Certified Information Systems Auditor CISA Exam Dumps

dumps2023-08-16T10:23:57+08:00

Certified Information System Auditor CISA exam is easy to pass. There are 150 multiple choice questions in real ISACA CISA exam, and you have 4 hours to finish the test. The available languages of CISA exam are English, Japanese, French, and so on. Free ISACA Certification CISA exam dumps are available below.

Page 1 of 21

1. An IS auditor is examining a front-end subledger and a main ledger.

Which of the following would be the GREATEST concern if there are flaws in the mapping of accounts between the two systems?

Double-posting of a single journal entry

Inability to support new business transactions

Unauthorized alteration of account attributes

Inaccuracy of financial reporting

2. What is MOST important to verify during an external assessment of network vulnerability?

Update of security information event management (SIEM) rules

Regular review of the network security policy

Completeness of network asset inventory

Location of intrusion detection systems (IDS)

3. Which of the following is the PRIMARY advantage of parallel processing for a new system implementation?

Assurance that the new system meets functional requirements

More time for users to complete training for the new system

Significant cost savings over other system implemental or approaches

Assurance that the new system meets performance requirements

4. A system development project is experiencing delays due to ongoing staff shortages.

Which of the following strategies would provide the GREATEST assurance of system quality at implementation?

Implement overtime pay and bonuses for all development staff.

Utilize new system development tools to improve productivity.

Recruit IS staff to expedite system development.

Deliver only the core functionality on the initial target date.

5. Which of the following is MOST important to ensure when developing an effective security awareness program?

Training personnel are information security professionals.

Phishing exercises are conducted post-training.

Security threat scenarios are included in the program content.

Outcome metrics for the program are established.

6. An online retailer is receiving customer complaints about receiving different items from what they ordered on the organization's website. The root cause has been traced to poor data quality. Despite efforts to clean erroneous data from the system, multiple data quality issues continue to occur.

Which of the following recommendations would be the BEST way to reduce the likelihood of future occurrences?

Assign responsibility for improving data quality.

Invest in additional employee training for data entry.

Outsource data cleansing activities to reliable third parties.

Implement business rules to validate employee data entry.

7. Which of the following is the BEST recommendation to prevent fraudulent electronic funds transfers by accounts payable employees?

Periodic vendor reviews

Dual control

Independent reconciliation

Re-keying of monetary amounts

Engage an external security incident response expert for incident handling.

8. Which of the following demonstrates the use of data analytics for a loan origination process?

Evaluating whether loan records are included in the batch file and are validated by the servicing system

Comparing a population of loans input in the origination system to loans booked on the servicing system

Validating whether reconciliations between the two systems are performed and discrepancies are investigated

Reviewing error handling controls to notify appropriate personnel in the event of a transmission failure

9. During the discussion of a draft audit report. IT management provided suitable evidence fiat a process has been implemented for a control that had been concluded by the IS auditor as Ineffective.

Which of the following is the auditor's BEST action?

Explain to IT management that the new control will be evaluated during follow-up

Re-perform the audit before changing the conclusion.

Change the conclusion based on evidence provided by IT management.

Add comments about the action taken by IT management in the report.

10. Which of the following is the BEST compensating control when segregation of duties is lacking in a small IS department?

Background checks

User awareness training

Transaction log review

Mandatory holidays

Page 2 of 21

11. Which of the following is the MOST effective way for an organization to project against data loss?

Limit employee internet access.

Implement data classification procedures.

Review firewall logs for anomalies.

Conduct periodic security awareness training.

12. While executing follow-up activities, an IS auditor is concerned that management has implemented corrective actions that are different from those originally discussed and agreed with the audit function. In order to resolve the situation, the IS auditor's BEST course of action would be to:

re-prioritize the original issue as high risk and escalate to senior management.

schedule a follow-up audit in the next audit cycle.

postpone follow-up activities and escalate the alternative controls to senior audit management.

determine whether the alternative controls sufficiently mitigate the risk.

13. An IS auditor has found that an organization is unable to add new servers on demand in a cost-efficient manner.

Which of the following is the auditor's BEST recommendation?

Increase the capacity of existing systems.

Upgrade hardware to newer technology.

Hire temporary contract workers for the IT function.

Build a virtual environment.

14. An IS auditor notes that several employees are spending an excessive amount of time using social media sites for personal reasons.

Which of the following should the auditor recommend be performed FIRST?

Implement a process to actively monitor postings on social networking sites.

Adjust budget for network usage to include social media usage.

Use data loss prevention (DLP) tools on endpoints.

implement policies addressing acceptable usage of social media during working hours.

15. The PRIMARY advantage of object-oriented technology is enhanced:

efficiency due to the re-use of elements of logic.

management of sequential program execution for data access.

grouping of objects into methods for data access.

management of a restricted variety of data types for a data object.

16. An IS auditor is following up on prior period items and finds management did not address an audit finding.

Which of the following should be the IS auditor's NEXT course of action?

Note the exception in a new report as the item was not addressed by management.

Recommend alternative solutions to address the repeat finding.

Conduct a risk assessment of the repeat finding.

Interview management to determine why the finding was not addressed.

17. From an IS auditor's perspective, which of the following would be the GREATEST risk associated with an incomplete inventory of deployed software in an organization?

Inability to close unused ports on critical servers

Inability to identify unused licenses within the organization

Inability to deploy updated security patches

Inability to determine the cost of deployed software

18. An IS auditor discovers an option in a database that allows the administrator to directly modify any table. This option is necessary to overcome bugs in the software, but is rarely used. Changes to tables are automatically logged.

The IS auditor's FIRST action should be to:

recommend that the option to directly modify the database be removed immediately.

recommend that the system require two persons to be involved in modifying the database.

determine whether the log of changes to the tables is backed up.

determine whether the audit trail is secured and reviewed.

19. During the implementation of an upgraded enterprise resource planning (ERP) system, which of the following is the MOST important consideration for a go-live decision?

Rollback strategy

Test cases

Post-implementation review objectives

Business case

20. What should be the PRIMARY basis for selecting which IS audits to perform in the coming year?

Senior management's request

Prior year's audit findings

Organizational risk assessment

Previous audit coverage and scope

Page 3 of 21

21. Coding standards provide which of the following?

Program documentation

Access control tables

Data flow diagrams

Field naming conventions

22. Which of the following components of a risk assessment is MOST helpful to management in determining the level of risk mitigation to apply?

Risk identification

Risk classification

Control self-assessment (CSA)

Impact assessment

23. An organization's enterprise architecture (EA) department decides to change a legacy system's components while maintaining its original functionality.

Which of the following is MOST important for an IS auditor to understand when reviewing this decision?

The current business capabilities delivered by the legacy system

The proposed network topology to be used by the redesigned system

The data flows between the components to be used by the redesigned system

The database entity relationships within the legacy system

24. During an ongoing audit, management requests a briefing on the findings to date.

Which of the following is the IS auditor's BEST course of action?

Review working papers with the auditee.

Request the auditee provide management responses.

Request management wait until a final report is ready for discussion.

Present observations for discussion only.

25. A data breach has occurred due lo malware.

Which of the following should be the FIRST course of action?

Notify the cyber insurance company.

Shut down the affected systems.

Quarantine the impacted systems.

Notify customers of the breach.

26. An IS auditor will be testing accounts payable controls by performing data analytics on the entire population of transactions.

Which of the following is MOST important for the auditor to confirm when sourcing the population data?

The data is taken directly from the system.

There is no privacy information in the data.

The data can be obtained in a timely manner.

The data analysis tools have been recently updated.

27. Which of the following access rights presents the GREATEST risk when granted to a new member of the system development staff?

Write access to production program libraries

Write access to development data libraries

Execute access to production program libraries

Execute access to development program libraries

28. Which of the following should be the PRIMARY basis for prioritizing follow-up audits?

Audit cycle defined in the audit plan

Complexity of management's action plans

Recommendation from executive management

Residual risk from the findings of previous audits

29. Which of the following is the MOST important benefit of involving IS audit when implementing governance of enterprise IT?

Identifying relevant roles for an enterprise IT governance framework

Making decisions regarding risk response and monitoring of residual risk

Verifying that legal, regulatory, and contractual requirements are being met

Providing independent and objective feedback to facilitate improvement of IT processes

30. Which of the following strategies BEST optimizes data storage without compromising data retention practices?

Limiting the size of file attachments being sent via email

Automatically deleting emails older than one year

Moving emails to a virtual email vault after 30 days

Allowing employees to store large emails on flash drives

Page 4 of 21

31. During the design phase of a software development project, the PRIMARY responsibility of an IS auditor is to evaluate the:

Future compatibility of the application.

Proposed functionality of the application.

Controls incorporated into the system specifications.

Development methodology employed.

32. Which of the following documents would be MOST useful in detecting a weakness in segregation of duties?

System flowchart

Data flow diagram

Process flowchart

Entity-relationship diagram

33. Which of the following is the BEST justification for deferring remediation testing until the next audit?

The auditor who conducted the audit and agreed with the timeline has left the organization.

Management's planned actions are sufficient given the relative importance of the observations.

Auditee management has accepted all observations reported by the auditor.

The audit environment has changed significantly.

34. An IS auditor is conducting a post-implementation review of an enterprise resource planning (ERP) system. End users indicated concerns with the accuracy of critical automatic calculations made by the system.

The auditor's FIRST course of action should be to:

review recent changes to the system.

verify completeness of user acceptance testing (UAT).

verify results to determine validity of user concerns.

review initial business requirements.

35. A system administrator recently informed the IS auditor about the occurrence of several unsuccessful intrusion attempts from outside the organization.

Which of the following is MOST effective in detecting such an intrusion?

Periodically reviewing log files

Configuring the router as a firewall

Using smart cards with one-time passwords

Installing biometrics-based authentication

36. An IS auditor finds the log management system is overwhelmed with false positive alerts.

The auditor's BEST recommendation would be to:

establish criteria for reviewing alerts.

recruit more monitoring personnel.

reduce the firewall rules.

fine tune the intrusion detection system (IDS).

37. Which of the following MOST effectively minimizes downtime during system conversions?

Phased approach

Direct cutover

Pilot study

Parallel run

38. Management is concerned about sensitive information being intentionally or unintentionally emailed as attachments outside the organization by employees.

What is the MOST important task before implementing any associated email controls?

Require all employees to sign nondisclosure agreements (NDAs).

Develop an acceptable use policy for end-user computing (EUC).

Develop an information classification scheme.

Provide notification to employees about possible email monitoring.

39. Which of the following is MOST important for an effective control self-assessment (CSA) program?

Determining the scope of the assessment

Performing detailed test procedures

Evaluating changes to the risk environment

Understanding the business process

40. When determining whether a project in the design phase will meet organizational objectives, what is BEST to compare against the business case?

Implementation plan

Project budget provisions

Requirements analysis

Project plan

Page 5 of 21

41. Which of the following is MOST important for an IS auditor to examine when reviewing an organization's privacy policy?

Whether there is explicit permission from regulators to collect personal data

The organization's legitimate purpose for collecting personal data

Whether sharing of personal information with third-party service providers is prohibited

The encryption mechanism selected by the organization for protecting personal data

42. When reviewing an organization's information security policies, an IS auditor should verify that the policies have been defined PRIMARILY on the basis of:

a risk management process.

an information security framework.

past information security incidents.

industry best practices.

43. Which of the following BEST ensures the quality and integrity of test procedures used in audit analytics?

Developing and communicating test procedure best practices to audit teams

Developing and implementing an audit data repository

Decentralizing procedures and Implementing periodic peer review

Centralizing procedures and implementing change control

44. Which of the following is the MOST important prerequisite for the protection of physical information assets in a data center?

Segregation of duties between staff ordering and staff receiving information assets

Complete and accurate list of information assets that have been deployed

Availability and testing of onsite backup generators

Knowledge of the IT staff regarding data protection requirements

45. Which of the following is the BEST source of information for assessing the effectiveness of IT process monitoring?

Real-time audit software

Performance data

Quality assurance (QA) reviews

Participative management techniques

46. The implementation of an IT governance framework requires that the board of directors of an organization:

Address technical IT issues.

Be informed of all IT initiatives.

Have an IT strategy committee.

Approve the IT strategy.

47. Which of the following is the BEST method to safeguard data on an organization's laptop computers?

Disabled USB ports

Full disk encryption

Biometric access control

Two-factor authentication

48. A new regulation requires organizations to report significant security incidents to the regulator within 24 hours of identification.

Which of the following is the IS auditor's BEST recommendation to facilitate compliance with the regulation?

Include the requirement in the incident management response plan.

Establish key performance indicators (KPIs) for timely identification of security incidents.

Enhance the alert functionality of the intrusion detection system (IDS).

Engage an external security incident response expert for incident handling.

49. During a follow-up audit, an IS auditor learns that some key management personnel have been replaced since the original audit, and current management has decided not to implement some previously accepted recommendations.

What is the auditor's BEST course of action?

Notify the chair of the audit committee.

Notify the audit manager.

Retest the control.

Close the audit finding.

50. During an audit of a reciprocal disaster recovery agreement between two companies, the

IS auditor would be MOST concerned with the:

allocation of resources during an emergency.

frequency of system testing.

differences in IS policies and procedures.

maintenance of hardware and software compatibility.

Page 6 of 21

51. An organization allows employees to retain confidential data on personal mobile devices.

Which of the following is the BEST recommendation to mitigate the risk of data leakage from lost or stolen devices?

Require employees to attend security awareness training.

Password protect critical data files.

Configure to auto-wipe after multiple failed access attempts.

Enable device auto-lock function.

52. Which of the following is MOST important to include in forensic data collection and preservation procedures?

Assuring the physical security of devices

Preserving data integrity

Maintaining chain of custody

Determining tools to be used

53. When evaluating the design of controls related to network monitoring, which of the following is MOST important for an IS auditor to review?

Incident monitoring togs

The ISP service level agreement

Reports of network traffic analysis

Network topology diagrams

54. Which of the following is the BEST control to mitigate the malware risk associated with an instant messaging (IM) system?

Blocking attachments in IM

Blocking external IM traffic

Allowing only corporate IM solutions

Encrypting IM traffic

55. Cross-site scripting (XSS) attacks are BEST prevented through:

application firewall policy settings.

a three-tier web architecture.

secure coding practices.

use of common industry frameworks.

56. Which of the following would be to MOST concern when determine if information assets are adequately safequately safeguarded during transport and disposal?

Lack of appropriate labelling

Lack of recent awareness training.

Lack of password protection

Lack of appropriate data classification

57. What is BEST for an IS auditor to review when assessing the effectiveness of changes recently made to processes and tools related to an organization's business continuity plan (BCP)?

Full test results

Completed test plans

Updated inventory of systems

Change management processes

58. Which of the following is the MOST effective control for protecting the confidentiality and integrity of data stored unencrypted on virtual machines?

Monitor access to stored images and snapshots of virtual machines.

Restrict access to images and snapshots of virtual machines.

Limit creation of virtual machine images and snapshots.

Review logical access controls on virtual machines regularly.

59. Which of the following should be an IS auditor's PRIMARY focus when developing a risk-based IS audit program?

Portfolio management

Business plans

Business processes

IT strategic plans

60. Which of the following should be done FIRST when planning a penetration test?

Execute nondisclosure agreements (NDAs).

Determine reporting requirements for vulnerabilities.

Define the testing scope.

Obtain management consent for the testing.

Page 7 of 21

61. An IS auditor finds that firewalls are outdated and not supported by vendors.

Which of the following should be the auditor's NEXT course of action?

Report the mitigating controls.

Report the security posture of the organization.

Determine the value of the firewall.

Determine the risk of not replacing the firewall.

62. When an IS audit reveals that a firewall was unable to recognize a number of attack attempts, the auditor's BEST recommendation is to place an intrusion detection system (IDS) between the firewall and:

the Internet.

the demilitarized zone (DMZ).

the organization's web server.

the organization's network.

63. Which of the following fire suppression systems needs to be combined with an automatic switch to shut down the electricity supply in the event of activation?

Carbon dioxide

FM-200

Dry pipe

Halon

64. Which of the following should an IS auditor be MOST concerned with during a post-implementation review?

The system does not have a maintenance plan.

The system contains several minor defects.

The system deployment was delayed by three weeks.

The system was over budget by 15%.

65. Which of the following is an audit reviewer's PRIMARY role with regard to evidence?

Ensuring unauthorized individuals do not tamper with evidence after it has been captured

Ensuring evidence is sufficient to support audit conclusions

Ensuring appropriate statistical sampling methods were used

Ensuring evidence is labeled to show it was obtained from an approved source

66. Which of the following is the MOST important reason to implement version control for an end-user computing (EUC) application?

To ensure that older versions are availability for reference

To ensure that only the latest approved version of the application is used

To ensure compatibility different versions of the application

To ensure that only authorized users can access the application

67. Which of the following is the PRIMARY concern when negotiating a contract for a hot site?

Availability of the site in the event of multiple disaster declarations

Coordination with the site staff in the event of multiple disaster declarations

Reciprocal agreements with other organizations

Complete testing of the recovery plan

68. Which of the following BEST indicates the effectiveness of an organization's risk management program?

Inherent risk is eliminated.

Residual risk is minimized.

Control risk is minimized.

Overall risk is quantified.

69. An organization conducted an exercise to test the security awareness level of users by sending an email offering a cash reward 10 those who click on a link embedded in the body of the email.

Which of the following metrics BEST indicates the effectiveness of awareness training?

The number of users deleting the email without reporting because it is a phishing email

The number of users clicking on the link to learn more about the sender of the email

The number of users forwarding the email to their business unit managers

The number of users reporting receipt of the email to the information security team

70. Which of the following should be the MOST important consideration when conducting a review of IT portfolio management?

Assignment of responsibility for each project to an IT team member

Adherence to best practice and industry approved methodologies

Controls to minimize risk and maximize value for the IT portfolio

Frequency of meetings where the business discusses the IT portfolio

Page 8 of 21

71. Which of the following is the BEST way to mitigate the impact of ransomware attacks?

Invoking the disaster recovery plan (DRP)

Backing up data frequently

Paying the ransom

Requiring password changes for administrative accounts

72. Which of the following would BEST determine whether a post-implementation review (PIR) performed by the project management office (PMO) was effective?

Lessons learned were implemented.

Management approved the PIR report.

The review was performed by an external provider.

Project outcomes have been realized.

73. Which of the following is an executive management concern that could be addressed by the implementation of a security metrics dashboard?

Effectiveness of the security program

Security incidents vs. industry benchmarks

Total number of hours budgeted to security

Total number of false positives

74. Which audit approach is MOST helpful in optimizing the use of IS audit resources?

Agile auditing

Continuous auditing

Outsourced auditing

Risk-based auditing

75. Which of the following would BEST facilitate the successful implementation of an IT-related framework?

Aligning the framework to industry best practices

Establishing committees to support and oversee framework activities

Involving appropriate business representation within the framework

Documenting IT-related policies and procedures

76. An IS auditor is planning an audit of an organization's accounts payable processes.

Which of the following controls is MOST important to assess in the audit?

Segregation of duties between issuing purchase orders and making payments.

Segregation of duties between receiving invoices and setting authorization limits

Management review and approval of authorization tiers

Management review and approval of purchase orders

77. Which of the following BEST minimizes performance degradation of servers used to authenticate users of an e-commerce website?

Configure a single server as a primary authentication server and a second server as a secondary authentication server.

Configure each authentication server as belonging to a cluster of authentication servers.

Configure each authentication server and ensure that each disk of its RAID is attached to the primary controller.

Configure each authentication server and ensure that the disks of each server form part of a duplex.

78. The decision to accept an IT control risk related to data quality should be the responsibility of the:

information security team.

IS audit manager.

chief information officer (CIO).

business owner.

79. The PRIMARY benefit lo using a dry-pipe fire-suppression system rather than a wet-pipe system is that a dry-pipe system:

is more effective at suppressing flames.

allows more time to abort release of the suppressant.

has a decreased risk of leakage.

disperses dry chemical suppressants exclusively.

80. An IS auditor suspects an organization's computer may have been used to commit a crime.

Which of the following is the auditor's BEST course of action?

Examine the computer to search for evidence supporting the suspicions.

Advise management of the crime after the investigation.

Contact the incident response team to conduct an investigation.

Notify local law enforcement of the potential crime before further investigation.

Page 9 of 21

81. An organization's software developers need access to personally identifiable information (Pll) stored in a particular data format.

Which of the following is the BEST way to protect this sensitive information while allowing the developers to use it in development and test environments?

Data masking

Data tokenization

Data encryption

Data abstraction

82. An organizations audit charier PRIMARILY:

describes the auditors' authority to conduct audits.

defines the auditors' code of conduct.

formally records the annual and quarterly audit plans.

documents the audit process and reporting standards.

83. Which of the following would be a result of utilizing a top-down maturity model process?

A means of benchmarking the effectiveness of similar processes with peers

A means of comparing the effectiveness of other processes within the enterprise

Identification of older, more established processes to ensure timely review

Identification of processes with the most improvement opportunities

84. Which of the following would MOST likely impair the independence of the IS auditor when performing a post-implementation review of an application system?

The IS auditor provided consulting advice concerning application system best practices.

The IS auditor participated as a member of the application system project team, but did not have operational responsibilities.

The IS auditor designed an embedded audit module exclusively for auditing the application system.

The IS auditor implemented a specific control during the development of the application system.

85. Which of the following is the BEST detective control for a job scheduling process involving data transmission?

Metrics denoting the volume of monthly job failures are reported and reviewed by senior management.

Jobs are scheduled to be completed daily and data is transmitted using a Secure File Transfer Protocol (SFTP).

Jobs are scheduled and a log of this activity is retained for subsequent review.

Job failure alerts are automatically generated and routed to support personnel.

86. Which of the following should be an IS auditor's GREATEST consideration when scheduling follow-up activities for agreed-upon management responses to remediate audit observations?

Business interruption due to remediation

IT budgeting constraints

Availability of responsible IT personnel

Risk rating of original findings

87. Which of the following is the BEST way to address segregation of duties issues in an organization with budget constraints?

Rotate job duties periodically.

Perform an independent audit.

Hire temporary staff.

Implement compensating controls.

88. During a new system implementation, an IS auditor has been assigned to review risk management at each milestone. The auditor finds that several risks to project benefits have not been addressed.

Who should be accountable for managing these risks?

Enterprise risk manager

Project sponsor

Information security officer

Project manager

89. Which of the following is a social engineering attack method?

An unauthorized person attempts to gam access to secure premises by following an authonzed person through a secure door.

An employee is induced to reveal confidential IP addresses and passwords by answering questions over the phone.

A hacker walks around an office building using scanning tools to search for a wireless network to gain access.

An intruder eavesdrops and collects sensitive information flowing through the network and sells it to third parties.

90. An organization has outsourced its data processing function to a service provider.

Which of the following would BEST determine whether the service provider continues to meet the organization s objectives?

Assessment of the personnel training processes of the provider

Adequacy of the service provider's insurance

Review of performance against service level agreements (SLAs)

Periodic audits of controls by an independent auditor

Page 10 of 21

91. Which of the following is MOST important for an IS auditor to review when evaluating the accuracy of a spreadsheet that contains several macros?

Encryption of the spreadsheet

Version history

Formulas within macros

Reconciliation of key calculations

92. Prior to a follow-up engagement, an IS auditor learns that management has decided to accept a level of residual risk related to an audit finding without remediation. The IS auditor is concerned about management's decision.

Which of the following should be the IS auditor's NEXT course of action?

Accept management's decision and continue the follow-up.

Report the issue to IS audit management.

Report the disagreement to the board.

Present the issue to executive management.

93. IS management has recently disabled certain referential integrity controls in the database management system (DBMS) software to provide users increased query performance.

Which of the following controls will MOST effectively compensate for the lack of referential integrity?

More frequent data backups

Periodic table link checks

Concurrent access controls

Performance monitoring tools

94. Which of the following is the PRIMARY reason for an IS auditor to conduct post-implementation reviews?

To determine whether project objectives in the business case have been achieved

To ensure key stakeholder sign-off has been obtained

To align project objectives with business needs

To document lessons learned to improve future project delivery

95. An IS auditor notes the transaction processing times in an order processing system have significantly increased after a major release.

Which of the following should the IS auditor review FIRST?

Capacity management plan

Training plans

Database conversion results

Stress testing results

96. During an incident management audit, an IS auditor finds that several similar incidents

were logged during the audit period.

Which of the following is the auditor's MOST important course of action?

Document the finding and present it to management.

Determine if a root cause analysis was conducted.

Confirm the resolution time of the incidents.

Validate whether all incidents have been actioned.

97. An IS auditor discovers that validation controls m a web application have been moved from the server side into the browser to boost performance

This would MOST likely increase the risk of a successful attack by.

phishing.

denial of service (DoS)

structured query language (SQL) injection

buffer overflow

98. Which of the following is the BEST control to prevent the transfer of files to external parties through instant messaging (IM) applications?

File level encryption

File Transfer Protocol (FTP)

Instant messaging policy

Application level firewalls

99. Which of the following should an IS auditor recommend as a PRIMARY area of focus when an organization decides to outsource technical support for its external customers?

Align service level agreements (SLAs) with current needs.

Monitor customer satisfaction with the change.

Minimize costs related to the third-party agreement.

Ensure right to audit is included within the contract.

100. A proper audit trail of changes to server start-up procedures would include evidence of:

subsystem structure.

program execution.

security control options.

operator overrides.

Page 11 of 21

101. During a disaster recovery audit, an IS auditor finds that a business impact analysis (BIA) has not been performed. The auditor should FIRST

perform a business impact analysis (BIA).

issue an intermediate report to management.

evaluate the impact on current disaster recovery capability.

conduct additional compliance testing.

102. An IS auditor found that a company executive is encouraging employee use of social networking sites for business purposes.

Which of the following recommendations would BEST help to reduce the risk of data leakage?

Requiring policy acknowledgment and nondisclosure agreements (NDAs) signed by employees

Establishing strong access controls on confidential data

Providing education and guidelines to employees on use of social networking sites

Monitoring employees' social networking usage

103. Due to limited storage capacity, an organization has decided to reduce the actual retention period for media containing completed low-value transactions.

Which of the following is MOST important for the organization to ensure?

The policy includes a strong risk-based approach.

The retention period allows for review during the year-end audit.

The total transaction amount has no impact on financial reporting.

The retention period complies with data owner responsibilities.

104. Which of the following is MOST important to ensure when planning a black box penetration test?

The management of the client organization is aware of the testing.

The test results will be documented and communicated to management.

The environment and penetration test scope have been determined.

Diagrams of the organization's network architecture are available.

105. Which of the following is the MOST important consideration for an IS auditor when assessing the adequacy of an organization's information security policy?

Alignment with the IT tactical plan

IT steering committee minutes

Compliance with industry best practice

Business objectives

106. What is the BEST control to address SQL injection vulnerabilities?

Unicode translation

Secure Sockets Layer (SSL) encryption

Input validation

Digital signatures

107. An IS auditor has been asked to assess the security of a recently migrated database system that contains personal and financial data for a bank's customers.

Which of the following controls is MOST important for the auditor to confirm is in place?

The default configurations have been changed.

All tables in the database are normalized.

The service port used by the database server has been changed.

The default administration account is used after changing the account password.

108. To confirm integrity for a hashed message, the receiver should use:

the same hashing algorithm as the sender's to create a binary image of the file.

a different hashing algorithm from the sender's to create a binary image of the file.

the same hashing algorithm as the sender's to create a numerical representation of the file.

a different hashing algorithm from the sender's to create a numerical representation of the file.

109. Which of the following data would be used when performing a business impact analysis (BIA)?

Projected impact of current business on future business

Cost-benefit analysis of running the current business

Cost of regulatory compliance

Expected costs for recovering the business

110. An organization has recently acquired and implemented intelligent-agent software for granting loans to customers.

During the post-implementation review, which of the following is the MOST important procedure for the IS auditor to perform?

Review system and error logs to verify transaction accuracy.

Review input and output control reports to verify the accuracy of the system decisions.

Review signed approvals to ensure responsibilities for decisions of the system are well defined.

Review system documentation to ensure completeness.

Page 12 of 21

111. Spreadsheets are used to calculate project cost estimates. Totals for each cost category are then keyed into the job-costing system.

What is the BEST control to ensure that data is accurately entered into the system?

Reconciliation of total amounts by project

Validity checks, preventing entry of character data

Reasonableness checks for each cost type

Display back of project detail after entry

112. Which of the following would be an IS auditor's GREATEST concern when reviewing the early stages of a software development project?

The lack of technical documentation to support the program code

The lack of completion of all requirements at the end of each sprint

The lack of acceptance criteria behind user requirements.

The lack of a detailed unit and system test plan

113. An IS auditor wants to determine who has oversight of staff performing a specific task and is referencing the organization's RACI chart.

Which of the following roles within the chart would provide this information?

Consulted

Informed

Responsible

Accountable

114. One benefit of return on investment (ROI) analysts in IT decision making is that it provides the:

basis for allocating indirect costs.

cost of replacing equipment.

estimated cost of ownership.

basis for allocating financial resources.

115. Which of the following is the MOST effective control to mitigate unintentional misuse of authorized access?

Annual sign-off of acceptable use policy

Regular monitoring of user access logs

Security awareness training

Formalized disciplinary action

116. An IS auditor is evaluating an organization's IT strategy and plans.

Which of the following would be of GREATEST concern?

There is not a defined IT security policy.

The business strategy meeting minutes are not distributed.

IT is not engaged in business strategic planning.

There is inadequate documentation of IT strategic planning.

117. Which of the following is the BEST data integrity check?

Counting the transactions processed per day

Performing a sequence check

Tracing data back to the point of origin

Preparing and running test data

118. During an external review, an IS auditor observes an inconsistent approach in classifying system criticality within the organization.

Which of the following should be recommended as the PRIMARY factor to determine system criticality?

Key performance indicators (KPIs)

Maximum allowable downtime (MAD)

Recovery point objective (RPO)

Mean time to restore (MTTR)

119. In a 24/7 processing environment, a database contains several privileged application accounts with passwords set to never expire.

Which of the following recommendations would BEST address the risk with minimal disruption to the business?

Modify applications to no longer require direct access to the database.

Introduce database access monitoring into the environment

Modify the access management policy to make allowances for application accounts.

Schedule downtime to implement password changes.

120. Which of the following provides the MOST reliable audit evidence on the validity of transactions in a financial application?

Walk-through reviews

Substantive testing

Compliance testing

Design documentation reviews

Page 13 of 21

121. Which of the following is the GREATEST concern associated with a high number of IT policy exceptions approved by management?

The exceptions are likely to continue indefinitely.

The exceptions may result in noncompliance.

The exceptions may elevate the level of operational risk.

The exceptions may negatively impact process efficiency.

122. Which of the following is MOST important with regard to an application development acceptance test?

The programming team is involved in the testing process.

All data files are tested for valid information before conversion.

User management approves the test design before the test is started.

The quality assurance (QA) team is in charge of the testing process.

123. An IT balanced scorecard is the MOST effective means of monitoring:

governance of enterprise I

control effectiveness.

return on investment (ROI).

change management effectiveness.

124. An organization plans to receive an automated data feed into its enterprise data warehouse from a third-party service provider.

Which of the following would be the BEST way to prevent accepting bad data?

Obtain error codes indicating failed data feeds.

Appoint data quality champions across the organization.

Purchase data cleansing tools from a reputable vendor.

Implement business rules to reject invalid data.

125. Which of the following attack techniques will succeed because of an inherent security weakness in an Internet firewall?

Phishing

Using a dictionary attack of encrypted passwords

Intercepting packets and viewing passwords

Flooding the site with an excessive number of packets

126. An IS auditor who was instrumental in designing an application is called upon to review the application.

The auditor should:

refuse the assignment to avoid conflict of interest.

use the knowledge of the application to carry out the audit.

inform audit management of the earlier involvement.

modify the scope of the audit.

127. An incorrect version of source code was amended by a development team. This MOST likely indicates a weakness in:

incident management.

quality assurance (QA).

change management.

project management.

128. Secure code reviews as part of a continuous deployment program are which type of control?

Detective

Logical

Preventive

Corrective

129. Which of the following should be GREATEST concern to an IS auditor reviewing data conversion and migration during the implementation of a new application system?

Data conversion was performed using manual processes.

Backups of the old system and data are not available online.

Unauthorized data modifications occurred during conversion.

The change management process was not formally documented

130. Which of the following tests would provide the BEST assurance that a health care organization is handling patient data appropriately?

Compliance with action plans resulting from recent audits

Compliance with local laws and regulations

Compliance with industry standards and best practice

Compliance with the organization's policies and procedures

Page 14 of 21

131. When implementing Internet Protocol security (IPsec) architecture, the servers involved in application delivery:

communicate via Transport Layer Security (TLS),

block authorized users from unauthorized activities.

channel access only through the public-facing firewall.

channel access through authentication.

132. An IS audit reveals that an organization is not proactively addressing known vulnerabilities.

Which of the following should the IS auditor recommend the organization do FIRST?

Verify the disaster recovery plan (DRP) has been tested.

Ensure the intrusion prevention system (IPS) is effective.

Assess the security risks to the business.

Confirm the incident response team understands the issue.

133. Which of the following is the BEST way to determine whether a test of a disaster recovery plan (DRP) was successful?

Analyze whether predetermined test objectives were met.

Perform testing at the backup data center.

Evaluate participation by key personnel.

Test offsite backup files.

134. Which of the following would BEST demonstrate that an effective disaster recovery plan (DRP) is in place?

Frequent testing of backups

Annual walk-through testing

Periodic risk assessment

Full operational test

135. Malicious program code was found in an application and corrected prior to release into production. After the release, the same issue was reported.

Which of the following is the IS auditor's BEST recommendation?

Ensure corrected program code is compiled in a dedicated server.

Ensure change management reports are independently reviewed.

Ensure programmers cannot access code after the completion of program edits.

Ensure the business signs off on end-to-end user acceptance test (UAT) results.

136. Which of the following is MOST useful for determining whether the goals of IT are aligned with the organization's goals?

Balanced scorecard

Enterprise dashboard

Enterprise architecture (EA)

Key performance indicators (KPIs)

137. Documentation of workaround processes to keep a business function operational during recovery of IT systems is a core part of a:

business impact analysis (BIA).

threat and risk assessment.

business continuity plan (BCP).

disaster recovery plan (DRP).

138. When auditing the security architecture of an online application, an IS auditor should FIRST review the:

firewall standards.

configuration of the firewall

firmware version of the firewall

location of the firewall within the network

139. In a small IT web development company where developers must have write access to production, the BEST recommendation of an IS auditor would be to:

hire another person to perform migration to production.

implement continuous monitoring controls.

remove production access from the developers.

perform a user access review for the development team

140. During the evaluation of controls over a major application development project, the MOST effective use of an IS auditor's time would be to review and evaluate:

application test cases.

acceptance testing.

cost-benefit analysis.

project plans.

Page 15 of 21

141. Which of the following is the MOST effective way to maintain network integrity when using mobile devices?

Implement network access control.

Implement outbound firewall rules.

Perform network reviews.

Review access control lists.

142. An IS auditor is reviewing an organization's information asset management process.

Which of the following would be of GREATEST concern to the auditor?

The process does not require specifying the physical locations of assets.

Process ownership has not been established.

The process does not include asset review.

Identification of asset value is not included in the process.

143. An organization's security policy mandates that all new employees must receive appropriate security awareness training.

Which of the following metrics would BEST assure compliance with this policy?

Percentage of new hires that have completed the training.

Number of new hires who have violated enterprise security policies.

Number of reported incidents by new hires.

Percentage of new hires who report incidents

144. An IS auditor finds that a key Internet-facing system is vulnerable to attack and that patches are not available.

What should the auditor recommend be done FIRST?

Implement a new system that can be patched.

Implement additional firewalls to protect the system.

Decommission the server.

Evaluate the associated risk.

145. Which of the following will be the MOST effective method to verify that a service vendor keeps control levels as required by the client?

Conduct periodic on-site assessments using agreed-upon criteria.

Periodically review the service level agreement (SLA) with the vendor.

Conduct an unannounced vulnerability assessment of vendor's IT systems.

Obtain evidence of the vendor's control self-assessment (CSA).

146. When an intrusion into an organization network is deleted, which of the following should be done FIRST?

Block all compromised network nodes.

Contact law enforcement.

Notify senior management.

Identity nodes that have been compromised.

147. Management has requested a post-implementation review of a newly implemented purchasing package to determine to what extent business requirements are being met.

Which of the following is MOST likely to be assessed?

Purchasing guidelines and policies

Implementation methodology

Results of line processing

Test results

148. During a review of a production schedule, an IS auditor observes that a staff member is not complying with mandatory operational procedures. The auditor's NEXT step should be to:

note the noncompliance in the audit working papers.

issue an audit memorandum identifying the noncompliance.

include the noncompliance in the audit report.

determine why the procedures were not followed.

149. Which of the following is the BEST method to prevent wire transfer fraud by bank employees?

Independent reconciliation

Re-keying of wire dollar amounts

Two-factor authentication control

System-enforced dual control

150. Which of the following BEST guards against the risk of attack by hackers?

Tunneling

Encryption

Message validation

Firewalls

Page 16 of 21

151. An organization recently implemented a cloud document storage solution and removed the ability for end users to save data to their local workstation hard drives.

Which of the following findings should be the IS auditor's GREATEST concern?

Users are not required to sign updated acceptable use agreements.

Users have not been trained on the new system.

The business continuity plan (BCP) was not updated.

Mobile devices are not encrypted.

152. An organization plans to receive an automated data feed into its enterprise data warehouse from a third-party service provider.

Which of the following would be the BEST way to prevent accepting bad data?

Obtain error codes indicating failed data feeds.

Purchase data cleansing tools from a reputable vendor.

Appoint data quality champions across the organization.

Implement business rules to reject invalid data.

153. Which of the following is the BEST way for an organization to mitigate the risk associated with third-party application performance?

Ensure the third party allocates adequate resources to meet requirements.

Use analytics within the internal audit function

Conduct a capacity planning exercise

Utilize performance monitoring tools to verify service level agreements (SLAs)

154. While auditing a small organization's data classification processes and procedures, an IS auditor noticed that data is often classified at the incorrect level.

What is the MOST effective way for the organization to improve this situation?

Use automatic document classification based on content.

Have IT security staff conduct targeted training for data owners.

Publish the data classification policy on the corporate web portal.

Conduct awareness presentations and seminars for information classification policies.

155. An IS auditor has been asked to audit the proposed acquisition of new computer hardware.

The auditor’s PRIMARY concern Is that:

the implementation plan meets user requirements.

a full, visible audit trail will be Included.

a dear business case has been established.

the new hardware meets established security standards

156. In data warehouse (DW) management, what is the BEST way to prevent data quality issues caused by changes from a source system?

Configure data quality alerts to check variances between the data warehouse and the source system

Require approval for changes in the extract/Transfer/load (ETL) process between the two systems

Include the data warehouse in the impact analysis (or any changes m the source system

Restrict access to changes in the extract/transfer/load (ETL) process between the two systems

157. Capacity management enables organizations to:

forecast technology trends

establish the capacity of network communication links

identify the extent to which components need to be upgraded

determine business transaction volumes.

158. An IS auditor is analyzing a sample of accesses recorded on the system log of an application. The auditor intends to launch an intensive investigation if one exception is found.

Which sampling method would be appropriate?

Discovery sampling

Judgmental sampling

Variable sampling

Stratified sampling

159. An IS auditor finds that an organization's data loss prevention (DLP) system is configured to use vendor default settings to identify violations.

The auditor's MAIN concern should be that:

violation reports may not be reviewed in a timely manner.

a significant number of false positive violations may be reported.

violations may not be categorized according to the organization's risk profile.

violation reports may not be retained according to the organization's risk profile.

160. An IS auditor is reviewing an industrial control system (ICS) that uses older unsupported technology in the scope of an upcoming audit.

What should the auditor consider the MOST significant concern?

Attack vectors are evolving for industrial control systems.

There is a greater risk of system exploitation.

Disaster recovery plans (DRPs) are not in place.

Technical specifications are not documented.

Page 17 of 21

161. To develop meaningful recommendations 'or findings, which of the following is MOST important 'or an IS auditor to determine and understand?

Root cause

Responsible party

impact

Criteria

162. Which of the following environments is BEST used for copying data and transformation into a compatible data warehouse formal?

Testing

Replication

Staging

Development

163. Which of the following should an IS auditor consider the MOST significant risk associated with a new health records system that replaces a legacy system?

Staff were not involved in the procurement process, creating user resistance to the new system.

Data is not converted correctly, resulting in inaccurate patient records.

The deployment project experienced significant overruns, exceeding budget projections.

The new system has capacity issues, leading to slow response times for users.

164. A month after a company purchased and implemented system and performance monitoring software, reports were too large and therefore were not reviewed or acted upon

The MOST effective plan of action would be to:

evaluate replacement systems and performance monitoring software.

restrict functionality of system monitoring software to security-related events.

re-install the system and performance monitoring software.

use analytical tools to produce exception reports from the system and performance monitoring software

165. An IS auditor finds a high-risk vulnerability in a public-facing web server used to process online customer payments.

The IS auditor should FIRST

document the exception in an audit report.

review security incident reports.

identify compensating controls.

notify the audit committee.

166. During the implementation of a new system, an IS auditor must assess whether certain automated calculations comply with the regulatory requirements

Which of the following is the BEST way to obtain this assurance?

Review sign-off documentation

Review the source code related to the calculation

Re-perform the calculation with audit software

Inspect user acceptance lest (UAT) results

167. An organization was recently notified by its regulatory body of significant discrepancies in its reporting data. A preliminary investigation revealed that the discrepancies were caused by problems with the organization's data quality Management has directed the data quality team to enhance their program. The audit committee has asked internal audit to be advisors to the process.

To ensure that management concerns are addressed, which data set should internal audit recommend be reviewed FIRST?

Data with customer personal information

Data reported to the regulatory body

Data supporting financial statements

Data impacting business objectives

168. When auditing the alignment of IT to the business strategy, it is MOST Important for the IS auditor to:

compare the organization's strategic plan against industry best practice.

interview senior managers for their opinion of the IT function.

ensure an IT steering committee is appointed to monitor new IT projects.

evaluate deliverables of new IT initiatives against planned business services.

169. Which of the following would lead an IS auditor to conclude that the evidence collected during a digital forensic investigation would not be admissible in court?

The person who collected the evidence is not qualified to represent the case.

The logs failed to identify the person handling the evidence.

The evidence was collected by the internal forensics team.

The evidence was not fully backed up using a cloud-based solution prior to the trial.

170. An employee loses a mobile device resulting in loss of sensitive corporate data.

Which of the following would have BEST prevented data leakage?

Data encryption on the mobile device

Complex password policy for mobile devices

The triggering of remote data wipe capabilities

Awareness training for mobile device users

Page 18 of 21

171. Which of the following must be in place before an IS auditor initiates audit follow-up activities?

Available resources for the activities included in the action plan

A management response in the final report with a committed implementation date

A heal map with the gaps and recommendations displayed in terms of risk

Supporting evidence for the gaps and recommendations mentioned in the audit report

172. Due to limited storage capacity, an organization has decided to reduce the actual retention period for media containing completed low-value transactions.

Which of the following is MOST important for the organization to ensure?

The policy includes a strong risk-based approach.

The retention period allows for review during the year-end audit.

The retention period complies with data owner responsibilities.

The total transaction amount has no impact on financial reporting

173. The due date of an audit project is approaching, and the audit manager has determined that only 60% of the audit has been completed.

Which of the following should the audit manager do FIRST?

Determine where delays have occurred

Assign additional resources to supplement the audit

Escalate to the audit committee

Extend the audit deadline

174. Which of the following is a social engineering attack method?

An employee is induced to reveal confidential IP addresses and passwords by answering questions over the phone.

A hacker walks around an office building using scanning tools to search for a wireless network to gain access.

An intruder eavesdrops and collects sensitive information flowing through the network and sells it to third parties.

An unauthorized person attempts to gain access to secure premises by following an authorized person through a secure door.

175. Which of the following documents should specify roles and responsibilities within an IT audit organization?

Organizational chart

Audit charier

Engagement letter

Annual audit plan

176. Which of the following is the MOST important determining factor when establishing appropriate timeframes for follow-up activities related to audit findings?

Availability of IS audit resources

Remediation dates included in management responses

Peak activity periods for the business

Complexity of business processes identified in the audit

177. Which of the following is the PRIMARY reason to follow a configuration management process to maintain application?

To optimize system resources

To follow system hardening standards

To optimize asset management workflows

To ensure proper change control

178. Which of the following is MOST important to verify when determining the completeness of the vulnerability scanning process?

The organization's systems inventory is kept up to date.

Vulnerability scanning results are reported to the CIS

The organization is using a cloud-hosted scanning tool for Identification of vulnerabilities

Access to the vulnerability scanning tool is periodically reviewed

179. Which of the following security risks can be reduced by a property configured network firewall?

SQL injection attacks

Denial of service (DoS) attacks

Phishing attacks

Insider attacks

180. Which of the following metrics would BEST measure the agility of an organization's IT function?

Average number of learning and training hours per IT staff member

Frequency of security assessments against the most recent standards and guidelines

Average time to turn strategic IT objectives into an agreed upon and approved initiative

Percentage of staff with sufficient IT-related skills for the competency required of their roles

Page 19 of 21

181. IT disaster recovery time objectives (RTOs) should be based on the:

maximum tolerable loss of data.

nature of the outage

maximum tolerable downtime (MTD).

business-defined criticality of the systems.

182. Which of the following is the MAIN purpose of an information security management system?

To identify and eliminate the root causes of information security incidents

To enhance the impact of reports used to monitor information security incidents

To keep information security policies and procedures up-to-date

To reduce the frequency and impact of information security incidents

183. An IS auditor Is reviewing a recent security incident and is seeking information about me approval of a recent modification to a database system's security settings

Where would the auditor MOST likely find this information?

System event correlation report

Database log

Change log

Security incident and event management (SIEM) report

184. The GREATEST benefit of using a polo typing approach in software development is that it helps to:

minimize scope changes to the system.

decrease the time allocated for user testing and review.

conceptualize and clarify requirements.

Improve efficiency of quality assurance (QA) testing

185. An IS auditor is reviewing the release management process for an in-house software development solution.

In which environment Is the software version MOST likely to be the same as production?

Staging

Testing

Integration

Development

186. Which of the following findings should be of GREATEST concern to an IS auditor performing a review of IT operations?

The job scheduler application has not been designed to display pop-up error messages.

Access to the job scheduler application has not been restricted to a maximum of two staff members

Operations shift turnover logs are not utilized to coordinate and control the processing environment

Changes to the job scheduler application's parameters are not approved and reviewed by an operations supervisor

187. During an IT governance audit, an IS auditor notes that IT policies and procedures are not regularly reviewed and updated.

The GREATEST concern to the IS auditor is that policies and procedures might not:

reflect current practices.

include new systems and corresponding process changes.

incorporate changes to relevant laws.

be subject to adequate quality assurance (QA).

188. An IS auditor is reviewing an organization's primary router access control list.

Which of the following should result in a finding?

There are conflicting permit and deny rules for the IT group.

The network security group can change network address translation (NAT).

Individual permissions are overriding group permissions.

There is only one rule per group with access privileges.

189. Which of the following is MOST helpful for measuring benefits realization for a new system?

Function point analysis

Balanced scorecard review

Post-implementation review

Business impact analysis (BIA)

190. Which of the following would be an appropriate rote of internal audit in helping to establish an organization's privacy program?

Analyzing risks posed by new regulations

Designing controls to protect personal data

Defining roles within the organization related to privacy

Developing procedures to monitor the use of personal data

Page 20 of 21

191. An organization is planning an acquisition and has engaged an IS auditor lo evaluate the IT governance framework of the target company.

Which of the following would be MOST helpful In determining the effectiveness of the framework?

Sell-assessment reports of IT capability and maturity

IT performance benchmarking reports with competitors

Recent third-party IS audit reports

Current and previous internal IS audit reports

192. An organization has recently implemented a Voice-over IP (VoIP) communication system.

Which of the following should be the IS auditor's PRIMARY concern?

A single point of failure for both voice and data communications

Inability to use virtual private networks (VPNs) for internal traffic

Lack of integration of voice and data communications

Voice quality degradation due to packet toss

193. CORRECT TEXT

Which of the following findings should be of GREATEST concern for an IS auditor when auditing the effectiveness of a phishing simulation test administered for staff members?

Staff members who failed the test did not receive follow-up education

Test results were not communicated to staff members.

Staff members were not notified about the test beforehand.

Security awareness training was not provided prior to the test.

194. An IS auditor is reviewing security controls related to collaboration tools for a business unit responsible for intellectual property and patents.

Which of the following observations should be of MOST concern to the auditor?

Training was not provided to the department that handles intellectual property and patents

Logging and monitoring for content filtering is not enabled.

Employees can share files with users outside the company through collaboration tools.

The collaboration tool is hosted and can only be accessed via an Internet browser

195. Which of the following activities provides an IS auditor with the MOST insight regarding potential single person dependencies that might exist within the organization?

Reviewing vacation patterns

Reviewing user activity logs

Interviewing senior IT management

Mapping IT processes to roles

196. Which of the following should be an IS auditor's GREATEST concern when an international organization intends to roll out a global data privacy policy?

Requirements may become unreasonable.

The policy may conflict with existing application requirements.

Local regulations may contradict the policy.

Local management may not accept the policy.

197. When planning an audit to assess application controls of a cloud-based system, it is MOST important tor the IS auditor to understand the.

architecture and cloud environment of the system.

business process supported by the system.

policies and procedures of the business area being audited.

availability reports associated with the cloud-based system.

198. Which of the following is MOST important for an IS auditor to verify when evaluating an organization's firewall?

Logs are being collected in a separate protected host

Automated alerts are being sent when a risk is detected

Insider attacks are being controlled

Access to configuration files Is restricted.

199. Due to a recent business divestiture, an organization has limited IT resources to deliver critical projects Reviewing the IT staffing plan against which of the following would BEST guide IT management when estimating resource requirements for future projects?

Human resources (HR) sourcing strategy

Records of actual time spent on projects

Peer organization staffing benchmarks

Budgeted forecast for the next financial year

200. Which of the following is the PRIMARY role of the IS auditor m an organization's information classification process?

Securing information assets in accordance with the classification assigned

Validating that assets are protected according to assigned classification

Ensuring classification levels align with regulatory guidelines

Defining classification levels for information assets within the organization

Page 21 of 21

201. Which of the following is the GREATEST security risk associated with data migration from a legacy human resources (HR) system to a cloud-based system?

Data from the source and target system may be intercepted.

Data from the source and target system may have different data formats.

Records past their retention period may not be migrated to the new system.

System performance may be impacted by the migration

202. Which of the following conditions would be of MOST concern to an IS auditor assessing the risk of a successful brute force attack against encrypted data at test?

Short key length

Random key generation

Use of symmetric encryption

Use of asymmetric encryption

203. Which of the following observations would an IS auditor consider the GREATEST risk when

conducting an audit of a virtual server farm tor potential software vulnerabilities?

Guest operating systems are updated monthly

The hypervisor is updated quarterly.

A variety of guest operating systems operate on one virtual server

Antivirus software has been implemented on the guest operating system only.

204. Which of the following is a detective control?

Programmed edit checks for data entry

Backup procedures

Use of pass cards to gain access to physical facilities

Verification of hash totals

205. An organization that has suffered a cyber attack is performing a forensic analysis of the affected users' computers.

Which of the following should be of GREATEST concern for the IS auditor reviewing this process?

An imaging process was used to obtain a copy of the data from each computer.

The legal department has not been engaged.

The chain of custody has not been documented.

Audit was only involved during extraction of the Information

206. Due to system limitations, segregation of duties (SoD) cannot be enforced in an accounts payable system.

Which of the following is the IS auditor's BEST recommendation for a compensating control?

Require written authorization for all payment transactions

Restrict payment authorization to senior staff members.

Reconcile payment transactions with invoices.

Review payment transaction history

207. Which of the following is MOST important for an IS auditor to do during an exit meeting with an auditee?

Ensure that the facts presented in the report are correct

Communicate the recommendations lo senior management

Specify implementation dates for the recommendations.

Request input in determining corrective action.

208. Which of the following Is the BEST way to ensure payment transaction data is restricted to the appropriate users?

Implementing two-factor authentication

Restricting access to transactions using network security software

implementing role-based access at the application level

Using a single menu tor sensitive application transactions

Certified Information Systems Auditor CISA Exam Dumps

Certified Information Systems Auditor CISA Exam Dumps

Share this post

Leave a Reply Cancel reply