CISA practice questions 471–480

1. Question 471 · 1459 in bank

   What is the PRIMARY reason an IS auditor would recommend an automated management review process for network administration activity on a daily basis instead of quarterly?

   • ATo identify system changes
   • BTo detect unauthorized transactions
   • CTo identify failed login attempts
   • DTo detect network intrusions

   Show answer

   Answer: D

   Explanation

   A. To identify system changes Explanation: A. To identify system changes The primary reason for recommending a daily automated management review process instead of a quarterly review is to identify system changes in a more timely manner. D. To detect network intrusions Detecting network intrusions is certainly a valid reason for frequent management reviews, but it is not the PRIMARY reason in this case. Identifying system changes is the most critical factor that drives the recommendation for a daily automated review process. In summary, the IS auditor's primary recommendation for a daily automated management review process is to enable the timely identification of any changes made to the network, which is crucial for maintaining the overall security and stability of the IT environment.

   Source: Adapted from community discussion — Binagr8

   Next question

2. Question 472 · 1459 in bank

   Which of the following is MOST important to the effectiveness of smoke detectors installed in a data processing facility?

   • ADetectors are linked to wet pipe fire suppression systems.
   • BDetectors are linked to dry pipe fire suppression systems.
   • CDetectors have the correct industry certification.
   • DDetectors trigger audible alarms when activated.

   Show answer

   Answer: D

   Explanation

   D. Detectors trigger audible alarms when activated is indeed the MOST important factor for the effectiveness of smoke detectors. An audible alarm ensures that the fire detection system provides timely alerts to prevent loss or damage by notifying individuals promptly.

   Source: Adapted from community discussion — Izzeddin

   Next question

3. Question 473 · 1459 in bank

   An IS auditor is observing transaction processing and notes that a high-priority update job ran out of sequence. What is the MOST significant risk from this observation?

   • ADaily schedules lack change control.
   • BPrevious jobs may have failed.
   • CThe job may not have run to completion.
   • DThe job completes with invalid data.

   Show answer

   Answer: D

   Explanation

   When a high-priority update job runs out of sequence, it may not have the necessary input or context to process data correctly. As a result, there's a significant risk that the job completes its processing with invalid data. This directly impacts data integrity and can have serious consequences for the organization, especially if decisions are made based on the erroneous data.

   Source: Adapted from community discussion — Swallows

   Next question

4. Question 474 · 1459 in bank

   At which stage of the system development life cycle (SDLC) is it MOST beneficial to perform a risk assessment?

   • APrior to system development
   • BAt each stage of the life cycle
   • CDuring business case development
   • DPrior to system deployment

   Show answer

   Answer: A

   Explanation

   While conducting risk assessments at each stage of the life cycle (option B) is valuable to continuously monitor and manage risks throughout the project, addressing risks early (prior to system development) sets a strong foundation for effective risk management across all subsequent stages of the SDLC. Therefore, option A, performing a risk assessment prior to system development, is often considered the most beneficial stage in the SDLC to conduct a risk assessment.

   Source: Adapted from community discussion — Swallows

   Next question

5. Question 475 · 1459 in bank

   Which of the following is the BEST source of information for an IS auditor to use when determining whether an organization's information security policy is adequate?

   • ARisk assessment results
   • BPenetration test results
   • CIndustry benchmarks
   • DInformation security program plans

   Show answer

   Answer: A

   Next question

6. Question 476 · 1459 in bank

   IT management has not implemented action plans for a previous audit report finding and has decided to accept the associated risk. Which of the following is the auditor's BEST course of action?

   • ADocument noncompliance with the agreed-upon plan.
   • BValidate compliance with the risk acceptance process.
   • CUpdate the enterprise risk register to reflect the observation.
   • DCheck for implementation of compensating controls.

   Show answer

   Answer: B

   Next question

7. Question 477 · 1459 in bank

   Which of the following provides the BEST assurance that vendor-supported software remains up to date?

   • ASoftware asset management
   • BVersion management
   • CLicensing agreement and escrow
   • DRelease and patch management

   Show answer

   Answer: D

   Next question

8. Question 478 · 1459 in bank

   Which of the following findings should be of GREATEST concern during an audit of IT governance and management?

   • AThere is no chief information security officer (CISO) position.
   • BThe organization is not aligned with an international IT control standard.
   • CThere is no IT representation in business strategy committee meetings.
   • DThe IT strategy development process is not documented.

   Show answer

   Answer: C

   Next question

9. Question 479 · 1459 in bank

   An IS auditor detects the presence of known ransomware indicators. What should the auditor do NEXT?

   • AResearch the type of ransomware to determine the associated risk.
   • BRecommend a tool to remove the ransomware from the server.
   • CNotify the parties responsible for the server.
   • DDetermine whether documented procedures exist for ransomware removal.

   Show answer

   Answer: C

   Next question

10. Question 480 · 1459 in bank

    Which of the following would BEST enhance the capability of a web server to accommodate a significant increase in web traffic?

    • ASolid state drives
    • BVirtualized environments
    • CAdditional network connections
    • DElastic cloud architecture

    Show answer

    Answer: D

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISA practice, question 471. 1459 questions available.