CISA practice questions 691–700

1. Question 691 · 1459 in bank

   An organization allows employees to use personally owned mobile devices to access customers' personal information. Which of the following is MOST important for an IS auditor to verify?

   • AEmployees have signed off on an acceptable use policy.
   • BDevices have adequate storage and backup capabilities.
   • CMobile devices are compatible with company infrastructure.
   • DMobile device security policies have been implemented.

   Show answer

   Answer: D

   Explanation

   Allowing employees to use personally owned mobile devices to access customers' personal information can increase the risk of unauthorized access or disclosure of the information. Therefore, it is critical that the organization implements appropriate security policies and controls to protect the information.

   Source: Adapted from community discussion — 007Georgeo

   Next question

2. Question 692 · 1459 in bank

   When is the BEST time to commence continuity planning for a new application system?

   • AImmediately after implementation
   • BFollowing successful user testing
   • CDuring the design phase
   • DJust prior to the handover to the system maintenance group

   Show answer

   Answer: C

   Next question

3. Question 693 · 1459 in bank

   Which of the following BEST indicates that an incident management process is effective?

   • ADecreased number of calls to the help desk
   • BIncreased number of incidents reviewed by IT management
   • CDecreased time for incident resolution
   • DIncreased number of reported critical incidents

   Show answer

   Answer: C

   Explanation

   The effectiveness of an incident management process can be measured by the ability to resolve incidents quickly and efficiently. A decrease in incident resolution time indicates that the process is working effectively, as appropriate actions are being taken to identify, analyze, and resolve incidents in a timely manner. A shorter resolution time means that the proper procedures are in place to deal with incidents efficiently, which in turn can lead to less disruption to services and higher user satisfaction. While other options can provide useful information about the overall performance of the incident handling process, the decrease in incident resolution time is a more direct indicator of the effectiveness and efficiency of the incident handling process.

   Source: Adapted from community discussion — CISAGuate22

   Next question

4. Question 694 · 1459 in bank

   Prior to the migration of acquired software into production, it is MOST important that the IS auditor review the:

   • Auser acceptance test (UAT) report.
   • Bvendor testing report.
   • Csystem documentation.
   • Dsource code escrow agreement.

   Show answer

   Answer: A

   Explanation

   A. user acceptance test report. UAT is critical, Escrow agreement serves a different purpose and can be done after migration.

   Source: Adapted from community discussion — gmutonyi

   Next question

5. Question 695 · 1459 in bank

   Which type of attack poses the GREATEST risk to an organization's most sensitive data?

   • ASpear phishing attack
   • BInsider attack
   • CPassword attack
   • DEavesdropping attack

   Show answer

   Answer: B

   Next question

6. Question 696 · 1459 in bank

   Using swipe cards to limit employee access to restricted areas requires implementing which additional control?

   • APhysical sign-in of all employees for access to restricted areas
   • BInitial escort of all new hires by a current employee
   • CPeriodic review of access profiles by management
   • DEmployee-access criteria determined on the basis of IS experience

   Show answer

   Answer: C

   Explanation

   Using swipe cards to limit employee access to restricted areas requires implementing periodic review of access profiles by management. This ensures that only authorized individuals have access to restricted areas and that any changes in employees' roles or responsibilities are reflected in their access permissions.

   Source: Adapted from community discussion — SBD600

   Next question

7. Question 697 · 1459 in bank

   To enable the alignment of IT staff development plans with IT strategy, which of the following should be done FIRST?

   • AInclude strategic objectives in IT staff performance objectives.
   • BReview IT staff job descriptions for alignment.
   • CIdentify required IT skill sets that support key business processes.
   • DDevelop quarterly training for each IT staff member.

   Show answer

   Answer: C

   Explanation

   The Correct answer is C for sure : Identifying the required IT skill sets that support key business processes is a critical first step in aligning IT staff development plans with IT strategy. It ensures that the IT staff is developing the skills and knowledge necessary to support the organization's key business processes and achieve its strategic objectives.

   Source: Adapted from community discussion — 007Georgeo

   Next question

8. Question 698 · 1459 in bank

   An internal audit department reports directly to the chief financial officer (CFO) of an organization. This MOST likely leads to:

   • Aaudit findings becoming more business-oriented.
   • Bconcern over the independence of the auditor.
   • Caudit recommendations receiving greater attention.
   • Dbiased audit findings and recommendations

   Show answer

   Answer: B

   Next question

9. Question 699 · 1459 in bank

   An internal audit department recently established a quality assurance (QA) program. Which of the following activities is MOST important to include as part of the QA program requirements?

   • ALong-term internal audit resource planning
   • BFeedback from internal audit staff
   • CAnalysis of user satisfaction reports from business lines
   • DOngoing monitoring of the audit activities

   Show answer

   Answer: D

   Explanation

   D. Ongoing monitoring of the audit activities. It is important to continuously monitor the audit activities to ensure that they are meeting the desired standards and to identify any areas for improvement. This can be done through regular evaluations, reviews, and assessments of the audit processes, procedures, and outcomes.

   Source: Adapted from community discussion — nickchen

   Next question

10. Question 700 · 1459 in bank

    While planning a review of IT governance, the IS auditor is MOST likely to:

    • Aobtain information about the framework of control adopted by management.
    • Bexamine audit committee minutes for IS-related matters and their control.
    • Cassess whether business process owner responsibilities are consistent across the organization.
    • Dreview compliance with policies and procedures issued by the board of directors.

    Show answer

    Answer: A

    Explanation

    Tricky question as it says planning a review not performing the actual review, so answer is A. The other options will be more suited to performing review of the IT governance within an organization

    Source: Adapted from community discussion — [Removed]

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISA practice, question 691. 1459 questions available.