Question 391 · 1459 in bank
Which of the following is the BEST indication of effective governance over IT infrastructure?
Show answer
Answer: C
Certified Information Systems Auditor1,459 questions across 146 pages are complete and free, with no account or card.
1459 questions in this bank
Free access · progress saved on this device
Which of the following is the BEST indication of effective governance over IT infrastructure?
Answer: C
An IS auditor learns that a web application within the audit scope has a vulnerability that could lead to the exposure of sensitive data. Which of the following should the auditor do FIRST?
Answer: D
Which of the following documents is MOST likely to include an audit's quality assurance (QA) process?
Answer: A
The audit charter typically outlines the overall framework, objectives, scope, and responsibilities of the audit, including its quality assurance (QA) processes. It sets the foundation for the audit and includes details on how quality will be ensured throughout the audit process. While the other documents might touch upon QA processes, the audit charter is specifically designed to establish these processes from the outset.
Source: Adapted from community discussion — Swallows
A review of an organization's balance sheet for material transactions and an application review of the program that produced the balance sheet would use which of the following sampling methods?
Answer: A
Definitively A. - this question seems to be directly referencing to the variable sampling description in the Manual: From the CISA Ref Manual 27th ed, 1.7.2 Sampling -> Variable Sampling "...An example of variable sampling is a review of an organization’s balance sheet for material transactions and an application review of the program that produced the balance sheet...."
Source: Adapted from community discussion — 46080f2
Which of the following is the BEST way for an IS auditor to verify whether help desk tickets are being managed by IT support in accordance with business expectations?
Answer: A
Who is responsible for authorizing data access for users?
Answer: A
The information owner is responsible for managing and approving access to their specific data. While other roles (CIO, security administrator, DBA) are important from a security and management perspective, the ultimate authority for approving access rests with the information owner.
Source: Adapted from community discussion — Swallows
Which of the following BEST facilitates compliance with requirements mandating the security of confidential data?
Answer: C
At first I spontaneously thought A. must be the right answer. But the question is very open, carefully formulated and asks about facilitating the fulfillment of requirements relating to the security of classified data. Encrypting everything externally, as in option A, could be counterproductive. So I'm going for C.
Source: Adapted from community discussion — 46080f2
An IT governance body wants to determine whether IT service delivery is based on consistently effective processes. Which of the following is the BEST approach?
Answer: A
Option A is the best answer because a maturity model is a framework that helps to assess the current state of an organization's processes and identify areas for improvement. It can be used to determine whether IT service delivery is based on consistently effective processes. Option B may be useful for evaluating the effectiveness of IT service delivery, but it does not address the issue of consistently effective processes. Option C involves comparing the current state of an organization's processes to a desired state, but it does not address the issue of consistently effective processes. Option D involves evaluating the effectiveness of controls, but it does not address the issue of consistently effective processes.
Source: Adapted from community discussion — nickchen
Which of the following MOST effectively reduces the probability of a brute force attack being successful?
Answer: A
Establishing an account lockout policy (A) is the most effective method for reducing the probability of a brute force attack being successful. A brute force attack involves trying many passwords or passphrases with the hope of eventually guessing the correct one. An account lockout policy will lock the account after a certain number of failed login attempts, thereby preventing the attacker from continuing to try different password combinations. This policy directly interrupts the brute force attack process by not allowing the attacker unlimited attempts within a short period of time.
Source: Adapted from community discussion — mdh717
Which of the following software versions would an IS auditor MOST likely find in the production environment during a post-deployment review?
Answer: B
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CISA practice, question 391. 1459 questions available.
Version 1.0.0. How we source questions