CISA practice questions 251–260

1. Question 251 · 1459 in bank

   Which of the following would be of GREATEST concern to an IS auditor conducting an audit of an organization's network security with the focus of preventing system breaches?

   • AComputer names are available to the Internet.
   • BThe data loss prevention (DLP) system does not monitor malicious incoming traffic.
   • CHelp desk personnel are able to remote into other external systems.
   • DThe guest wireless system does not have content filtering.

   Show answer

   Answer: B

   Explanation

   Monitoring incoming traffic is crucial for detecting and preventing potential malicious activity, unauthorized access attempts, and data exfiltration. A lack of monitoring in the DLP system increases the risk of system breaches and can leave the network vulnerable to various security threats.

   Source: Adapted from community discussion — KAP2HURUF

   Next question

2. Question 252 · 1459 in bank

   Which of the following presents the GREATEST risk of data leakage in the cloud environment?

   • AMulti-tenancy within the same database
   • BLack of role-based access
   • CExpiration of security certificate
   • DLack of data retention policy

   Show answer

   Answer: A

   Explanation

   ption A - Multi-tenancy within the Same Database: Multi-tenancy involves multiple clients (tenants) sharing the same infrastructure, including databases. If not properly implemented, this can pose a significant risk of data leakage. Without adequate isolation mechanisms, one tenant may have the potential to access or view another tenant's sensitive data, leading to data leakage.

   Source: Adapted from community discussion — KAP2HURUF

   Next question

3. Question 253 · 1459 in bank

   An audit program indicates that a specific number of transactions are to be sampled for testing a particular control. However, it has been determined that the control design is deficient. What should the IS auditor do in response to this information?

   • ARecommend a change to the audit program to increase the sample size.
   • BRecommend a change to the audit program and testing methodology used.
   • CDocument the observation and the testing methodology used.
   • DNotify audit management and continue to use the sample size.

   Show answer

   Answer: B

   Next question

4. Question 254 · 1459 in bank

   An organization has outsourced the development of a core application. However, the organization plans to bring the support and future maintenance of the application back in-house. Which of the following findings should be the IS auditor's GREATEST concern?

   • AThe data model is not clearly documented.
   • BThe vendor development team is located overseas.
   • CThe cost of outsourcing is lower than in-house development.
   • DA training plan for business users has not been developed.

   Show answer

   Answer: A

   Explanation

   This is the greatest concern as it can significantly impact the organization's ability to maintain and support the application. Without clear documentation of the data model, the organization may struggle to understand the application's structure, which can make it challenging to fix issues or develop new features. Before transitioning support and future maintenance in-house, the organization should ensure that the data model is clearly documented and that the in-house team understands it thoroughly.

   Source: Adapted from community discussion — mohamedadel2024

   Next question

5. Question 255 · 1459 in bank

   Where should photoelectric smoke detectors be installed to improve fire detection at an offsite data processing facility?

   • AEntry points
   • BAir vents
   • CServer cages
   • DExit points

   Show answer

   Answer: C

   Explanation

   Server cages contain critical IT equipment, and fires in these areas can have a severe impact on data processing operations. Placing smoke detectors within server cages ensures early detection of smoke originating from or affecting these critical components.

   Source: Adapted from community discussion — KAP2HURUF

   Next question

6. Question 256 · 1459 in bank

   Which of the following is MOST important to effectively manage risk associated with application programming interfaces (APIs) and third-party virtual environments?

   • ACompliance monitoring
   • BBackups of virtual environments
   • CInventory of APIs
   • DAPI single sign-on (SSO) capability

   Show answer

   Answer: A

   Next question

7. Question 257 · 1459 in bank

   Which of the following should an IS auditor use when verifying a three-way match has occurred in an enterprise resource planning (ERP) system?

   • AGoods delivery notification
   • BPurchase order
   • CPurchase requisition
   • DBank confirmation

   Show answer

   Answer: B

   Explanation

   Three-way match is the process of comparing the purchase order, invoice, and goods receipt to make sure they match, prior to approving the invoice.

   Source: Adapted from community discussion — joehong

   Next question

8. Question 258 · 1459 in bank

   Which of the following is an example of inherent risk?

   • AQuality assurance (QA) processes may not effectively reduce errors.
   • BAn approval process may not detect significant errors.
   • CThe organization may not comply with regulations.
   • DProjects may still be delayed despite management controls.

   Show answer

   Answer: C

   Explanation

   Inherent risk is the risk that an organization could encounter when no controls are in place, where residual risk is the risk that exists with controls in place. Therefore, C should be Inherent risk, where D is residual risk.

   Source: Adapted from community discussion — joehong

   Next question

9. Question 259 · 1459 in bank

   Which of the following is the MOST important consideration when establishing vulnerability scanning on critical IT infrastructure?

   • AThe scanning will be cost-effective.
   • BThe scanning will be performed during non-peak hours.
   • CThe scanning will be followed by penetration testing.
   • DThe scanning will not degrade system performance.

   Show answer

   Answer: D

   Next question

10. Question 260 · 1459 in bank

    An employee has accidentally posted confidential data to the company's social media page. Which of the following is the BEST control to prevent this from recurring?

    • AEstablish two-factor access control for social media accounts.
    • BImplement a moderator approval process.
    • CRequire all updates to be made by the marketing director.
    • DPerform periodic audits of social media updates.

    Show answer

    Answer: B

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISA practice, question 251. 1459 questions available.