CISA practice questions 401–410

1. Question 401 · 1459 in bank

   The business case for an information system investment should be available for review until the:

   • Ainformation system investment is retired.
   • Bformal investment decision is approved.
   • Cinformation system has reached end of life.
   • Dbenefits have been fully realized.

   Show answer

   Answer: D

   Explanation

   Answer D both option A and option D ("benefits have been fully realized") are valid endpoints for the availability of the business case. The choice between the two options may depend on the specific context of the organization and the purpose of the review. If the focus is on assessing the overall success and ROI of the investment, option D may be more appropriate. However, if the investment is being retired and lessons learned are being gathered, option A would be the endpoint for review

   Source: Adapted from community discussion — a84n

   Next question

2. Question 402 · 1459 in bank

   Which of the following sampling methodologies is PRIMARILY used to detect significant deficiencies?

   • ADiscovery sampling
   • BCompliance testing
   • CAttribute sampling
   • DSubstantive testing

   Show answer

   Answer: A

   Explanation

   Discovery sampling is primarily used to detect significant deficiencies by examining a sample with the intent of discovering errors, irregularities, or other significant issues that might exist within a population. This method is particularly useful when there is a suspicion of fraud, errors, or other significant problems that may not be apparent through other sampling methodologies.

   Source: Adapted from community discussion — Swallows

   Next question

3. Question 403 · 1459 in bank

   A warehouse employee of a retail company has been able to conceal the theft of inventory items by entering adjustments of either damaged or lost stock items to the inventory system. Which control would have BEST prevented this type of fraud in a retail environment?

   • AStatistical sampling of adjustment transactions
   • BSeparate authorization for input of transactions
   • CAn edit check for the validity of the inventory transaction
   • DUnscheduled audits of lost stock lines

   Show answer

   Answer: B

   Next question

4. Question 404 · 1459 in bank

   Which of the following BEST supports the effectiveness of a compliance program?

   • AAssessing and tracking all compliance audit findings
   • BImplementing a governance, risk, and compliance (GRC) tool to track compliance to regulations
   • CMonitoring which compliance regulations apply to the organization
   • DImplementing an awareness plan regarding compliance regulation requirements

   Show answer

   Answer: A

   Next question

5. Question 405 · 1459 in bank

   Which of the following is MOST important for an IS auditor to confirm during the implementation phase of a new system?

   • AAccuracy of error reports in recognizing erroneous data
   • BWhether system objectives and requirements were documented
   • CWhether appropriate internal controls are in place
   • DSystem parameters for scheduling and running the system

   Show answer

   Answer: C

   Next question

6. Question 406 · 1459 in bank

   Which of the following BEST enables an organization to identify potential security threats associated with a virtualization technique proposed by the vendor of a popular virtual machine (VM) system?

   • AArchitecture design
   • BFunctional specifications
   • CRisk assessment
   • DHypervisor logs

   Show answer

   Answer: C

   Explanation

   Those who are saying D can you explain how do you check logs of a system that doesn't exist yet? This system is proposed by the vendor, not implemented yet. Answer is C.

   Source: Adapted from community discussion — RS66

   Next question

7. Question 407 · 1459 in bank

   During a follow-up audit, an IS auditor finds that the auditee has updated virus scanner definitions without adopting the original audit recommendation to increase the frequency of using the scanner. The MOST appropriate action for the auditor is to:

   • Amodify the audit opinion based on the new information available.
   • Bprepare a follow-up audit report reiterating the recommendation.
   • Cescalate the issue to senior management.
   • Dconclude that the residual risk is beyond tolerable levels of risk.

   Show answer

   Answer: B

   Explanation

   A follow-up audit report documents and details any recommendations made during the initial audit that were not implemented. The auditor can clearly state why the recommendations were not implemented and what was done instead, helping management understand the nature of the problem.

   Source: Adapted from community discussion — Swallows

   Next question

8. Question 408 · 1459 in bank

   Which of the following BEST demonstrates alignment of the IT department with the corporate mission?

   • AAnnual board meetings
   • BBiweekly reporting to senior management
   • CQuarterly steering committee meetings
   • DAnalysis of IT department functionality

   Show answer

   Answer: C

   Next question

9. Question 409 · 1459 in bank

   What is the FIRST step when creating a data classification program?

   • ADevelop a policy.
   • BDevelop data process maps.
   • CCategorize and prioritize data.
   • DCategorize information by owner.

   Show answer

   Answer: A

   Explanation

   The first step when creating a data classification program is to develop a policy. This policy outlines the objectives, scope, and guidelines for classifying data within an organization. It provides the framework for identifying, categorizing, and protecting sensitive information based on its importance and sensitivity. Once the policy is established, the organization can proceed with categorizing and prioritizing data (option C) according to the guidelines outlined in the policy.

   Source: Adapted from community discussion — Swallows

   Next question

10. Question 410 · 1459 in bank

    Which of the following indicates an effective change control environment?

    • AThere is version control for the program documentation.
    • BUser management formally approves change requests.
    • CRelease management is automated.
    • DThe quality assurance (QA) group reports to the application development manager.

    Show answer

    Answer: B

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISA practice, question 401. 1459 questions available.