Which of the following is the MOST significant risk that IS auditors are required to consider for each engagement?

Misalignment with business objectives

Process and resource inefficiencies

Irregularities and illegal acts

Noncompliance with organizational policies

Misalignment with business objectives

An externally facing system containing sensitive data is configured such that users have either read-only or administrator rights. Most users of the system have administrator access. Which of the following is the GREATEST risk associated with this situation?

Users can make unauthorized changes.

Users can export application logs.

Users can make unauthorized changes.

Users can install open-licensed software.

During an audit of an organization's risk management practices, an IS auditor finds several documented IT risk acceptances have not been renewed in a timely manner after the assigned expiration date When assessing the seventy of this finding, which mitigating factor would MOST significantly minimize the associated impact?

There are documented compensating controls over the business processes.

The risk acceptances were previously reviewed and approved by appropriate senior management

The business environment has not significantly changed since the risk acceptances were approved.

The risk acceptances with issues reflect a small percentage of the total population

Which of the following is the MOST effective way for an organization to help ensure agreed-upon action plans from an IS audit will be implemented?

Ensure sufficient audit resources are allocated,

Communicate audit results organization-wide.

Test corrective actions upon completion.

Which of the following is the BEST metric to measure the alignment of IT and business strategy?

Percentage of enterprise risk assessments that include IT-related risk

Level of stakeholder satisfaction with the scope of planned IT projects

Percentage of enterprise risk assessments that include IT-related risk

Percentage of stat satisfied with their IT-related roles

Frequency of business process capability maturity assessments

Which of the following is MOST important for an IS auditor to confirm when reviewing an organization's plans to implement robotic process automation (RPA> to automate routine business tasks?

The end-to-end process is understood and documented.

Roles and responsibilities are defined for the business processes in scope.

A benchmarking exercise of industry peers who use RPA has been completed.

A request for proposal (RFP) has been issued to qualified vendors.

Which of the following should be performed FIRST before key performance indicators (KPIs) can be implemented?

Identification of organizational goals

Analysis of industry benchmarks

Identification of organizational goals

Analysis of quantitative benefits

Implementation of a balanced scorecard

During audit framework. an IS auditor teams that employees are allowed to connect their personal devices to company-owned computers. How can the auditor BEST validate that appropriate security controls are in place to prevent data loss?

Review compliance with data loss and applicable mobile device user acceptance policies.

Conduct a walk-through to view results of an employee plugging in a device to transfer confidential data.

Review compliance with data loss and applicable mobile device user acceptance policies.

Verify the data loss prevention (DLP) tool is properly configured by the organization.

Verify employees have received appropriate mobile device security awareness training.

If enabled within firewall rules, which of the following services would present the GREATEST risk?

Simple mail transfer protocol (SMTP)

Simple object access protocol (SOAP)

Hypertext transfer protocol (HTTP)

Which of the following is the BEST way to mitigate the risk associated with unintentional modifications of complex calculations in end-user computing (EUC)?

Execute copies of EUC programs out of a secure library

Have an independent party review the source calculations

Execute copies of EUC programs out of a secure library

implement complex password controls

Verify EUC results through manual calculations

Which of the following BEST enables the effectiveness of an agile project for the rapid development of a new software application?

The work is separated into sprints.

Project segments are established.

The work is separated into phases.

The work is separated into sprints.

Project milestones are created.

Which of the following would BEST ensure that a backup copy is available for restoration of mission critical data after a disaster''

Periodically test backups stored in a remote location

Use an electronic vault for incremental backups

Deploy a fully automated backup maintenance system.

Periodically test backups stored in a remote location

Use both tape and disk backup systems

Which of the following is the BEST evidence that an organization's IT strategy is aligned lo its business objectives?

The IT strategy is approved by executive management.

The IT strategy is modified in response to organizational change.

The IT strategy is approved by executive management.

The IT strategy is based on IT operational best practices.

The IT strategy has significant impact on the business strategy

Which of the following security measures will reduce the risk of propagation when a cyberattack occurs?

Data loss prevention (DLP) system

A credit card company has decided to outsource the printing of customer statements It Is MOST important for the company to verify whether:

the provider's information security controls are aligned with the company's.

the provider has alternate service locations.

the contract includes compensation for deficient service levels.

the provider's information security controls are aligned with the company's.

the provider adheres to the company's data retention policies.

Which of the following would BEST help to ensure that potential security issues are considered by the development team as part of incremental changes to agile-developed software?

Include a mandatory step to analyze the security impact when making changes.

Assign the security risk analysis to a specially trained member of the project management office.

Deploy changes in a controlled environment and observe for security defects.

Include a mandatory step to analyze the security impact when making changes.

Mandate that the change analyses are documented in a standard format.

An IS auditor is reviewing processes for importing market price data from external data providers. Which of the following findings should the auditor consider MOST critical?

The quality of the data is not monitored.

Imported data is not disposed frequently.

The transfer protocol is not encrypted.

The transfer protocol does not require authentication.

Which of the following would be of GREATEST concern when reviewing an organization's security information and event management (SIEM) solution?

SIEM configuration is reviewed annually

Which of the following is MOST important for an IS auditor to look for in a project feasibility study?

An assessment of whether the expected benefits can be achieved

An assessment of whether requirements will be fully met

An assessment indicating security controls will operate effectively

An assessment of whether the expected benefits can be achieved

An assessment indicating the benefits will exceed the implement

What should an IS auditor do FIRST when management responses to an in-person internal control questionnaire indicate a key internal control is no longer effective?

Ascertain the existence of other compensating controls.

Determine the resources required to make the control effective.

Validate the overall effectiveness of the internal control.

Verify the impact of the control no longer being effective.

Ascertain the existence of other compensating controls.

During an exit meeting, an IS auditor highlights that backup cycles are being missed due to operator error and that these exceptions are not being managed. Which of the following is the BEST way to help management understand the associated risk?

Explain the impact to disaster recovery.

Explain the impact to resource requirements.

Explain the impact to incident management.

Explain the impact to backup scheduling.

Which of the following presents the GREATEST challenge to the alignment of business and IT?

Lack of chief information officer (CIO) involvement in board meetings

Insufficient IT budget to execute new business projects

Lack of information security involvement in business strategy development

An IT steering committee chaired by the chief information officer (CIO)

Which of the following is the MOST efficient way to identify segregation of duties violations in a new system?

Review a report of security rights in the system.

Observe the performance of business processes.

Develop a process to identify authorization conflicts.

Examine recent system access rights violations.

An IS auditor has completed the fieldwork phase of a network security review and is preparing the initial following findings should be ranked as the HIGHEST risk?

Network penetration tests are not performed

The network firewall policy has not been approved by the information security officer.

Network firewall rules have not been documented.

The network device inventory is incomplete.

An IS auditor is reviewing logical access controls for an organization's financial business application Which of the following findings should be of GREATEST concern to the auditor?

User accounts are shared between users

Users are not required to change their passwords on a regular basis

Management does not review application user activity logs

User accounts are shared between users

Password length is set to eight characters

Which of the following is MOST important for an IS auditor to verify when evaluating an organization's data conversion and infrastructure migration plan?

Strategic: goals have been considered.

A code check review is included.

A migration steering committee has been formed.

Which of the following should be the FIRST step m managing the impact of a recently discovered zero-day attack?

Evaluating the likelihood of attack

Assessing the Impact of vulnerabilities

Which of the following is me GREATE ST impact as a result of the ongoing deterioration of a detective control?

Increased number of false negatives in security logs

Decreased effectiveness of roof cause analysis

Decreased overall recovery time

Increased demand for storage space for logs

An auditee disagrees with a recommendation for corrective action that appears in the draft engagement report. Which of the following is the IS auditor's BEST course of action when preparing the final report?

Include the position supported by senior management in the final engagement report

Come to an agreement prior to issuing the final report.

Include the position supported by senior management in the final engagement report

Ensure the auditee's comments are included in the working papers

Exclude the disputed recommendation from the final engagement report

Which of the following would provide the BEST evidence of an IT strategy corrections effectiveness?

Synchronization of IT activities with corporate objectives

The minutes from the IT strategy committee meetings

Synchronization of IT activities with corporate objectives

The IT strategy committee charier

Business unit satisfaction survey results

An IT balanced scorecard is PRIMARILY used for:

measuring IT strategic performance

evaluating the IT project portfolio

measuring IT strategic performance

allocating IT budget and resources

monitoring risk in lT-related processes

An IS auditor notes that not all security tests were completed for an online sales system recently promoted to production. Which of the following is the auditor's BEST course of action?

Determine exposure to the business

Adjust future testing activities accordingly

Increase monitoring for security incidents

Hire a third party to perform security testing

Which of the following is MOST important for an IS auditor to verify when reviewing the use of an outsourcer for disposal of storage media?

The vendor's process appropriately sanitizes the media before disposal

The contract includes issuance of a certificate of destruction by the vendor

The vendor has not experienced security incidents in the past.

The disposal transportation vehicle is fully secure

Which of the following is the PRIMARY reason for an IS audit manager to review the work performed by a senior IS auditor prior to presentation of a report?

To ensure the conclusions are adequately supported

To ensure adequate sampling methods were used during fieldwork

To ensure the work is properly documented and filed

To ensure the work is conducted according to industry standards

Which of following is MOST important to determine when conducting a post-implementation review?

Whether success criteria have been achieved

Whether the solution architecture compiles with IT standards

Whether success criteria have been achieved

Whether the project has been delivered within the approved budget

Whether lessons teamed have been documented

Isaca CISA Practice Test 11 - Free Online Exam Prep & Questions

Which of the following would MOST effectively help to reduce the number of repealed incidents in an organization?

Become a Premium Member for full access

Unlock Premium Member

Isaca CISA Practice Test 11

Question

Isaca CISA Practice Tests

Practice Tests