CISA practice questions 711–720

1. Question 711 · 1459 in bank

   A chief information officer (CIO) has asked an IS auditor to implement several security controls for an organization's IT processes and systems. The auditor should:

   • Arefuse due to independence issues.
   • Bcommunicate the conflict of interest to audit management.
   • Cperform the assignment and future audits with the due professional care.
   • Dobtain approval from executive management for the implementation.

   Show answer

   Answer: B

   Explanation

   While it's essential for IS auditors to maintain independence and objectivity in their work, outright refusal may not always be necessary or practical. By communicating the conflict of interest to audit management, the auditor can ensure that appropriate steps are taken to address the situation while still fulfilling the organization's needs.

   Source: Adapted from community discussion — Swallows

   Next question

2. Question 712 · 1459 in bank

   An algorithm in an email program analyzes traffic to quarantine emails identified as spam. The algorithm in the program is BEST characterized as which type of control?

   • ADetective
   • BDirective
   • CPreventive
   • DCorrective

   Show answer

   Answer: C

   Explanation

   C. Preventive The algorithm in the email program that quarantines emails identified as spam is a preventive control. Preventive controls are designed to prevent unwanted or unauthorized activities or events from occurring. In this case, the algorithm is designed to prevent spam emails from reaching the user's inbox, thereby preventing potential security threats or unwanted content from being delivered.

   Source: Adapted from community discussion — JustCisa

   Next question

3. Question 713 · 1459 in bank

   During the implementation of a new system, an IS auditor must assess whether certain automated calculations comply with the regulatory requirements. Which of the following is the BEST way to obtain this assurance?

   • ARe-perform the calculation with audit software.
   • BReview the source code related to the calculation.
   • CReview sign-off documentation.
   • DInspect user acceptance test (UAT) results.

   Show answer

   Answer: A

   Explanation

   By re-running calculations with audit software, you can see the actual results and directly verify that the system is functioning correctly. This provides objective evidence of compliance with regulatory requirements. While reviewing source code is important, correct code does not guarantee that the actual calculations are accurate.

   Source: Adapted from community discussion — Swallows

   Next question

4. Question 714 · 1459 in bank

   When testing the adequacy of tape backup procedures, which step BEST verifies that regularly scheduled backups are timely and run to completion?

   • AReviewing a sample of system-generated backup logs
   • BInterviewing key personnel involved in the backup process
   • CObserving the execution of a daily backup run
   • DEvaluating the backup policies and procedures

   Show answer

   Answer: A

   Explanation

   Reviewing the backup logs can provide evidence that backups are being performed according to schedule and that they are completing successfully. The logs typically record the start time, completion time, and status of each backup job, along with any error messages or alerts that may have been generated during the backup process. By reviewing a sample of backup logs, the auditor can confirm that backups are being performed on a regular basis and that any backup failures are being promptly addressed.

   Source: Adapted from community discussion — 007Georgeo

   Next question

5. Question 715 · 1459 in bank

   Which of the following would MOST effectively ensure the integrity of data transmitted over a network?

   • AMessage encryption
   • BSteganography
   • CCertificate authority (CA)
   • DMessage digest

   Show answer

   Answer: D

   Explanation

   message digest is also called hashing. so hash of the message would provide the most effective integrity of the date transmitted. D is correct

   Source: Adapted from community discussion — Pauloludele

   Next question

6. Question 716 · 1459 in bank

   During the planning stage of a compliance audit, an IS auditor discovers that a bank's inventory of compliance requirements does not include recent regulatory changes related to managing data risk. What should the auditor do FIRST?

   • AAsk management why the regulatory changes have not been included.
   • BReport the missing regulatory updates to the chief information officer (CIO).
   • CDiscuss potential regulatory issues with the legal department.
   • DExclude recent regulatory changes from the audit scope.

   Show answer

   Answer: A

   Explanation

   Based on the findings from the discussion with management, the auditor can then escalate the issue to the CIO or other relevant stakeholders if necessary. sking management why the recent regulatory changes have not been included in the inventory helps to understand the root cause of the omission. This step is crucial for identifying whether there was a lapse in the process, oversight, or other issues that need to be addressed.

   Source: Adapted from community discussion — PurpleParrot

   Next question

7. Question 717 · 1459 in bank

   An organization has replaced all of the storage devices at its primary data center with new, higher capacity units. The replaced devices have been installed at the disaster recovery site to replace older units. An IS auditor's PRIMARY concern would be whether:

   • Athe recovery site devices can handle the storage requirements.
   • Bthe procurement was in accordance with corporate policies and procedures.
   • Cthe relocation plan has been communicated to all concerned parties.
   • Da hardware maintenance contract is in place for both old and new storage devices.

   Show answer

   Answer: A

   Next question

8. Question 718 · 1459 in bank

   Which of the following should be of GREATEST concern to an IS auditor reviewing data conversion and migration during the implementation of a new application system?

   • AData conversion was performed using manual processes.
   • BUnauthorized data modifications occurred during conversion.
   • CThe change management process was not formally documented.
   • DBackups of the old system and data are not available online.

   Show answer

   Answer: B

   Explanation

   B. Unauthorized data modifications occurred during conversion. The unauthorized data modifications during data conversion and migration pose the greatest concern to an IS auditor. Data integrity is critical during the migration process, and unauthorized modifications can lead to data corruption and may have a significant impact on the accuracy and reliability of the new application system. This is especially important in situations where historical data is being converted, as any unauthorized changes could result in data loss, compliance issues, or incorrect business decisions.

   Source: Adapted from community discussion — JustCisa

   Next question

9. Question 719 · 1459 in bank

   When auditing the alignment of IT to the business strategy, it is MOST important for the IS auditor to:

   • Aensure an IT steering committee is appointed to monitor new IT projects.
   • Bevaluate deliverables of new IT initiatives against planned business services.
   • Cinterview senior managers for their opinion of the IT function.
   • Dcompare the organization's strategic plan against industry best practice.

   Show answer

   Answer: B

   Next question

10. Question 720 · 1459 in bank

    An organization is acquiring a new customer relationship management (CRM) system. In which of the following would the IS auditor find the MOST relevant information on projected cost savings?

    • ARequest for proposal (RFP)
    • BFeasibility study document
    • CBusiness case
    • DResults of prototype testing

    Show answer

    Answer: C

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISA practice, question 711. 1459 questions available.