CISA practice questions 311–320

1. Question 311 · 1459 in bank

   An IS auditor has been asked to review an organization's IT resource management practices. Which of the following findings should be of GREATEST concern?

   • AAn existing vacancy for an IT administrator
   • BThe lack of a confidentiality agreement for IT management
   • CInsufficient IT training
   • DAn undocumented IT strategy

   Show answer

   Answer: D

   Explanation

   D. As everything must align with organization strategy . Therefore, if there is absence of undocumented strategy, the resources management practices will lack direction

   Source: Adapted from community discussion — Rachy

   Next question

2. Question 312 · 1459 in bank

   Which of the following should be the PRIMARY objective of an organization's incident management program?

   • APreventing recurrence of similar incidents in the future
   • BReducing the number and severity of security incidents throughout the organization
   • CClosing incidents in accordance with service level agreements (SLAs)
   • DEnabling the organization to resume normal business operations

   Show answer

   Answer: D

   Next question

3. Question 313 · 1459 in bank

   An IS auditor is asked to review an organization's technology relationships, interfaces, and data. Which of the following enterprise architecture (EA) areas is MOST appropriate for this review?

   • AApplication architecture
   • BInfrastructure architecture
   • CReference architecture
   • DInformation security architecture

   Show answer

   Answer: C

   Next question

4. Question 314 · 1459 in bank

   An IS auditor finds that irregularities have occurred and that auditee management has chosen to ignore them. If reporting to external authorities is required, which of the following is the BEST action for the IS auditor to take?

   • AObtain approval from audit management to submit the report.
   • BObtain approval from auditee management to release the report.
   • CObtain approval from both audit and auditee management to release the report.
   • DSubmit the report to appropriate regulators immediately.

   Show answer

   Answer: A

   Next question

5. Question 315 · 1459 in bank

   Which of the following areas is MOST important for an IS auditor to focus on when reviewing the maturity model for a technology organization?

   • AService level agreements (SLAs)
   • BStandard operating procedures
   • CRoles and responsibility matrix
   • DBusiness resiliency

   Show answer

   Answer: A

   Next question

6. Question 316 · 1459 in bank

   An organization's strategy to source certain IT functions from a software as a service (SaaS) provider should be approved by the:

   • AIT steering committee.
   • Bchief financial officer (CFO).
   • CIT operations manager.
   • Dchief risk officer (CRO).

   Show answer

   Answer: A

   Next question

7. Question 317 · 1459 in bank

   A small organization is experiencing rapid growth and plans to create a new information security policy. Which of the following is MOST relevant to creating the policy?

   • AEnterprise architecture (EA)
   • BBusiness impact analysis (BIA)
   • CBusiness objectives
   • DRecent incident trends

   Show answer

   Answer: C

   Next question

8. Question 318 · 1459 in bank

   Which of the following is the MOST appropriate control to have in place after data migration?

   • AReview of representative samples of migrated data
   • BClearly defined and documented data migration roles
   • CFormal sign-off by senior management after completion
   • DMapping of transactions from source to receiving system

   Show answer

   Answer: A

   Next question

9. Question 319 · 1459 in bank

   Due to technical limitations, an organization is not able to implement encryption of credit card details in the customer database. Which of the following would provide the BEST assurance of data confidentiality?

   • ATokenization of credit card details
   • BEncryption of credit card details in transit
   • CMulti-factor authentication to access the database
   • DData masking of credit card details on screen

   Show answer

   Answer: A

   Next question

10. Question 320 · 1459 in bank

    Which of the following issues identified during a formal review of an organization's information security policies presents the GREATEST potential risk to the organization?

    • AThe policies have not been reviewed by the risk management committee.
    • BThe policies are not based on industry best practices for information security.
    • CThe policies are not aligned with the information security risk appetite.
    • DThe policies are not available to key risk stakeholders.

    Show answer

    Answer: C

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISA practice, question 311. 1459 questions available.