CISA practice questions 801–810

1. Question 801 · 1459 in bank

   During an audit of an access control system, an IS auditor finds that RFID card readers are not connected via the network to a central server. Which of the following is the GREATEST risk associated with this finding?

   • ALost or stolen cards cannot be disabled immediately.
   • BCard reader firmware updates cannot be rolled out automatically.
   • CThe system is not easily scalable to accommodate a new device.
   • DIncidents cannot be investigated without a centralized log file.

   Show answer

   Answer: A

   Explanation

   A is correct. Incident can be investigated even if logging is not centralized. as long as trails can be obtained from other sources that provide evidence of an incident, investigation will take place. relying only on the central logging will not yield sufficient information

   Source: Adapted from community discussion — Hashi1_snr

   Next question

2. Question 802 · 1459 in bank

   Invoking a business continuity plan (BCP) is demonstrating which type of control?

   • APreventive
   • BCorrective
   • CDirective
   • DDetective

   Show answer

   Answer: B

   Explanation

   Corrective Controls Corrective controls, as their name suggests, are designed to minimize the impact of a threat event once it has occurred, and help in restoring, or correcting, a business to normal operations. Examples of corrective controls include the following: • Business continuity planning • Disaster recovery planning • Incident response planning • Backup procedures

   Source: Adapted from community discussion — Idkanything

   Next question

3. Question 803 · 1459 in bank

   When determining whether a project in the design phase will meet organizational objectives, what is BEST to compare against the business case?

   • AProject plan
   • BRequirements analysis
   • CImplementation plan
   • DProject budget provisions

   Show answer

   Answer: B

   Explanation

   The requirements analysis phase of a project involves identifying, documenting, and validating the needs and expectations of stakeholders. This includes understanding the functional, technical, and business requirements that the project must fulfill to achieve its objectives. Comparing the requirements analysis against the business case ensures that the project's scope and objectives are aligned with the overarching goals and expectations outlined in the business case. It helps verify that the project will deliver the intended outcomes and benefits as defined in the business case.

   Source: Adapted from community discussion — Swallows

   Next question

4. Question 804 · 1459 in bank

   When planning an audit to assess application controls of a cloud-based system, it is MOST important for the IS auditor to understand the:

   • Aavailability reports associated with the cloud-based system.
   • Barchitecture and cloud environment of the system.
   • Cpolicies and procedures of the business area being audited.
   • Dbusiness process supported by the system.

   Show answer

   Answer: B

   Explanation

   Understanding the architecture and cloud environment of the system is crucial because it provides essential insights into how the application controls are implemented and operated within the cloud-based system. The cloud environment introduces unique considerations and complexities that must be comprehended to effectively evaluate the application controls.

   Source: Adapted from community discussion — EBTURK

   Next question

5. Question 805 · 1459 in bank

   The results of an IS audit indicating the need to strengthen controls has been communicated to the appropriate stakeholders. Which of the following is the BEST way for management to enforce implementation of the recommendations?

   • ACopy senior management on communications related to the audit
   • BHave stakeholders develop a business case for control changes
   • CAssign ownership to each remediation activity
   • DRequest auditors to design a roadmap for closure

   Show answer

   Answer: C

   Next question

6. Question 806 · 1459 in bank

   An organization that has decided to approve the use of end-user computing (EUC) should FIRST ensure:

   • Aan EUC policy is developed.
   • BEUC controls are reviewed.
   • Ca business impact analysis (BIA) is conducted.
   • DEUC use cases are assessed and documented.

   Show answer

   Answer: A

   Next question

7. Question 807 · 1459 in bank

   Internal audit is conducting an audit of customer transaction risk. Which of the following would be the BEST reason to use data analytics?

   • ATransactional data is contained in multiple discrete systems that have varying levels of reliability.
   • BAnomalies and risk trends in the data set have yet to be defined.
   • CThe audit is being performed to comply with regulations requiring periodic random sample testing.
   • DThe audit focus is on a small number of predefined high-risk transactions.

   Show answer

   Answer: A

   Explanation

   From CRM 27th, An IS auditor can use data analytics for the following purposes: • Identification of areas where poor data quality exists • Performance of risk assessment at the planning phase of an audit THE ANSWER IS B. Anomalies and risk trends in the data set have yet to be defined

   Source: Adapted from community discussion — A_Salem

   Next question

8. Question 808 · 1459 in bank

   Critical processes are not defined in an organization's business continuity plan (BCP). Which of the following would have MOST likely identified the gap?

   • AUpdating the risk register
   • BReviewing the business continuity strategy
   • CReviewing the business impact analysis (BIA)
   • DTesting the incident response plan

   Show answer

   Answer: C

   Next question

9. Question 809 · 1459 in bank

   When auditing the closing stages of a system development project, which of the following should be the MOST important consideration?

   • ARollback procedures
   • BControl requirements
   • CUser acceptance test (UAT) results
   • DFunctional requirements documentation

   Show answer

   Answer: A

   Explanation

   Rollback procedures - Not all new system deployments go as planned. To mitigate the risk of downtime for mission-critical systems, good practices dictate that the tools and applications required to reverse the migration are available prior to attempting the production cutover. Some or all of these tools and applications may need to be developed as part of the project.

   Source: Adapted from community discussion — kGiGa

   Next question

10. Question 810 · 1459 in bank

    Following a breach, what is the BEST source to determine the maximum amount of time before customers must be notified that their personal information may have been compromised?

    • AIndustry standards
    • BInformation security policy
    • CIncident response plan
    • DIndustry regulations

    Show answer

    Answer: D

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISA practice, question 801. 1459 questions available.