Certified Information Systems Auditor1,459 questions across 146 pages are complete and free, with no account or card.
1459 questions in this bank
Free access · progress saved on this device
An IS auditor may be justified in using a SMALLER sample size under which of the following circumstances?
Answer: A
Low confidence coefficient → Small sample size acceptable High expected error rate → Large sample size required Thus, a small sample size may be justified only when the confidence coefficient is low.
Source: Adapted from community discussion — Swallows
An IS auditor is reviewing the service management of an outsourced help desk. Which of the following is the BEST indicator of how effectively the service provider is performing this function?
Answer: C
While the other options may provide some insights into the help desk's operations: A. Number of calls worked: This metric can give you an idea of the volume of work the help desk is handling but doesn't necessarily indicate the quality or effectiveness of the service. B. Call transcript reviews: Reviewing call transcripts can help identify specific issues or areas for improvement, but it may not provide a comprehensive view of overall service effectiveness. D. Average ticket age: This metric can help assess how quickly issues are resolved, but it doesn't necessarily measure the overall quality or user satisfaction with the service. Customer satisfaction ratings are a more holistic and direct measure of the service provider's performance and how well they are meeting the needs of the users.
Source: Adapted from community discussion — SuperMax
Which of the following is the BEST preventive control to protect the confidentiality of data on a corporate smartphone in the event it is lost?
Answer: A
A. Encryption of the data stored on the device The best preventive control to protect the confidentiality of data on a corporate smartphone in the event it is lost is to encrypt the data stored on the device. Encryption ensures that even if the device falls into the wrong hands, the data remains unreadable without the proper decryption key. This is a fundamental security measure for protecting data at rest on mobile devices and is considered a strong preventive control for maintaining data confidentiality. While options B (Remote data wipe program), C (Password for device authentication), and D (Biometric authentication for the device) are also important security measures, they are typically used in conjunction with encryption rather than as standalone preventive controls for data confidentiality.
Source: Adapted from community discussion — SuperMax
Which of the following would be MOST important to include in an IS audit report?
Answer: D
The MOST important element to include in an IS audit report is the level of unmitigated risk along with business impact. This information provides a clear understanding of the potential consequences of identified risks and allows management to prioritize and address them appropriately. It helps stakeholders make informed decisions about risk mitigation strategies and resource allocation.
Source: Adapted from community discussion — FAGFUR
Which of the following should be an IS auditor's PRIMARY focus when evaluating the response process for cyber crimes?
Answer: C
When evaluating the response process for cybercrimes, an IS auditor's PRIMARY focus should be on evidence collection. Collecting and preserving digital evidence is crucial for investigating cybercrimes and supporting legal actions. Proper evidence handling ensures that the information is admissible in court, enhances the chances of successful prosecution, and contributes to a thorough understanding of the incident.
Source: Adapted from community discussion — FAGFUR
An organization plans to receive an automated data feed into its enterprise data warehouse from a third-party service provider. Which of the following would be the BEST way to prevent accepting bad data?
Answer: D
Which of the following audit procedures would provide the BEST assurance that an application program is functioning as designed?
Answer: D
The best assurance that an application program is functioning as designed is often obtained through reviewing program documentation (Option D). Program documentation typically includes specifications, design documents, and other materials that outline how the application is supposed to work. By comparing the actual program behavior with the documented design and specifications, an auditor can assess whether the program is functioning as intended.
Source: Adapted from community discussion — FAGFUR
To mitigate the risk of exposing data through application programming interface (API) queries, which of the following design considerations is MOST important?
Answer: C
The most important design consideration to mitigate the risk of exposing data through application programming interface queries is data minimization. Data minimization involves limiting the collection and storage of personal information to only what is necessary for the intended purpose. When implementing APIs, it is crucial to ensure that only the minimum required data is exposed or queried, reducing the potential impact in case of a security breach or unauthorized access.
Source: Adapted from community discussion — FAGFUR
One advantage of monetary unit sampling is the fact that
Answer: A
A. large-value population items are segregated and audited separately. Monetary unit sampling is a statistical sampling technique used in auditing to select and test items from a population. One of its advantages is that it allows for the segregation and separate auditing of large-value items. This can be beneficial because large-value items may have a significant impact on financial statements and financial statements' overall accuracy and reliability. By segregating and auditing these large-value items separately, auditors can give special attention to high-risk areas and ensure they are accurately represented in the financial statements.
Source: Adapted from community discussion — SuperMax
Backup procedures for an organization's critical data are considered to be which type of control?
Answer: C
It's a corrective control in ISMS (Information Security Management Systems). Controls serve a security objective and modify either the likelihood of occurrence or the amount of damage done. A backup does not prevent the loss of data due to an attack or a technical failure. It just reduces the amount of damage. Preventive controls reduce the likelihood, corrective controls reduce the damage. When you go through risk analysis, you have a vulnerability that is met by a threat, the risk emerges. If the threat and vulnerability match, damage occurs. The backup reduces this damage but does not modify likelihood. The loss of data is an outcome of the event which risk is measured.
Source: Adapted from community discussion — SuperMax
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CISA practice, question 61. 1459 questions available.
Version 1.0.0. How we source questions