacy legislation in other countries that may contain similar requirements
   • DOperational plan for achieving compliance with the legislation

   Show answer

   Answer: D

   Explanation

   When reviewing an organization's response to new privacy legislation, the IS auditor should first evaluate the operational plan for achieving compliance with the legislation. The operational plan outlines the specific actions and measures that the organization intends to take to meet the requirements of the new privacy legislation. Understanding the operational plan is crucial because it provides insights into how the organization is addressing compliance, allocating resources, and implementing necessary changes to adhere to the legal requirements. It includes details about processes, controls, and timelines for achieving compliance.

   Source: Adapted from community discussion — FAGFUR

   Next question

9. Question 169 · 1459 in bank

   Which of the following should be of GREATEST concern to an IS auditor reviewing on-site preventive maintenance for an organization’s business-critical server hardware?

   • AThe preventive maintenance schedule is based on mean time between failures (MTBF) parameters.
   • BPreventive maintenance is outsourced to multiple vendors without requiring nondisclosure agreements (NDAs).
   • CPreventive maintenance has not been approved by the information system owner.
   • DPreventive maintenance costs exceed the business’s allocated budget.

   Show answer

   Answer: B

   Explanation

   In cases such as replacing HDDs for on-site maintenance, confidential information may be leaked to outside parties. To prevent such cases, an NDA should be signed.

   Source: Adapted from community discussion — Swallows

   Next question

10. Question 170 · 1459 in bank

    An IS auditor is concerned that unauthorized access to a highly sensitive data center might be gained by piggybacking or tailgating. Which of the following is the BEST recommendation?

    • AAirlock entrance
    • BIntruder alarms
    • CProcedures for escorting visitors
    • DBiometrics

    Show answer

    Answer: A

    Explanation

    Deadman doors, also referred to as a mantrap or airlock entrance, uses two doors and is typically found in entries to facilities, such as computer rooms and high-security areas. For the second door to operate, the first entry door must close and lock, with only one person permitted in the holding area. This reduces the risk of tailgating or piggybacking, when an unauthorized person follows an authorized person through a secured entry. Reference: CRM 5.3.4 PHYSICAL ACCESS EXPOSURES AND CONTROLS

    Source: Adapted from community discussion — Superman

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISA practice, question 161. 1459 questions available.