CISA practice questions 641–650

1. Question 641 · 1459 in bank

   During an incident management audit, an IS auditor finds that several similar incidents were logged during the audit period. Which of the following is the auditor's MOST important course of action?

   • ADocument the finding and present it to management.
   • BDetermine if a root cause analysis was conducted.
   • CValidate whether all incidents have been actioned.
   • DConfirm the resolution time of the incidents.

   Show answer

   Answer: B

   Explanation

   The correct answer is B. Determine if a root cause analysis was conducted. If an IS auditor finds that several similar incidents were logged during the audit period, it is important to determine if a root cause analysis was conducted. A root cause analysis is a systematic process that is used to identify the underlying cause of a problem or incident. By identifying the root cause, organizations can take appropriate corrective action to prevent similar incidents from occurring in the future. Other actions that the auditor may take include documenting the finding and presenting it to management (A), validating whether all incidents have been actioned (C), and confirming the resolution time of the incidents (D). However, identifying the root cause of the incidents is the most important course of action because it will help the organization prevent similar incidents from occurring in the future.

   Source: Adapted from community discussion — nickchen

   Next question

2. Question 642 · 1459 in bank

   Stress testing should ideally be carried out under a:

   • Atest environment with test data.
   • Bproduction environment with test data.
   • Ctest environment with production workloads.
   • Dproduction environment with production workloads.

   Show answer

   Answer: C

   Explanation

   i would nominate answer B as the best and effective is production with masked data or else which could shift this enviroment to prod directly. this documented everywhere.

   Source: Adapted from community discussion — Eric0223

   Next question

3. Question 643 · 1459 in bank

   An audit of environmental controls at a data center could include a review of the:

   • Alocal alarms on emergency exits.
   • Blogs recording visitors to the data center.
   • Clist of employees authorized to enter the data center.
   • Dceiling space to ensure that there are no wet pipes.

   Show answer

   Answer: D

   Next question

4. Question 644 · 1459 in bank

   A data breach has occurred due to malware. Which of the following should be the FIRST course of action?

   • AShut down the affected systems.
   • BQuarantine the impacted systems.
   • CNotify customers of the breach.
   • DNotify the cyber insurance company

   Show answer

   Answer: B

   Next question

5. Question 645 · 1459 in bank

   An online retailer is receiving customer complaints about receiving different items from what they ordered on the organization's website. The root cause has been traced to poor data quality. Despite efforts to clean erroneous data from the system, multiple data quality issues continue to occur. Which of the following recommendations would be the BEST way to reduce the likelihood of future occurrences?

   • AOutsource data cleansing activities to reliable third parties.
   • BAssign responsibility for improving data quality.
   • CImplement business rules to validate employee data entry.
   • DInvest in additional employee training for data entry.

   Show answer

   Answer: C

   Next question

6. Question 646 · 1459 in bank

   During an operational audit of a biometric system used to control physical access, which of the following should be of GREATEST concern to an IS auditor?

   • AFalse positives
   • BUser acceptance of biometrics
   • CFalse negatives
   • DLack of biometric training

   Show answer

   Answer: A

   Explanation

   C- False negative is correct. An instance in which a security tool intended to detect a particular threat fails to do so

   Source: Adapted from community discussion — Staanlee

   Next question

7. Question 647 · 1459 in bank

   During a software acquisition review, an IS auditor should recommend that there be a software escrow agreement when:

   • Athe product is new in the market.
   • Bthe deliverables do not include the source code.
   • Cthere is no service level agreement (SLA).
   • Dthe estimated life for the product is less than 3 years.

   Show answer

   Answer: B

   Next question

8. Question 648 · 1459 in bank

   Which of the following would be MOST useful when analyzing computer performance?

   • ATuning of system software to optimize resource usage
   • BOperations report of user dissatisfaction with response time
   • CStatistical metrics measuring capacity utilization
   • DReport of off-peak utilization and response time

   Show answer

   Answer: C

   Explanation

   Option C. Statistical metrics measuring capacity utilization would be the most useful when analyzing computer performance. These metrics provide valuable information on how resources, such as CPU, memory, and storage, are being used and can help identify bottlenecks or underutilized resources. This information can then be used to optimize resource usage, such as by adding more memory or upgrading hardware, which can improve overall performance. Option A. Tuning of system software to optimize resource usage is also important, but it's not enough to just tune the software if you don't have an understanding of how the resources are being utilized. Option B. Operations report of user dissatisfaction with response time can be useful in identifying specific issues that users are experiencing, but it doesn't provide a comprehensive view of overall performance. Option D. Report of off-peak utilization and response time is important to understand how the system behaves during non-peak hours, but it does not give a complete picture of the system performance.

   Source: Adapted from community discussion — tapsshore

   Next question

9. Question 649 · 1459 in bank

   An emergency power-off switch should:

   • Anot be in the computer room.
   • Bnot be identified
   • Cbe protected.
   • Dbe illuminated.

   Show answer

   Answer: C

   Explanation

   I think C and D are equally important. The emergency power-off switch should indeed be protected to avoid intentional power-off by malicious people, or accidental power-off by people who are not familiar with the environment. However, because the safety of people's lives is paramount, the emergency power-off switch is also designed to allow all passages to be completely unobstructed in response to emergency disasters, so that people can escape easily, so it should be easy to quickly identify the location. If you really want to prioritize, D is indeed more important than C.

   Source: Adapted from community discussion — Victor83516

   Next question

10. Question 650 · 1459 in bank

    When reviewing a data classification scheme, it is MOST important for an IS auditor to determine if:

    • Athe information owner is required to approve access to the asset.
    • Bsenior IT managers are identified as information owners.
    • Cthe security criteria are clearly documented for each classification.
    • Deach information asset is assigned to a different classification.

    Show answer

    Answer: C

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISA practice, question 641. 1459 questions available.