CISA practice questions 291–300

1. Question 291 · 1459 in bank

   An IS auditor is reviewing an organization's overall incident response capability following recovery from a cybersecurity incident. Which of the following findings should be of MOST concern to the auditor?

   • ARisk analysis errors were identified as part of the post-incident review.
   • BLogs were only collected as part of the post-incident review.
   • CThe incident was caused by a known vulnerability with a documented risk acceptance.
   • DLessons learned were not documented after the incident.

   Show answer

   Answer: B

   Explanation

   Logs are crucial for incident detection, investigation, and response. Collecting logs only after an incident has occurred, as part of the post-incident review, suggests that the organization lacks the necessary monitoring and logging capabilities to proactively detect and respond to incidents.

   Source: Adapted from community discussion — PurpleParrot

   Next question

2. Question 292 · 1459 in bank

   During the walk-through procedures for an upcoming audit, an IS auditor notes that the key application in scope is part of a Software as a Service (SaaS) agreement. What should the auditor do NEXT?

   • AVerify whether a third-party security attestation exists.
   • BVerify whether IT management monitors the effectiveness of the environment.
   • CVerify whether a right-to-audit clause exists.
   • DVerify whether service level agreements (SLAs) are defined and monitored.

   Show answer

   Answer: D

   Explanation

   Service level agreements (SLAs) define the level of service that the SaaS provider agrees to offer and the metrics by which that service will be measured. It's crucial for the auditor to ensure that SLAs are clearly defined in the agreement and actively monitored to ensure compliance.

   Source: Adapted from community discussion — Swallows

   Next question

3. Question 293 · 1459 in bank

   Halfway through an enterprise-wide project to implement business solutions, an IS auditor is called in to do a project risk evaluation. The results from this audit are to be communicated directly to the project steering committee. What should the auditor do FIRST?

   • AAssess the project organization and actual cost incurred.
   • BInterview the project manager about the project scope and current status.
   • CReview the organization's project management framework.
   • DPerform a risk assessment of the project based on best practices.

   Show answer

   Answer: C

   Next question

4. Question 294 · 1459 in bank

   Which of the following cloud deployment models would BEST meet the needs of a startup software development organization with limited initial capital?

   • ACommunity
   • BHybrid
   • CPrivate
   • DPublic

   Show answer

   Answer: D

   Next question

5. Question 295 · 1459 in bank

   An organization relies on an external vendor that uses a cloud-based Software as a Service (SaaS) model to back up its data. Which of the following is the GREATEST risk to the organization related to data backup and retrieval?

   • AThe organization may be locked into an unfavorable contract with the vendor.
   • BThe organization may not be allowed to inspect the vendor's data center.
   • CThe vendor may be unable to restore critical data.
   • DThe vendor may be unable to restore data by recovery time objective (RTO) requirements.

   Show answer

   Answer: C

   Explanation

   Answer D In a cloud-based Software as a Service (SaaS) model, the organization often has specified Recovery Time Objectives (RTOs), which represent the maximum acceptable downtime for systems and data. If the vendor fails to restore data within the agreed-upon RTOs, it could disrupt business operations, cause financial losses, and damage customer trust. The inability of the vendor to meet RTO requirements directly impacts the organization's ability to resume operations swiftly after a data loss event. If critical data cannot be restored within the specified RTO, it could lead to extended periods of downtime, impacting productivity and potentially resulting in financial penalties if service level agreements (SLAs) are not met. Therefore, the risk that the vendor may be unable to restore data by RTO requirements (option D) is indeed significant, as it directly affects the organization's ability to recover from data loss incidents and maintain business continuity.

   Source: Adapted from community discussion — a84n

   Next question

6. Question 296 · 1459 in bank

   A security administrator is called in the middle of the night by the on-call programmer. A number of programs have failed, and the programmer has asked for access to the live system. What is the BEST course of action?

   • AReview activity logs the following day and investigate any suspicious activity.
   • BGive the programmer read-only access to investigate the problem.
   • CRequire that a change request be completed and approved.
   • DGive the programmer an emergency ID for temporary access and review the activity.

   Show answer

   Answer: D

   Next question

7. Question 297 · 1459 in bank

   Which of the following should an IS auditor recommend be performed FIRST when evaluating potential enterprise resource planning (ERP) implementation vendors?

   • AReview the vendors' past implementations.
   • BInvestigate the vendors' financial history.
   • CCheck the vendors' client references.
   • DDevelop the vendor response scorecard.

   Show answer

   Answer: D

   Explanation

   As I understand it, the development of a vendor scorecard typically includes the results from options A., B. and C. as a basis - whereby the order in which these bases are developed is irrelevant, as all the data for the scorecard must be available. So somehow only D. itself makes sense as an answer.

   Source: Adapted from community discussion — 46080f2

   Next question

8. Question 298 · 1459 in bank

   Which of the following is the BEST way to ensure an organization's data classification policies are preserved during the process of data transformation?

   • AConduct a data discovery exercise across all business applications.
   • BControl access to extract, transform, and load (ETL) tools.
   • CImplement classification labels in metadata during data creation.
   • DMap data classification controls to data sets.

   Show answer

   Answer: C

   Next question

9. Question 299 · 1459 in bank

   When evaluating an information security risk assessment, what is MOST important to review to gain an understanding of how risk is reduced?

   • AInherent risk
   • BResidual risk
   • CMitigation efforts
   • DControl effectiveness

   Show answer

   Answer: C

   Explanation

   Any view about Residual Risk - When evaluating an information security risk assessment, Residual Risk is the most important to review to understand how effectively risks have been reduced. Here’s why: • Residual Risk represents the level of risk remaining after all mitigation efforts and controls have been applied. It directly shows the effectiveness of these risk management strategies in reducing the overall risk. • Mitigation Efforts and Control Effectiveness are important for understanding what measures are in place and how well they work. However, Residual Risk provides the final measure of the risk that still exists after these efforts, making it the most direct indicator of how much risk has been successfully reduced.

   Source: Adapted from community discussion — 1e71ed5

   Next question

10. Question 300 · 1459 in bank

    Which of the following is the GREATEST risk when using application programming interfaces (APIS) in a third-party hosted virtual environment?

    • AData exfiltration
    • BLack of accountability
    • CInability to test third-party APIs
    • DLack of redundancy

    Show answer

    Answer: A

    Explanation

    The GREATEST risk when using application programming interfaces (APIs) in a third-party hosted virtual environment is option A: Data exfiltration. Data exfiltration refers to the unauthorized extraction or theft of data from a system or network. When using third-party APIs in a hosted virtual environment, there is a risk that the APIs may have vulnerabilities or be exploited by malicious actors to gain unauthorized access to sensitive data. This can result in data breaches, loss of confidential information, and potential legal and reputational consequences for the organization. While options B, C, and D are also important risks to consider, data exfiltration poses the greatest threat as it directly impacts the security and integrity of the organization's data. It is crucial to assess the security measures, access controls, and data protection mechanisms in place when utilizing third-party APIs to mitigate the risk of data exfiltration.

    Source: Adapted from community discussion — KAP2HURUF

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISA practice, question 291. 1459 questions available.