CISA practice questions 441–450

1. Question 441 · 1459 in bank

   To address issues related to privileged users identified in an IS audit, management implemented a security information and event management (SIEM) system. Which type of control is in place?

   • ADirective
   • BDetective
   • CPreventive
   • DCorrective

   Show answer

   Answer: B

   Explanation

   A SIEM system collects, aggregates, and analyzes security event data from various sources within an IT infrastructure. It then generates alerts or reports on potential security incidents or policy violations, allowing security teams to detect and investigate suspicious activities. While a SIEM system can help identify and respond to security issues related to privileged users, its primary function is to detect and analyze security events rather than prevent them from occurring.

   Source: Adapted from community discussion — Swallows

   Next question

2. Question 442 · 1459 in bank

   An IS auditor is evaluating the log management system for an organization with devices and systems in multiple geographic locations. Which of the following is MOST important for the auditor to verify?

   • ALog files are reviewed in multiple locations.
   • BLog files are encrypted and digitally signed.
   • CLog files of the servers are synchronized.
   • DLog files are concurrently updated.

   Show answer

   Answer: C

   Explanation

   For devices and systems in multiple geographic locations, having synchronized log files is critical for overall monitoring and analysis integrity, ensuring log data is consistent and enables effective problem resolution and analysis of security incidents.

   Source: Adapted from community discussion — Swallows

   Next question

3. Question 443 · 1459 in bank

   A new privacy regulation requires a customer's privacy information to be deleted within 72 hours, if requested. Which of the following would be an IS auditor's GREATEST concern regarding compliance to this regulation?

   • AOutdated online privacy policies
   • BEnd user access to applications with customer information
   • CIncomplete backup and retention policies
   • DLack of knowledge of where customers' information is saved

   Show answer

   Answer: D

   Explanation

   The greatest concern for an IS auditor regarding compliance with the new privacy regulation would be a lack of knowledge of where customers' information is saved. If the organization does not know where the information is stored, it would be impossible to delete it within the required 72-hour timeframe upon request.

   Source: Adapted from community discussion — SBD600

   Next question

4. Question 444 · 1459 in bank

   A business area received an audit finding because an administrator made unapproved emergency changes to a critical system. Which of the following would BEST prevent unapproved changes in the future?

   • ATwo-factor authentication on emergency access accounts
   • BUpdated emergency change management procedures
   • CRegular emergency change-control log reviews
   • DDual-control temporary emergency access accounts

   Show answer

   Answer: D

   Explanation

   Dual-control (or two-person integrity) requires two individuals to authorize and execute actions. By implementing dual-control for emergency access accounts, it ensures that no single administrator can make changes without the approval of another authorized individual. This significantly reduces the risk of unapproved changes as it requires collaboration and oversight, providing a robust mechanism for preventing unauthorized actions.

   Source: Adapted from community discussion — 4dfe785

   Next question

5. Question 445 · 1459 in bank

   A computer forensic audit is MOST relevant in which of the following situations?

   • AInadequate controls in the IT environment
   • BMismatches in transaction data
   • CData loss due to hacking of servers
   • DMissing server patches

   Show answer

   Answer: C

   Next question

6. Question 446 · 1459 in bank

   Which of the following findings would be of GREATEST concern when evaluating an organization's endpoint computer patch management process?

   • APatching is performed every three months.
   • BPatch implementation took longer than expected.
   • CRollbacks were required for some patches.
   • DPatching is performed manually for some systems.

   Show answer

   Answer: C

   Explanation

   When evaluating an organization's endpoint computer patch management process, the most concerning outcome is C. Some patches required rollback. The reason being, the need for rollbacks when applying patches indicates problems in several ways: Unexpected problems: The need for rollbacks usually indicates that the application of a patch caused unexpected problems or system instability. This can affect security and system availability. Lack of testing or risk management: The need for rollbacks suggests that the patch was not pre-tested or risk management was not performed properly. If proper testing and evaluation were not performed before applying a patch, future patch applications will be less reliable. Reduced operational efficiency: The need for rollbacks can increase system operation downtime and workload, reducing the operational efficiency of the organization. These factors make the need for rollbacks the most concerning outcome for the security and stability of an organization's endpoint computers.

   Source: Adapted from community discussion — Swallows

   Next question

7. Question 447 · 1459 in bank

   During the evaluation of controls for a major application development project, the MOST effective use of an IS auditor's time would be to review and evaluate:

   • Arequirements documentation.
   • Bacceptance testing.
   • Cproject plans.
   • Dcost-benefit analysis.

   Show answer

   Answer: A

   Explanation

   The most effective use of an IS auditor's time during the evaluation of controls for a major application development project would be to review and evaluate: B. acceptance testing. Explanation: Acceptance Testing (Option B): This is a critical phase where the system is tested to ensure it meets the specified requirements and functions as intended. Evaluating acceptance testing allows the IS auditor to verify that the controls are functioning correctly and that the system meets the necessary standards before it goes live. Requirements Documentation (Option A): While important, requirements documentation primarily focuses on what the system should do rather than how well it meets those requirements in practice.

   Source: Adapted from community discussion — Binagr8

   Next question

8. Question 448 · 1459 in bank

   A month after a company purchased and implemented system and performance monitoring software, reports were too large and therefore were not reviewed or acted upon. The MOST effective plan of action would be to:

   • Aevaluate replacement systems and performance monitoring software.
   • Buse analytical tools to produce exception reports from the system and performance monitoring software.
   • Cre-install the system and performance monitoring software.
   • Drestrict functionality of system monitoring software to security-related events.

   Show answer

   Answer: B

   Explanation

   Option B. Using analytical tools to produce exception reports allows for the identification and extraction of critical information or anomalies from the large volume of data generated by the monitoring software. Exception reports focus on highlighting deviations, thresholds breaches, or significant events that require immediate attention or action. By implementing exception reporting, the company can filter out non-essential information and focus on the most important and relevant data points. This helps address the problem of large reports overwhelming the review process and enables timely and effective monitoring of critical events or issues. - ChatGPT and it makes a lot of sense

   Source: Adapted from community discussion — necoll007

   Next question

9. Question 449 · 1459 in bank

   Which of the following practices associated with capacity planning provides the GREATEST assurance that future incidents related to existing server performance will be prevented?

   • ADuplicating existing disk drive systems to improve redundancy and data storage
   • BReviewing results from simulated high-demand stress test scenarios
   • CPerforming a root cause analysis for past performance incidents
   • DAnticipating current service level agreements (SLAs) will remain unchanged

   Show answer

   Answer: B

   Explanation

   Of the following capacity planning practices, the one that provides the greatest assurance of preventing future incidents related to the performance of existing servers is B. Review the results of simulated high-demand stress test scenarios. Reasons: Proactive assessment: Stress testing proactively assesses how a server will react to high-load conditions, thus preventing future performance issues. Understanding limitations: Testing can identify system limitations and bottlenecks so that necessary remedial measures can be implemented. While root cause analysis is important, the proactive approach of stress testing provides more direct assurance of preventing future problems.

   Source: Adapted from community discussion — Swallows

   Next question

10. Question 450 · 1459 in bank

    Shortly after a system was deployed into production, it was identified that some key scenarios were not tested during user acceptance testing (UAT). Which of the following is the GREATEST concern with this situation?

    • AThe system may have gone into production with defects.
    • BSystem functions may not meet business requirements.
    • CSignificant security risks may not have been assessed.
    • DExtra funding may be required to complete the testing.

    Show answer

    Answer: B

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISA practice, question 441. 1459 questions available.