CISA practice questions 171–180

1. Question 171 · 1459 in bank

   Which of the following is MOST likely to increase non-sampling risk?

   • AImproperly stratified populations
   • BDecreased tolerance rate
   • CInappropriate materiality ratings
   • DPoor knowledge of the audit process

   Show answer

   Answer: D

   Explanation

   Non-sampling risk refers to the risk that arises from factors other than sampling errors. Among the options provided, poor knowledge of the audit process is most likely to increase non-sampling risk. If the audit team lacks adequate knowledge of the audit process, including a thorough understanding of the business, industry, and relevant audit standards, it increases the risk of making incorrect judgments, overlooking important details, and failing to identify material misstatements. These issues can lead to increased non-sampling risk because they are not related to errors arising solely from the use of sampling procedures.

   Source: Adapted from community discussion — FAGFUR

   Next question

2. Question 172 · 1459 in bank

   An organization has decided to outsource a critical application due to a lack of specialized resources. Which risk response has been adopted?

   • AMitigation
   • BAvoidance
   • CSharing
   • DAcceptance

   Show answer

   Answer: C

   Explanation

   When an organization decides to outsource a critical application due to a lack of specialized resources, it has adopted the risk response of sharing. Sharing involves transferring or outsourcing a portion or all of the risk to another party. In this case, the organization is sharing the responsibility for the critical application with an external service provider. In the context of outsourcing a critical application, the organization has chosen to share the risk by relying on external expertise and resources through outsourcing.

   Source: Adapted from community discussion — FAGFUR

   Next question

3. Question 173 · 1459 in bank

   Which of the following would be MOST helpful to an IS auditor assessing the reliability of an organization’s network?

   • AProtocol analyzer
   • BOnline monitoring
   • CDowntime report
   • DResponse time report

   Show answer

   Answer: A

   Explanation

   A. Protocol analyzer A protocol analyzer, also known as a packet sniffer or network analyzer, is a tool that allows an auditor to capture and analyze network traffic. While the other options (B. Online monitoring, C. Downtime report, D. Response time report) can provide valuable information, a protocol analyzer is the most comprehensive tool for assessing network reliability as it offers real-time monitoring and detailed analysis of network traffic and behavior.

   Source: Adapted from community discussion — SuperMax

   Next question

4. Question 174 · 1459 in bank

   While conducting an IT operations audit, an internal IS auditor discovers there are backup media missing that potentially contain unencrypted data. Which of the following should be the IS auditor’s NEXT step?

   • AReview the backup media policy and procedures.
   • BNotify legal and regulatory authorities of the lost media.
   • CWrite a report regarding the missing media.
   • DDetermine what data is on the missing media.

   Show answer

   Answer: D

   Next question

5. Question 175 · 1459 in bank

   An IS auditor has found that despite an increase in phishing attacks over the past two years, there has been a significant decrease in the success rate. Which of the following is the MOST likely reason for this decline?

   • AImplementation of a security awareness program
   • BEnhanced training for incident responders
   • CImplementation of an intrusion detection system (IDS)
   • DDevelopment of an incident response plan

   Show answer

   Answer: A

   Explanation

   The most likely reason for the decline in the success rate of phishing attacks, despite an increase in their frequency, is the implementation of a security awareness program. Phishing attacks often rely on tricking individuals into divulging sensitive information or clicking on malicious links. A well-implemented security awareness program educates users about the risks of phishing, teaches them how to recognize phishing attempts, and emphasizes the importance of security best practices. As a result, employees become more vigilant and less susceptible to falling for phishing scams, leading to a decrease in the success rate of such attacks.

   Source: Adapted from community discussion — FAGFUR

   Next question

6. Question 176 · 1459 in bank

   Which of the following risks is BEST mitigated by implementing an automated three-way match?

   • AInaccurate customer records.
   • BInvalid payment processing.
   • CInaccurate customer discounts.
   • DPurchase order delays

   Show answer

   Answer: B

   Explanation

   B. Invalid payment processing. The three-way match is a common control mechanism in the procurement and accounts payable processes, especially in the context of managing supplier invoices and payments. It involves matching three key documents: Purchase Order (PO): This document outlines what was ordered, including quantity and price. Receipt of Goods/Services: This document confirms that the goods or services have been received as per the PO. Supplier Invoice: This document contains the supplier's request for payment. The purpose of the three-way match is to ensure that the invoice matches both the purchase order and the receipt of goods/services.

   Source: Adapted from community discussion — SuperMax

   Next question

7. Question 177 · 1459 in bank

   An IS auditor found that a company executive is encouraging employee use of social networking sites for business purposes. Which of the following recommendations would BEST help to reduce the risk of data leakage?

   • ARequiring policy acknowledgment and nondisclosure agreements (NDAs) signed by employees
   • BMonitoring employees' social networking usage
   • CEstablishing strong access controls on confidential data
   • DProviding education and guidelines to employees on use of social networking sites

   Show answer

   Answer: D

   Explanation

   the best recommendation to reduce the risk of data leakage would be to provide education and guidelines to employees on the use of social networking sites. This recommendation would help to raise awareness of the risks and provide guidance on safe practices. Additionally, it is important to establish policies and procedures that clearly define what is expected of employees when using social networking sites for business purposes. By providing clear guidance and educating employees, the risk of data leakage can be reduced.

   Source: Adapted from community discussion — 3008

   Next question

8. Question 178 · 1459 in bank

   A configuration management audit identified that predefined automated procedures are used when deploying and configuring application infrastructure in a cloud-based environment. Which of the following is MOST important for the IS auditor to review?

   • AContracts of vendors responsible for maintaining provisioning tools
   • BNumber of administrators with access to cloud management consoles
   • CProcesses for making changes to cloud environment specifications
   • DStorage location of configuration management documentation

   Show answer

   Answer: C

   Explanation

   The most important aspect for the IS auditor to review, given the use of predefined automated procedures for deploying and configuring application infrastructure in a cloud-based environment, is the processes for making changes to cloud environment specifications. Automated procedures can greatly enhance efficiency and consistency, but they also necessitate robust processes for managing changes. The review of processes for making changes includes assessing how changes to configurations are authorized, tested, and implemented. This is crucial for ensuring that changes are well-controlled and aligned with business and security requirements.

   Source: Adapted from community discussion — FAGFUR

   Next question

9. Question 179 · 1459 in bank

   Which of the following is the PRIMARY reason to perform a risk assessment?

   • ATo determine the current risk profile
   • BTo ensure alignment with the business impact analysis (BIA)
   • CTo help allocated budget for risk mitigation controls
   • DTo achieve compliance with regulatory requirements

   Show answer

   Answer: A

   Explanation

   A. To determine the current risk profile A risk assessment is typically conducted to identify, analyze, and evaluate potential risks and threats to an organization's assets, operations, and objectives. The primary goal is to understand the organization's current risk profile, which involves assessing the likelihood and impact of various risks. While the other options (B, C, and D) may also be important in the context of risk management, they are often secondary to the fundamental purpose of assessing the current risk profile.

   Source: Adapted from community discussion — SuperMax

   Next question

10. Question 180 · 1459 in bank

    Which of the following is the GREATEST benefit related to disaster recovery for an organization that has converted its infrastructure to a virtualized environment?

    • AVirtual servers decrease the recovery time objective (RTO).
    • BVirtual servers reduce the time and complexity associated with backup procedures.
    • CVirtual servers can be recreated on similar hardware faster than restoring from backups.
    • DVirtual servers eliminate the need to verify backups.

    Show answer

    Answer: A

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISA practice, question 171. 1459 questions available.