CISA practice questions 221–230

1. Question 221 · 1459 in bank

   A financial institution suspects that a manager has been crediting customer accounts without authorization. Which of the following is the MOST effective method to validate this concern?

   • AVariable sampling
   • BDiscovery sampling
   • CStop-or-go sampling
   • DHaphazard sampling

   Show answer

   Answer: B

   Explanation

   Discovery sampling is particularly useful in detecting fraud or irregularities. It is designed to find at least one occurrence of an error or fraud in the population being examined, making it highly effective for situations where there is a suspicion of unauthorized activities.

   Source: Adapted from community discussion — 1e71ed5

   Next question

2. Question 222 · 1459 in bank

   An IS auditor reviewing the physical access section of a security plan for a data center should expect to find that:

   • Aentry points requiring different rules of access have been identified.
   • Baccess to environmental controls is well labeled.
   • Cthe data center has mantraps on entrances and exits.
   • Dthe access devices are connected to a remote management system.

   Show answer

   Answer: A

   Explanation

   A. Entry points requiring different rules of access have been identified. This includes identifying various entry points within the data center and specifying different levels of access control for each entry point based on the sensitivity of the area and the data stored within it. This approach helps ensure that appropriate access controls are implemented and enforced throughout the data center facility.

   Source: Adapted from community discussion — KAP2HURUF

   Next question

3. Question 223 · 1459 in bank

   An organization is planning to re-purpose workstations that were used to handle confidential information. Which of the following would be the IS auditor's BEST recommendation to dispose of this information?

   • AOverwrite the disks with random data.
   • BReformat the disks.
   • CErase the disks by degaussing.
   • DDelete the disk partitions.

   Show answer

   Answer: A

   Explanation

   Degaussing is basically to destroy the disc, the key word in that question is to RE PURPOSE. Degaussing will make the disc not repurposable.

   Source: Adapted from community discussion — JacCISA

   Next question

4. Question 224 · 1459 in bank

   Which of the following is the PRIMARY objective when encrypting a database?

   • APreserving the ability to query data
   • BProtecting data from unauthorized changes
   • CPreserving the ability to access data securely
   • DProtecting data from unauthorized viewing

   Show answer

   Answer: D

   Explanation

   When encrypting a database, the primary objective is to protect the data from unauthorized viewing. Encryption uses algorithms to transform data into an unreadable format, making it difficult for unauthorized individuals to access or decipher the information. By encrypting a database, even if someone gains unauthorized access to the data, they will not be able to understand or interpret the encrypted content without the decryption key. This helps to safeguard sensitive and confidential information and maintain data privacy and security.

   Source: Adapted from community discussion — KAP2HURUF

   Next question

5. Question 225 · 1459 in bank

   Audit observations should be FIRST communicated with the auditee:

   • Aduring fieldwork.
   • Bat the end of fieldwork.
   • Cwithin the audit report.
   • Dwhen drafting the report.

   Show answer

   Answer: A

   Explanation

   Audit observations are the findings and recommendations that result from an audit engagement. Audit observations should be first communicated with the auditee during fieldwork, which is the stage of the audit process where the auditor collects and analyzes evidence to evaluate the audit objectives1.

   Source: Adapted from community discussion — KAP2HURUF

   Next question

6. Question 226 · 1459 in bank

   Which of the following would be an IS auditor's GREATEST concern when reviewing the organization's business continuity plan (BCP)?

   • AThe recovery plan does not contain the process and application dependencies.
   • BThe duration of tabletop exercises is longer than the recovery point objective (RPO).
   • CThe recovery point objective (RPO) and recovery time objective (RTO) are not the same.
   • DThe duration of tabletop exercises is longer than the recovery time objective (RTO).

   Show answer

   Answer: A

   Next question

7. Question 227 · 1459 in bank

   Which of the following provides the BEST evidence that IT portfolio management is aligned with organizational strategies?

   • AIT steering committee minutes that include approval for prioritization of IT projects
   • BProject sponsor sign-off on all project documents from beginning to end
   • CProject sponsor sign-off on IT project proposals and milestones
   • DFinance committee minutes that include approval for the annual IT budget

   Show answer

   Answer: A

   Explanation

   Option B, "Project sponsor sign-off on all project documents from beginning to end," does provide some evidence of oversight and accountability throughout the project lifecycle. However, it does not directly demonstrate the alignment of IT portfolio management with organizational strategies.

   Source: Adapted from community discussion — KAP2HURUF

   Next question

8. Question 228 · 1459 in bank

   An IS auditor reviewing an IT organization should be MOST concerned if the IT steering committee:

   • Adoes not meet regularly for oversight of IT investments and projects.
   • Bconsults the board of directors on procedural and standard changes.
   • Creviews IT-related policies and standards only once per year.
   • Ddoes not include business-level representation.

   Show answer

   Answer: D

   Next question

9. Question 229 · 1459 in bank

   A bank performed minor changes to the interest calculation computer program. Which of the following techniques would provide the STRONGEST evidence to determine whether the interest calculations are correct?

   • AReview of the quality assurance (QA) test results
   • BManual verification of a sample of the results
   • CSource code review
   • DParallel simulation using audit software

   Show answer

   Answer: D

   Explanation

   Parallel simulation provides a powerful method for validating the accuracy of interest calculations by allowing you to compare the results of a modified program with those of an unmodified program, providing objective evidence based on actual calculation results.

   Source: Adapted from community discussion — Swallows

   Next question

10. Question 230 · 1459 in bank

    External experts were used on a recent IT audit engagement. While assessing the external experts' work, the internal audit team found some gaps in the evidence that may have impacted their conclusions. What is the internal audit team's BEST course of action?

    • AEngage another expert to conduct the same testing.
    • BReport a scope limitation in their conclusions.
    • CRecommend the external experts conduct additional testing.
    • DEscalate to senior management.

    Show answer

    Answer: C

    Explanation

    The best course of action for the internal audit team is to recommend that the external experts conduct additional testing. This allows the external experts to address the gaps in evidence and ensure their conclusions are accurate and complete.

    Source: Adapted from community discussion — SBD600

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISA practice, question 221. 1459 questions available.