CISA practice questions 191–200

1. Question 191 · 1459 in bank

   A firewall between internal network segments improves security and reduces risk by:

   • Ainspecting all traffic flowing between network segments and applying security policies.
   • Bensuring all connecting systems have appropriate security controls enabled.
   • Cmonitoring and reporting on sessions between network participants.
   • Dlogging all packets passing through network segments.

   Show answer

   Answer: A

   Explanation

   A firewall between internal network segments improves security and reduces risk by inspecting all traffic flowing between network segments and applying security policies. Firewalls act as a barrier between different parts of the network, and they can be configured to control and filter traffic based on defined security rules and policies. The primary purpose of a firewall between internal network segments is to inspect and control the flow of traffic, thereby enhancing security and reducing the risk of unauthorized access or malicious activity between network segments.

   Source: Adapted from community discussion — FAGFUR

   Next question

2. Question 192 · 1459 in bank

   Which of the following BEST enables an IS auditor to understand the shared control requirements between multiple cloud service providers and the customer organization?

   • ARoles and responsibilities of the IT professionals working under a shared responsibility model
   • BAn industry-accepted cloud security framework for which all parties have obtained certification
   • CLogs produced by a cloud access security broker (CASB) monitoring the multi-cloud solution
   • DA risk and controls matrix that documents a clear set of actions for each party

   Show answer

   Answer: D

   Explanation

   A risk and controls matrix is a structured document that outlines the specific risks and associated control measures for a particular process or system. In the context of understanding shared control requirements between multiple cloud service providers and the customer organization, a risk and controls matrix can provide a clear and detailed overview of the responsibilities and actions that each party (the cloud service providers and the customer organization) must take to ensure the security and compliance of the cloud environment. This matrix helps in defining and documenting roles, responsibilities, and control measures for all parties involved. It allows the IS auditor to have a comprehensive understanding of the shared control requirements and ensures that there is clarity regarding who is responsible for what aspects of security and compliance in a multi-cloud environment. This is particularly important in a shared responsibility model where both the cloud service providers and the customer organization have their respective responsibilities for security and compliance.

   Source: Adapted from community discussion — SuperMax

   Next question

3. Question 193 · 1459 in bank

   The BEST way to evaluate the effectiveness of a newly developed application is to:

   • Aperform a post-implementation review.
   • Breview acceptance testing results.
   • Cperform a secure code review
   • Danalyze load testing results.

   Show answer

   Answer: A

   Explanation

   The best way to evaluate the effectiveness of a newly developed application is to perform a post-implementation review. A post-implementation review assesses the overall performance and outcomes of the application after it has been deployed in a live environment. It involves evaluating how well the application meets its objectives, whether it aligns with business requirements, and if it performs as expected.

   Source: Adapted from community discussion — FAGFUR

   Next question

4. Question 194 · 1459 in bank

   Which of the following is an IS auditor's BEST recommendation to mitigate the risk of eavesdropping associated with an application programming interface (API) integration implementation?

   • AImplement Simple Object Access Protocol (SOAP).
   • BEncrypt the extensible markup language (XML) file.
   • CMask the API endpoints.
   • DImplement Transport Layer Security (TLS).

   Show answer

   Answer: D

   Explanation

   Implementing TLS ensures that data exchanged between systems, including API calls, is encrypted, making it significantly more difficult for eavesdroppers to intercept and decipher sensitive information. Therefore, TLS is the recommended measure to enhance the security of API communications and mitigate the risk of eavesdropping.

   Source: Adapted from community discussion — FAGFUR

   Next question

5. Question 195 · 1459 in bank

   Which of the following should be used to evaluate an IT development project before an investment is committed?

   • AFeasibility study
   • BFunction point analysis
   • CRapid application development
   • DEarned value analysis (EVA)

   Show answer

   Answer: A

   Explanation

   A. Feasibility study A feasibility study is typically used to evaluate an IT development project before an investment is committed. This study assesses the practicality and viability of the project from various perspectives, including technical, economic, operational, and scheduling. It helps stakeholders determine whether the project is worth pursuing and if it aligns with the organization's strategic goals. The feasibility study can provide valuable insights into the potential risks, costs, and benefits associated with the project, helping decision-makers make informed investment decisions. While the other options (B, C, and D) are important techniques and methodologies used in IT project management and evaluation, they are typically applied at later stages of the project rather than during the initial evaluation and investment decision phase.

   Source: Adapted from community discussion — SuperMax

   Next question

6. Question 196 · 1459 in bank

   A small business unit is implementing a control self-assessment (CSA) program and leveraging the internal audit function to test its internal controls annually. Which of the following is the MOST significant benefit of this approach?

   • ALine management is more motivated to avoid control exceptions.
   • BBusiness owners can focus more on their core roles.
   • CRisks are detected earlier.
   • DCompliance costs are reduced.

   Show answer

   Answer: C

   Explanation

   The most significant benefit of implementing a control self-assessment program and leveraging the internal audit function to test internal controls annually is that risks are detected earlier. CSA programs involve individuals within the business unit assessing and testing their own controls, which can lead to the identification of risks and control weaknesses at an early stage. The involvement of internal audit provides an independent and objective validation of the self-assessment results. Early detection of risks allows for timely corrective actions, enhancing the organization's ability to prevent or mitigate potential issues before they escalate. This contributes significantly to the effectiveness of the internal control environment.

   Source: Adapted from community discussion — FAGFUR

   Next question

7. Question 197 · 1459 in bank

   An organization has recently become aware of a pervasive chip-level security vulnerability that affects all of its processors. Which of the following is the BEST way to prevent this vulnerability from being exploited?

   • AInstall vendor patches.
   • BReview security log incidents.
   • CImplement security awareness training.
   • DReview hardware vendor contracts.

   Show answer

   Answer: A

   Explanation

   The best way to prevent a pervasive chip-level security vulnerability from being exploited is to install vendor patches. When a security vulnerability is identified in hardware components, the hardware vendor typically releases patches or updates to address the vulnerability. Applying these patches promptly helps mitigate the risk of exploitation. Installing vendor patches is a critical and effective measure to address known vulnerabilities and enhance the security of hardware components. Organizations should stay informed about security advisories and promptly apply patches to minimize the risk of exploitation.

   Source: Adapted from community discussion — FAGFUR

   Next question

8. Question 198 · 1459 in bank

   A request for proposal (RFP) for the acquisition of computer hardware should include:

   • Asupport and maintenance requirements.
   • Bdetailed specification of the current hardware infrastructure.
   • Cthe requirement that the supplier allow a right of audit.
   • Dmaximum cost restriction

   Show answer

   Answer: A

   Explanation

   A request for proposal (RFP) for the acquisition of computer hardware should include support and maintenance requirements. Including support and maintenance requirements in the RFP ensures that potential suppliers understand the expectations for ongoing support, troubleshooting, and maintenance services for the hardware. Including support and maintenance requirements in the RFP ensures that potential suppliers are aware of the organization's expectations regarding ongoing service and support, helping to align the procurement process with the organization's operational needs.

   Source: Adapted from community discussion — FAGFUR

   Next question

9. Question 199 · 1459 in bank

   The PRIMARY focus of audit follow-up reports should be to:

   • Aassess if new risks have developed.
   • Bdetermine if audit recommendations have been implemented.
   • Cdetermine if past findings are still relevant.
   • Dverify the completion date of the implementation.

   Show answer

   Answer: B

   Next question

10. Question 200 · 1459 in bank

    Which of the following BEST protects evidence in a forensic investigation?

    • AProtecting the hardware of the affected system
    • BPowering down the affected system
    • CImaging the affected system
    • DRebooting the affected system

    Show answer

    Answer: C

    Explanation

    The best way to protect evidence in a forensic investigation is to image the affected system. Imaging involves creating a forensic copy or snapshot of the entire storage media (e.g., hard drive) of the system. This ensures that an exact replica of the digital evidence is preserved without altering the original data. Imaging the affected system is a fundamental practice in digital forensics as it allows investigators to analyze the forensic copy while preserving the original evidence for further examination or legal proceedings.

    Source: Adapted from community discussion — FAGFUR

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISA practice, question 191. 1459 questions available.