CISA practice questions 11–20

1. Question 11 · 1459 in bank

   Which of the following is the GREATEST advantage of agile development over waterfall development?

   • AAgile development values working software over static documentation.
   • BAgile development values processes and tools over individuals and interactions.
   • CAgile development values contract negotiation over customer collaboration.
   • DAgile development values following a plan over responding to change.

   Show answer

   Answer: A

   Explanation

   The greatest advantage of agile development over waterfall development is often considered to be the emphasis on working software over static documentation. In agile development, the focus is on delivering a working product incrementally and iteratively, allowing for continuous feedback and adaptation. This approach contrasts with waterfall development, which typically involves a sequential process with extensive upfront documentation. The Agile Manifesto, a foundational document for agile development, explicitly states, "Working software over comprehensive documentation," emphasizing the importance of delivering a functional product rather than relying heavily on extensive documentation. Agile values individuals and interactions, customer collaboration, and responding to change over rigid processes, tools, contract negotiation, and following a plan.

   Source: Adapted from community discussion — FAGFUR

   Next question

2. Question 12 · 1459 in bank

   Which of the following controls provides the MOST protection against ransomware attacks?

   • AEducation and awareness training
   • BTested and reliable backups
   • CA tested incident response plan
   • DSignature based anti-malware tools

   Show answer

   Answer: B

   Explanation

   Having tested and reliable backups is often considered the most critical control for recovering from ransomware attacks and minimizing data loss and downtime.

   Source: Adapted from community discussion — FAGFUR

   Next question

3. Question 13 · 1459 in bank

   Which of the following is the BEST control to help ensure that security requirements are considered throughout the life cycle of an agile software development project?

   • AIncluding project team members who can provide security expertise
   • BReverting to traditional waterfall software development life cycle (SDLC) techniques
   • CDocumenting security control requirements and obtaining internal audit sign off
   • DRequiring the project to go through accreditation before release into production

   Show answer

   Answer: A

   Explanation

   A. Including project team members who can provide security expertise Including project team members with security expertise is the best control to ensure that security requirements are considered throughout the life cycle of an agile software development project. This approach integrates security considerations directly into the development process, allowing for timely identification and mitigation of security risks. Options B, C, and D do not align with agile principles and may hinder the flexibility and efficiency of the agile development process.

   Source: Adapted from community discussion — SuperMax

   Next question

4. Question 14 · 1459 in bank

   An IS auditor finds that a key Internet-facing system is vulnerable to attack and that patches are not available. What should the auditor recommend be done FIRST?

   • AImplement additional firewalls to protect the system.
   • BDecommission the server.
   • CImplement a new system that can be patched.
   • DEvaluate the associated risk.

   Show answer

   Answer: D

   Next question

5. Question 15 · 1459 in bank

   Which of the following is MOST important when assembling an internal team to perform penetration testing for the organization?

   • AObtain a listing of key systems for testing from management.
   • BGain agreement from management on timing and scope.
   • CPerform a scan and identify in-scope assets.
   • DQuery the company directory to find privileged users.

   Show answer

   Answer: B

   Explanation

   Gaining agreement from management on timing and scope is the most critical initial step to ensure a well-planned and effective penetration testing exercise.

   Source: Adapted from community discussion — FAGFUR

   Next question

6. Question 16 · 1459 in bank

   Which of the following would a digital signature MOST likely prevent?

   • ADisclosure
   • BRepudiation
   • CCorruption
   • DUnauthorized change

   Show answer

   Answer: B

   Explanation

   Digital signatures are a technology that uses public key cryptography to guarantee that the contents of communications have not been tampered with. It can detect tampering, but does not have the ability to prevent or correct tampering.

   Source: Adapted from community discussion — Swallows

   Next question

7. Question 17 · 1459 in bank

   An IS auditor is determining the scope for an upcoming audit. Which of the following BEST enables the auditor to ensure appropriate controls are considered?

   • AConducting interviews with IT staff
   • BReading recent industry journal articles
   • CUsing an IT-related framework
   • DReviewing previous audit reports

   Show answer

   Answer: C

   Explanation

   IT frameworks help auditors identify key controls, assess the maturity of processes, and ensure alignment with industry-recognized standards. They offer a systematic approach to evaluating and improving controls within an organization's IT environment.

   Source: Adapted from community discussion — FAGFUR

   Next question

8. Question 18 · 1459 in bank

   A PRIMARY objective of risk management is to keep the total cost of risks below the:

   • Aestimated amount of losses included in the firm's budget.
   • Bamount of losses that would materially damage the firm.
   • Ccosts of loss prevention measures, such as physical security measures.
   • Dadministrative costs of risk management.

   Show answer

   Answer: B

   Explanation

   The primary objective of risk management is to keep the total cost of risks below the amount of losses that would materially damage the firm. This means that risk management aims to prevent losses that could have a significant and adverse impact on the organization's financial stability, reputation, and overall well-being.

   Source: Adapted from community discussion — FAGFUR

   Next question

9. Question 19 · 1459 in bank

   Which of the following should be the role of internal audit in an organization’s move to the cloud?

   • AIdentifying and mitigating risk to an acceptable level
   • BIdentifying impacts to organizational budgets and resources
   • CImplementing security controls for data prior to migration
   • DServing as a trusted partner and advisor

   Show answer

   Answer: A

   Explanation

   Because They can evaluate potential risks such as data breaches, data loss, service disruptions, and compliance issues. By identifying these risks, internal audit can work with the relevant stakeholders to develop and implement risk mitigation strategies to ensure that the risks are reduced to an acceptable level.

   Source: Adapted from community discussion — 007Georgeo

   Next question

10. Question 20 · 1459 in bank

    How does a switched network reduce the risk of network sniffing?

    • ASwitches can detect active packet sniffing devices in their subnet.
    • BPackets are not broadcasted throughout the whole subnet.
    • CNetwork traffic is generally reduced.
    • DSource and destination addresses are encrypted.

    Show answer

    Answer: B

    Explanation

    A switched network reduces the risk of network sniffing primarily because packets are not broadcasted throughout the whole subnet. In a switched network, each switch maintains a table that maps MAC addresses to the corresponding switch ports. When a device sends a packet, the switch forwards the packet only to the specific port where the destination device is connected, rather than broadcasting it to all ports in the subnet.

    Source: Adapted from community discussion — FAGFUR

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISA practice, question 11. 1459 questions available.