CISA practice questions 231–240

1. Question 231 · 1459 in bank

   An IS auditor has been asked to review an event log aggregation system to ensure risk management practices have been applied. Which of the following should be of MOST concern to the auditor?

   • ACompleteness testing has not been performed on the log data.
   • BLog feeds are uploaded via batch process.
   • CThe log data is not normalized.
   • DData encryption standards have not been considered.

   Show answer

   Answer: A

   Explanation

   Data encryption is crucial for protecting sensitive information contained within the event logs. If encryption standards have not been considered or implemented, it poses a significant risk to the confidentiality and integrity of the log data. Unauthorized access or tampering could occur, leading to potential breaches or manipulation of critical information. The best answer is D

   Source: Adapted from community discussion — Sibsankar

   Next question

2. Question 232 · 1459 in bank

   Concerned about a major data security breach, the chief executive officer (CEO) has asked for a detailed audit of the network security function. A recent reorganization has left the IS audit department with limited technical experience. The BEST course of action for the IS audit manager is to:

   • Aassign the most senior IS auditors to the network security audit.
   • Baccept the audit request but postpone the audit until network training can be obtained.
   • Ccontract with an external organization to perform the audit.
   • Dgive the audit high priority in next year's audit plan.

   Show answer

   Answer: C

   Explanation

   C. contract with an external organization to perform the audit. Explanation: External Expertise: Contracting with an external organization that specializes in network security audits brings in the required technical expertise. External firms often have specialized knowledge, skills, and experience in conducting thorough security assessments. Timeliness: Engaging an external organization can help expedite the audit process, providing timely insights into the network security posture. This is particularly important when there are immediate concerns about a potential data security breach.

   Source: Adapted from community discussion — KAP2HURUF

   Next question

3. Question 233 · 1459 in bank

   Which of the following is MOST likely to increase if an organization increases its risk appetite?

   • AAudit findings
   • BKey controls
   • COpportunities
   • DSecurity incidents

   Show answer

   Answer: D

   Next question

4. Question 234 · 1459 in bank

   The practice of periodic secure code reviews is which type of control?

   • ACompensating
   • BDetective
   • CPreventive
   • DCorrective

   Show answer

   Answer: B

   Explanation

   These reviews help uncover issues that could lead to security breaches or functional failures, enabling the organization to address them before deployment. While secure coding practices (e.g., training and guidelines) are preventive, the act of reviewing code is detective because it identifies problems after the fact.

   Source: Adapted from community discussion — 1Naa

   Next question

5. Question 235 · 1459 in bank

   An IS audit review identifies inconsistencies in privacy requirements across third-party service provider contracts. Which of the following is the BEST recommendation to address this situation?

   • APrioritize contract amendments for third-party providers.
   • BReview privacy requirements when contracts come up for renewal.
   • CSuspend contracts with third-party providers that handle sensitive data.
   • DRequire third-party providers to sign nondisclosure agreements (NDAs).

   Show answer

   Answer: A

   Explanation

   A. Prioritize contract amendments for third-party providers. This is the most proactive and comprehensive approach to addressing inconsistent privacy requirements. By prioritizing contract amendments, the organization can: Establish consistent privacy standards: Ensure all third-party providers adhere to the same level of data protection. Mitigate risks: Reduce the likelihood of data breaches and regulatory non-compliance. Enhance legal protection: Strengthen the organization's position in case of data incidents.

   Source: Adapted from community discussion — KAP2HURUF

   Next question

6. Question 236 · 1459 in bank

   What should an IS auditor recommend to management as the MOST important action before selecting a Software as a Service (SaaS) vendor?

   • ADetermine service level requirements.
   • BPerform a business impact analysis (BIA).
   • CComplete a risk assessment.
   • DConduct a vendor audit.

   Show answer

   Answer: C

   Explanation

   RIsk assessmenta; it provides a foundational understanding of the risks associated with the SaaS vendor, allowing management to make an informed decision. Identifying and evaluating these risks helps ensure that the selected vendor aligns with the organization’s risk tolerance and overall strategy. While determining service level requirements (SLAs) is important to ensure the vendor meets the organization's performance expectations, it is secondary to assessing the risks associated with the vendor.

   Source: Adapted from community discussion — PurpleParrot

   Next question

7. Question 237 · 1459 in bank

   An IS auditor discovers from patch logs that some in-scope systems are not compliant with the regular patching schedule. What should the auditor do NEXT?

   • ARequest a plan of action to be established as a follow-up item.
   • BInterview IT management to clarify the current procedure.
   • CReview the organization's patch management policy.
   • DReport this finding to senior management.

   Show answer

   Answer: C

   Next question

8. Question 238 · 1459 in bank

   Which of the following observations should be of GREATEST concern to an IS auditor performing an audit of change and release management controls for a new complex system developed by a small in-house IT team?

   • AIT administrators have access to the production and development environment.
   • BSome user acceptance testing (UAT) was completed by members of the IT team.
   • CPost-implementation testing is not conducted for all system releases.
   • DAccess to change testing strategy and results is not restricted to staff outside the IT team.

   Show answer

   Answer: C

   Next question

9. Question 239 · 1459 in bank

   For effective IT governance, it is MOST important to have an independent reporting line for which of the following IT functions?

   • ARisk management
   • BInfrastructure
   • COperations
   • DSecurity

   Show answer

   Answer: A

   Explanation

   independence in the second line of defense (risk management and compliance) is vital to provide objective oversight and assurance, enhancing the organization's ability to identify and mitigate risks effectively.

   Source: Adapted from community discussion — KAP2HURUF

   Next question

10. Question 240 · 1459 in bank

    Which of the following is the PRIMARY role of key performance indicators (KPIs) in supporting business process effectiveness?

    • ATo analyze workflows in order to optimize business processes and eliminate tasks that do not provide value
    • BTo evaluate the cost-benefit of tools implemented to monitor control performance
    • CTo enable conclusions about the performance of the processes and target variances for follow-up analysis
    • DTo assess the functionality of a software deliverable based on business processes

    Show answer

    Answer: C

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISA practice, question 231. 1459 questions available.