CISA practice questions 421–430

1. Question 421 · 1459 in bank

   What is the BEST way for an IS auditor to test the effectiveness of physical security controls for an organization's data center?

   • ACompare physical security controls against industry best practice.
   • BInspect surveillance footage of the data center.
   • CConduct an onsite inspection of physical security at the data center.
   • DReview badge access logs for the data center.

   Show answer

   Answer: C

   Next question

2. Question 422 · 1459 in bank

   Which of the following is the PRIMARY benefit of a tabletop exercise for an incident response plan?

   • AIt increases confidence in the team’s response readiness.
   • BIt reduces the likelihood of an incident occurring.
   • CIt identifies deficiencies in the operating environment.
   • DIt demonstrates the maturity of the incident response program.

   Show answer

   Answer: A

   Next question

3. Question 423 · 1459 in bank

   Which of the following is MOST important for an IS auditor to review when assessing the integrity of encryption controls for data at rest?

   • AProtection of encryption keys
   • BEncryption of test data
   • CFrequency of encryption key changes
   • DLength of encryption keys

   Show answer

   Answer: A

   Next question

4. Question 424 · 1459 in bank

   Which of the following would BEST guide an IS auditor when determining an appropriate time to schedule the follow-up of agreed corrective actions for reported audit issues?

   • ABusiness management has completed the implementation of agreed actions on schedule.
   • BProgress updates indicate that the implementation of agreed actions is on track.
   • CSufficient time has elapsed since implementation to provide evidence of control operation.
   • DRegulators have announced a timeline for an inspection visit.

   Show answer

   Answer: C

   Next question

5. Question 425 · 1459 in bank

   An IS auditor finds that management has signed a contract with a new application service provider but did not obtain third-party audit reports as part of the due diligence process. Which of the following is the GREATEST risk associated with this finding?

   • ARoles and responsibilities may not be understood.
   • BService level agreements (SLAs) may not be achievable.
   • CService provider controls may not be in place.
   • DService provider policies may not be properly documented.

   Show answer

   Answer: C

   Next question

6. Question 426 · 1459 in bank

   In which of the following situations is it MOST appropriate to implement data mirroring as part of a recovery strategy?

   • AWhen the mean time between failures (MTBF) is long
   • BWhen the recovery point objective (RPO) is short
   • CWhen disaster tolerance is low
   • DWhen the risk of a ransomware attack is high

   Show answer

   Answer: B

   Next question

7. Question 427 · 1459 in bank

   An organization outsources its payroll function to a third-party service provider. Which of the following is MOST important for an IS auditor to verify when reviewing the outsourcing agreement?

   • AThe provider has agreed to a right-to-audit clause.
   • BThe provider aligns with payroll industry best practices.
   • CThe provider has a good service reputation.
   • DThe provider has an extensive security training program.

   Show answer

   Answer: A

   Next question

8. Question 428 · 1459 in bank

   An IS audit team is evaluating documentation of the most recent application user access review. It is determined that the user list was not system generated. Which of the following should be of MOST concern?

   • ATimeliness of the user list review
   • BAvailability of the user list
   • CCompleteness of the user list
   • DConfidentiality of the user list

   Show answer

   Answer: C

   Next question

9. Question 429 · 1459 in bank

   Which of the following is MOST important for an organization to include in a software escrow agreement when outsourcing software development to a third party?

   • AThe escrow agent repository is to be updated as the software product evolves.
   • BThe escrow agent repository is to be subject to periodic audits by the organization.
   • CThe escrow agent repository is to be securely protected against vendor access.
   • DThe escrow agent repository is to be held in the organization's own country.

   Show answer

   Answer: A

   Next question

10. Question 430 · 1459 in bank

    In order for a firewall to effectively protect a network against external attacks, what fundamental practice must be followed?

    • AOnly essential external services should be permitted.
    • BThe firewall must be placed in the demilitarized zone (DMZ).
    • CFilters for external information must be defined.
    • DAll external communication must be via the firewall.

    Show answer

    Answer: A

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISA practice, question 421. 1459 questions available.