CISA practice questions 611–620

1. Question 611 · 1459 in bank

   An IS auditor has been asked to review the integrity of data transfer between two business-critical systems that have not been tested since implementation. Which of the following would provide the MOST useful information to plan an audit?

   • AQuality assurance (QA) testing
   • BSystem change logs
   • CIT testing policies and procedures
   • DPrevious system interface testing records

   Show answer

   Answer: B

   Next question

2. Question 612 · 1459 in bank

   An IS auditor is reviewing an organization’s system development life cycle (SDLC). Which of the following MUST be included in the review?

   • AOwnership of the system quality management plan
   • BUtilization of standards in the system development processes and procedures
   • CValidation that system development processes adhere to quality standards
   • DDefinition of quality attributes to be associated with the system

   Show answer

   Answer: C

   Next question

3. Question 613 · 1459 in bank

   A business application’s database is copied to a replication server within minutes. Which of the following processes taking place during business hours will MOST benefit from this architecture?

   • ARolling forward of transactions when a production server fails
   • BAd hoc batch reporting jobs from the replication server
   • CAnalysis of application performance degradation
   • DHardware replacement work involving databases

   Show answer

   Answer: B

   Next question

4. Question 614 · 1459 in bank

   When evaluating the management practices at a third-party organization providing outsourced services, the IS auditor considers relying on an independent auditor's report. The IS auditor would FIRST:

   • Areview the objectives of the audit.
   • Bexamine the independent auditor's workpapers.
   • Cdiscuss the report with the independent auditor.
   • Ddetermine if recommendations have been implemented.

   Show answer

   Answer: A

   Next question

5. Question 615 · 1459 in bank

   A finance department has a two-year project to upgrade the enterprise resource planning (ERP) system hosting the general ledger. In year one, the system version upgrade will be applied, and in year two, business processes will be updated to implement new system functionality. Which of the following should be the PRIMARY focus of an IS auditor reviewing the second year of the implementation?

   • AData migration
   • BSociability testing
   • CUser acceptance testing (UAT)
   • DInitial user access provisioning

   Show answer

   Answer: C

   Next question

6. Question 616 · 1459 in bank

   Which of the following would be the GREATEST concern for an IS auditor conducting a pre-implementation review of a data loss prevention (DLP) tool?

   • AThe tool is implemented in monitor mode rather than block mode.
   • BCrawlers are used to discover sensitive data.
   • CDeep packet inspection opens data packets in transit.
   • DEncryption keys are not centrally managed.

   Show answer

   Answer: D

   Next question

7. Question 617 · 1459 in bank

   Which of the following is the PRIMARY benefit of benchmarking an organization’s software development life cycle practices against a capability maturity model?

   • ASecurity requirements are added to software development processes.
   • BReliable products are guaranteed.
   • CProgrammers’ efficiency is improved.
   • DRepeatable software development procedures are established.

   Show answer

   Answer: D

   Next question

8. Question 618 · 1459 in bank

   Which type of testing is used to identify security vulnerabilities in source code in the development environment?

   • ADynamic analysis security testing (DAST)
   • BInteractive application security testing (IAST)
   • CStatic analysis security testing (SAST)
   • DRuntime application self-protection (RASP)

   Show answer

   Answer: C

   Next question

9. Question 619 · 1459 in bank

   An IS auditor evaluating the change management process must select a sample from the change log. What is the BEST way for the auditor to confirm the change log is complete?

   • AObtain management attestation of completeness.
   • BTake the last change from the system and trace it back to the log.
   • CTake an item from the log and trace it back to the system.
   • DInterview change management personnel about completeness.

   Show answer

   Answer: B

   Next question

10. Question 620 · 1459 in bank

    Which of the following is the PRIMARY benefit of monitoring IT operational logs?

    • AIdentifying configuration flaws in operating systems
    • BGenerating exception reports to assess security compliance
    • CDetecting processing errors in a timely manner
    • DManaging the usability and capacity of IT resources

    Show answer

    Answer: C

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISA practice, question 611. 1459 questions available.