CISA practice questions 981–990

1. Question 981 · 1459 in bank

   Which of the following would an IS auditor recommend as the MOST effective preventive control to reduce the risk of data leakage?

   • AValidate that all data files contain digital watermarks.
   • BImplement an intrusion detection system (IDS).
   • CEnsure that paper documents are disposed securely.
   • DVerify that application logs capture any changes made.

   Show answer

   Answer: C

   Explanation

   An IS auditor would recommend ensuring that paper documents are disposed of securely as the most effective preventive control to reduce the risk of data leakage. Option A, validating that all data files contain digital watermarks, is a detective control that helps identify the source of data leaks after they occur, but it does not prevent them.

   Source: Adapted from community discussion — SRJ13

   Next question

2. Question 982 · 1459 in bank

   Which of the following should an IS auditor review FIRST when planning a customer data privacy audit?

   • ALegal and compliance requirements
   • BCustomer agreements
   • CData classification
   • DOrganizational policies and procedures

   Show answer

   Answer: A

   Next question

3. Question 983 · 1459 in bank

   Which of the following issues associated with a data center's closed circuit television (CCTV) surveillance cameras should be of MOST concern to an IS auditor?

   • ACCTV recordings are not regularly reviewed.
   • BCCTV records are deleted after one year.
   • CCCTV footage is not recorded 24 x 7.
   • DCCTV cameras are not installed in break rooms.

   Show answer

   Answer: A

   Explanation

   This is a typiclal ISACA thinking. : The most concerning issue with regards to CCTV surveillance cameras is that CCTV recordings are not regularly reviewed. It is essential for an IS auditor to ensure that recordings are frequently reviewed to ensure that the security of the data center is properly maintained. Additionally, the IS auditor should ensure that CCTV footage is recorded 24 x 7, and records should not be deleted until all necessary procedures are taken. Lastly, CCTV cameras should be installed in break rooms, as these are areas where confidential information may be discussed.

   Source: Adapted from community discussion — cidigi

   Next question

4. Question 984 · 1459 in bank

   An IS auditor concludes that logging and monitoring mechanisms within an organization are ineffective because central servers are not included within the central log repository. Which of the following audit procedures would have MOST likely identified this exception?

   • AComparing all servers included in the current central log repository with the listing used for the prior-year audit
   • BInspecting a sample of alerts generated from the central log repository
   • CComparing a list of all servers from the directory server against a list of all servers present in the central log repository
   • DInspecting a sample of alert settings configured in the central log repository

   Show answer

   Answer: C

   Next question

5. Question 985 · 1459 in bank

   Which of the following attack techniques will succeed because of an inherent security weakness in an Internet firewall?

   • AFlooding the site with an excessive number of packets
   • BIntercepting packets and viewing passwords
   • CPhishing
   • DUsing a dictionary attack of encrypted passwords

   Show answer

   Answer: A

   Explanation

   The option B describes a different type of attack known as packet sniffing or eavesdropping. While packet sniffing can pose a security risk, it typically bypasses the firewall altogether and relies on vulnerabilities in network protocols or encryption mechanisms rather than exploiting weaknesses in the firewall itself. Therefore, option A is the attack technique that will succeed because of an inherent security weakness in an Internet firewall.

   Source: Adapted from community discussion — Swallows

   Next question

6. Question 986 · 1459 in bank

   Which of the following is the BEST indication of the completeness of interface control documents used for the development of a new application?

   • AFailed interface data transfers prevent subsequent processes.
   • BAll documents have been reviewed by end users.
   • CBoth successful and failed interface data transfers are recorded.
   • DAll inputs and outputs for potential actions are included.

   Show answer

   Answer: D

   Explanation

   Having all inputs and outputs for potential actions included in the interface control documents is considered the best indication of their completeness because it means that all necessary information required for the interfaces has been documented and accounted for. This reduces the likelihood of missing information or unexpected errors during the development and implementation of the new application. In other words, having a comprehensive and complete list of inputs and outputs helps ensure that the interface design is complete and accurately reflects the requirements and objectives of the application.

   Source: Adapted from community discussion — zebree

   Next question

7. Question 987 · 1459 in bank

   Which of the following would BEST demonstrate that an effective disaster recovery plan (DRP) is in place?

   • AFull operational test
   • BPeriodic risk assessment
   • CAnnual walk-through testing
   • DFrequent testing of backups

   Show answer

   Answer: A

   Next question

8. Question 988 · 1459 in bank

   Which of the following provides the MOST reliable audit evidence on the validity of transactions in a financial application?

   • ASubstantive testing
   • BWalk-through reviews
   • CDesign documentation reviews
   • DCompliance testing

   Show answer

   Answer: A

   Next question

9. Question 989 · 1459 in bank

   Which of the following establishes the role of the internal audit function?

   • AAudit project plan
   • BAudit objectives
   • CAudit charter
   • DAudit governance

   Show answer

   Answer: C

   Next question

10. Question 990 · 1459 in bank

    Which of the following is MOST important for an IS auditor to review when evaluating the accuracy of a spreadsheet that contains several macros?

    • AVersion history
    • BFormulas within macros
    • CReconciliation of key calculations
    • DEncryption of the spreadsheet

    Show answer

    Answer: B

    Explanation

    B. Formulas within macros. The Question is about Accuracy and not completeness. Reconciliation would be done to verify the completeness rather than accuracy.

    Source: Adapted from community discussion — BA27

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISA practice, question 981. 1459 questions available.