CISA practice questions 491–500

1. Question 491 · 1459 in bank

   Which of the following would BEST detect unauthorized modification of data by a database administrator (DBA)?

   • AAudit database change requests
   • BAudit database activity logs
   • CReview changes to edit checks
   • DCompare data to input records

   Show answer

   Answer: B

   Next question

2. Question 492 · 1459 in bank

   When auditing an organization's procurement process, which of the following observations should be of MOST concern to an IS auditor?

   • APurchasing procedures and processes have not been updated during the past two years.
   • BContracts can be approved after expenses have been incurred.
   • CThe procurement manager is new to the organization.
   • DThresholds for requesting and approving payments for purchase requests have not been established.

   Show answer

   Answer: B

   Explanation

   Option B is of most concern because it directly impacts financial integrity, control, and compliance within the procurement process. Approving contracts after expenses have been incurred significantly undermines the integrity of the procurement process, increases the risk of unauthorized spending, and can lead to compliance and financial control issues.

   Source: Adapted from community discussion — PurpleParrot

   Next question

3. Question 493 · 1459 in bank

   Which of the following is the MOST important consideration when designing a risk-based incident response management program?

   • AMonitoring recurring low-risk events
   • BMinimizing false-positive and false-negative alerts
   • CTesting and updating the incident response plan annually
   • DAssigning roles and responsibilities

   Show answer

   Answer: B

   Next question

4. Question 494 · 1459 in bank

   Which of the following conditions should be of GREATEST concern to an IS auditor reviewing change management?

   • AVendors do not have access to apply changes to the quality assurance (QA) environment.
   • BThe individual applying the changes is not responsible for approving the changes.
   • CChange management documentation is not submitted prior to development.
   • DThe change management process does not include vendor-supplied changes.

   Show answer

   Answer: C

   Next question

5. Question 495 · 1459 in bank

   Which of the following should be of GREATEST concern to an IS auditor conducting an audit of an organization's data center?

   • AThe data centers in a high flood zone.
   • BEmployees working in the data center have not been trained in the use of fire extinguishers.
   • CThe data center has a wet-pipe sprinkler system.
   • DEmployees working in the data center are not trained on emergency evacuation procedures.

   Show answer

   Answer: D

   Next question

6. Question 496 · 1459 in bank

   After an employee termination, a network account was removed, but the application account remained active. To keep this issue from recurring, which of the following is the BEST recommendation?

   • AIntegrate application accounts with network single sign-on.
   • BPerform periodic access reviews.
   • CRetrain system administration staff.
   • DLeverage shared accounts for the application.

   Show answer

   Answer: A

   Explanation

   This is just a matter of careful reading. To keep this issue from recurring (Preventative), you would use SSO to ensure that disabling the network account would in turn disable access for the application. Performing periodic access reviews is a corrective control, addressing application accounts that were not disabled after the fact (at this point, you are past preventing it).

   Source: Adapted from community discussion — chadeeu

   Next question

7. Question 497 · 1459 in bank

   In a typical system development life cycle (SDLC), which group is PRIMARILY responsible for confirming compliance with requirements?

   • ASteering committee
   • BRisk management
   • CQuality assurance (QA)
   • DInternal audit

   Show answer

   Answer: C

   Next question

8. Question 498 · 1459 in bank

   An IS auditor is reviewing an artificial intelligence (AI) and expert system application. The system has produced several critical errors with severe impact. Which of the following should the IS auditor do NEXT to understand the cause of the errors?

   • AReview the decision-making logic built into the system.
   • BVerify system adherence to corporate policy.
   • CUnderstand the purpose and functionality of the system.
   • DInterview the system owner.

   Show answer

   Answer: A

   Next question

9. Question 499 · 1459 in bank

   An IS auditor is reviewing historical production change tickets. Which of the following is the BEST indication of potential concerns with the change management process?

   • AA large number of canceled changes
   • BA large number of emergency changes
   • CA large number of rollback changes
   • DA large number of high-impact changes

   Show answer

   Answer: C

   Explanation

   A high number of rollback changes suggests that changes are frequently failing or causing problems, which points to underlying issues in the change management process.

   Source: Adapted from community discussion — PurpleParrot

   Next question

10. Question 500 · 1459 in bank

    An organization requires the use of a key card to enter its data center. Recently, a control was implemented that requires biometric authentication for each employee. Which type of control has been added?

    • ACompensating
    • BCorrective
    • CDetective
    • DPreventive

    Show answer

    Answer: D

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISA practice, question 491. 1459 questions available.