CISA practice questions 651–660

1. Question 651 · 1459 in bank

   During a project meeting for the implementation of an enterprise resource planning (ERP). a new requirement is requested by the finance department. Which of the following would BEST indicate to an IS auditor that the resulting risk to the project has been assessed?

   • AThe project status as reported in the meeting minutes
   • BThe analysis of the cost and time impact of the requirement
   • CThe updated business requirements
   • DThe approval of the change by the finance department

   Show answer

   Answer: B

   Explanation

   They are referring to the risk to the project - scope creep will always result in additional cost and delay in implementation. This directly translate to the risk to the project, which is what the question asked for

   Source: Adapted from community discussion — botherder88

   Next question

2. Question 652 · 1459 in bank

   An organization has implemented a quarterly job schedule to update database tables so prices are adjusted in line with a price index. These changes do not go through the regular change management process. Which of the following is the MOST important control to have in place?

   • AAn overarching approval is obtained from the change advisory board.
   • BUser acceptance testing (UAT) is performed after the production run.
   • CEach production run is approved by an authorized individual.
   • DException reports are generated to identify anomalies.

   Show answer

   Answer: C

   Explanation

   Based on best practices and ISACA standards, the MOST important control to have in place in this scenario would be: A. An overarching approval is obtained from the change advisory board. Implementing an overarching approval process from the change advisory board ensures that changes, even if they are scheduled and recurring, are reviewed and approved by appropriate stakeholders. This helps maintain accountability, oversight, and alignment with organizational policies and objectives. While other controls such as user acceptance testing (option B), individual approvals (option C), and exception reporting (option D) are valuable, obtaining approval from the change advisory board ensures a comprehensive review and oversight of the changes, mitigating risks associated with unmanaged modifications to critical database tables.

   Source: Adapted from community discussion — Yejide03

   Next question

3. Question 653 · 1459 in bank

   Which of the following methods will BEST reduce the risk associated with the transition to a new system using technologies that are not compatible with the old system?

   • APilot operation
   • BParallel changeover
   • CModular changeover
   • DPhased operation

   Show answer

   Answer: B

   Explanation

   It is Pilot Operation. Pilot operation is a method of transitioning to a new system in which the new system is implemented on a small scale to a select group of users or in a limited area. This method helps to reduce the risk associated with the transition by allowing the organization to test the new system in a controlled environment and identify any potential issues or problems before a full implementation. Pilot operation also provides an opportunity to train users on the new system, identify any potential training gaps, and ensure that users are comfortable with the new system before a full implementation.

   Source: Adapted from community discussion — SRJ13

   Next question

4. Question 654 · 1459 in bank

   Following a merger, a review of an international organization determines the IT steering committee's decisions do not extend to regional offices as required in the consolidated IT operating model. Which of the following is the IS auditor's BEST recommendation?

   • ACreate regional centers of excellence.
   • BEngage an IT governance consultant.
   • CUpdate the IT steering committee's formal charter.
   • DCreate regional IT steering committees.

   Show answer

   Answer: C

   Explanation

   Updating the IT steering committee's formal charter would involve revising its mandate or scope to include decision-making authority that extends to regional offices, as required in the consolidated IT operating model. This update would ensure that the committee's responsibilities and decision-making processes align with the organization's new structure following the merger. It would also clarify the committee's role in overseeing IT governance and strategy at both the central and regional levels, promoting consistency and alignment throughout the organization.

   Source: Adapted from community discussion — Swallows

   Next question

5. Question 655 · 1459 in bank

   An organization recently decided to send the backup of its customer relationship management (CRM) system to its cloud provider for recovery. Which of the following should be of GREATEST concern to an IS auditor reviewing this process?

   • ATesting of restore data has not been performed.
   • BValidation of backup data has not been performed.
   • CBackups are sent and stored in unencrypted format.
   • DThe cloud provider is located in a different country.

   Show answer

   Answer: C

   Explanation

   Encrypting backups is essential to ensure that the data remains confidential, especially when it is transmitted or stored in an external environment such as a cloud service provider. Without encryption, the data may be exposed to unauthorized access or theft during transmission or storage. Additionally, lack of encryption may violate regulatory requirements or organization's security policies. Therefore, an IS auditor must ensure that backups are encrypted using strong encryption algorithms, and the encryption keys are securely managed.

   Source: Adapted from community discussion — 3008

   Next question

6. Question 656 · 1459 in bank

   A checksum is classified as which type of control?

   • APreventive control
   • BDetective control
   • CAdministrative control
   • DCorrective control

   Show answer

   Answer: B

   Explanation

   B. Detective control. A checksum is a form of data validation that involves calculating a value based on the data being transmitted or stored and comparing it to a previously calculated value. It helps detect errors or changes in the data by verifying its integrity during transmission or storage.

   Source: Adapted from community discussion — necoll007

   Next question

7. Question 657 · 1459 in bank

   During a follow-up audit, an IS auditor finds that some critical recommendations have not been addressed as management has decided to accept the risk. Which of the following is the IS auditor's BEST course of action?

   • AAdjust the annual risk assessment accordingly.
   • BRequire the auditee to address the recommendations in full.
   • CEvaluate senior management's acceptance of the risk.
   • DUpdate the audit program based on management's acceptance of risk.

   Show answer

   Answer: C

   Next question

8. Question 658 · 1459 in bank

   Management has asked internal audit to prioritize and perform a specialized cybersecurity audit, but the IS audit team has no experience in this area. Which of the following is the BEST course of action?

   • ADelay the audit until the IS auditors are sufficiently trained.
   • BDelay the audit until an experienced IS auditor has been hired.
   • CPerform the audit as requested using third-party support.
   • DPerform the audit with the most experienced IS auditors.

   Show answer

   Answer: C

   Next question

9. Question 659 · 1459 in bank

   When implementing a new IT maturity model, which of the following should occur FIRST?

   • ADetermine the model elements to be evaluated.
   • BBenchmark with industry peers.
   • CDefine the target IT maturity level.
   • DDevelop performance metrics.

   Show answer

   Answer: A

   Explanation

   Define the target IT maturity level: Defining the target IT maturity level is important, but it should be done after determining the model elements to be evaluated. This will allow the organization to set realistic goals based on a comprehensive understanding of its current IT maturity status.

   Source: Adapted from community discussion — SBD600

   Next question

10. Question 660 · 1459 in bank

    Which of the following is the PRIMARY role of the IS auditor in an organization's information classification process?

    • ASecuring information assets in accordance with the classification assigned
    • BValidating that assets are protected according to assigned classification
    • CEnsuring classification levels align with regulatory guidelines
    • DDefining classification levels for information assets within the organization

    Show answer

    Answer: B

    Explanation

    La función principal del auditor de SI (Sistemas de Información) en el proceso de clasificación de la información de una organización es asegurar que los activos de información estén protegidos según la clasificación asignada. Por lo tanto, la opción correcta es la B. El auditor de SI se encarga de evaluar y verificar que se implementen las medidas de seguridad adecuadas para proteger los activos de información de la organización de acuerdo con su clasificación. Esto implica revisar las políticas y controles existentes, así como realizar pruebas y auditorías para asegurarse de que los activos estén protegidos de manera efectiva. Si bien las otras opciones pueden ser funciones adicionales del auditor de SI en relación con la clasificación de la información, la función principal es garantizar que los activos estén protegidos adecuadamente según su clasificación asignada.

    Source: Adapted from community discussion — CISAGuate22

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISA practice, question 651. 1459 questions available.