CISA practice questions 791–800

1. Question 791 · 1459 in bank

   During a review of a production schedule, an IS auditor observes that a staff member is not complying with mandatory operational procedures. The auditor's NEXT step should be to:

   • Anote the noncompliance in the audit working papers.
   • Bdetermine why the procedures were not followed.
   • Cissue an audit memorandum identifying the noncompliance.
   • Dinclude the noncompliance in the audit report.

   Show answer

   Answer: B

   Explanation

   Explanation: As an IS auditor, the first step should always be to determine why the mandatory operational procedures were not followed. It is important to identify the root cause of the noncompliance to prevent it from happening in the future. If the noncompliance is due to a lack of training or understanding of the procedures, the auditor may recommend additional training or clarification of the procedures. If the noncompliance is due to a lack of resources or conflicting priorities, the auditor may recommend changes to the production schedule or resource allocation. In summary, the IS auditor's next step should be to determine why the mandatory operational procedures were not followed and identify the root cause before taking any further actions.

   Source: Adapted from community discussion — 3008

   Next question

2. Question 792 · 1459 in bank

   The PRIMARY objective of IT service level management is to:

   • Aimprove IT cost control.
   • Bmanage computer operations activities.
   • Csatisfy customer requirements.
   • Dincrease awareness of IT services.

   Show answer

   Answer: C

   Next question

3. Question 793 · 1459 in bank

   A small startup organization does not have the resources to implement segregation of duties. Which of the following is the MOST effective compensating control?

   • ARotation of log monitoring and analysis responsibilities
   • BAdditional management reviews and reconciliations
   • CMandatory vacations
   • DThird-party assessments

   Show answer

   Answer: B

   Explanation

   In a small organization, where the number of employees is relatively small, job rotations may not make much sense, and they are likely to be transferred back to their original positions after a while. So B is the correct answer.

   Source: Adapted from community discussion — Victor83516

   Next question

4. Question 794 · 1459 in bank

   The use of which of the following would BEST enhance a process improvement program?

   • ABalanced scorecard
   • BProject management methodologies
   • CCapability maturity models
   • DModel-based design notations

   Show answer

   Answer: C

   Explanation

   Capability maturity models, such as the Capability Maturity Model Integration (CMMI), are specifically designed to enhance process improvement programs. These models provide a structured framework for organizations to assess and improve their processes across various domains, such as software development, project management, and service delivery.

   Source: Adapted from community discussion — dan08

   Next question

5. Question 795 · 1459 in bank

   Reconciliations have identified data discrepancies between an enterprise data warehouse and a revenue system for key financial reports. What is the GREATEST risk to the organization in this situation?

   • AThe key financial reports may no longer be produced.
   • BFinancial reports may be delayed.
   • CUndetected fraud may occur.
   • DDecisions may be made based on incorrect information.

   Show answer

   Answer: D

   Next question

6. Question 796 · 1459 in bank

   An organization has recently implemented a Voice-over IP (VoIP) communication system. Which of the following should be the IS auditor's PRIMARY concern?

   • AVoice quality degradation due to packet loss
   • BLack of integration of voice and data communications
   • CA single point of failure for both voice and data communications
   • DInability to use virtual private networks (VPNs) for internal traffic

   Show answer

   Answer: C

   Next question

7. Question 797 · 1459 in bank

   When evaluating the ability of a disaster recovery plan (DRP) to enable the recovery of IT processing capabilities, it is MOST important for the IS auditor to verify the plan is:

   • Astored at an offsite location.
   • Bcommunicated to department heads.
   • Cregularly reviewed.
   • Dperiodically tested.

   Show answer

   Answer: D

   Next question

8. Question 798 · 1459 in bank

   During a disaster recovery audit, an IS auditor finds that a business impact analysis (BIA) has not been performed. The auditor should FIRST:

   • Aconduct additional compliance testing.
   • Bissue an intermediate report to management.
   • Cperform a business impact analysis (BIA).
   • Devaluate the impact on current disaster recovery capability.

   Show answer

   Answer: D

   Next question

9. Question 799 · 1459 in bank

   During a review, an IS auditor discovers that corporate users are able to access cloud-based applications and data from any Internet-connected web browser. Which of the following is the auditor's BEST recommendation to help prevent unauthorized access?

   • AUtilize strong anti-malware controls on all computing devices.
   • BImplement an intrusion detection system (IDS).
   • CUpdate security policies and procedures.
   • DImplement multi-factor authentication.

   Show answer

   Answer: D

   Next question

10. Question 800 · 1459 in bank

    To create a digital signature in a message using asymmetric encryption, it is necessary to:

    • Aencrypt the authentication sequence using a public key.
    • Bfirst use a symmetric algorithm for the authentication sequence.
    • Ctransmit the actual digital signature in unencrypted clear text.
    • Dencrypt the authentication sequence using a private key.

    Show answer

    Answer: D

    Explanation

    For Asymmetric Encryption, the sender uses a public key to encrypt the data and the receiver uses the private key to decrypt the encrypted data. For Signing, the sender uses the private key to create the message's signature and the receiver uses the public key to verify the signature.

    Source: Adapted from community discussion — ItsBananass

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISA practice, question 791. 1459 questions available.