A programmer has made unauthorized changes lo key fields in a payroll system report. Which of the following control weaknesses would have contributed MOST to this problem?

The programmer has access to the production programs

The programmer did not involve the user in testing

The user requirements were not documented

The programmer has access to the production programs

Payroll files were not under the control of a librarian

Which of the following should be the FIRST consideration when deciding whether data should be moved to a cloud provider for storage?

Service level agreements (SLAs)

During an audit which of the following would be MOST helpful in establishing a baseline for measuring data quality?

Validation of rules by the business

Industry standard business definitions

Validation of rules by the business

Built-in data error prevention application controls

Which of the following is the GREATEST benefit of adopting an international IT governance framework rather than establishing a new framework based on the actual situation of a specific organization1?

Wide acceptance by different business and support units with IT governance objectives

Readily available resources such as domains and risk and control methodologies

Comprehensive coverage of fundamental and critical risk and control areas for IT governance

Fewer resources expended on trial-and-error attempts to fine-tune implementation methodologies

Wide acceptance by different business and support units with IT governance objectives

When planning an audit, it is acceptable for an IS auditor to rely on a third-party provider's external audit report on service level management when the

scope and methodology meet audit requirements

service provider is independently certified and accredited

report confirms that service levels were not violated

report was released within the last 12 months

Which of the following is the MOST important factor when an organization is developing information security policies and procedures?

Alignment with an information security framework

Consultation with security staff

Inclusion of mission and objectives

Compliance with relevant regulations

Alignment with an information security framework

Which type of device sits on the perimeter of a corporate of home network, where it obtains a public IP address and then generates private IP addresses internally?

Intrusion prevention system (IPS)

An IS auditor is analyzing a sample of accounts payable transactions for a specific vendor and identifies one transaction with a value five times as high as the average transaction. Which of the following should the auditor do NEXT?

Request an explanation of the variance from the auditee

Report the variance immediately to the audit committee

Request an explanation of the variance from the auditee

Increase the sample size to 100% of the population

Exclude the transaction from the sample population

An organization outsourced its IS functions to meet its responsibility for disaster recovery, the organization should:

coordinate disaster recovery administration with the outsourcing vendor

discontinue maintenance of the disaster recovery plan (DRP>

coordinate disaster recovery administration with the outsourcing vendor

delegate evaluation of disaster recovery to a third party

delegate evaluation of disaster recovery to internal audit

A vendor requires privileged access to a key business application. Which of the following is the BEST recommendation to reduce the risk of data leakage?

Implement real-time activity monitoring for privileged roles

Include the right-to-audit in the vendor contract

Perform a review of privileged roles and responsibilities

Require the vendor to implement job rotation for privileged roles

The FIRST step in auditing a data communication system is to determine:

business use and types of messages to be transmitted

traffic volumes and response-time criteria

physical security for network equipment

the level of redundancy in the various communication paths

business use and types of messages to be transmitted

Which of the following management decisions presents the GREATEST risk associated with data leakage?

Security awareness training is not provided to staff

There is no requirement for desktops to be encrypted

Staff are allowed to work remotely

Security awareness training is not provided to staff

Security policies have not been updated in the past year

An IS auditor is reviewing an organization's business continuity plan (BCP) following a change in organizational structure with significant impact to business processes. Which of the following findings should be the auditor's GREATEST concern?

A test plan for the BCP has not been completed during the last two years

Key business process end users did not participate in the business impact ' analysis (BIA)

Copies of the BCP have not been distributed to new business unit end users sjnce the reorganization

A test plan for the BCP has not been completed during the last two years

Capacity management tools are PRIMARILY used to ensure that:

available resources are used efficiently and effectively

computer systems are used to their maximum capacity most of the time

concurrent use by a large number of users is enabled

proposed hardware acquisitions meet capacity requirements

When is it MOST important for an IS auditor to apply the concept of materiality in an audit?

When planning an audit engagement

When gathering information for the fieldwork

When a violation of a regulatory requirement has been identified

When evaluating representations from the auditee

During the discussion of a draft audit report IT management provided suitable evidence that a process has been implemented for a control that had been concluded by the IS auditor as ineffective Which of the following is the auditor's BEST action?

Re-perform the audit before changing the conclusion

Explain to IT management that the new control will be evaluated during follow-up

Add comments about the action taken by IT management in the report

Change the conclusion based on evidence provided by IT management

Re-perform the audit before changing the conclusion

Which of the following should be the PRIMARY role of an internal audit function in the management of identified business risks?

Validating enterprise risk management (ERM)

Establishing a risk management framework

Validating enterprise risk management (ERM)

Operating the risk management framework

Which of the following is the PRIMARY advantage of using virtualization technology for corporate applications?

Better utilization of resources

Increased application performance

When evaluating information security governance within an organization, which of the following findings should be of MOST concern to an IS auditor?

The data center manager has final sign-off on security projects

The information security department has difficulty filling vacancies

An information security governance audit was not conducted within the past year

The data center manager has final sign-off on security projects

Information security policies are updated annually

A senior auditor is reviewing work papers prepared by a junior auditor indicating that a finding was removed after the auditee said they corrected the problem. Which of the following is the senior auditor s MOST appropriate course of action?

Approve the work papers as written

Refer the issue to the audit director

Which of the following should be of GREATEST concern to an IS auditor assessing the effectiveness of an organization's vulnerability scanning program''

Results are not reported to individuals with authority to ensure resolution

Steps taken to address identified vulnerabilities are not formally documented

Results are not reported to individuals with authority to ensure resolution

Scans are performed less frequently than required by the organization's vulnerability scanning schedule

Results are not approved by senior management

Which of the following provides the MOST useful information for performing a business impact analysis (B1A)?

inventory of relevant business processes

Policies for business procurement

Documentation of application configurations

Results of business resumption planning efforts

An IS auditor discovers that due to resource constraints a database administrator (DBA) is responsible for developing and executing changes into the production environment Which ot the following should the auditor do FIRSTS

identify whether any compensating controls exist

Determine whether another DBA could make the changes

Report a potential segregation of duties violation

identify whether any compensating controls exist

Ensure a change management process is followed prior to implementation

A database administrator (DBA) should be prevented from having end user responsibilities:

having end user responsibilities

accessing sensitive information

having access to production files

An incident response team has been notified of a virus outbreak in a network subnet. Which of the following should be the NEXT step?

Verify that the compromised systems are fully functional

Remove and restore the affected systems

Which of the following provides the MOST reliable method of preventing unauthonzed logon?

Reinforcing current security policies

Installing an automatic password generator

Which of the following information security requirements BE ST enables the tracking of organizational data in a bring your own device (BYOD) environment?

Employees must enroll their personal devices in the organization's mobile device management program

Employees must immediately report lost or stolen mobile devices containing organizational data

Employees must sign acknowledgment of the organization's mobile device acceptable use policy

Employees must enroll their personal devices in the organization's mobile device management program

A company requires that all program change requests (PCRs) be approved and all modifications be automatically logged. Which of the following IS audit procedures will BEST determine whether unauthorized changes have been made to production programs?

Use source code comparison software to determine whether any changes have been made to a sample of programs since the last audit date

Trace a sample of complete PCR forms to the log of all program changes

Use source code comparison software to determine whether any changes have been made to a sample of programs since the last audit date

Review a sample of PCRs for proper approval throughout the program change process

Trace a sample of program change from the log to completed PCR forms

Which of the following is the PRIMARY reason to perform a risk assessment?

To determine the current risk profile

To ensure alignment with the business impact analysis (BIA)

To achieve compliance with regulatory requirements

To help allocate budget for risk mitigation controls

Which of the following is an IS auditor's BEST approach when prepanng to evaluate whether the IT strategy supports the organization's vision and mission?

Meet with senior management to understand business goals

Review strategic projects tor return on investments (ROls)

Solicit feedback from other departments to gauge the organization's maturity

Meet with senior management to understand business goals

Review the organization's key performance indicators (KPls)

A review of IT interface controls finds an organization does not have a process to identify and correct records that do not get transferred to the receiving system Which of the following is the IS auditors BEST recommendation?

implement software to perform automatic reconciliations of data between systems

Enable automatic encryption decryption and electronic signing of data files

implement software to perform automatic reconciliations of data between systems

Have coders perform manual reconciliation of data between systems

Automate the transfer of data between systems as much as feasible

A firewall between internal network segments improves security and reduces risk by:

inspecting all traffic flowing between network segments and applying security policies

Jogging all packets passing through network segments

inspecting all traffic flowing between network segments and applying security policies

monitoring and reporting on sessions between network participants

ensuring all connecting systems have appropriate security controls enabled.

Isaca CISA Practice Test 15 - Free Online Exam Prep & Questions

Users are complaining that a newly released enterprise resource planning (ERP) system is functioning too slowly. Which of the following tests during the quality assurance (QA) phase would have identified this concern?

Become a Premium Member for full access

Unlock Premium Member

Isaca CISA Practice Test 15

Question

Isaca CISA Practice Tests

Practice Tests