CISA practice questions 41–50

1. Question 41 · 1459 in bank

   During a post-implementation review, which of the following provides the BEST evidence that user requirements have been met?

   • AOperator error logs
   • BEnd-user documentation
   • CUser acceptance testing (UAT)
   • DManagement interviews

   Show answer

   Answer: C

   Explanation

   C. User acceptance testing (UAT) User acceptance testing (UAT) provides the BEST evidence that user requirements have been met because it involves actual users testing the system or product to ensure that it meets their needs and expectations. UAT directly involves the users who will be using the system, and their feedback and approval during this testing phase are strong indicators that the requirements have been successfully implemented. While the other options may provide valuable information, UAT is specifically designed to validate that user requirements have been satisfied.

   Source: Adapted from community discussion — SuperMax

   Next question

2. Question 42 · 1459 in bank

   An IS auditor assessing an organization’s information systems needs to understand management’s approach regarding controls. Which documentation should the auditor review FIRST?

   • APolicies
   • BStandards
   • CGuidelines
   • DProcedures

   Show answer

   Answer: A

   Explanation

   When assessing an organization's information systems and understanding management's approach to controls, the IS auditor should review policies FIRST. Policies provide the overarching framework and high-level guidance for establishing controls within an organization. They define the organization's intent, objectives, and expectations regarding information security and control measures. After reviewing policies, an auditor may then delve into more detailed documentation such as standards, guidelines, and procedures to understand how these policies are implemented and operationalized within the organization. Policies serve as the foundation for the development of more detailed control documentation.

   Source: Adapted from community discussion — FAGFUR

   Next question

3. Question 43 · 1459 in bank

   Which of the following is MOST useful for matching records of incoming and outgoing personnel to identify tailgating in physical security logs?

   • ADiscovery sampling methodology
   • BContinuous auditing
   • CData analytics tools
   • DReconciliation with HR records

   Show answer

   Answer: D

   Explanation

   Reconciliation with HR records is the MOST useful method for matching records of incoming and outgoing personnel to identify tailgating in physical security logs. By comparing security logs with HR records, organizations can ensure that individuals entering or leaving the premises align with the expected personnel movements. This helps in detecting instances of tailgating, where unauthorized individuals follow authorized personnel through access points. While data analytics tools and continuous auditing can play a role in analyzing large datasets and monitoring ongoing activities, reconciling with HR records provides a direct link between personnel data and physical security logs, making it a more targeted and effective approach for identifying tailgating incidents.

   Source: Adapted from community discussion — FAGFUR

   Next question

4. Question 44 · 1459 in bank

   Due to system limitations, segregation of duties (SoD) cannot be enforced in an accounts payable system. Which of the following is the IS auditor's BEST recommendation for a compensating control?

   • ARequire written authorization for all payment transactions.
   • BReview payment transaction history.
   • CReconcile payment transactions with invoices.
   • DRestrict payment authorization to senior staff members.

   Show answer

   Answer: A

   Explanation

   The correct answer is C because there is no dual control due to system limitation, the only compensating control here is to reconcile each transaction with the invoice inorder to ensure the accuracy of the transaction processed.

   Source: Adapted from community discussion — Pauloludele

   Next question

5. Question 45 · 1459 in bank

   An IS auditor assesses an organization's backup management practices for optimization potential. Which of the following features of a regular backup tape reorganization job BEST enables the organization to realize cost savings?

   • ARefreshed data written on tapes
   • BRotation of backup tapes
   • CDecommissioning of old tapes
   • DDefragmentation of data on tapes

   Show answer

   Answer: B

   Next question

6. Question 46 · 1459 in bank

   Which of the following is MOST important to define within a disaster recovery plan (DRP)?

   • ARoles and responsibilities for recovery team members
   • BTest results for backup data restoration
   • CA comprehensive list of disaster recovery scenarios and priorities
   • DBusiness continuity plan (BCP)

   Show answer

   Answer: C

   Explanation

   Option C. According to the Certified Information Systems Auditor (CISA) exam, the MOST important thing to define within a disaster recovery plan (DRP) is option C: A comprehensive list of disaster recovery scenarios and priorities. A comprehensive list of disaster recovery scenarios and priorities is critical in a disaster recovery plan (DRP) as it helps ensure that the organization is prepared to respond to a range of potential disasters effectively. The list should identify all the possible disaster scenarios that could affect the organization and their relative priorities. The list should also identify the critical systems, applications, and data that must be recovered first in the event of a disaster.

   Source: Adapted from community discussion — SRJ13

   Next question

7. Question 47 · 1459 in bank

   Which of the following findings should be of MOST concern to an IS auditor assessing agile software development practices?

   • AThere is a low acceptance rate by the business of delivered software.
   • BTesting is performed by both software developers and testers.
   • CRelease plans have been revised several times before actual release.
   • DThe IT team feels unable to strictly follow standard agile practices.

   Show answer

   Answer: A

   Explanation

   Answer is A Of the options listed, the finding that should be of MOST concern to an IS auditor assessing agile software development practices is A. There is a low acceptance rate by the business of delivered software. One of the key principles of agile software development is to prioritize customer satisfaction through early and continuous delivery of working software. If the business is not accepting the delivered software, it indicates a potential misalignment between the development team and the business. This could be due to a variety of reasons, such as a lack of communication or collaboration, unclear requirements, or insufficient testing.

   Source: Adapted from community discussion — jsalamba

   Next question

8. Question 48 · 1459 in bank

   Which of the following would BEST integrate multiple data warehouses while reducing the workload required for moving data between the warehouses?

   • AExtract, transform, and load
   • BData virtualization
   • CReal-time data mirroring
   • DStreaming data integration

   Show answer

   Answer: B

   Explanation

   Data virtualization would best integrate multiple data warehouses while reducing the workload required for moving data between the warehouses. Data virtualization is an approach that allows organizations to access and query data from multiple sources, including different data warehouses, without physically moving the data. It provides a logical layer that abstracts the underlying physical data storage, enabling users to query and analyze data as if it were stored in a single location. This approach helps in avoiding the need for extensive data movement, reducing the workload associated with extracting, transforming, and loading (ETL) data between warehouses. It promotes a more agile and efficient data integration strategy, allowing organizations to access and analyze data across multiple sources in real-time.

   Source: Adapted from community discussion — FAGFUR

   Next question

9. Question 49 · 1459 in bank

   A confidential file was sent to a legal entity, and hashing was used on the file. Which type of control has been applied?

   • ADetective
   • BCompensating
   • CCorrective
   • DPreventive

   Show answer

   Answer: D

   Explanation

   When hashing is used on a file, it is considered a preventive control. Preventive controls are designed to stop an incident or violation from occurring. In this case, hashing is used to ensure the integrity of the file by generating a hash value (a fixed-size string of characters) based on the content of the file. If the file is altered in any way, the hash value will change, indicating potential tampering. The use of hashing in this context is a preventive measure to help prevent unauthorized changes to the confidential file and maintain its integrity during transmission or storage.

   Source: Adapted from community discussion — FAGFUR

   Next question

10. Question 50 · 1459 in bank

    An IS auditor is performing a follow-up audit and notes that some critical deficiencies have not been addressed. The auditor's BEST course of action is to:

    • Adocument management's reasons for not addressing deficiencies.
    • Bpostpone the audit until the deficiencies are addressed.
    • Cprovide new recommendations.
    • Dassess the impact of not addressing deficiencies.

    Show answer

    Answer: D

    Explanation

    D. assess the impact of not addressing deficiencies. In this situation, the IS auditor's best course of action is to assess the impact of not addressing the critical deficiencies. This assessment will help in understanding the potential risks and consequences of not addressing these issues and can provide valuable information to management for decision-making. It may also lead to documenting management's reasons for not addressing the deficiencies and potentially providing new recommendations based on the assessment findings. Postponing the audit may not be the most practical option, as it may not necessarily prompt immediate action on the deficiencies.

    Source: Adapted from community discussion — SuperMax

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISA practice, question 41. 1459 questions available.