CISA practice questions 541–550

1. Question 541 · 1459 in bank

   Which of the following BEST enables an IS auditor to determine the effectiveness of controls for an audit area?

   • AControl self-assessment (CSA)
   • BPrior audit results
   • CControl implementation methods
   • DSWOT analysis

   Show answer

   Answer: A

   Next question

2. Question 542 · 1459 in bank

   An organization has implemented a policy to require minimum security control baselines when configuring servers or systems. What control type has been implemented?

   • ACompensating
   • BDirective
   • CPreventive
   • DCorrective

   Show answer

   Answer: B

   Explanation

   B. Directive A directive control is one that sets policies or guidelines that direct behavior, ensuring that certain actions or standards are followed. In this case, the policy to require minimum security control baselines when configuring servers or systems is a directive control because it establishes mandatory security configurations that must be followed.

   Source: Adapted from community discussion — Enig

   Next question

3. Question 543 · 1459 in bank

   While conducting a follow-up on an asset management audit, the IS auditor finds paid invoices for IT devices not recorded in the organization's inventory. Which of the following is the auditor's BEST course of action?

   • AAlert both audit and operations management about the discrepancy.
   • BAsk the asset management staff where the devices are.
   • CMake a note of the evidence to include it in the scope of a future audit.
   • DIgnore the invoices since they are not part of the follow-up.

   Show answer

   Answer: A

   Explanation

   option a This action is crucial because it addresses a potential issue of asset mismanagement or oversight that could lead to financial discrepancies, compliance issues, or security vulnerabilities. By alerting both audit and operations management, the auditor ensures that the discrepancy is investigated promptly and that corrective actions can be taken to rectify the inventory records.

   Source: Adapted from community discussion — PurpleParrot

   Next question

4. Question 544 · 1459 in bank

   Which of the following is an analytical review procedure for a payroll system?

   • APerforming reasonableness tests by multiplying the number of employees by the average wage rate
   • BPerforming penetration attempts on the payroll system
   • CEvaluating the performance of the payroll system using benchmarking software
   • DTesting hours reported on time sheets

   Show answer

   Answer: A

   Next question

5. Question 545 · 1459 in bank

   During a financial accounting audit, an IS auditor finds that the IT general controls are deficient. Which of the following is the MOST effective course of action to complete the audit?

   • AConduct an IT risk assessment.
   • BIncrease the substantive testing of the financial balances.
   • CPlace greater reliance on the financial application controls.
   • DPlace greater reliance on the framework of control.

   Show answer

   Answer: B

   Next question

6. Question 546 · 1459 in bank

   IT disaster recovery time objectives (RTOs) should be based on the:

   • Amean time to restore (MTTR).
   • Bmaximum tolerable downtime (MTD).
   • Csystem interdependencies.
   • Dmaximum tolerable loss of data.

   Show answer

   Answer: B

   Next question

7. Question 547 · 1459 in bank

   During an audit of a mortgage processing application, an IS auditor identifies that the application allows all users to export large quantities of sensitive customer data. Which of the following is the BEST control for the auditor to recommend to mitigate this risk?

   • ARestrict download capability to authorized users.
   • BRequire strong passwords for application login.
   • CPeriodically recertify user access.
   • DMask sensitive data within the application.

   Show answer

   Answer: A

   Next question

8. Question 548 · 1459 in bank

   Which of the following should be of MOST concern to an IS auditor reviewing data backup procedures prior to a system migration?

   • AData backups are stored at a different site from the systems application servers.
   • BIncremental data backup jobs are paused during the migration.
   • CData restoration procedures have never been utilized to restore the system's database.
   • DA full backup has not occurred within a week.

   Show answer

   Answer: C

   Next question

9. Question 549 · 1459 in bank

   Which type of control has been established when an organization implements a security information and event management (SIEM) system?

   • APreventive
   • BDetective
   • CDirective
   • DCorrective

   Show answer

   Answer: B

   Next question

10. Question 550 · 1459 in bank

    What is the MOST effective way to detect installation of unauthorized software packages by employees?

    • ACommunicating the policy to employees
    • BRegular scanning of hard drives
    • CLogging of activity on the network
    • DMaintaining current antivirus software

    Show answer

    Answer: C

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISA practice, question 541. 1459 questions available.