CISA practice questions 731–740

1. Question 731 · 1459 in bank

   A bank's web-hosting provider has just completed an internal IT security audit and provides only a summary of the findings to the bank's auditor. Which of the following should be the bank's GREATEST concern?

   • AThe audit scope may not have addressed critical areas.
   • BThe audit procedures are not provided to the bank.
   • CThe bank's auditors are not independent of the service provider.
   • DThe audit may be duplicative of the bank's internal audit procedures

   Show answer

   Answer: A

   Explanation

   The bank's greatest concern in this scenario is the possibility that the audit scope may not have addressed critical areas (Option A). The summary provided by the web-hosting provider may not provide the bank with sufficient information to determine whether the audit scope was adequate and whether all critical areas were assessed

   Source: Adapted from community discussion — 3008

   Next question

2. Question 732 · 1459 in bank

   An incorrect version of source code was amended by a development team. This MOST likely indicates a weakness in:

   • Achange management.
   • Bproject management.
   • Cincident management.
   • Dquality assurance (QA).

   Show answer

   Answer: D

   Next question

3. Question 733 · 1459 in bank

   An organization allows employees to retain confidential data on personal mobile devices. Which of the following is the BEST recommendation to mitigate the risk of data leakage from lost or stolen devices?

   • AConfigure to auto-wipe after multiple failed access attempts.
   • BRequire employees to attend security awareness training.
   • CEnable device auto-lock function.
   • DPassword protect critical data files.

   Show answer

   Answer: A

   Next question

4. Question 734 · 1459 in bank

   A new regulation in one country of a global organization has recently prohibited cross-border transfer of personal data. An IS auditor has been asked to determine the organization's level of exposure in the affected country. Which of the following would be MOST helpful in making this assessment?

   • AIdentifying data security threats in the affected jurisdiction
   • BReviewing data classification procedures associated with the affected jurisdiction
   • CIdentifying business processes associated with personal data exchange with the affected jurisdiction
   • DDeveloping an inventory of all business entities that exchange personal data with the affected jurisdiction

   Show answer

   Answer: C

   Explanation

   C is correct, sorry. It's not the responsibility of an Auditor to develop an inventory. Auditors review, identify, observe etc. But not perform an operational task.

   Source: Adapted from community discussion — echo_cert

   Next question

5. Question 735 · 1459 in bank

   When responding to an ongoing denial of service (DoS) attack, an organization's FIRST course of action should be to:

   • Aminimize impact.
   • Binvestigate damage.
   • Canalyze the attack path.
   • Drestore service.

   Show answer

   Answer: A

   Next question

6. Question 736 · 1459 in bank

   Which of the following BEST describes an audit risk?

   • AThe financial report may contain undetected material errors.
   • BEmployees have been misappropriating funds.
   • CThe company is being sued for false accusations.
   • DKey employees have not taken vacation for 2 years.

   Show answer

   Answer: A

   Next question

7. Question 737 · 1459 in bank

   In an IT organization where many responsibilities are shared, which of the following is the BEST control for detecting unauthorized data changes?

   • AUsers are required to periodically rotate responsibilities.
   • BSegregation of duties conflicts are periodically reviewed.
   • CData changes are logged in an outside application.
   • DData changes are independently reviewed by another group.

   Show answer

   Answer: D

   Explanation

   Option D directly addresses the detection of unauthorized data changes by having a separate group or individual review the changes independently. This independent review can help identify discrepancies or anomalies that may indicate unauthorized access or alterations to data, providing an effective control for detecting unauthorized changes. Option C poses a Self-review threat since it is responsibility that is shared, not simply access.

   Source: Adapted from community discussion — dan08

   Next question

8. Question 738 · 1459 in bank

   An IS auditor is evaluating controls for monitoring the regulatory compliance of a third party that provides IT services to the organization. Which of the following should be the auditor's GREATEST concern?

   • AA gap analysis against regulatory requirements has not been conducted.
   • BThe third-party disclosed a policy-related issue of noncompliance.
   • CThe organization has not reviewed the third party's policies and procedures.
   • DThe organization has not communicated regulatory requirements to the third party.

   Show answer

   Answer: D

   Next question

9. Question 739 · 1459 in bank

   End users have been demanding the ability to use their own devices for work, but want to keep personal information out of corporate control. Which of the following would be MOST effective at reducing the risk of security incidents while satisfying end user requirements?

   • AEncrypt corporate data on the devices.
   • BEnable remote wipe capabilities for the devices.
   • CRequire complex passwords.
   • DImplement an acceptable use policy.

   Show answer

   Answer: A

   Explanation

   the most effective solution to mitigate security risks while still satisfying user requirements is to encrypt corporate data on the devices. This solution ensures that the organization's sensitive information is protected, and personal data on the device remains under the user's control. sorry , answer is A, encrypt.

   Source: Adapted from community discussion — 3008

   Next question

10. Question 740 · 1459 in bank

    Following the sale of a business division, employees will be transferred to a new organization, but they will retain access to IT equipment from the previous employer. An IS auditor has recommended that both organizations agree to and document an acceptable use policy for the equipment. What type of control has been recommended?

    • ACorrective control
    • BPreventive control
    • CDetective control
    • DDirective control

    Show answer

    Answer: D

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISA practice, question 731. 1459 questions available.