Certified Information Systems Auditor1,459 questions across 146 pages are complete and free, with no account or card.
1459 questions in this bank
Free access · progress saved on this device
An IS audit manager finds that data manipulation logic developed by the audit analytics team leads to incorrect conclusions. This inaccurate logic is MOST likely an indication of which of the following?
Answer: A
An organization is establishing a steering committee for the implementation of a new enterprise resource planning (ERP) system that uses Agile project management methodology. What is the MOST important criterion for the makeup of this committee?
Answer: B
Which of the following is the BEST control to mitigate the malware risk associated with an instant messaging (IM) system?
Answer: C
Option B is the best control to mitigate the malware risk associated with an IM system because blocking attachments in IM can help to prevent the transmission of malware through the IM system. Malware is often transmitted through attachments, so blocking attachments can be an effective way to prevent the spread of malware. Option A may help to reduce the risk of malware, but it is not as effective as blocking attachments because malware can still be transmitted through other means. Option C may help to reduce the risk of malware, but it is not as effective as blocking attachments because malware can still be transmitted through other means. Option D may help to protect against the interception of IM traffic, but it does not address the risk of malware transmission.
Source: Adapted from community discussion — nickchen
What type of data analytics tool should be used to determine the correlation between the variables and a specific outcome?
Answer: D
Which of the following should an IS auditor do FIRST when assessing an organization's ability to effectively secure its data?
Answer: C
The correct answer is C. Ensure management has identified the data and where it resides. Before assessing the organization's ability to secure its data, the IS auditor must first ensure that management has: - Identified the data that needs to be protected - Determined where the data is stored, processed, and transmitted - Recognized the data's importance and value to the organization This step is essential because it provides a foundation for the rest of the assessment. Without a clear understanding of what data needs to be protected and where it resides, it is impossible to effectively secure it.
Source: Adapted from community discussion — jan1234
Which of the following is the MOST appropriate procedure for an organization to use when classifying data?
Answer: C
B. "Review data classification questionnaires completed by data owners" is the most appropriate procedure. Data owners, who are responsible for the data and understand its value and sensitivity, should be the ones to complete detailed questionnaires about the data. The information security team can then review these questionnaires and work with the data owners to determine the appropriate data classification levels. C. "Use results from business impact analyses to classify data" is not the most appropriate procedure for data classification. While business impact analyses can provide valuable insights, they may not capture the full context and nuances required for accurate data classification. Data classification should be a separate and more focused process that involves the data owners directly.
Source: Adapted from community discussion — Binagr8
An IS auditor noted that a change to a critical calculation was placed into the production environment without being tested. Which of the following is the BEST way to obtain assurance that the calculation functions correctly?
Answer: D
Answer: D checking the regular execution of the calculation batch job as a means to obtain assurance that the calculation functions correctly. While monitoring the regular execution of the calculation can provide some level of assurance that it runs without obvious errors, it does not directly verify the accuracy or correctness of the calculation itself, especially if a change has been implemented without proper testing.
Source: Adapted from community discussion — a84n
The use of cookies constitutes the MOST significant security threat when they are used for:
Answer: C
An IS auditor can BEST evaluate the business impact of system failures by:
Answer: C
In a data center audit, an IS auditor finds that the humidity level is very low. The IS auditor would be MOST concerned because of an expected increase in:
Answer: C
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CISA practice, question 431. 1459 questions available.
Version 1.0.0. How we source questions