CISA practice questions 551–560

1. Question 551 · 1459 in bank

   Which of the following should be done FIRST when creating a data protection program?

   • ATest logical access controls for effectiveness.
   • BPerform classification based on standards.
   • CImplement data loss prevention (DLP) controls.
   • DDeploy intrusion detection systems (IDS).

   Show answer

   Answer: B

   Next question

2. Question 552 · 1459 in bank

   Which the following component of a service level agreement (SLA) provides the GREATEST assurance that service provider production issues will be resolved promptly?

   • ARight to audit the service provider upon request
   • BPenalties for noncompliance
   • CDocumented processes for dispute resolution
   • DIndemnity clause against liabilities

   Show answer

   Answer: B

   Explanation

   How is Hayati going to vote for an answer and ruin the results without adding any argument or context, just states "Why B?" Let me tell you "Why B?" Because including a penalty for noncompliance could be a financial penalty and companies want to get paid. Therefore, if they are not meeting the agreement they will not be getting paid to some degree. Money talks and is what will force them to stay within the bounds that were agreed upon. C just states that they have a documented process which is great. But say its the weekend and no one is required to be on call but something breaks and it needs to be resolved. But the agreement does not put any requirements on it. Then it won't get fixed till Monday. Whereas if there is an agreement in place that if something is not resolved in a 2 hour period there would be a reduced payment (or something), this would push them to resolve the issue within the 2 hour period.

   Source: Adapted from community discussion — blehbleh

   Next question

3. Question 553 · 1459 in bank

   Which of the following would BEST reduce the operational risks associated with the potential for a third-party software vendor to go out of business?

   • ASoftware escrow agreements
   • BService level agreements (SLAs) in the contract
   • CEvidence of the vendor’s financial stability
   • DVendor software support agreements

   Show answer

   Answer: A

   Next question

4. Question 554 · 1459 in bank

   The PRIMARY role of an IS auditor in the remediation of problems found during an audit engagement is to:

   • Apresent updated policies to management for approval.
   • Bexplain the findings and provide general advice.
   • Ctake ownership of the problems and oversee remediation efforts.
   • Dhelp auditee management by providing the solution.

   Show answer

   Answer: B

   Next question

5. Question 555 · 1459 in bank

   The remediation process related to a high-risk audit finding involves a multi-step action plan by management and may not be completed by the next audit cycle. Which of the following is the BEST way for an IS auditor to follow up on the activities?

   • APerform more substantive testing until the remediation plan is implemented.
   • BSchedule a review of the controls after the projected remediation date.
   • CContinue to audit the failed controls according to the audit schedule.
   • DReview the progress of remediation on a regular basis.

   Show answer

   Answer: D

   Next question

6. Question 556 · 1459 in bank

   When reviewing the acquisition for a new application, which of the following is MOST important to ensure was included in the request for proposal (RFP) process?

   • AUser acceptance testing (UAT) plan
   • BVendor financial stability
   • CVendor key performance indicators (KPIs)
   • DSystem development methodology

   Show answer

   Answer: A

   Explanation

   Hayati, you are killing me, you voting and saying "Why not (answer)" adds zero value to the conversation. Regardless in this case I agree it is A. The reason being if there is not user acceptance testing then you can not ensure or validate that it meets the user requirements and needs. The RFP should include user acceptance testing.

   Source: Adapted from community discussion — blehbleh

   Next question

7. Question 557 · 1459 in bank

   The PRIMARY objective of a follow-up audit is to:

   • Adetermine adequacy of actions taken on recommendations.
   • Bevaluate whether the risk profile has changed.
   • Cverify compliance with policies.
   • Dassess the appropriateness of recommendations.

   Show answer

   Answer: A

   Next question

8. Question 558 · 1459 in bank

   Which type of testing is BEST for evaluating how well an application functions with other IT systems?

   • AIntegration testing
   • BSystem testing
   • CFinal acceptance testing
   • DUnit testing

   Show answer

   Answer: A

   Next question

9. Question 559 · 1459 in bank

   Which of the following potential scenarios is MOST likely to result in audit risk?

   • ASampling methods may not detect a material error.
   • BNew auditor hiring may be delayed due to budget cuts.
   • CAudit files may be lost due to a ransomware attack.
   • DManagement may have differing opinions of audit results.

   Show answer

   Answer: A

   Next question

10. Question 560 · 1459 in bank

    In the case of a disaster where the data center is no longer available, which of the following tasks should be done FIRST?

    • AArrange for a secondary site.
    • BAnalyze risk.
    • CPerform data recovery.
    • DActivate the call tree

    Show answer

    Answer: D

    Explanation

    D: Activate the call tree. Activating the call tree involves notifying and mobilizing the designated personnel and teams responsible for responding to the disaster. The call tree is a predefined communication mechanism that outlines the order and method of contacting key individuals in the event of an emergency.

    Source: Adapted from community discussion — necoll007

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISA practice, question 551. 1459 questions available.