CISA practice questions 971–980

1. Question 971 · 1459 in bank

   Which of the following system conversion strategies provides the GREATEST redundancy?

   • ADirect cutover
   • BParallel run
   • CPhased approach
   • DPilot study

   Show answer

   Answer: B

   Next question

2. Question 972 · 1459 in bank

   Which of the following would provide the MOST important input during the planning phase for an audit on the implementation of a bring your own device (BYOD) program?

   • AResults of a risk assessment
   • BPolicies including BYOD acceptable use statements
   • CFindings from prior audits
   • DAn inventory of personal devices to be connected to the corporate network

   Show answer

   Answer: A

   Explanation

   A. Results of a risk assessment During the planning phase for an audit on the implementation of a bring your own device (BYOD) program, the most important input would be the results of a risk assessment. This assessment would help identify potential security risks and vulnerabilities associated with allowing personal devices onto the corporate network. Understanding the level of risk involved guides the audit's focus and helps in prioritizing the areas that need to be examined thoroughly.

   Source: Adapted from community discussion — lsiau76

   Next question

3. Question 973 · 1459 in bank

   Which of the following is the PRIMARY reason that asset classification is vital to an information security program?

   • ATo ensure risk mitigation efforts are adequate
   • BTo ensure asset protection efforts are in line with industry standards
   • CTo ensure sufficient resources are allocated for information security
   • DTo ensure the appropriate level of protection to assets

   Show answer

   Answer: D

   Next question

4. Question 974 · 1459 in bank

   When evaluating the design of controls related to network monitoring, which of the following is MOST important for an IS auditor to review?

   • ANetwork topology diagrams
   • BReports of network traffic analysis
   • CThe ISP service level agreement
   • DIncident monitoring logs

   Show answer

   Answer: A

   Explanation

   A. Network Topology Diagrams The first step in assessing network monitoring controls should be the review of the adequacy of network documentation, specifically topology diagrams. If this information is not up to date, then monitoring processes and the ability to diagnose problems will not be effective.

   Source: Adapted from community discussion — SuperMax

   Next question

5. Question 975 · 1459 in bank

   Which of the following is MOST important for an organization to complete prior to developing its disaster recovery plan (DRP)?

   • ABusiness impact analysis (BIA)
   • BComprehensive IT inventory
   • CSupport staff skills gap analysis
   • DRisk assessment

   Show answer

   Answer: A

   Next question

6. Question 976 · 1459 in bank

   Which of the following would be MOST time and cost efficient when performing a control self-assessment (CSA) for an organization with a large number of widely dispersed employees?

   • ASurvey questionnaire
   • BFacilitated workshops
   • CFace-to-face interviews
   • DTop-down and bottom-up analysis

   Show answer

   Answer: A

   Next question

7. Question 977 · 1459 in bank

   Which of the following is the BEST way to ensure that business continuity plans (BCPs) will work effectively in the event of a major disaster?

   • ARegularly update business impact assessments.
   • BPrepare detailed plans for each business function.
   • CMake senior managers responsible for their plan sections.
   • DInvolve staff at all levels in periodic paper walk-through exercises.

   Show answer

   Answer: D

   Next question

8. Question 978 · 1459 in bank

   Which of the following should be of MOST concern to an IS auditor reviewing the public key infrastructure (PKI) for enterprise email?

   • AThe private key certificate has not been updated.
   • BThe certificate revocation list has not been updated.
   • CThe certificate practice statement has not been published.
   • DThe PKI policy has not been updated within the last year.

   Show answer

   Answer: B

   Next question

9. Question 979 · 1459 in bank

   Which of the following will MOST likely compromise the control provided by a digital signature created using RSA encryption?

   • AAltering the plaintext message
   • BDeciphering the receiver's public key
   • CObtaining the sender's private key
   • DReversing the hash function using the digest

   Show answer

   Answer: C

   Next question

10. Question 980 · 1459 in bank

    Which of the following should be of GREATEST concern to an IS auditor conducting an audit of an organization that recently experienced a ransomware attack?

    • AAntivirus software was unable to prevent the attack even though it was properly updated.
    • BBackups were only performed within the local network.
    • CThe most recent security patches were not tested prior to implementation.
    • DEmployees were not trained on cybersecurity policies and procedures.

    Show answer

    Answer: B

    Explanation

    Answer: B In a ransomware attack, having recent and secure backups is crucial for recovery without paying the ransom. If backups are only stored locally and were compromised during the attack, the organization may have no recourse for recovering its data and systems without resorting to ransom payment. This makes the lack of proper backup strategy a more immediate and critical concern for the IS auditor to address during the audit.

    Source: Adapted from community discussion — a84n

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISA practice, question 971. 1459 questions available.