CISA practice questions 961–970

1. Question 961 · 1459 in bank

   Which audit approach is MOST helpful in optimizing the use of IS audit resources?

   • AAgile auditing
   • BContinuous auditing
   • CRisk-based auditing
   • DOutsourced auditing

   Show answer

   Answer: C

   Next question

2. Question 962 · 1459 in bank

   Which of the following is the MOST effective approach in assessing the quality of modifications made to financial software?

   • AAn independent auditor will be engaged to undertake a pre-implementation review.
   • BThe quality of the implemented product will be assessed during acceptance testing.
   • CThe quality plan will be assessed during the design phase of development.
   • DIndependent quality assurance (QA) activities will be undertaken at various phases of the project.

   Show answer

   Answer: B

   Next question

3. Question 963 · 1459 in bank

   Which of the following should be an IS auditor's GREATEST concern when reviewing a business continuity plan (BCP)?

   • ASome critical business processes are not included in the BCP.
   • BBusiness unit personnel are not aware of the BCP.
   • CThere is no evidence that the BCP has been tested.
   • DAn offsite storage location is not documented in the BCP.

   Show answer

   Answer: A

   Explanation

   While the absence of evidence that the BCP has been tested (option C) is also a significant concern, ensuring that critical business processes are adequately addressed within the plan is typically the GREATEST concern for an IS auditor. Therefore, it should be the primary focus when reviewing a business continuity plan.

   Source: Adapted from community discussion — Swallows

   Next question

4. Question 964 · 1459 in bank

   Which of the following findings would be of GREATEST concern when auditing an organization's end-user computing (EUC)?

   • AReduced oversight by the IT department
   • BInability to monitor EUC audit logs and activities
   • CErrors flowed through to financial statements
   • DInconsistency of patching processes being followed

   Show answer

   Answer: B

   Next question

5. Question 965 · 1459 in bank

   Which of the following is the BEST way to ensure payment transaction data is restricted to the appropriate users?

   • AImplementing role-based access at the application level
   • BRestricting access to transactions using network security software
   • CUsing a single menu for sensitive application transactions
   • DImplementing two-factor authentication

   Show answer

   Answer: A

   Next question

6. Question 966 · 1459 in bank

   Which of the following provides the MOST comprehensive description of IT's role in an organization?

   • AIT job descriptions
   • BIT project portfolio
   • CIT organizational chart
   • DIT charter

   Show answer

   Answer: D

   Next question

7. Question 967 · 1459 in bank

   Which of the following is the BEST way for an IS auditor to validate that employees have been made aware of the organization's information security policy?

   • AInterview employees to determine their level of understanding of the policy.
   • BCompare the employee roster against a list of those who attended security training.
   • CReview HR records for employee violations of the information security policy.
   • DReview the training process to determine how policies are explained to employees.

   Show answer

   Answer: A

   Explanation

   i think B is correct. To "validate" that employees have been made aware, the most objective and straightforward way would be B. A relies on individual employees' ability to recall and explain the policy. therefore it may not accurately reflect whether they were made aware of the policy, especially if some time has passed since they had been told about it.

   Source: Adapted from community discussion — starzuu

   Next question

8. Question 968 · 1459 in bank

   Which of the following components of a risk assessment is MOST helpful to management in determining the level of risk mitigation to apply?

   • AImpact assessment
   • BControl self-assessment (CSA)
   • CRisk classification
   • DRisk identification

   Show answer

   Answer: A

   Explanation

   Answer: A option A focuses specifically on evaluating the potential consequences or impact of identified risks. This assessment helps management understand the severity of each risk scenario, enabling them to prioritize mitigation efforts and allocate resources accordingly option C alone does not provide management with specific information on how to mitigate risks.

   Source: Adapted from community discussion — a84n

   Next question

9. Question 969 · 1459 in bank

   Which of the following is the MOST effective control to ensure electronic records beyond their retention periods are deleted from IT systems?

   • AExecute all data deletions at a predefined month during the year.
   • BBuild in system logic to trigger data deletion at predefined times.
   • CReview the record retention register regularly to initiate data deletion.
   • DPerform a sample check of current data against the retention schedule.

   Show answer

   Answer: B

   Next question

10. Question 970 · 1459 in bank

    Which of the following is the BEST way to mitigate risk to an organization's network associated with devices permitted under a bring your own device (BYOD) policy?

    • AImplement a network access control system.
    • BRequire personal devices to be reviewed by IT staff.
    • CEnable port security on all network switches.
    • DEnsure the policy requires antivirus software on devices.

    Show answer

    Answer: A

    Explanation

    Network acess controls enable access to devices selectively based on certian criterias like authentication, Security Posture (only devices with uodated OS) , Antivirus etc, are given access..

    Source: Adapted from community discussion — Deeplaxmi

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISA practice, question 961. 1459 questions available.