CISA practice questions 361–370

1. Question 361 · 1459 in bank

   Which of the following is the GREATEST security concern specific to virtualized environments?

   • AA management console grants administrative access.
   • BUnmanaged memory may leak data between guests.
   • CPerformance issues of the host can affect security capabilities.
   • DVulnerabilities can result in exposure of sensitive data.

   Show answer

   Answer: B

   Explanation

   Unmanaged memory may leak data between guests: Virtualization involves sharing physical resources among multiple virtual machines (VMs). If memory is not properly managed, sensitive data from one VM could potentially be accessed by another VM running on the same physical host. This is a significant concern as it directly relates to the isolation between virtual machines.

   Source: Adapted from community discussion — Swallows

   Next question

2. Question 362 · 1459 in bank

   Which of the following is the BEST recommendation to mitigate the risk associated with remote access through the hypervisor interface?

   • APresentation-layer and application-layer controls
   • BEnterprise security policies and controls
   • CSecure configuration of guest systems
   • DNetwork-layer and transport-layer controls

   Show answer

   Answer: D

   Explanation

   Network-layer and transport-layer controls: These controls involve measures such as firewalls, VPNs (Virtual Private Networks), encryption, and network segmentation. Implementing strong network-layer and transport-layer controls helps secure communication between remote users and the hypervisor interface, reducing the risk of unauthorized access or interception of sensitive data.

   Source: Adapted from community discussion — Swallows

   Next question

3. Question 363 · 1459 in bank

   Which of the following is the GREATEST advantage of outsourcing the development of an e-banking solution when in-house technical expertise is not available?

   • AIncreased ability to adapt the system
   • BReduced risk of system downtime
   • CDirect oversight of risks
   • DLower start-up costs

   Show answer

   Answer: D

   Explanation

   This is D. You don’t have the team. You don’t want to hire pay for training and get enough people to start this project because that costs a ton on money. So you outsource because you get to save money on initial start up costs.

   Source: Adapted from community discussion — blehbleh

   Next question

4. Question 364 · 1459 in bank

   In a 24/7 processing environment, a database contains several privileged application accounts with passwords set to "never expire." Which of the following recommendations would BEST address the risk with minimal disruption to the business?

   • ASchedule downtime to implement password changes.
   • BIntroduce database access monitoring into the environment.
   • CModify the access management policy to make allowances for application accounts.
   • DModify applications to no longer require direct access to the database.

   Show answer

   Answer: B

   Next question

5. Question 365 · 1459 in bank

   When assessing the quality of personnel data, an IS auditor finds that the data values reconcile to values outside of the database and logical access is appropriately restricted. Which of the following should also be reviewed to provide a comprehensive assessment of the data quality?

   • AWhether the data can be used in the correct context
   • BWhether the data is classified appropriately
   • CWhether procedures for using the database are followed
   • DWhether users are appropriately trained

   Show answer

   Answer: A

   Explanation

   Whether the data can be used in the correct context: While the data may reconcile to values outside of the database and logical access is appropriately restricted, it's essential to ensure that the data is accurate and relevant for its intended purpose. Assessing whether the data can be effectively utilized in the correct context ensures that it aligns with business requirements and objectives.

   Source: Adapted from community discussion — Swallows

   Next question

6. Question 366 · 1459 in bank

   When evaluating evidence as part of an IS audit, which of the following sources should be considered MOST reliable?

   • AEvidence demonstrated in front of the auditor
   • BEvidence provided directly from the auditee
   • CEvidence curated by senior management
   • DEvidence provided by a third party

   Show answer

   Answer: A

   Next question

7. Question 367 · 1459 in bank

   Which of the following should be done FIRST to ensure that a data loss prevention (DLP) process is appropriately implemented?

   • AClassify the data stored on its systems.
   • BDetermine methods used to transmit data.
   • CMeasure the volume of data stored.
   • DIdentity the locations of the data on its systems.

   Show answer

   Answer: D

   Next question

8. Question 368 · 1459 in bank

   Which of the following should an IS auditor regard as the PRIMARY role of IT governance when considering an outsourcing arrangement for IT services?

   • AEnsuring the risk associated with outsourcing has been mitigated
   • BEnsuring stakeholder input in the outsourcing decision process
   • CEnsuring vendor due diligence during the vendor selection process
   • DEnsuring the outsourcing contract includes a right-to-audit clause

   Show answer

   Answer: A

   Next question

9. Question 369 · 1459 in bank

   The risk of communication failure in an e-commerce environment is BEST minimized through the use of:

   • Aalternative or diverse routing.
   • Bcompression software to minimize transmission duration.
   • Cfunctional or message acknowledgments.
   • Da packet filtering firewall to reroute messages

   Show answer

   Answer: A

   Explanation

   This is question asking for availibility issue of the E-comm business so the correct answer should be A. Not C which is for integrity of the communication data.

   Source: Adapted from community discussion — lingtianx1127

   Next question

10. Question 370 · 1459 in bank

    Which of the following should be an IS auditor's PRIMARY consideration when determining which issues to include in an audit report?

    • AInherent risk
    • BMateriality
    • CProfessional skepticism
    • DManagement's agreement

    Show answer

    Answer: B

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISA practice, question 361. 1459 questions available.