CISA practice questions 631–640

1. Question 631 · 1459 in bank

   During an audit of a financial application, it was determined that many terminated users' accounts were not disabled. Which of the following should be the IS auditor's NEXT step?

   • APerform a review of terminated users' account activity.
   • BConclude that IT general controls are ineffective.
   • CCommunicate risks to the application owner.
   • DPerform substantive testing of terminated users' access rights.

   Show answer

   Answer: A

   Explanation

   If an IS auditor discovers that many terminated users' accounts have not been disabled, the next step should be to review the account activity of those terminated users. This helps to determine if there has been any unauthorized access or fraudulent activities carried out using these accounts. Perform substantive testing of terminated users' access rights: This step may be useful in understanding the extent of the problem, but the immediate concern is to review the account activity to determine if there has been any unauthorized access or fraudulent activities using the terminated users' accounts.

   Source: Adapted from community discussion — SBD600

   Next question

2. Question 632 · 1459 in bank

   When developing metrics to measure the contribution of IT to the achievement of business goals, the MOST important consideration is that the metrics:

   • Ameasure the effectiveness of IT controls in the achievement of IT strategy.
   • Bprovide quantitative measurement of IT initiatives in relation with business targets.
   • Care expressed in terms of how IT risk impacts the achievement of business goals.
   • Dare used by similar industries to measure the effect of IT on business strategy.

   Show answer

   Answer: B

   Explanation

   Im not sure if all metrics could provide quantitative measurement of IT initiatives. In my opinion "are expressed in terms of how IT risk impacts the achievement of business goals" is the right answer.

   Source: Adapted from community discussion — Adham12

   Next question

3. Question 633 · 1459 in bank

   The MOST important function of a business continuity plan (BCP) is to:

   • Aensure that the critical business functions can be recovered.
   • Bprovide procedures for evaluating tests of the BCP.
   • Cprovide a schedule of events that has to occur if there is a disaster.
   • Densure that all business functions are restored.

   Show answer

   Answer: A

   Next question

4. Question 634 · 1459 in bank

   A small financial institution is preparing to implement a check image processing system to support planned mobile banking product offerings. Which of the following is MOST critical to the successful implementation of the system?

   • AFeasibility studies
   • BControl design
   • CIntegration testing
   • DEnd user training

   Show answer

   Answer: C

   Explanation

   Integration testing is crucial to ensure that the check image processing system integrates smoothly with the existing infrastructure and interfaces with other systems involved in the mobile banking process. This testing phase verifies the interoperability, data flow, and functionality of the system when it interacts with various components, such as databases, applications, networks, and mobile devices.

   Source: Adapted from community discussion — TTH1019

   Next question

5. Question 635 · 1459 in bank

   A characteristic of a digital signature is that it:

   • Ais under control of the receiver.
   • Bis unique to the message.
   • Chas a reproducible hashing algorithm.
   • Dis validated when data are changed.

   Show answer

   Answer: B

   Next question

6. Question 636 · 1459 in bank

   What is the BEST way to control updates to the vendor master file in an accounts payable system?

   • AUsing prenumbered and authorized request forms
   • BHaving only one person updating the master file
   • CPeriodically reviewing the entire vendor master file
   • DComparing updates against authorization

   Show answer

   Answer: D

   Explanation

   The best way to control updates to the vendor master file in an accounts payable system is by comparing updates against proper authorization. This ensures that only authorized changes are made, and it helps prevent fraudulent activity or unauthorized modifications.

   Source: Adapted from community discussion — SBD600

   Next question

7. Question 637 · 1459 in bank

   Management receives information indicating a high level of risk associated with potential flooding near the organization's data center with in the next few years. As a result, a decision has been made to move data center operations to another facility on higher ground. Which approach has been adopted?

   • ARisk reduction
   • BRisk acceptance
   • CRisk transfer
   • DRisk avoidance

   Show answer

   Answer: D

   Explanation

   The approach that has been adopted in this scenario is D. Risk avoidance. Risk avoidance involves taking actions to eliminate or avoid the risk altogether. In this case, the decision to move data center operations to another facility on higher ground is a proactive measure to avoid the potential risk of flooding near the current data center location. By relocating the data center to a safer location, the organization is actively avoiding the risk associated with potential flooding.

   Source: Adapted from community discussion — ObaidMan

   Next question

8. Question 638 · 1459 in bank

   A PRIMARY benefit derived by an organization employing control self-assessment (CSA) techniques is that CSA:

   • Acan identify high-risk areas for detailed review.
   • Ballows IS auditors to independently assess risk.
   • Ccan be used as a replacement for traditional audits.
   • Dallows management to relinquish responsibility for control.

   Show answer

   Answer: A

   Explanation

   A is right : CSA is predicated on the review of high-risk areas that either need immediate attention or a more thorough review at a later date. Choice B is incorrect, because CSA requires the involvement of auditors and line management. What occurs is that the internal audit function shifts some of the control monitoring responsibilities to the functional areas. Choice C is incorrect because CSA is not a replacement for traditional audits. CSA is not intended to replace audit’s responsibilities, but to enhance them. Choice D is incorrect, because CSA does not allow management to relinquish its responsibility for control.

   Source: Adapted from community discussion — 007Georgeo

   Next question

9. Question 639 · 1459 in bank

   During an audit of an organization's financial statements, an IS auditor finds that the IT general controls are deficient. What should the IS auditor recommend?

   • AIncrease the compliance testing of the application controls.
   • BPlace greater reliance on the application controls.
   • CIncrease the substantive testing of the financial balances.
   • DPlace greater reliance on the framework of control.

   Show answer

   Answer: C

   Explanation

   https://reciprocity.com/blog/substantive-testing-vs-control-testing-how-do-they-compare/#:~:text=What%20Is%20Substantive%20Testing%3F,complete%2C%20relevant%2C%20and%20accurate. Control testing is an audit procedure used to determine whether internal controls effectively prevent or discover material misstatements at the appropriate assertion level. Substantive testing is the phase of an audit where the auditor gathers samples to identify any material misstatements in the client’s accounting records or other data. This is required to verify that a company’s financial records are complete, relevant, and accurate. Control testing is completed before substantive testing, and results from control testing will influence the scope of substantive testing. For example, if an auditor determines that an organization’s controls are weak, he or she may recommend more thorough substantive testing

   Source: Adapted from community discussion — Mark_1

   Next question

10. Question 640 · 1459 in bank

    An organization is considering allowing users to connect personal devices to the corporate network. Which of the following should be done FIRST?

    • AConfigure users on the mobile device management (MDM) solution.
    • BCreate inventory records of personal devices.
    • CImplement an acceptable use policy.
    • DConduct security awareness training.

    Show answer

    Answer: C

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISA practice, question 631. 1459 questions available.