CISA practice questions 381–390

1. Question 381 · 1459 in bank

   During an IT governance review, an IS auditor finds that all IT expenditures are included as a single line item in the enterprise-wide budget. Which of the following documentation would provide the BEST evidence for evaluating how IT expenditures support business objectives?

   • AProfit and loss statements
   • BIT steering committee approval
   • CBusiness impact analysis (BIA)
   • DIT purchase orders

   Show answer

   Answer: B

   Explanation

   The IT steering committee is typically responsible for overseeing IT strategy and ensuring that IT initiatives align with business objectives. Therefore, approval from the IT steering committee indicates that IT expenditures have been evaluated in terms of their contribution to achieving business goals.

   Source: Adapted from community discussion — Swallows

   Next question

2. Question 382 · 1459 in bank

   An organization has made a strategic decision to split into separate operating entities to improve profitability. However, the IT infrastructure remains shared between the entities. Which of the following would BEST help to ensure that IS audit still covers key risk areas within the IT environment as part of its annual plan?

   • ADeveloping a risk-based plan considering each entity's business processes
   • BConducting an audit of newly introduced IT policies and procedures
   • CRevising IS audit plans to focus on IT changes introduced after the split
   • DIncreasing the frequency of risk-based IS audits for each business entity

   Show answer

   Answer: A

   Next question

3. Question 383 · 1459 in bank

   Which of the following controls BEST ensures the integrity of data exchanged between two systems?

   • AData classification
   • BEncryption
   • CHash values
   • DControl totals

   Show answer

   Answer: C

   Explanation

   While encryption can protect the confidentiality of data during transmission, it doesn't inherently guarantee its integrity. Hash values specifically address the integrity aspect by providing a means to detect any unauthorized changes to the data.

   Source: Adapted from community discussion — Swallows

   Next question

4. Question 384 · 1459 in bank

   An IS auditor detects that event logging has been disabled on a critical server. Which of the following is the GREATEST concern?

   • AUsers have the ability to disable logging.
   • BOrganizational policies do not prohibit disabling of event logs.
   • CThe ability to troubleshoot incidents is limited.
   • DUnauthorized transactions may go undetected.

   Show answer

   Answer: D

   Next question

5. Question 385 · 1459 in bank

   An IS auditor has identified deficiencies within the organization's software development life cycle policies. Which of the following should be done NEXT?

   • AEscalate the situation to the lead auditor.
   • BIdentify who approved the policies.
   • CDocument the findings in the audit report.
   • DCommunicate the observation to the auditee.

   Show answer

   Answer: D

   Explanation

   D. Communicate the observation to the auditee. Documenting the findings in the audit report is essential, but it should come after communicating the observations to the auditee. The auditee should have an opportunity to respond or take corrective action before the findings are formally documented.

   Source: Adapted from community discussion — MJORGER

   Next question

6. Question 386 · 1459 in bank

   Which of the following is MOST important for an IS auditor to confirm when reviewing an organization's incident response management program?

   • AAll identified incidents are escalated to the CEO and the CISO.
   • BThe alerting tools and incident response team can detect incidents.
   • CIncident response is within defined service level agreements (SLAs).
   • DAll incidents have a severity level assigned.

   Show answer

   Answer: B

   Next question

7. Question 387 · 1459 in bank

   Which of the following is the MOST important area of focus for an IS auditor when developing a risk-based audit strategy?

   • ABusiness processes
   • BRecent audit results
   • CCritical business applications
   • DExisting IT controls

   Show answer

   Answer: C

   Next question

8. Question 388 · 1459 in bank

   Which of the following is MOST important for an IS auditor to verify during an audit closing meeting?

   • AThe findings and agreed-upon resolutions are communicated to executive management.
   • BThe agreed-upon resolutions are cost-effective and do not disrupt the business.
   • CThe organization has the applicable resources to implement the agreed-upon resolutions.
   • DThe agreed-upon resolutions and the time allotted to address the findings are correct.

   Show answer

   Answer: D

   Explanation

   While ensuring that resolutions are communicated to executive management (A), that they are cost-effective and do not disrupt the business (B), and that the organization has the resources to implement them (C) are all important considerations, these aspects can be addressed and refined after the closing meeting. The primary goal of the closing meeting is to confirm that the findings and resolutions are accurately captured and that there is a mutual understanding of the next steps within a feasible timeframe.

   Source: Adapted from community discussion — KAP2HURUF

   Next question

9. Question 389 · 1459 in bank

   Which of the following is the GREATEST benefit of an effective data classification process?

   • AData retention periods are well defined.
   • BData is protected according to its sensitivity.
   • CData custodians are identified.
   • DAppropriate ownership over data is assigned.

   Show answer

   Answer: B

   Next question

10. Question 390 · 1459 in bank

    The PRIMARY advantage of object-oriented technology is enhanced:

    • Agrouping of objects into methods for data access.
    • Bmanagement of sequential program execution for data access.
    • Cmanagement of a restricted variety of data types for a data object.
    • Defficiency due to the re-use of elements of logic.

    Show answer

    Answer: D

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISA practice, question 381. 1459 questions available.