CISA practice questions 591–600

1. Question 591 · 1459 in bank

   Reviewing project plans and status reports throughout the development life cycle will:

   • Aeliminate the need to perform a risk assessment.
   • Bpostpone documenting the project's progress until the final phase.
   • Cguarantee that the project will meet its intended deliverables.
   • Dfacilitate the optimal use of resources over the life of the project.

   Show answer

   Answer: D

   Next question

2. Question 592 · 1459 in bank

   Which of the following tests is MOST likely to detect an error in one subroutine resulting from a recent change in another subroutine?

   • ARegression testing
   • BUser acceptance testing (UAT)
   • CStress testing
   • DBlack-box testing

   Show answer

   Answer: A

   Next question

3. Question 593 · 1459 in bank

   Which of the following is the BEST approach to validate whether a streaming site can continue to provide service during a period of live streaming with an anticipated high volume of viewers?

   • AFuzzing
   • BUsability test
   • CFault grading
   • DLoad test

   Show answer

   Answer: D

   Next question

4. Question 594 · 1459 in bank

   When assessing the overall effectiveness of an organization’s disaster recovery planning process, which of the following is MOST important for the IS auditor to verify?

   • AManagement documents and distributes a copy of the plan to all personnel.
   • BManagement contracts with a third party for warm site services.
   • CManagement schedules an annual tabletop exercise.
   • DManagement reviews and updates the plan annually or as changes occur.

   Show answer

   Answer: C

   Next question

5. Question 595 · 1459 in bank

   A post-implementation audit has been completed for the deployment of a sophisticated job scheduling tool. Which of the following observations would be of GREATEST concern?

   • AThe IT team customized tool settings without seeking approval from the provider.
   • BThe overall project took longer to complete than planned.
   • CThe data encryption setting is not enabled in the scheduling tool.
   • DThe IT team accesses the scheduler admin panel via a generic account.

   Show answer

   Answer: C

   Next question

6. Question 596 · 1459 in bank

   An IS auditor is reviewing desktop software profiles and notes that a user has downloaded and installed several games that are not approved by the company. Which of the following is the MOST significant risk that could result from this situation?

   • AViolation of user’s privacy
   • BPotential for malware
   • CNoncompliance with the acceptable use policy
   • DInteroperability issues with company software

   Show answer

   Answer: B

   Next question

7. Question 597 · 1459 in bank

   Which of the following is the MOST effective control when granting access to a service provider for a cloud-based application?

   • AAdministrator access is provided for a limited period with an expiration date.
   • BAccess has been provided on a need-to-know basis.
   • CUser IDs are deleted when work is completed.
   • DAccess is provided to correspond with the service level agreement (SLA).

   Show answer

   Answer: A

   Explanation

   I am pretty sure A is the correct answer as it has an expiration time. Option C says they are deleted when work is completed which is a good idea and should be done but when work is completed is very arbitrary. B doesn’t make a lot of sense. Access is provided on a need to know basis. I mean, duh. Right, they shouldn’t just access all the time whenever. Which is why I lean toward A. Because it has an expiration date so it doesn’t necessarily matter if the work got completed. They can get granted access again without it extending too long. Hopefully that makes sense to anyone else who is struggling with the options given.

   Source: Adapted from community discussion — blehbleh

   Next question

8. Question 598 · 1459 in bank

   Which of the following can only be provided by asymmetric encryption?

   • AInformation privacy
   • BData availability
   • C256-bit key length
   • DNonrepudiation

   Show answer

   Answer: D

   Next question

9. Question 599 · 1459 in bank

   Which of the following should be an IS auditor’s PRIMARY focus when auditing the implementation of a new IT operations performance monitoring system?

   • AValidating whether baselines have been established
   • BReviewing whether all changes have been implemented
   • CDetermining whether there is a process for annual review of the maintenance manual
   • DConfirming whether multi-factor authentication (MFA) is deployed as part of the operational enhancements

   Show answer

   Answer: A

   Next question

10. Question 600 · 1459 in bank

    Which of the following poses the GREATEST risk to the use of active RFID tags?

    • APhishing attacks
    • BSession hijacking
    • CPiggybacking
    • DEavesdropping

    Show answer

    Answer: D

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISA practice, question 591. 1459 questions available.