CISA practice questions 51–60

1. Question 51 · 1459 in bank

   Which of the following is the BEST way to help ensure new IT implementations align with enterprise architecture (EA) principles and requirements?

   • AConsider stakeholder concerns when defining the EA.
   • BConduct EA reviews as part of the change advisory board.
   • CPerform mandatory post-implementation reviews of IT implementations.
   • DDocument the security view as part of the EA.

   Show answer

   Answer: B

   Explanation

   Option B involves conducting enterprise architecture reviews as part of the change advisory board. The change advisory board typically comprises individuals from various departments, including IT, who evaluate the impact of changes to the organization's technology infrastructure. By including enterprise architecture reviews in this process, an organization can ensure that new IT implementations align with enterprise architecture principles and requirements.

   Source: Adapted from community discussion — 3008

   Next question

2. Question 52 · 1459 in bank

   Which of the following is MOST important to confirm when evaluating an IT organization's structure?

   • AClear reporting and lines of authority
   • BDocumented provisions for interdepartmental cross-training
   • CComprehensive system architecture documentation
   • DPolicies and procedures that define requirements for periodic job rotation

   Show answer

   Answer: A

   Explanation

   When evaluating an IT organization's structure, the MOST important factor to confirm is clear reporting and lines of authority. A well-defined organizational structure outlines reporting relationships, establishes lines of authority, and clarifies roles and responsibilities within the IT organization. Clear reporting and lines of authority contribute to efficient decision-making, effective communication, and accountability. It helps ensure that tasks are assigned to the appropriate individuals or teams and that there is a clear understanding of who is responsible for what within the organization. This organizational clarity is crucial for the overall effectiveness and performance of the IT organization

   Source: Adapted from community discussion — FAGFUR

   Next question

3. Question 53 · 1459 in bank

   Which feature associated with an Infrastructure as a Service (IaaS) cloud service provider allows for the provisioning of new servers as demand changes?

   • AMeasured service
   • BResource pooling
   • CRapid elasticity
   • DLoad balancing

   Show answer

   Answer: C

   Explanation

   Rapid elasticity is the feature associated with an Infrastructure as a Service (IaaS) cloud service provider that allows for the provisioning of new servers as demand changes. Rapid elasticity refers to the ability to quickly and easily scale computing resources up or down based on demand. This allows users to dynamically allocate and deallocate resources as needed, providing flexibility and efficiency in handling varying workloads.

   Source: Adapted from community discussion — FAGFUR

   Next question

4. Question 54 · 1459 in bank

   Which of the following provides the BEST evidence that all elements of a business continuity plan (BCP) are operating effectively?

   • AWalk-through test results
   • BFull operational test results
   • CSimulation test results
   • DTabletop test results

   Show answer

   Answer: B

   Explanation

   Full operational test results provide the BEST evidence that all elements of a business continuity plan (BCP) are operating effectively. A full operational test involves simulating an actual disaster or business disruption and fully activating the business continuity plan to ensure that all elements of the plan, including processes, technologies, and personnel, are functioning as intended.

   Source: Adapted from community discussion — FAGFUR

   Next question

5. Question 55 · 1459 in bank

   Spreadsheets are used to calculate project cost estimates. Totals for each cost category are then keyed into the job-costing system. What is the BEST control to ensure that data is accurately entered into the system?

   • ADisplay back of project detail after entry
   • BReconciliation of total amounts by project
   • CReasonableness checks for each cost type
   • DValidity checks, preventing entry of character data

   Show answer

   Answer: B

   Explanation

   B. Reconciliation of total amounts by project The best control to ensure that data is accurately entered into the job-costing system after being calculated in spreadsheets is to perform a reconciliation of total amounts by project (Option B). Reconciliation involves comparing the totals from the spreadsheet calculations with the totals entered into the job-costing system. This helps identify any discrepancies or errors between the two sets of data, ensuring that the data has been accurately transferred and entered. Reconciliation provides an effective way to catch data entry mistakes and maintain the integrity of the financial information in the system.

   Source: Adapted from community discussion — lsiau76

   Next question

6. Question 56 · 1459 in bank

   Email required for business purposes is being stored on employees’ personal devices. Which of the following is an IS auditor's BEST recommendation?

   • AProhibit employees from storing company email on personal devices.
   • BImplement an email containerization solution on personal devices.
   • CRequire employees to utilize passwords on personal devices.
   • DEnsure antivirus protection is installed on personal devices.

   Show answer

   Answer: B

   Explanation

   Email containerization involves creating a secure, isolated environment on the personal device specifically for business email. This separation helps protect business data from potential risks associated with personal use or other applications on the device.

   Source: Adapted from community discussion — FAGFUR

   Next question

7. Question 57 · 1459 in bank

   Which of the following steps of data conversion requires users to define the flow and relationship between the source and target objects on a field-by-field basis?

   • ATransformation
   • BExtraction
   • CLoad
   • DValidation

   Show answer

   Answer: A

   Explanation

   The step of data conversion that requires users to define the flow and relationship between the source and target objects on a field-by-field basis is transormation.

   Source: Adapted from community discussion — FAGFUR

   Next question

8. Question 58 · 1459 in bank

   An application development team is also promoting changes to production for a critical financial application. Which of the following is the BEST control to reduce the associated risk?

   • APerforming periodic audits
   • BImplementing a change management code review
   • CPerforming regression tests
   • DExporting change logs to a secure server

   Show answer

   Answer: B

   Explanation

   Implementing a change management code review is the best control in this context to reduce the associated risk. Code reviews help ensure that changes to the critical financial application are thoroughly examined for quality, security, and compliance before being promoted to production. This practice can catch potential issues early in the development process and prevent them from reaching the production environment. While other options such as performing periodic audits, performing regression tests, and exporting change logs are important, a code review is particularly effective for ensuring the quality and security of the actual code being deployed.

   Source: Adapted from community discussion — FAGFUR

   Next question

9. Question 59 · 1459 in bank

   A vendor requires privileged access to a key business application. Which of the following is the BEST recommendation to reduce the risk of data leakage?

   • APerform a review of privileged roles and responsibilities.
   • BImplement real-time activity monitoring for privileged roles.
   • CRequire the vendor to implement job rotation for privileged roles.
   • DInclude the right-to-audit in the vendor contract.

   Show answer

   Answer: B

   Explanation

   Implementing real-time activity monitoring for privileged roles is the best recommendation to reduce the risk of data leakage in this scenario. Real-time monitoring allows organizations to track and analyze the activities performed by privileged users, including vendors, in critical applications. This helps detect any unauthorized or suspicious actions promptly, allowing for a quick response to potential security threats.

   Source: Adapted from community discussion — FAGFUR

   Next question

10. Question 60 · 1459 in bank

    An IS auditor is reviewing a bank’s service level agreement (SLA) with a third-party provider that hosts the bank's secondary data center. Which of the following findings should be of GREATEST concern to the auditor?

    • AThe SLA has not been reviewed in more than a year.
    • BThe recovery time objective (RTO) has a longer duration than documented in the disaster recovery plan (DRP).
    • CThe recovery point objective (RPO) has a shorter duration than documented in the disaster recovery plan (DRP).
    • DBackup data is hosted online only.

    Show answer

    Answer: B

    Explanation

    The finding of GREATEST concern to the IS auditor in this scenario would be: B. The recovery time objective (RTO) has a longer duration than documented in the disaster recovery plan (DRP). This is a significant concern because the RTO specifies the maximum allowable downtime for the bank’s systems. If the RTO in the SLA is longer than what is documented in the disaster recovery plan, it means that in the event of a disaster, the third-party provider may not be able to meet the bank’s required downtime limits. This could potentially result in extended downtime, financial losses, and disruptions to the bank’s operations. It’s crucial for the RTO in the SLA to align with the bank’s business continuity requirements as outlined in its disaster recovery plan.

    Source: Adapted from community discussion — SuperMax

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISA practice, question 51. 1459 questions available.