CISA practice questions 21–30

1. Question 21 · 1459 in bank

   Which of the following is the MOST effective way for internal audit management to ensure the quality of IS audits is maintained?

   • AEngage a third party to conduct regular quality assurance (QA) reviews.
   • BInclude quality metrics in audit staff annual performance evaluations.
   • CIntroduce a balanced scorecard for internal audit.
   • DConduct control self-assessments (CSA) with IT management.

   Show answer

   Answer: A

   Explanation

   Engaging a third party to conduct regular quality assurance reviews is often considered the most effective way for internal audit management to ensure the quality of IS audits is maintained. External QA reviews provide an independent and objective assessment of the internal audit function's processes, methodologies, and overall effectiveness. This external perspective can offer valuable insights into areas for improvement and help ensure that the IS audits meet professional standards and best practices.

   Source: Adapted from community discussion — FAGFUR

   Next question

2. Question 22 · 1459 in bank

   During a review of an organization's network threat response process, the IS auditor noticed that the majority of alerts were closed without resolution. Management responded that those alerts were unworkable due to lack of actionable intelligence, and therefore the support team is allowed to close them. What is the BEST way for the auditor to address this situation?

   • AFurther review closed unactioned alerts to identify mishandling of threats.
   • BReopen unactioned alerts and report to the audit committee.
   • CRecommend that management enhance the policy and improve threat awareness training.
   • DOmit the finding from the report as this practice is in compliance with the current policy.

   Show answer

   Answer: A

   Explanation

   The IS auditor should review the closed unactioned alerts to determine if there was any mishandling of threats. This will help the auditor assess if the current policy and practice are effective and if there is a need for improvements in the threat response process. so answer is a

   Source: Adapted from community discussion — SBD600

   Next question

3. Question 23 · 1459 in bank

   In an organization's feasibility study to acquire hardware to support a new web server, omission of which of the following would be of MOST concern?

   • AReputation of potential vendors
   • BAlternatives for financing the acquisition
   • CFinancial stability of potential vendors
   • DCost-benefit analysis of available products

   Show answer

   Answer: D

   Explanation

   In a feasibility study to acquire hardware to support a new web server, the omission of the cost-benefit analysis of available products would be of MOST concern. The cost-benefit analysis is a crucial component of a feasibility study as it helps evaluate the economic feasibility of the investment.

   Source: Adapted from community discussion — FAGFUR

   Next question

4. Question 24 · 1459 in bank

   Which of the following is MOST helpful for understanding an organization’s key driver to modernize application platforms?

   • ANetwork architecture diagrams
   • BInventory of end-of-life software
   • CVendor software invoices
   • DSystem-wide incident reports

   Show answer

   Answer: B

   Explanation

   An inventory of end-of-life software can provide valuable insights into which applications or systems are outdated and may need to be modernized. This information helps identify key drivers for modernization efforts, as outdated software may pose security risks, lack support, and hinder overall performance. Understanding the state of the software within an organization is crucial in developing a strategy for modernizing application platforms.

   Source: Adapted from community discussion — FAGFUR

   Next question

5. Question 25 · 1459 in bank

   An IS auditor is reviewing results from the testing of an organization’s disaster recovery plan (DRP). Which of the following findings should be of GREATEST concern?

   • AThe testing was done after implementing a business application.
   • BThe backups at the DR site are not encrypted.
   • CThe testing was done during critical business hours.
   • DThe backups at the DR site are unreadable.

   Show answer

   Answer: D

   Explanation

   This is a typical BAD and irresponsible question of ISACA CISA, "C" refers a bad timing for testing and "could" influence the business severely. While the "D", "unreadable" may mean either "recovery is failed" or "the privilege is temporary missing ". The correct answer should depend on the exact situation of "C" and "D". In an other word, the answer depends on what the question auditor's thought , which is very very irresponsible. If we see "unreadable" means "the test is failed" and "D"'s influence is not very significantly recognized , I would choose D, not C.

   Source: Adapted from community discussion — hermfrancis

   Next question

6. Question 26 · 1459 in bank

   Demonstrated support from which of the following roles in an organization has the MOST influence over information security governance?

   • AInformation security steering committee
   • BChief information security officer (CISO)
   • CBoard of directors
   • DChief information officer (CIO)

   Show answer

   Answer: C

   Explanation

   In many organizations, the Board of Directors is ultimately accountable for ensuring that information security is aligned with business objectives, legal and regulatory requirements, and the organization's overall risk tolerance. Demonstrated support from the board provides a strong foundation for a robust and effective information security governance framework.

   Source: Adapted from community discussion — FAGFUR

   Next question

7. Question 27 · 1459 in bank

   An employee performs computer operations and, when the situation demands, program modifications. Which of the following should the IS auditor recommend?

   • AAutomated logging of changes to development libraries should be instituted.
   • BProcedures should be established to ensure that program changes are identified and approved.
   • CAdditional staff should be recruited to provide separation of duties.
   • DAccess control should prevent the operator from making program modifications.

   Show answer

   Answer: B

   Explanation

   B. Procedures should be established to ensure that program changes are identified and approved. In this scenario, the IS auditor should recommend establishing procedures to identify and approve program changes. This is important for maintaining control and accountability over program modifications, ensuring that they are made in a controlled and authorized manner. Automated logging (Option A) and access controls (Option D) can be part of these procedures, but it's crucial to have clear processes for identifying and approving changes as well. Hiring additional staff (Option C) for separation of duties might not be necessary if proper procedures and controls are in place.

   Source: Adapted from community discussion — SuperMax

   Next question

8. Question 28 · 1459 in bank

   A national bank recently migrated a large number of business-critical applications to the cloud. Which of the following is MOST important to ensuring the resiliency of the applications?

   • AConducting periodic system stress testing
   • BNegotiating a service level agreement (SLA) with the provider
   • CUsing a monitoring tool to assess uptime
   • DCreating restore points for critical applications

   Show answer

   Answer: B

   Explanation

   In the context of ensuring the resiliency of business-critical applications migrated to the cloud, option B, "Negotiating a service level agreement (SLA) with the provider," is typically the MOST important. While all the options listed are important for application resiliency, negotiating a comprehensive SLA with the cloud provider helps establish clear expectations regarding uptime, performance, and other critical aspects of service. A well-defined SLA can provide legal guarantees and penalties for the provider if service levels are not met, which is essential for ensuring the reliability and resiliency of your applications. It serves as a contractual commitment to maintaining the required levels of availability and performance for your applications in the cloud.

   Source: Adapted from community discussion — SuperMax

   Next question

9. Question 29 · 1459 in bank

   Which of the following should be an IS auditor's PRIMARY consideration when evaluating the development and design of a privacy program?

   • APolicies and procedures consistent with privacy guidelines
   • BIndustry practice and regulatory compliance guidance
   • CInformation security and incident management practices
   • DPrivacy training and awareness program for employees

   Show answer

   Answer: B

   Explanation

   The IS auditor's PRIMARY consideration when evaluating the development and design of a privacy program should be: B. Industry practice and regulatory compliance guidance While all the options listed are important aspects of a privacy program, ensuring that the program aligns with industry best practices and complies with relevant regulations is typically the top priority. This provides a strong foundation for addressing privacy concerns effectively.

   Source: Adapted from community discussion — SuperMax

   Next question

10. Question 30 · 1459 in bank

    Which of the following should be of GREATEST concern to an IS auditor reviewing an organization’s newly established enterprise architecture (EA)?

    • AThe business leaders were not consulted when designing the IT architecture.
    • BStandard architecture methodology was not adopted for designing the IT architecture.
    • CStaff responsible for designing the IT architecture do not hold a related certification.
    • DExternal experts were not consulted when designing the IT architecture.

    Show answer

    Answer: A

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISA practice, question 21. 1459 questions available.