CISA practice questions 211–220

1. Question 211 · 1459 in bank

   An organization's security team created a simulated production environment with multiple vulnerable applications. What would be the PRIMARY purpose of creating such an environment?

   • ATo collect digital evidence of cyberattacks
   • BTo provide training to security managers
   • CTo attract attackers in order to study their behavior
   • DTo test the intrusion detection system (IDS)

   Show answer

   Answer: C

   Explanation

   C. To attract attackers in order to study their behavior The primary purpose of creating a simulated production environment with multiple vulnerable applications is to attract attackers intentionally, allowing the security team to study their behavior, tactics, techniques, and procedures. This type of environment, often referred to as a "honeypot" or "honeynet," is designed to lure potential attackers and gain insights into current cyber threats. It helps organizations understand the methods attackers use and strengthens their overall cybersecurity posture.

   Source: Adapted from community discussion — KAP2HURUF

   Next question

2. Question 212 · 1459 in bank

   Which of the following will provide the GREATEST assurance to IT management that a quality management system (QMS) is effective?

   • AA high percentage of IT employees attending quality training
   • BA high percentage of incidents being quickly resolved
   • CA high percentage of stakeholders satisfied with the quality of IT
   • DA high percentage of IT processes reviewed by quality assurance (QA)

   Show answer

   Answer: D

   Explanation

   Quality Assurance (QA) is a key element in ensuring the effectiveness of a Quality Management System (QMS). Quality Assurance periodically reviews IT processes and systems according to defined criteria and processes to ensure that they comply with quality standards. Therefore, a high percentage of IT processes reviewed by Quality Assurance is a key indicator of an effective QMS.

   Source: Adapted from community discussion — Swallows

   Next question

3. Question 213 · 1459 in bank

   An organization has just created a new data classification scheme and needs to define how it will operate within the organization. What should be the NEXT step?

   • ACreate a list of all data owners and custodians.
   • BCreate a set of standards and procedures.
   • CHire a specialized auditor to assess the implementation.
   • DConduct workshops for each business unit.

   Show answer

   Answer: B

   Explanation

   After creating a new data classification scheme, the next logical step is to develop a set of standards and procedures that guide the implementation and operation of the classification scheme within the organization. This includes defining how data will be classified, who is responsible for classification, the criteria for each classification level, and the associated security measures.

   Source: Adapted from community discussion — KAP2HURUF

   Next question

4. Question 214 · 1459 in bank

   An IS auditor is providing input to an RFP to acquire a financial application system. Which of the following is MOST important for the auditor to recommend?

   • AThe application should meet the organization's requirements.
   • BVendor employee background checks should be conducted regularly.
   • CAudit trails should be included in the design.
   • DPotential suppliers should have experience in the relevant area.

   Show answer

   Answer: A

   Explanation

   A key objective of the RFP process is to select a vendor or solution that best meets the organization's needs and requirements. Therefore, it is essential for the IS auditor to emphasize that the financial application system should align with the organization's specific functional, technical, and security requirements.

   Source: Adapted from community discussion — MJORGER

   Next question

5. Question 215 · 1459 in bank

   An employee loses a mobile device resulting in loss of sensitive corporate data. Which of the following would have BEST prevented data leakage?

   • AData encryption on the mobile device
   • BThe triggering of remote data wipe capabilities
   • CAwareness training for mobile device users
   • DComplex password policy for mobile devices

   Show answer

   Answer: A

   Explanation

   Data encryption is the most effective measure to prevent sensitive data from being accessed by unauthorized parties if a mobile device is lost. Encryption ensures that even if the device falls into the wrong hands, the data remains protected because it is only accessible with the correct decryption key. NOT B because it requires the device to be powered on and connected to a network for the remote wipe command to execute. If the device is offline or inaccessible, this measure may not prevent data leakage.

   Source: Adapted from community discussion — Eiad1100

   Next question

6. Question 216 · 1459 in bank

   Which of the following is MOST important to ensure when reviewing a global organization's controls to protect data held on its IT infrastructure across all of its locations?

   • AThe capacity of underlying communications infrastructure in the host locations is sufficient.
   • BThe threat of natural disasters in each location hosting infrastructure has been accounted for.
   • CRelevant data protection legislation and regulations for each location are adhered to.
   • DTechnical capabilities exist in each location to manage the data and recovery operations.

   Show answer

   Answer: C

   Next question

7. Question 217 · 1459 in bank

   Which of the following BEST ensures that effective change management is in place in an IS environment?

   • AAdequate testing was carried out by the development team.
   • BUser-prepared detailed test criteria for acceptance testing of the software.
   • CUser authorization procedures for application access are well established.
   • DAccess to production source and object programs is well controlled.

   Show answer

   Answer: D

   Next question

8. Question 218 · 1459 in bank

   What is the PRIMARY reason for an organization to classify the data stored on its internal networks?

   • ATo comply with the organization's data policies
   • BTo follow industry best practices
   • CTo implement data protection requirements
   • DTo determine data retention policy

   Show answer

   Answer: C

   Explanation

   Answer C Data classification is typically implemented to ensure that data is adequately protected based on its sensitivity and criticality. While compliance with the organization's data policies may necessitate data classification, the ultimate goal is often to mitigate risks associated with data breaches, unauthorized access, or data loss. By classifying data according to its level of sensitivity or importance, organizations can establish appropriate security controls, access restrictions, and encryption measures to protect against potential threats. This proactive approach to data protection helps organizations safeguard their valuable assets and maintain trust with stakeholders.

   Source: Adapted from community discussion — a84n

   Next question

9. Question 219 · 1459 in bank

   Effective separation of duties in an online environment can BEST be achieved by utilizing:

   • Aappropriate supervision.
   • Baccess authorization tables.
   • Ctransaction logging.
   • Dwritten procedure manuals.

   Show answer

   Answer: B

   Explanation

   B. Access authorization tables can best achieve effective separation of duties in an online environment. Access authorization tables are typically used in system security to control and manage user access rights and privileges. By properly configuring access authorization tables, organizations can assign different levels of access to individuals based on their job roles and responsibilities. This helps enforce separation of duties by ensuring that individuals only have access to the systems and data necessary for performing their specific tasks, reducing the risk of unauthorized actions or errors. While appropriate supervision, transaction logging, and written procedure manuals are also valuable controls, access authorization tables specifically focus on managing and enforcing separation of duties in online environments.

   Source: Adapted from community discussion — KAP2HURUF

   Next question

10. Question 220 · 1459 in bank

    Which of the following provides the GREATEST assurance that a middleware application compiling data from multiple sales transaction databases for forecasting is operating effectively?

    • AAutomated reconciliations
    • BException reporting
    • CManual checks
    • DContinuous auditing

    Show answer

    Answer: D

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISA practice, question 211. 1459 questions available.