CISA practice questions 181–190

1. Question 181 · 1459 in bank

   Which of the following should be the GREATEST concern to an IS auditor reviewing an organization's method to transport sensitive data between offices?

   • AThe method relies exclusively on the use of 128-bit encryption.
   • BThe method relies exclusively on the use of digital signatures.
   • CThe method relies exclusively on the use of asymmetric encryption algorithms.
   • DThe method relies exclusively on the use of public key infrastructure (PKI).

   Show answer

   Answer: B

   Explanation

   While digital signatures can provide data integrity and authentication, they do not necessarily ensure the confidentiality of sensitive data during transport. Digital signatures are primarily used to verify the authenticity and integrity of data, ensuring that it has not been tampered with. However, they do not encrypt the data itself, which means that the content could still be intercepted and read by unauthorized individuals. In contrast, options A, C, and D all involve encryption mechanisms, which play a crucial role in protecting the confidentiality of sensitive data during transport. Encryption ensures that the data is scrambled and can only be deciphered by authorized recipients who possess the appropriate decryption keys.

   Source: Adapted from community discussion — KAP2HURUF

   Next question

2. Question 182 · 1459 in bank

   During a database management evaluation, an IS auditor discovers that some accounts with database administrator (DBA) privileges have been assigned a default password with an unlimited number of failed login attempts. Which of the following is the auditor's BEST course of action?

   • APostpone the audit until adequate security and password management practices are established.
   • BDocument the finding and explain the risk of having administrator accounts with inappropriate security settings.
   • CIdentify accounts that have had excessive failed login attempts and request they be disabled.
   • DRequest the IT manager to change administrator security parameters and update the finding.

   Show answer

   Answer: B

   Explanation

   The best course of action for the IS auditor, upon discovering that some accounts with database administrator privileges have been assigned a default password with an unlimited number of failed login attempts, is to document the finding and explain the risk of having administrator accounts with inappropriate security settings. Documenting the finding and explaining the risk is an essential step in the audit process. It provides a clear record of the security weakness and its potential impact on the organization. It also serves to raise awareness among relevant stakeholders about the risks associated with weak security settings on administrator accounts.

   Source: Adapted from community discussion — FAGFUR

   Next question

3. Question 183 · 1459 in bank

   Which of the following is the PRIMARY purpose of performing a parallel run of a new system?

   • ATo verify the new system provides required business functionality
   • BTo identify any errors in the program and file interfaces immediately
   • CTo compare the key performance indicators (KPIs) of the new and old systems
   • DTo verify the new system produces the expected results

   Show answer

   Answer: D

   Explanation

   D) To ensure the new system meets user requirements. The PRIMARY purpose of performing a parallel run of a new system is to **validate the operation of the new system against its predecessor**. During a parallel run, both the old and new systems operate simultaneously, processing the same data and performing the same tasks. This allows for a comparison of their outputs, which helps to ensure that the new system is working correctly. Therefore, the correct answer is **D. To verify the new system produces the expected results.

   Source: Adapted from community discussion — 3008

   Next question

4. Question 184 · 1459 in bank

   Which of the following is a method to prevent disclosure of classified documents printed on a shared printer?

   • AProducing a header page with classification level for printed documents
   • BEncrypting the data stream between the user's computer and the printer
   • CUsing passwords to allow authorized users to send documents to the printer
   • DRequiring a key code to be entered on the printer to produce hard copy

   Show answer

   Answer: D

   Next question

5. Question 185 · 1459 in bank

   Which of the following should be done FIRST when planning to conduct internal and external penetration testing for a client?

   • AEstablish the timing of testing.
   • BIdentify milestones.
   • CDetermine the test reporting.
   • DEstablish the rules of engagement.

   Show answer

   Answer: D

   Explanation

   When planning to conduct internal and external penetration testing for a client, the first step should be to establish the rules of engagement. Rules of engagement define the scope, objectives, and constraints of the penetration testing engagement. They outline what is allowed and what is not allowed during the testing process. Establishing the rules of engagement is crucial for ensuring a clear understanding between the testing team and the client, addressing legal and compliance considerations, and defining the scope of the testing activities. This includes specifying the systems and networks that can be tested, the testing methods that can be employed, and any limitations or restrictions.

   Source: Adapted from community discussion — FAGFUR

   Next question

6. Question 186 · 1459 in bank

   Due to advancements in technology and electronic records, an IS auditor has completed an engagement by email only. Which of the following did the IS auditor potentially compromise?

   • AReporting
   • BProficiency
   • CDue professional care
   • DSufficient evidence

   Show answer

   Answer: D

   Explanation

   Conducting an engagement by email only may potentially compromise the principle of obtaining sufficient appropriate evidence. Sufficient evidence is essential for the IS auditor to form conclusions and opinions about the subject matter of the engagement. While advancements in technology can facilitate communication and document sharing, relying solely on email may limit the auditor's ability to gather comprehensive evidence. Certain audit procedures may require direct observation, physical inspection, or face-to-face interviews, which cannot be adequately fulfilled through email exchanges alone. The primary concern in conducting an engagement by email only is the potential compromise of obtaining sufficient evidence needed for a comprehensive audit.

   Source: Adapted from community discussion — FAGFUR

   Next question

7. Question 187 · 1459 in bank

   Which of the following provides the BEST evidence of effective IT portfolio management?

   • APrograms in the IT portfolio are prioritized by each business function.
   • BThe IT portfolio is updated on the basis of current industry benchmarks.
   • CThe IT portfolio is updated as business strategy changes.
   • DIT portfolio updates are communicated when approved.

   Show answer

   Answer: C

   Explanation

   The best evidence of effective IT portfolio management is when the IT portfolio is updated as business strategy changes. IT portfolio management involves aligning IT investments with business objectives, and regular updates to the portfolio based on changes in business strategy demonstrate responsiveness to the evolving needs and goals of the organization. The most compelling evidence of effective IT portfolio management is the proactive adjustment of the portfolio in response to changes in the broader business strategy.

   Source: Adapted from community discussion — FAGFUR

   Next question

8. Question 188 · 1459 in bank

   Which of the following is the MOST efficient way to assess the controls in a service provider's environment?

   • AReview testing performed by the service provider's internal audit department.
   • BRequire the service provider to conduct control self-assessments (CSAs).
   • CReview the service provider's master service agreement (MSA).
   • DObtain an independent auditor's report from the service provider.

   Show answer

   Answer: D

   Next question

9. Question 189 · 1459 in bank

   Which of the following is the PRIMARY responsibility of an internal IS auditor regarding IT controls?

   • AProviding independent assurance to the public over IT controls implemented by the organization
   • BContinuously monitoring IT control operations and reporting any abnormal or exceptional cases
   • CDesigning and deploying IT controls as part of normal operations
   • DValidating IT control effectiveness after implementation across the organization

   Show answer

   Answer: D

   Explanation

   The primary responsibility of an internal IS auditor regarding IT controls is validating IT control effectiveness after implementation across the organization. Internal auditors play a crucial role in assessing and providing assurance on the effectiveness of controls to mitigate risks.

   Source: Adapted from community discussion — FAGFUR

   Next question

10. Question 190 · 1459 in bank

    Which of the following should an IS auditor be MOST concerned with when reviewing the IT asset disposal process?

    • AData stored on the asset
    • BCertificate of destruction
    • CMonetary value of the asset
    • DData migration to the new asset

    Show answer

    Answer: A

    Explanation

    When reviewing the IT asset disposal process, an IS (Information Systems) auditor should be MOST concerned with option A: Data stored on the assetA. Data stored on the asset: This is the most critical concern because failing to properly handle and erase data from disposed assets can lead to data breaches and security risks. It's essential that all sensitive and confidential data is securely wiped or destroyed during the disposal process to prevent unauthorized access. In summary, the primary focus of an IS auditor during the IT asset disposal process should be on ensuring that data stored on the asset is securely erased or destroyed to mitigate data security risks.

    Source: Adapted from community discussion — SuperMax

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISA practice, question 181. 1459 questions available.