CISA practice questions 771–780

1. Question 771 · 1459 in bank

   An IS auditor is reviewing processes for importing market price data from external data providers. Which of the following findings should the auditor consider MOST critical?

   • AThe quality of the data is not monitored.
   • BThe transfer protocol does not require authentication.
   • CImported data is not disposed frequently.
   • DThe transfer protocol is not encrypted.

   Show answer

   Answer: D

   Explanation

   You are importing data from external market provider which makes it authentic source, data quality doesnt need to be monitored as it may only be one source. But transfer protocol should be encrypted both for confidentiality and integrity. Authentication may not even be needed maybe its open to everyone. Answer is clearly D, in all cases you need encryption

   Source: Adapted from community discussion — frisbg

   Next question

2. Question 772 · 1459 in bank

   An information systems security officer's PRIMARY responsibility for business process applications is to:

   • Acreate role-based rules for each business process.
   • Bapprove the organization's security policy.
   • Censure access rules agree with policies.
   • Dauthorize secured emergency access.

   Show answer

   Answer: C

   Explanation

   actually all of below should be done in such enterprise. no matter the sequence. but in order to satisfy this exam, A would be best

   Source: Adapted from community discussion — Eric0223

   Next question

3. Question 773 · 1459 in bank

   Coding standards provide which of the following?

   • AAccess control tables
   • BData flow diagrams
   • CField naming conventions
   • DProgram documentation

   Show answer

   Answer: C

   Explanation

   C is the right answer, Coding standards provide field naming conventions, which are rules for naming variables, constants, functions, classes, and other elements in a program. Coding standards help to ensure consistency, readability, maintainability, and portability of code. Program documentation, access control tables, and data flow diagrams are not part of coding standards. References: CISA Review Manual (Digital Version), Chapter 4, Section 4.3.1

   Source: Adapted from community discussion — 1e71ed5

   Next question

4. Question 774 · 1459 in bank

   During which IT project phase is it MOST appropriate to conduct a benefits realization analysis?

   • APost-implementation review phase
   • BDesign review phase
   • CUser acceptance testing (UAT) phase
   • DFinal implementation phase

   Show answer

   Answer: A

   Next question

5. Question 775 · 1459 in bank

   Due to a high volume of customer orders, an organization plans to implement a new application for customers to use for online ordering. Which type of testing is MOST important to ensure the security of the application prior to go-live?

   • AStress testing
   • BUser acceptance testing (UAT)
   • CVulnerability testing
   • DRegression testing

   Show answer

   Answer: C

   Explanation

   C. Vulnerability testing is to ensure the security of the application. It can't be A. Searching on CISA ISACA Ref. Manual 27th ed. we find two occurences of the term "stress testing". 1) "3.5.1 Testing Classifications" - Stress Testing: Studying the impact on the application by testing with an incremental number of concurrent users/services on the application to determine the maximum number of concurrent users/services the application can process 2) Glossary C - Capacity stress testing: Testing an application with large quantities of data to evaluate its performance during peak periods. Also called volume testing. Also searching the ISACA site on google ( search operator site:isaca.org ) doesn't give any indication that stress testing could have something to do with security.

   Source: Adapted from community discussion — 46080f2

   Next question

6. Question 776 · 1459 in bank

   During an audit of identity and access management, an IS auditor finds that the engagement audit plan does not include the testing of controls that regulate access by third parties. Which of the following would be the auditor's BEST course of action?

   • AAdd testing of third-party access controls to the scope of the audit.
   • BPlan to test these controls in another audit.
   • CDetermine whether the risk has been identified in the planning documents.
   • DEscalate the deficiency to audit management.

   Show answer

   Answer: C

   Next question

7. Question 777 · 1459 in bank

   What is the PRIMARY reason for conducting a risk assessment when developing an annual IS audit plan?

   • AIdentify and prioritize audit areas
   • BDetermine the existence of controls in audit areas
   • CProvide assurance material items will be covered
   • DDecide which audit procedures and techniques to use

   Show answer

   Answer: A

   Next question

8. Question 778 · 1459 in bank

   An employee transfers from an organization's risk management department to become the lead IS auditor. While in the risk management department, the employee helped develop the key performance indicators (KPIs) now used by the organization. Which of the following would pose the GREATEST threat to the independence of this auditor?

   • AEvaluating the effectiveness of IT risk management processes
   • BRecommending controls to address the IT risks identified by KPIs
   • CDeveloping KPIs to measure the internal audit team
   • DTraining the IT audit team on IT risk management processes

   Show answer

   Answer: C

   Explanation

   the greatest threat to the independence of this auditor is developing KPIs to measure the internal audit team. This task creates a potential conflict of interest as the auditor may be evaluating their own work and performance.

   Source: Adapted from community discussion — 3008

   Next question

9. Question 779 · 1459 in bank

   As part of an audit response, an auditee has concerns with the recommendations and is hesitant to implement them. Which of the following would be the BEST course of action for the IS auditor?

   • ASuggest hiring a third-party consultant to perform a current state assessment.
   • BIssue a final report without including the opinion of the auditee.
   • CConduct further discussions with the auditee to develop a mitigation plan.
   • DAccept the auditee's response and perform additional testing.

   Show answer

   Answer: C

   Next question

10. Question 780 · 1459 in bank

    After discussing findings with an auditee, an IS auditor is required to obtain approval of the report from the CEO before issuing it to the audit committee. This requirement PRIMARILY affects the IS auditor's:

    • Ajudgment
    • Beffectiveness
    • Cindependence
    • Dintegrity

    Show answer

    Answer: C

    Explanation

    Independence is a fundamental principle in auditing that ensures objectivity and impartiality in the audit process. When the CEO, who may have vested interests in the audit findings, has the authority to approve the report before it reaches the audit committee, it could potentially compromise the auditor's independence. The auditor might feel pressure to alter or suppress findings to align with the CEO's preferences, undermining the integrity of the audit process.

    Source: Adapted from community discussion — Swallows

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISA practice, question 771. 1459 questions available.