A disaster recovery plan (DRP) should include steps for:

obtaining replacement supplies.

assessing and quantifying risk.

negotiating contracts with disaster planning consultants.

identifying application control requirements.

obtaining replacement supplies.

Which of the following is the BEST indication that there are potential problems within an organization's IT service desk function?

An excessive backlog of user requests

Undocumented operating procedures

An excessive backlog of user requests

Lack of key performance indicators (KPIs)

While evaluating the data classification process of an organization, an IS auditor's PRIMARY focus should be on whether:

data classifications are automated.

a data dictionary is maintained.

data retention requirements are clearly defined.

When assessing the overall effectiveness of an organization's disaster recovery planning process, which of the following is MOST important for the IS auditor to verify?

Management reviews and updates the plan annually or as changes occur.

Management contracts with a third party for warm site services.

Management schedules an annual tabletop exercise.

Management documents and distributes a copy of the plan to all personnel.

Management reviews and updates the plan annually or as changes occur.

What is the MOST effective way to detect installation of unauthorized software packages by employees?

Regular scanning of hard drives

Communicating the policy to employees

Logging of activity on the network

Maintaining current antivirus software

Which of the following is MOST effective for controlling visitor access to a data center?

Visitors are escorted by an authorized employee

Visitors sign in at the front desk upon arrival

Closed-circuit television (CCTV) is used to monitor the facilities

Which of the following BEST enables an organization to improve the visibility of end-user computing (EUC) applications that support regulatory reporting?

EUC tests of operational effectiveness

Which of the following is MOST helpful to an IS auditor when assessing the effectiveness of controls?

A control self-assessment (CSA)

Which of the following is the BEST indication to an IS auditor that management's post-implementation review was effective?

Lessons learned were documented and applied.

Business and IT stakeholders participated in the post-implementation review.

Post-implementation review is a formal phase in the system development life cycle (SDLC).

Internal audit follow-up was completed without any findings.

An organization has engaged a third party to implement an application to perform business-critical calculations. Which of the following is the MOST important process to help ensure the application provides accurate calculations?

Key performance indicator (KPI) monitoring

Which of the following is the BEST source of information to determine the required level of data protection on a file server?

Data classification policy and procedures

Access rights of similar file servers

Previous data breach incident reports

Acceptable use policy and privacy statements

Which of the following should be the FIRST step when conducting an IT risk assessment?

Identify assets to be protected.

Which of the following is a concern associated with virtualization?

Performance issues with the host could impact the guest operating systems.

The physical footprint of servers could decrease within the data center.

Performance issues with the host could impact the guest operating systems.

Processing capacity may be shared across multiple operating systems.

One host may have multiple versions of the same operating system.

Which of the following BEST protects evidence in a forensic investigation?

Powering down the affected system

Protecting the hardware of the affected system

Email required for business purposes is being stored on employees' personal devices.Which of the following is an IS auditor's BEST recommendation?

Implement an email containerization solution on personal devices

Require employees to utilize passwords on personal devices

Prohibit employees from storing company email on personal devices

Ensure antivirus protection is installed on personal devices

Implement an email containerization solution on personal devices

Which of the following is the MAJOR advantage of automating internal controls?

To efficiently test large volumes of data

To enable the review of large value transactions

To efficiently test large volumes of data

To help identity transactions with no segregation of duties

To assist in performing analytical reviews

Which of the following is MOST important to consider when developing a service level agreement (SLAP)?

Description of the services from the viewpoint of the client organization

Description of the services from the viewpoint of the provider

Detailed identification of work to be completed

Provisions for regulatory requirements that impact the end users' businesses

Description of the services from the viewpoint of the client organization

Which of the following is the BEST way to address potential data privacy concerns associated with inadvertent disclosure of machine identifier information contained within security logs?

Unit the use of logs to only those purposes for which they were collected

Restrict the transfer of log files from host machine to online storage

Only collect logs from servers classified as business critical

Limit log collection to only periods of increased security activity

Which of the following would BEST help to ensure that an incident receives attention from appropriate personnel in a timely manner?

Implementing incident escalation procedures

Completing the incident management log

Broadcasting an emergency message

Requiring a dedicated incident response team

Implementing incident escalation procedures

What is the BEST way to reduce the risk of inaccurate or misleading data proliferating through business intelligence systems?

Establish rules for converting data from one format to another

Implement data entry controls for new and existing applications

Implement a consistent database indexing strategy

Develop a metadata repository to store and access metadata

Which of the following should be the FIRST step when planning an IS audit of a third-party service provider that monitors network activities?

Review the roles and responsibilities of the third-party provider

Review the third party's monitoring logs and incident handling

Review the roles and responsibilities of the third-party provider

Evaluate the organization's third-party monitoring process

Determine if the organization has a secure connection to the provider

When auditing the closing stages of a system development protect which of the following should be the MOST important consideration?

User acceptance lest (UAT) results

Functional requirements documentation

User acceptance lest (UAT) results

Which of the following provides the BEST audit evidence that a firewall is configured in compliance with the organization's security policy?

Analyzing how the configuration changes are performed

Which of the following should be considered when examining fire suppression systems as part of a data center environmental controls review?

Onsite replacement availability

During a database management evaluation an IS auditor discovers that some accounts with database administrator (DBA) privileges have been assigned a default password with an unlimited number of failed login attempts Which of the following is the auditor's BEST course of action?

Document the finding and explain the risk of having administrator accounts with inappropriate security settings

Identify accounts that have had excessive failed login attempts and request they be disabled

Request the IT manager to change administrator security parameters and update the finding

Document the finding and explain the risk of having administrator accounts with inappropriate security settings

Isaca CISA Practice Test 13 - Free Online Exam Prep & Questions

Which of the following provides a new IS auditor with the MOST useful information to evaluate overall IT performance?

Become a Premium Member for full access

Unlock Premium Member

Isaca CISA Practice Test 13

Question

Isaca CISA Practice Tests

Practice Tests