Question 351 · 1459 in bank
Which of the following is the BEST security control to validate the integrity of data communicated between production databases and a big data analytics system?
Show answer
Answer: A
Certified Information Systems Auditor1,459 questions across 146 pages are complete and free, with no account or card.
1459 questions in this bank
Free access · progress saved on this device
Which of the following is the BEST security control to validate the integrity of data communicated between production databases and a big data analytics system?
Answer: A
A contract for outsourcing IS functions should always include:
Answer: A
While option D is important as well, it does not always need to be documented in detail in the contract. The specific security procedures a contractor uses may be proprietary information that they are not willing or able to share in full - but they should be able to demonstrate that their security procedures meet certain standards. On the other hand, a provision for an independent audit of the contractor's operations is non-negotiable and should always be included in the contract. This allows the company outsourcing their IS functions to ensure that contractual obligations related to data privacy, service level agreements, etc., are being met by the contractor.
Source: Adapted from community discussion — KAP2HURUF
What is the BEST method for securing credit card numbers stored temporarily on a file server prior to transmission to the downstream system for payment processing?
Answer: B
Vote for B. – based on the case study in the ISACA Manual 27th ed: § 3.8.1 – “… forwards all sales data over a frame relay network to database servers located at the retailer’s corporate headquarters, with strong encryption applied to the data, which are then sent over a virtual private network (VPN) to the credit card processor for approval of the sale….”
Source: Adapted from community discussion — 46080f2
During an IS audit, it is discovered that data classification rules are often ignored by programmers developing in-house software. Which of the following recommendations would BEST mitigate the risk in this situation?
Answer: C
A network review is being undertaken to evaluate security risks. Which of the following would be of MOST concern if identified during the review?
Answer: C
My understanding is that B implies that there is no firewall nor proxy between the PC and the internet ("direct access"), which would indeed be the biggest problem. The formulation of C is unclear. What does "Firewall access" mean? It does not sound like direct external access.
Source: Adapted from community discussion — marc4354345
A secure server room has a badge reader system that records name, date, and time information whenever a staff member uses a badge to enter or exit. When reviewing the system logs, an IS auditor notices records for some employees entering, but not exiting, the room. Which of the following would be the MOST effective compensating control to recommend?
Answer: A
Which of the following is the MOST appropriate testing approach when auditing a daily data flow between two systems via an automated interface to confirm that it is complete and accurate?
Answer: D
An IS auditor reviewing incident response management processes notices that resolution times for reoccurring incidents have not shown improvement. Which of the following is the auditor's BEST recommendation?
Answer: B
Problem management involves identifying and addressing the root causes of incidents to prevent their recurrence. By implementing problem management practices, the organization can focus on understanding the underlying issues causing recurring incidents and take steps to resolve them proactively. This approach is essential for improving the overall efficiency and effectiveness of the incident response process. B is right answer
Source: Adapted from community discussion — Sibsankar
When removing a financial application system from production, which of the following is MOST important?
Answer: D
Ensuring that data retained for regulatory purposes can be retrieved is critical because financial systems often deal with sensitive and legally mandated data, such as financial transactions, customer records, and compliance-related information. Regulatory bodies may require organizations to maintain certain data for a specified period even after a system has been retired. Although A is important, it is often related to privacy and security. Sensitive is the most important in this context.
Source: Adapted from community discussion — kclow
Which of the following processes is MOST important to define within a data classification policy?
Answer: A
This process involves monitoring and reviewing who has access to various data assets, ensuring that access is appropriate based on the classification of the data. It's crucial for maintaining the confidentiality, integrity, and availability of sensitive information. Without proper auditing procedures, unauthorized access to sensitive data could go undetected, leading to potential data breaches or misuse.
Source: Adapted from community discussion — Swallows
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CISA practice, question 351. 1459 questions available.
Version 1.0.0. How we source questions