CISA practice questions 81–90

1. Question 81 · 1459 in bank

   Which of the following is the PRIMARY risk when business units procure IT assets without IT involvement?

   • AData security requirements are not considered.
   • BAdditional training is required for end users.
   • CThe system is not supported by the IT department.
   • DCorporate procurement standards are not followed.

   Show answer

   Answer: A

   Explanation

   A. Data security requirements are not considered. The primary risk when business units procure IT assets without IT involvement is that data security requirements may not be adequately considered. This can lead to vulnerabilities and potential breaches, which can have serious consequences for the organization. While the other options (B, C, and D) are also potential risks associated with independent procurement of IT assets, data security is typically the most critical concern.

   Source: Adapted from community discussion — SuperMax

   Next question

2. Question 82 · 1459 in bank

   A database administrator (DBA) should be prevented from:

   • Aaccessing sensitive information.
   • Bhaving end user responsibilities.
   • Chaving access to production files.
   • Dusing an emergency user ID.

   Show answer

   Answer: A

   Explanation

   A. accessing sensitive information. Database administrators (DBAs) are responsible for managing and maintaining databases, ensuring their integrity, security, and performance. Preventing a DBA from accessing sensitive information is crucial to maintaining data security and privacy. DBAs should have access to the necessary tools and resources to perform their job functions, but measures should be in place to restrict their access to sensitive data that is not essential for their administrative tasks. Options B, C, and D are not necessarily things a DBA should be prevented from, and in some cases, they may be required to perform their duties effectively

   Source: Adapted from community discussion — SuperMax

   Next question

3. Question 83 · 1459 in bank

   Which of the following provides the MOST protection against emerging threats?

   • AReal-time updating of antivirus software
   • BSignature-based intrusion detection system (IDS)
   • CDemilitarized zone (DMZ)
   • DHeuristic intrusion detection system (IDS)

   Show answer

   Answer: D

   Explanation

   Heuristic-based IDS uses advanced algorithms and analytics to predict an attacker’s next move based on their behavior patterns. It can adapt and learn from observed traffic, protecting against novel and evolving threats.

   Source: Adapted from community discussion — 3008

   Next question

4. Question 84 · 1459 in bank

   Which of the following is MOST important to ensure when removing a financial application from production?

   • AThe data retention period is still observed.
   • BEnd user requests for changes are canceled.
   • CEnd user training is updated.
   • DSoftware license agreements are retained.

   Show answer

   Answer: A

   Explanation

   The most important consideration when removing a financial application from production is to ensure that the data retention period is still observed. Financial applications often handle sensitive and regulated data, and compliance with data retention policies and legal requirements is crucial. Failure to adhere to data retention periods could lead to legal and regulatory issues.

   Source: Adapted from community discussion — FAGFUR

   Next question

5. Question 85 · 1459 in bank

   Which of the following should be of concern to an IS auditor reviewing an organization's network to ensure attack vectors from the Internet are minimized?

   • AThe organization employs different types of firewalls in the demilitarized zone (DMZ).
   • BThe organization's email server is in the demilitarized zone (DMZ).
   • CA data loss prevention (DLP) system is behind the organization's firewalls.
   • DA router is Internet-facing at the network perimeter.

   Show answer

   Answer: D

   Explanation

   An IS auditor reviewing an organization's network to ensure attack vectors from the Internet are minimized should be concerned about **option D**. A router that is Internet-facing at the network perimeter can be a potential entry point for attackers to gain unauthorized access to the organization's network

   Source: Adapted from community discussion — 3008

   Next question

6. Question 86 · 1459 in bank

   Which of the following controls associated with software development would be classified as a preventive control to address scope creep?

   • AIteration retrospective
   • BSystem demo
   • CIteration review
   • DBacklog grooming

   Show answer

   Answer: D

   Explanation

   Backlog grooming is a preventive control associated with software development to address scope creep. Backlog grooming involves regularly reviewing and refining the product backlog to ensure that it contains well-defined, prioritized, and achievable user stories or tasks. By proactively managing and refining the backlog, the development team can prevent scope creep by clarifying requirements, removing ambiguities, and ensuring that the work aligns with the project's goals.

   Source: Adapted from community discussion — FAGFUR

   Next question

7. Question 87 · 1459 in bank

   A web application is developed in-house by an organization. Which of the following would provide the BEST evidence to an IS auditor that the application is secure from external attack?

   • ADatabase application monitoring logs
   • BCode review by a third party
   • CPenetration test results
   • DWeb application firewall implementation

   Show answer

   Answer: C

   Explanation

   The best evidence to an IS auditor that a web application is secure from external attack is penetration test results. Penetration testing involves simulating real-world attacks on the application to identify vulnerabilities and weaknesses. The results of a penetration test provide concrete evidence of the security posture of the web application and highlight areas that may need improvement.

   Source: Adapted from community discussion — FAGFUR

   Next question

8. Question 88 · 1459 in bank

   Which of the following is an IS auditor's GREATEST concern when an organization does not regularly update software on individual workstations in the internal environment?

   • AThe organization may not be in compliance with licensing agreements.
   • BSystem functionality may not meet business requirements.
   • CThe system may have version control issues.
   • DThe organization may be more susceptible to cyber-attacks.

   Show answer

   Answer: D

   Next question

9. Question 89 · 1459 in bank

   Which of the following provides the BEST audit evidence that a firewall is configured in compliance with the organization's security policy?

   • AAnalyzing how the configuration changes are performed
   • BPerforming penetration testing
   • CReviewing the rule base
   • DAnalyzing log files

   Show answer

   Answer: C

   Explanation

   The best audit evidence that a firewall is configured in compliance with the organization's security policy is reviewing the rule base. The rule base of a firewall contains the set of rules that dictate how traffic is allowed or denied through the firewall. By reviewing the rule base, an auditor can assess whether the configuration aligns with the organization's security policy, ensuring that only authorized traffic is permitted and unauthorized traffic is blocked.

   Source: Adapted from community discussion — FAGFUR

   Next question

10. Question 90 · 1459 in bank

    During a follow-up audit, an IS auditor finds that senior management has implemented a different remediation action plan than what was previously agreed upon. Which of the following is the auditor's BEST course of action?

    • AReport the deviation by the control owner in the audit report.
    • BCancel the follow-up audit and reschedule for the next audit period.
    • CEvaluate the implemented control to ensure it mitigates the risk to an acceptable level.
    • DRequest justification from management for not implementing the recommended control.

    Show answer

    Answer: C

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISA practice, question 81. 1459 questions available.