CISA practice questions 341–350

1. Question 341 · 1459 in bank

   An IS auditor learns that an organization's business continuity plan (BCP) has not been updated in the last 18 months and that the organization recently closed a production plant. Which of the following is the auditor's BEST course of action?

   • AAssess the risk to operations from the closing of the plant.
   • BDetermine whether the business impact analysis (BIA) is current with the organization's structure and context.
   • CPerform testing to determine the impact to the recovery time objective (RTO).
   • DDetermine the types of technologies used at the plant and how they may affect the BCP.

   Show answer

   Answer: B

   Next question

2. Question 342 · 1459 in bank

   Which of the following would be of GREATEST concern to an IS auditor assessing the organizational risk associated with fraud?

   • AUnauthorized changes to the production environment have been detected.
   • BPeriodic user access reviews to financial systems are inconsistent.
   • CA major financial application is developed and maintained by the application team.
   • DThe organization does not require employees to take mandatory leave.

   Show answer

   Answer: B

   Explanation

   Inconsistent periodic user access reviews to financial systems can pose significant risks related to fraud. Proper access controls are crucial in preventing unauthorized access to financial data and systems, which could be exploited by individuals intending to commit fraud. Inconsistent reviews may result in outdated user access permissions, potentially allowing unauthorized users to manipulate financial data or perform fraudulent activities without detection. This could lead to financial losses, regulatory compliance issues, and damage to the organization's reputation. Therefore, ensuring consistent and thorough user access reviews is critical for mitigating fraud risks within an organization.

   Source: Adapted from community discussion — Swallows

   Next question

3. Question 343 · 1459 in bank

   Upon completion of audit work, an IS auditor should:

   • Aprovide a report to the auditee stating the initial findings.
   • Bprovide a report to senior management prior to discussion with the auditee.
   • Cdistribute a summary of general findings to the members of the auditing team.
   • Dreview the working papers with the auditee.

   Show answer

   Answer: A

   Next question

4. Question 344 · 1459 in bank

   An organization is shifting to a remote workforce. In preparation, the IT department is performing stress and capacity testing of remote access infrastructure and systems. What type of control is being implemented?

   • ADirective
   • BDetective
   • CPreventive
   • DCompensating

   Show answer

   Answer: C

   Next question

5. Question 345 · 1459 in bank

   Which of the following controls is MOST crucial to ensure an organization will be able to recover its data from backup media in the event of a disaster?

   • AKeeping a current inventory of backup media
   • BEncrypting data on backup media
   • CPeriodically restoring backup media for key databases
   • DStoring backup media at an offsite facility

   Show answer

   Answer: D

   Explanation

   I vote for D. While restore tests (option C.) are a general requirement for a backup implementation, this is specifically about disaster case. From my understanding of the ISACA way of thinking, whenever an area is narrowed down in the question, an answer specific to that area is expected. In addition, ISACA also describes the following requirement summarized in the article "How to Develop and Execute a Rigorous Data Backup and Recovery Strategy" from 18.04.2022: The most crucial control to ensure an organization can recover its data from backup media in case of a disaster is to follow the 3-2-1 rule. This rule states that organizations should maintain at least 3 copies or versions of data stored on 2 different pieces of media, with 1 copy being offsite. This approach helps reduce the risk of data disruption and ensures that there are multiple backups available for recovery purposes.

   Source: Adapted from community discussion — 46080f2

   Next question

6. Question 346 · 1459 in bank

   Which of the following is the BEST way to mitigate the risk of services no longer being available from a bankrupt Software as a Service (SaaS) provider?

   • AIncluding service level agreements (SLAs) in the contract
   • BRetaining copies of the software for emergency situations
   • CHaving a software escrow agreement with a third party
   • DBacking up the data processed by the software

   Show answer

   Answer: D

   Next question

7. Question 347 · 1459 in bank

   An IS auditor finds that periodic reviews of read-only users for a reporting system are not being performed. Which of the following should be the IS auditor's NEXT course of action?

   • AObtain a verbal confirmation from IT for this exemption
   • BReview the list of end users and evaluate for authorization.
   • CReport this control process weakness to senior management.
   • DVerify management's approval for this exemption.

   Show answer

   Answer: D

   Explanation

   Option B, "Review the list of end users and evaluate for authorization," could be considered as a potential course of action, but it's not the immediate next step.

   Source: Adapted from community discussion — KAP2HURUF

   Next question

8. Question 348 · 1459 in bank

   Which of the following is the MOST important reason for an IS auditor to examine the results of a post-incident review performed after a security incident?

   • ATo re-analyze the incident to identify any hidden backdoors planted by the attacker
   • BTo evaluate the effectiveness of the network firewall against future security breaches
   • CTo compare incident response metrics with industry benchmarks
   • DTo evaluate the effectiveness of continuous improvement efforts

   Show answer

   Answer: D

   Next question

9. Question 349 · 1459 in bank

   Which test approach provides the GREATEST assurance of the completeness of transactions transferred between systems?

   • ATesting the reconciliations of the totals of transactions in the two systems
   • BTesting a sample of transactions in the source system from a list of all transactions in the destination system
   • CTesting the processes used to review processing exceptions
   • DTesting a sample of transactions in the destination system from a list of all transactions in the source system

   Show answer

   Answer: A

   Explanation

   Testing the reconciliations of the totals of transactions in the two systems provides the greatest assurance of completeness because it covers ALL transactions, not just a sample. This approach checks whether the total amounts match in both the originating and the receiving systems. If there are any discrepancies, it highlights that some transactions may not have been transferred completely or accurately. This holistic view of all transactions is more comprehensive and thus provides greater assurance compared to testing only a sample of transactions.

   Source: Adapted from community discussion — KAP2HURUF

   Next question

10. Question 350 · 1459 in bank

    Which of the following is a PRIMARY benefit of using risk assessments to determine areas to be included in an audit plan?

    • ATimely audit execution
    • BEffective allocation of audit resources
    • CReduced travel and expense costs
    • DEffective risk mitigation

    Show answer

    Answer: B

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISA practice, question 341. 1459 questions available.