The PRIMARY purpose of requiring source code escrow in a contractual agreement is to:

ensure the source code is available.

comply with vendor management policy

convert source code to new executable code.

satisfy regulatory requirements.

ensure the source code is available.

Which of the following provides the MOST assurance of the integrity of a firewall log?

The log is reviewed on a monthly basis.

Authorized access is required to view the log.

The log is retained per policy.

Which of the following is the BEST recommendation to include in an organization's bring your own device (BYOD) policy to help prevent data leakage?

Require multi-factor authentication on BYOD devices,

Require employees to waive privacy rights related to data on BYOD devices.

Require multi-factor authentication on BYOD devices,

Specify employee responsibilities for reporting lost or stolen BYOD devices.

Allow only registered BYOD devices to access the network.

Which of the following provides the BEST evidence that a third-party service provider's information security controls are effective?

An audit report of the controls by the service provider's external auditor

Documentation of the service provider's security configuration controls

An interview with the service provider's information security officer

A review of the service provider's policies and procedures

Which of the following is the MOST effective way to identify exfiltration of sensitive data by a malicious insider?

Establish behavioral analytics monitoring

Implement data loss prevention (DLP) software

Provide ongoing information security awareness training

Establish behavioral analytics monitoring

An IS auditor identifies that a legacy application to be decommissioned in three months cannot meet the security requirements established by the current policy. What is the BEST way (or the auditor to address this issue?

Verify management has approved a policy exception to accept the risk.

Recommend the application be patched to meet requirements.

Inform the IT director of the policy noncompliance.

Verify management has approved a policy exception to accept the risk.

Take no action since the application will be decommissioned in three months.

An IS auditor reviewing the throat assessment for a data cantor would be MOST concerned if:

all identified threats relate to external entities.

some of the identified threats are unlikely to occur.

all identified threats relate to external entities.

the exercise was completed by local management.

neighboring organizations' operations have been included.

Which of the following is the BEST indication of effective IT investment management?

IT investments are mapped to specific business objectives

IT investments are implemented and monitored following a system development life cycle (SDLC)

IT investments are mapped to specific business objectives

Key performance indicators (KPIs) are defined for each business requiring IT Investment

The IT Investment budget is significantly below industry benchmarks

Which of the following is the MOST important responsibility of user departments associated with program changes?

Approving changes before implementation

Updating documentation lo reflect latest changes

Approving changes before implementation

Audit frameworks cart assist the IS audit function by:

providing direction and information regarding the performance of audits.

defining the authority and responsibility of the IS audit function.

providing details on how to execute the audit program.

providing direction and information regarding the performance of audits.

outlining the specific steps needed to complete audits

Which of the following would be the BEST process for continuous auditing to a large financial Institution?

Validating access controls for real-time data systems

Testing encryption standards on the disaster recovery system

Validating access controls for real-time data systems

Performing parallel testing between systems

Validating performance of help desk metrics

An internal audit team is deciding whether to use an audit management application hosted by a third party in a different country.What should be the MOST important consideration related to the uploading of payroll audit documentation in the hosted application?

Privacy regulations affecting the organization

Financial regulations affecting the organization

Data center physical access controls whore the application is hosted

Privacy regulations affecting the organization

Per-unit cost charged by the hosting services provider for storage

Which of the following findings should be of GREATEST concern to an IS auditor assessing the risk associated with end-user computing (EUC) in an organization?

Lack of defined criteria for EUC applications

Insufficient processes to track ownership of each EUC application?

Insufficient processes to lest for version control

Lack of awareness training for EUC users

Lack of defined criteria for EUC applications

What would be an IS auditor's BEST course of action when an auditee is unable to close all audit recommendations by the time of the follow-up audit?

Evaluate the residual risk due to open issues.

Ensure the open issues are retained in the audit results.

Terminate the follow-up because open issues are not resolved

Recommend compensating controls for open issues.

Evaluate the residual risk due to open issues.

in a post-implantation Nation review of a recently purchased system it is MOST important for the iS auditor to determine whether the:

stakeholder expectations were identified

vendor product offered a viable solution.

test scenarios reflected operating activities.

An IS auditor is evaluating the access controls for a shared customer relationship management (CRM) system. Which of the following would be the GREATEST concern?

Security baseline is not consistently applied

Complex passwords are not required

An IS auditor concludes that logging and monitoring mechanisms within an organization are ineffective because critical servers are not included within the central log repository. Which of the following audit procedures would have MOST likely identified this exception?

Comparing a list of all servers from the directory server against a list of all servers present in the central log repository

Inspecting a sample of alerts generated from the central log repository

Comparing a list of all servers from the directory server against a list of all servers present in the central log repository

Inspecting a sample of alert settings configured in the central log repository

Comparing all servers included in the current central log repository with the listing used for the prior-year audit

Which of the following areas is MOST likely to be overlooked when implementing a new data classification process?

End-user computing (EUC) systems

An IS auditor Is renewing the deployment of a new automated system Which of the following findings presents the MOST significant risk?

Data from the legacy system is not migrated correctly to the new system.

The new system has resulted m layoffs of key experienced personnel.

Users have not been trained on the new system.

Data from the legacy system is not migrated correctly to the new system.

The new system is not platform agnostic

Which of the following is an advantage of using agile software development methodology over the waterfall methodology?

Clearly defined business expectations

Which of the following is the BEST approach for determining the overall IT risk appetite of an organization when business units use different methods for managing IT risks?

Prioritize the organization's IT risk scenarios

Average the business units' IT risk levels

Identify the highest-rated IT risk level among the business units

Prioritize the organization's IT risk scenarios

Establish a global IT risk scoring criteria

Which of the following should be of GREATEST concern to an |$ auditor reviewing data conversion and migration during the implementation of a new application system?

Unauthorized data modifications occurred during conversion,

The change management process was not formally documented

Backups of the old system and data are not available online

Unauthorized data modifications occurred during conversion,

Data conversion was performed using manual processes

An IS auditor has discovered that a software system still in regular use is years out of date and no longer supported. The auditee has stated that it will take six months until the software is running on the current version. Which of the following is the BEST way to reduce the immediate risk associated with using an unsupported version of the software?

Segregate the outdated software system from the main network.

Verify all patches have been applied to the software system's outdated version.

Close all unused ports on the outdated software system.

Monitor network traffic attempting to reach the outdated software system.

Segregate the outdated software system from the main network.

An IS auditor finds that while an organization's IT strategy is heavily focused on research and development, the majority of protects n the IT portfolio focus on operations and maintenance. Which of the Mowing is the BEST recommendation?

Align the IT strategy will business objectives

Review priorities in the IT portfolio

Change the IT strategy to focus on operational excellence.

Align the IT portfolio with the IT strategy.

Which of the following is the BEST way to verify the effectiveness of a data restoration process?

Performing periodic complete data restorations

Performing periodic reviews of physical access to backup media

Performing periodic complete data restorations

Validating off ne backups using software utilities

Reviewing and updating data restoration policies annually

A bank has a combination of corporate customer accounts (higher monetary value) and small business accounts (lower monetary value) as part of online banking. Which of the following is the BEST sampling approach for an IS auditor to use for these accounts?

Stratified mean per unit sampling

Unstratified mean per unit sampling

Which of the following should be the FIRST step to successfully implement a corporate data classification program?

Approve a data classification policy.

Select a data loss prevention (DLP) product.

Confirm that adequate resources are available for the project.

Check for the required regulatory requirements.

A CFO has requested an audit of IT capacity management due to a series of finance system slowdowns during month-end reporting. What would be MOST important to consider before including this audit in the program?

Whether the system's performance poses a significant risk to the organization

Whether system delays result in more frequent use of manual processing

Whether the system's performance poses a significant risk to the organization

Whether stakeholders are committed to assisting with the audit

Whether internal auditors have the required skills to perform the audit

Which of the following is the MOST appropriate indicator of change management effectiveness?

Number of incidents resulting from changes

Time lag between changes to the configuration and the update of records

Number of system software changes

Time lag between changes and updates of documentation materials

Number of incidents resulting from changes

An organization has recently moved to an agile model for deploying custom code to its in-house accounting software system. When reviewing the procedures in place for production code deployment, which of the following is the MOST significant security concern to address?

Change control does not include testing and approval from quality assurance (QA).

Software vulnerability scanning is done on an ad hoc basis.

Change control does not include testing and approval from quality assurance (QA).

Production code deployment is not automated.

Current DevSecOps processes have not been independently verified.

Isaca CISA Practice Test 12 - Free Online Exam Prep & Questions

Which of the following is the GREATEST risk if two users have concurrent access to the same database record?

Become a Premium Member for full access

Unlock Premium Member

Isaca CISA Practice Test 12

Question

Isaca CISA Practice Tests

Practice Tests