CISA practice questions 831–840

1. Question 831 · 1459 in bank

   Which of the following security testing techniques is MOST effective in discovering unknown malicious attacks?

   • APenetration testing
   • BSandboxing
   • CVulnerability testing
   • DReverse engineering

   Show answer

   Answer: A

   Explanation

   Penetration testing, also known as ethical hacking, involves simulating real-world cyberattacks to identify vulnerabilities and weaknesses in an organization's systems, networks, or applications. Penetration testers use various methods and tools to attempt to exploit vulnerabilities in the same way that malicious attackers would. While sandboxing (Option B) can be useful for isolating potentially malicious code or programs in a controlled environment to prevent harm to the system, it is not specifically designed to discover unknown malicious attacks. Sandbox environments are typically used to analyze and evaluate https://www.examtopics.com/exams/isaca/cisa/view/2/#the behavior of suspicious or unknown software in a safe manner.

   Source: Adapted from community discussion — Swallows

   Next question

2. Question 832 · 1459 in bank

   Which of the following should be the PRIMARY objective of conducting an audit follow-up of management action plans?

   • ATo verify that risks listed in the audit report have been properly mitigated
   • BTo ensure senior management is aware of the audit findings
   • CTo identify new risks and controls for the organization
   • DTo align the management action plans with business requirements

   Show answer

   Answer: A

   Next question

3. Question 833 · 1459 in bank

   Which of the following is the BEST use of a balanced scorecard when evaluating IT performance?

   • ADetermining compliance with relevant regulatory requirements
   • BMonitoring alignment of IT with the rest of the organization
   • CEvaluating implementation of the business strategy
   • DMonitoring alignment of the IT project portfolio to budget

   Show answer

   Answer: B

   Next question

4. Question 834 · 1459 in bank

   Which of the following is the MOST appropriate role for an IS auditor assigned as a team member for a software development project?

   • AImplementing controls within the software
   • BDeveloping user acceptance testing (UAT) scripts
   • CPerforming a mid-term evaluation of the project management process
   • DMonitoring assessed risk for the project

   Show answer

   Answer: D

   Explanation

   An IS auditor’s primary role is to provide independent assurance that risk management, governance, and internal control processes are operating effectively. In the context of a software development project, this would typically involve monitoring the assessed risks associated with the project to ensure they are being properly managed.

   Source: Adapted from community discussion — dan08

   Next question

5. Question 835 · 1459 in bank

   Which of the following should be of GREATEST concern for an IS auditor reviewing an organization's bring your own device (BYOD) policy?

   • ANot all devices are approved for BYOD.
   • BThe policy does not include the right to audit BYOD devices.
   • CA mobile device management (MDM) solution is not implemented.
   • DThe policy is not updated annually.

   Show answer

   Answer: B

   Explanation

   When reviewing an organization's bring your own device (BYOD) policy, the greatest concern for an IS auditor should be if the policy does not include the right to audit BYOD devices. This is crucial because it is essential for the organization to maintain visibility and control over the devices to ensure compliance with security policies, protect sensitive data, and maintain a secure environment.

   Source: Adapted from community discussion — SBD600

   Next question

6. Question 836 · 1459 in bank

   Which of the following statements appearing in an organization's acceptable use policy BEST demonstrates alignment with data classification standards related to the protection of information assets?

   • AInformation assets should only be accessed by persons with a justified need.
   • BAll information assets must be encrypted when stored on the organization's systems.
   • CAny information assets transmitted over a public network must be approved by executive management.
   • DAll information assets will be assigned a clearly defined level to facilitate proper employee handling.

   Show answer

   Answer: D

   Next question

7. Question 837 · 1459 in bank

   Which of the following information security requirements BEST enables the tracking of organizational data in a bring your own device (BYOD) environment?

   • AEmployees must immediately report lost or stolen mobile devices containing organizational data.
   • BEmployees must use auto-lock features and complex passwords on personal devices.
   • CEmployees must sign acknowledgment of the organization's mobile device acceptable use policy.
   • DEmployees must enroll their personal devices in the organization's mobile device management program.

   Show answer

   Answer: A

   Next question

8. Question 838 · 1459 in bank

   Which of the following is MOST important for an IS auditor to verify when evaluating an organization's firewall?

   • ALogs are being collected in a separate protected host.
   • BAccess to configuration files is restricted.
   • CAutomated alerts are being sent when a risk is detected.
   • DInsider attacks are being controlled

   Show answer

   Answer: B

   Explanation

   Access to configuration files being restricted is critical for maintaining the security and integrity of the firewall configuration. Unauthorized access to firewall configuration files could lead to misconfigurations, vulnerabilities, or intentional changes by malicious actors, compromising the effectiveness of the firewall and potentially exposing the organization's network to security risks.

   Source: Adapted from community discussion — Swallows

   Next question

9. Question 839 · 1459 in bank

   An organization recently implemented a cloud document storage solution and removed the ability for end users to save data to their local workstation hard drives. Which of the following findings should be the IS auditor's GREATEST concern?

   • AMobile devices are not encrypted.
   • BUsers are not required to sign updated acceptable use agreements.
   • CThe business continuity plan (BCP) was not updated.
   • DUsers have not been trained on the new system.

   Show answer

   Answer: A

   Explanation

   While all the findings mentioned are important considerations for the organization's security and compliance posture, the lack of encryption on mobile devices poses the most significant risk. With the implementation of a cloud document storage solution and the removal of the ability for users to save data locally, there's a heightened reliance on mobile devices for accessing and storing data. If these devices are not encrypted, sensitive information stored on them could be at risk of unauthorized access or exposure in the event of loss or theft

   Source: Adapted from community discussion — Vima234

   Next question

10. Question 840 · 1459 in bank

    Which of the following would be of GREATEST concern to an IS auditor reviewing backup and recovery controls?

    • ABackup procedures are not documented.
    • BWeekly and monthly backups are stored onsite.
    • CBackups are stored in an external hard drive.
    • DRestores from backups are not periodically tested.

    Show answer

    Answer: D

    Explanation

    Periodic testing of restores from backups is crucial for verifying the effectiveness and reliability of the backup and recovery processes. Without regular testing, there is a risk that backups may not be functioning correctly, or that data may not be recoverable in the event of a disaster or data loss incident. Testing restores allows organizations to identify any issues or gaps in the backup and recovery procedures, ensuring that critical data can be restored promptly and accurately when needed.

    Source: Adapted from community discussion — Swallows

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISA practice, question 831. 1459 questions available.