CISA practice questions 481–490

1. Question 481 · 1459 in bank

   Which of the following attack types is MOST effectively addressed by an organization's security awareness program?

   • AMan-in-the-middle
   • BPhishing
   • CStructured query language (SQL) injection
   • DDistributed denial of service (DDoS)

   Show answer

   Answer: B

   Next question

2. Question 482 · 1459 in bank

   What is the BEST way to identify unforeseen risk that may impact IT processes?

   • AReview metrics and historical incident response reports.
   • BPerform application control self-assessments (CSAs).
   • CAssess IT policies and procedures.
   • DConduct a threat and vulnerability analysis.

   Show answer

   Answer: D

   Next question

3. Question 483 · 1459 in bank

   Which of the following is the PRIMARY purpose of a rollback plan for a system change?

   • ATo ensure a backup exists before implementing a change
   • BTo ensure testing can be re-performed if required
   • CTo ensure steps exist to remove the change if necessary
   • DTo ensure the system change is effective

   Show answer

   Answer: C

   Next question

4. Question 484 · 1459 in bank

   A firewall has been installed on the company's web server. Which concern does the firewall address?

   • AAccessing information by the outside world
   • BAvailability of the information
   • CConnectivity to the Internet
   • DUnauthorized modification of information by internal users

   Show answer

   Answer: A

   Next question

5. Question 485 · 1459 in bank

   Which of the following is acceptable to be left out of a final audit report?

   • AThe nature and extent of audit procedures conducted
   • BSignificant findings previously communicated to management
   • CFindings of minimal risk to the overall organization
   • DThe cause and risk associated with a reported issue

   Show answer

   Answer: C

   Next question

6. Question 486 · 1459 in bank

   Which of the following is the MOST significant risk associated with the use of virtualization?

   • AInsufficient network bandwidth
   • BSingle point of failure
   • CInadequate configuration
   • DPerformance issues of hosts

   Show answer

   Answer: B

   Explanation

   Per CISA manual: Although virtualization offers significant advantages, they bring risk that an enterprise must manage effectively. Because the host in a virtualized environment represents a potential single point of failure within the system, a successful attack on the host could result in a compromise that is larger in both scope and impact. Ans = B!

   Source: Adapted from community discussion — Jhenn

   Next question

7. Question 487 · 1459 in bank

   An IS auditor finds that communication closets requiring electronic swipe card access are missing access logs. Which of the following should be done NEXT?

   • ADetermine whether there are video cameras covering the entrances.
   • BDetermine whether management approved the access policy.
   • CDetermine whether anything is missing from the closets.
   • DDetermine whether any access swipe cards have been lost or stolen.

   Show answer

   Answer: A

   Next question

8. Question 488 · 1459 in bank

   Which of the following is the MOST appropriate control to ensure the identity of an email sender?

   • AAutomatic return receipt
   • BDigital signature
   • CMulti-factor authentication (MFA)
   • DTransport Layer Security (TLS)

   Show answer

   Answer: B

   Next question

9. Question 489 · 1459 in bank

   Which of the following is MOST important to consider when scheduling follow-up audits?

   • AThe impact if corrective actions are not taken
   • BThe amount of time the auditee has agreed to spend with auditors
   • CThe efforts required for independent verification with new auditors
   • DControls and detection risks related to the observations

   Show answer

   Answer: A

   Explanation

   The purpose of a follow-up audit is to assess whether the auditee has taken appropriate corrective actions in response to the findings of a previous audit. Therefore, the impact if corrective actions are not taken is the most important factor to consider when scheduling a follow-up audit.

   Source: Adapted from community discussion — Alizade

   Next question

10. Question 490 · 1459 in bank

    Secure code reviews as part of a continuous deployment program are which type of control?

    • ADetective
    • BCorrective
    • CLogical
    • DPreventive

    Show answer

    Answer: D

    Explanation

    Secure code reviews as part of a continuous deployment program are a preventive control. Preventive controls are designed to stop security issues from occurring in the first place. By reviewing the code for security vulnerabilities before it is deployed, organizations can identify and fix potential issues, thereby preventing security breaches or other incidents from happening.

    Source: Adapted from community discussion — SBD600

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISA practice, question 481. 1459 questions available.