CISA practice questions 71–80

1. Question 71 · 1459 in bank

   An IS auditor is reviewing the system development practices of an organization that is about to move from a waterfall to an agile approach. Which of the following is MOST important for the auditor to focus on as a result of this move?

   • ACapacity planning
   • BCode versioning
   • CSecure code review
   • DRelease management

   Show answer

   Answer: D

   Explanation

   When an organization is transitioning from a waterfall to an agile approach in system development, release management becomes particularly crucial. In an agile environment, there are often more frequent releases of smaller increments of functionality. Effective release management involves planning, coordinating, and overseeing the deployment of these releases into production.

   Source: Adapted from community discussion — FAGFUR

   Next question

2. Question 72 · 1459 in bank

   Which of the following is the PRIMARY objective of implementing privacy-related controls within an organization?

   • ATo comply with legal and regulatory requirements
   • BTo prevent confidential data loss
   • CTo provide options to individuals regarding use of their data
   • DTo identify data at rest and data in transit for encryption

   Show answer

   Answer: A

   Explanation

   The correct answer is C, to comply with legal and regulatory requirements. While compliance is not the only objective of implementing privacy-related controls, it is the primary objective as compliance with legal and regulatory requirements is necessary to ensure the protection of personal information. Other objectives, such as preventing confidential data loss or providing options to individuals regarding use of their data, are also important but are secondary to the primary objective of compliance with legal and regulatory requirements.

   Source: Adapted from community discussion — 3008

   Next question

3. Question 73 · 1459 in bank

   An IS auditor conducts a review of a third-party vendor's reporting of key performance indicators (KPIs). Which of the following findings should be of MOST concern to the auditor?

   • ASome KPIs are not documented.
   • BKPIs are not clearly defined.
   • CKPIs have never been updated.
   • DKPI data is not being analyzed.

   Show answer

   Answer: B

   Explanation

   The finding that should be of most concern to the auditor is when KPIs are not clearly defined. Clear and well-defined Key Performance Indicators (KPIs) are crucial for assessing and measuring the performance of a third-party vendor. If the KPIs are not clearly defined, it can lead to ambiguity, misunderstanding, and misinterpretation of the performance data, making it difficult to make informed decisions or evaluations.

   Source: Adapted from community discussion — FAGFUR

   Next question

4. Question 74 · 1459 in bank

   Which of the following is critical to the successful establishment of an enterprise IT architecture?

   • AComparison of the architecture with that of other organizations
   • BA well-defined data migration policy
   • COrganizational support for standardization
   • DAn architecture encompassing only critical systems

   Show answer

   Answer: C

   Explanation

   Organizational support for standardization is critical to the successful establishment of an enterprise IT architecture. Standardization helps ensure consistency, interoperability, and efficiency across the organization's IT systems and processes. When there is strong support for standardization from the organization, it becomes easier to implement and maintain an IT architecture that aligns with best practices, industry standards, and the organization's strategic goals. While the other options may have relevance, organizational support for standardization is fundamental to achieving a cohesive and effective enterprise IT architecture.

   Source: Adapted from community discussion — FAGFUR

   Next question

5. Question 75 · 1459 in bank

   Which of the following would protect the confidentiality of information sent in email messages?

   • AEncryption
   • BSecure Hash Algorithm 1 (SHA-1)
   • CDigital certificates
   • DDigital signatures

   Show answer

   Answer: A

   Explanation

   Encryption is the technique that would protect the confidentiality of information sent in email messages. Encrypting email messages ensures that the content is scrambled in such a way that only authorized parties with the proper decryption key can understand the original information. This is particularly important for protecting sensitive or confidential data during transmission.

   Source: Adapted from community discussion — FAGFUR

   Next question

6. Question 76 · 1459 in bank

   Which of the following would be of GREATEST concern to an IS auditor when evaluating governance processes for a user-developed tool?

   • APenetration testing has not been conducted.
   • BSignificant changes to the tool were not documented.
   • CThe backup strategy has not been tested.
   • DA risk assessment has not been performed.

   Show answer

   Answer: D

   Explanation

   A risk assessment has not been performed: This is the most critical concern among the options listed. A risk assessment is crucial for identifying and mitigating potential risks, including security vulnerabilities, compliance issues, and operational risks. Without a risk assessment, the organization may be unaware of the potential threats and vulnerabilities associated with the user-developed tool, which can lead to significant problems.

   Source: Adapted from community discussion — SuperMax

   Next question

7. Question 77 · 1459 in bank

   Which task should an IS auditor complete FIRST during the preliminary planning phase of a database security review?

   • ADetermine which databases will be in scope.
   • BIdentify the most critical database controls.
   • CEvaluate the types of databases being used.
   • DPerform a business impact analysis (BIA).

   Show answer

   Answer: A

   Explanation

   During the preliminary planning phase of a database security review, an IS auditor should first determine which databases will be in scope. This allows the auditor to focus their efforts on the specific databases that are relevant to the organization's security posture and objectives.

   Source: Adapted from community discussion — SBD600

   Next question

8. Question 78 · 1459 in bank

   Which of the following is an IS auditor's BEST course of action when the auditee indicates that a corrective action plan for a high-risk finding will take longer than expected?

   • ADetermine if an interim compensating control has been implemented.
   • BRequire that remediation is completed in the agreed timeframe.
   • CAccept the longer target date and document it in the audit system.
   • DEscalate the overdue finding to the audit committee.

   Show answer

   Answer: A

   Explanation

   When the auditee indicates that a corrective action plan for a high-risk finding will take longer than expected is to determine if an interim compensating control has been implemented. Implementing interim compensating controls is a common practice to mitigate risks while a more permanent solution is being developed and implemented. The auditor should assess whether such measures are in place to reduce the risk during the extended time frame.

   Source: Adapted from community discussion — FAGFUR

   Next question

9. Question 79 · 1459 in bank

   Which type of framework is BEST suited to illustrate the traceability of information and communications technologies and their alignment with business objectives?

   • AEnterprise architecture (EA) framework
   • BService management framework
   • CProject management framework
   • DIT governance framework

   Show answer

   Answer: A

   Explanation

   The best type of framework to illustrate the traceability of information and communications technologies and their alignment with business objectives is an EA framework. Enterprise Architecture is designed to provide a holistic view of an organization's structure, processes, information, and technology. It facilitates the alignment of IT with business objectives and helps illustrate how various components of the IT landscape contribute to achieving organizational goals.

   Source: Adapted from community discussion — FAGFUR

   Next question

10. Question 80 · 1459 in bank

    Which of the following is the BEST way for an organization that is using a Software as a Service (SaaS) application to reduce its risk associated with the collection and protection of personal information?

    • ALimit the amount of personal information collected to industry standards.
    • BEncrypt personal information held by the organization.
    • CLimit the amount of personal information collected to the minimum required.
    • DOnly allow remote access to personal information from an alternate site.

    Show answer

    Answer: C

    Explanation

    By minimizing the amount of personal information stored or processed, the organization can reduce the potential impact in case of a security breach or unauthorized access.

    Source: Adapted from community discussion — FAGFUR

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISA practice, question 71. 1459 questions available.