Certified Information Systems Auditor1,459 questions across 146 pages are complete and free, with no account or card.
1459 questions in this bank
Free access · progress saved on this device
When evaluating whether the expected benefits of a project have been achieved, it is MOST important for an IS auditor to review:
Answer: D
Quality assurance results are like IT checklists can be incorrect, maybe they are generic or unrelated. As IS auditor we need to understand business case first and validate QA results are correct or maybe develop our own checklist or test cases.
Source: Adapted from community discussion — frisbg
A help desk has been contacted regarding a lost business mobile device. The FIRST course of action should be to:
Answer: B
Should be B.. Without validating the identity of the caller, identifying the supposedly lost phone can lead to disclosing location of another person to the caller, which can lead to privacy violation too
Source: Adapted from community discussion — botherder88
When conducting a requirements analysis for a project, the BEST approach would be to:
Answer: D
When evaluating information security governance within an organization, which of the following findings should be of MOST concern to an IS auditor?
Answer: C
During a post-implementation review, an IS auditor learns that while benefits were realized according to the business case, complications during implementation added to the cost of the solution. Which of the following is the auditor's BEST course of action?
Answer: B
When reviewing an organization's IT governance processes, which of the following provides the BEST indication that information security expectations are being met at all levels?
Answer: A
While implementation of a comprehensive security awareness program (option D) is important for promoting a culture of security awareness and education among employees, it may not necessarily provide the best indication that information security expectations are being met at all levels. Security awareness programs are essential components of an organization's overall security strategy, but they primarily focus on educating and empowering employees to recognize and mitigate security risks rather than directly measuring the effectiveness of security controls and processes.
Source: Adapted from community discussion — Swallows
When assessing whether an organization's IT performance measures are comparable to other organizations in the same industry, which of the following would be MOST helpful to review?
Answer: C
An employee approaches an IS auditor and expresses concern about a critical security issue in a newly installed application. Which of the following would be the MOST appropriate action for the auditor to take?
Answer: A
When an individual user approaches an auditor, their response should always be coordinated with their audit management. Therefore A. It happens again and again that individual users try to instrumentalize auditors for their own interests. For example, if a user would have preferred a different solution and feels ignored and now wants to take revenge for their choice. As a result of the coordination with the audit management, option B., C. or D. may well emerge as a follow-up action.
Source: Adapted from community discussion — 46080f2
An organization has outsourced its data processing function to a service provider. Which of the following would BEST determine whether the service provider continues to meet the organization's objectives?
Answer: D
When an organization outsources its data processing function to a service provider, it is important to ensure that the provider continues to meet the organization's objectives. The provider is typically contracted to perform specific tasks and meet certain requirements, such as data security, availability, and performance. The organization should continuously monitor the provider's performance against the agreed-upon service level agreements (SLAs) to determine whether the provider is meeting the objectives
Source: Adapted from community discussion — 3008
The PRIMARY objective of value delivery in reference to IT governance is to:
Answer: B
While ensuring compliance (option C) with regulatory requirements and internal policies is also important in IT governance, the primary focus of value delivery is on optimizing investments to create value for the organization. Compliance is a necessary aspect of governance, but it is not the primary objective of value delivery, which is more concerned with generating tangible benefits and returns on IT investments.
Source: Adapted from community discussion — Swallows
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CISA practice, question 671. 1459 questions available.
Version 1.0.0. How we source questions