Question 271 · 1459 in bank
An IS auditors reviewing the perimeter security design of a network. Which of the following provides the GREATEST assurance that both incoming and outgoing internet traffic is controlled?
Show answer
Answer: D
Certified Information Systems Auditor1,459 questions across 146 pages are complete and free, with no account or card.
1459 questions in this bank
Free access · progress saved on this device
An IS auditors reviewing the perimeter security design of a network. Which of the following provides the GREATEST assurance that both incoming and outgoing internet traffic is controlled?
Answer: D
Which type of review is MOST important to conduct when an IS auditor is informed that a recent internal exploitation of a bug has been discovered in a business application?
Answer: B
The BEST way to provide assurance that a project is adhering to the project plan is to:
Answer: A
A. conduct compliance audits at major system milestones. Compliance audits at major system milestones provide a structured, systematic, and independent evaluation of the project’s adherence to the project plan.
Source: Adapted from community discussion — MJORGER
An organization requires any travel and entertainment expenses over $10,000 to be approved by senior management. Which of the following is the MOST effective way to mitigate the risk that employees will split invoices to avoid the approval process?
Answer: A
Option D has a narrow scope of auditing for invoices that have already been submitted, and cannot effectively prevent the discovery of split travel and entertainment expense claims in real time. Although it is important to always audit for new suspicious claims, there is a limit to how much it can do to prevent invoices that have already been split. Therefore, the most effective method is to use CAAT to audit annual transactions and ensure that travel and entertainment expenses are properly approved.
Source: Adapted from community discussion — Swallows
During the evaluation of controls over a major application development project, the MOST effective use of an IS auditor's time would be to review and evaluate:
Answer: D
Reviewing and evaluating project plans is the most effective use of an IS auditor's time when assessing controls over a major application development project. Project plans outline the overall strategy, objectives, timelines, resources, and milestones of the project. By examining project plans, the auditor can gain insight into the project's governance structure, risk management practices, and control mechanisms.
Source: Adapted from community discussion — EBTURK
An organization needs to comply with data privacy regulations forbidding the display of personally identifiable information (PII) on customer bills or receipts. However, it is a business requirement to display at least one attribute so that customers can verify the bills or receipts are intended for them. What is the BEST recommendation?
Answer: B
I vote for B. in the beginning, actually i was confused between B and D. However, it reading the question again, focusing to this sentence "customers can verify the bills or receipts are intended for them" -> If you do tokenization, the data is in another form that customer cannot read to verify if that information is intended for them. Then, I go to B as my answer.
Source: Adapted from community discussion — MichaelHoang
Which of the following is the BEST sampling method to use when relatively few errors are expected to be found in a population?
Answer: B
B. Stop-or-go sampling. This method is specifically designed for situations where the auditor can stop the sampling process as soon as a predetermined number of errors are found. It can be more efficient when expecting few errors, allowing the auditor to terminate the sampling once a certain level of confidence is reached regarding the error rate in the population.
Source: Adapted from community discussion — KAP2HURUF
Following a security incident, which of the following BEST enables the integrity of the data captured during a forensic investigation?
Answer: D
It should be D. In forensic investigations, maintaining a chain of custody is more comprehensive because it covers the entire lifecycle of the evidence and ensures its integrity throughout the investigation process. While hash comparison is a part of this process, chain of custody provides the broader context needed for data integrity and legal admissibility.
Source: Adapted from community discussion — 1e71ed5
During an audit, an IT finding is agreed upon by all IT teams involved, but no team wants to be responsible for remediation or considers the finding within its area of responsibility. Which of the following is the IS auditor's BEST course of action?
Answer: C
During an organization's implementation of a data loss prevention (DLP) solution, which of the following activities should be completed FIRST?
Answer: B
B. Enabling detection points. Enabling detection points is a foundational step in the implementation of a DLP solution. This involves identifying and configuring the points in the organization's network or systems where the DLP solution will actively monitor and detect data loss incidents. This step is crucial for defining the scope and coverage of the DLP solution before configuring specific rules, exceptions, or generating reports. While configuring rule sets (Option A), establishing exceptions workflow (Option C), and configuring reports (Option D) are important components of a comprehensive DLP implementation, they typically come after enabling detection points to ensure a systematic and effective deployment of the solution.
Source: Adapted from community discussion — KAP2HURUF
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CISA practice, question 271. 1459 questions available.
Version 1.0.0. How we source questions