Which of the following should be of GREATEST concern to an IS auditor conducting an audit of an organization that recently experienced a ransomware attack?

Backups were only performed within the local network

Antivirus software was unable to prevent the attack even though it was properly updated

The most recent security patches were not tested prior to implementation

Backups were only performed within the local network

Employees were not trained on cybersecurity policies and procedures

An organization is migrating its HR application to an Infrastructure as a Service (laaS) model in a private cloud. Who is PRIMARILY responsible for the security configurations of the deployed application's operating system?

The cloud provider's external auditor

Which of the following should be of GREATEST concern to an IS auditor who is assessing an organization's configuration and release management process?

Changes and change approvals are not documented

The organization does not use an industry-recognized methodology

Changes and change approvals are not documented

All changes require middle and senior management approval

There is no centralized configuration management database (CMDB)

An IS auditor is performing a follow-up audit for findings identified in an organization's user provisioning process Which of the following is the MOST appropriate population to sample from when testing for remediation?

All users provisioned after the final audit report was issued

All users provisioned after the finding was originally identified

All users provisioned after management resolved the audit issue

All users provisioned after the final audit report was issued

All users who have followed user provisioning processes provided by management

Which of the following is the GREATEST advantage of vulnerability scanning over penetration testing?

The testing process can be automated to cover large groups of assets

The testing produces a lower number of false positive results

Network bandwidth is utilized more efficiently

Custom-developed applications can be tested more accurately

The testing process can be automated to cover large groups of assets

Which of the following is the BEST reason for an IS auditor to emphasize to management the importance of using an IT governance framework?

Frameworks can be tailored and optimized for different organizations

Frameworks enable IT benchmarks against competitors

Frameworks can be tailored and optimized for different organizations

Frameworks help facilitate control self-assessments (CSAs)

Frameworks help organizations understand and manage IT risk

During a routine internal software licensing review, an IS auditor discovers instances where employees shared license keys to critical pieces of business software. Which of the following would be the auditor's BEST course of action?

Verify whether the licensing agreement allows shared use

Recommend the utilization of software licensing monitoring tools

Recommend the purchase of additional software license keys

Validate user need for shared software licenses

Verify whether the licensing agreement allows shared use

During a routine internal software licensing review, an IS auditor discovers instances where employees shared license keys to critical pieces of business software. Which of the following would be the auditor's BEST course of action?

Verify whether the licensing agreement allows shared use

Recommend the utilization of software licensing monitoring tools

Recommend the purchase of additional software license keys

Validate user need for shared software licenses

Verify whether the licensing agreement allows shared use

Which of the following indicates that an internal audit organization is structured to support the independence and clarity of the reporting process?

The internal audit manager has a reporting line to the audit committee.

Auditors are responsible for performing operational duties or activities.

The internal audit manager reports functionally to a senior management official.

The internal audit manager has a reporting line to the audit committee.

Auditors are responsible for assessing and operating a system of internal controls.

Which of the following is the MOST important outcome of an information security program?

Organizational awareness of security responsibilities is improved.

Operating system weaknesses are more easily identified.

Emerging security technologies are better understood and accepted.

The cost to mitigate information security risk is reduced.

Organizational awareness of security responsibilities is improved.

When auditing the feasibility study of a system development project, the IS auditor should:

review cost-benefit documentation for reasonableness.

review qualifications of key members of the project team.

review the request for proposal (RFP) to ensure that it covers the scope of work.

review cost-benefit documentation for reasonableness.

ensure that vendor contracts are reviewed by legal counsel.

An IS auditor finds a segregation of duties issue in an enterprise resource planning (ERP) system. Which of the following is the BEST way to prevent the misconfiguration from recurring?

Granting user access using a role-based model

Monitoring access rights on a regular basis

Referencing a standard user-access matrix

Granting user access using a role-based model

Correcting the segregation of duties conflicts

A web proxy server for corporate connections to external resources reduces organizational risk by:

anonymizing users through changed IP addresses.

providing multi-factor authentication for additional security.

providing faster response than direct access.

load balancing traffic to optimize data pathways.

Which of the following should be the GREATEST concern to an IS auditor reviewing an organization's method to transport sensitive data between offices?

The method relies exclusively on the use of public key infrastructure (PKI).

The method relies exclusively on the use of asymmetric encryption algorithms.

The method relies exclusively on the use of 128-bit encryption.

The method relies exclusively on the use of digital signatures.

The method relies exclusively on the use of public key infrastructure (PKI).

Which of the following is MOST important for an IS auditor to validate when auditing network device management?

All devices have current security patches assessed.

Devices cannot be accessed through service accounts.

Backup policies include device configuration files.

All devices have current security patches assessed.

All devices are located within a protected network segment.

Which of the following should be restricted from a network administrator's privileges in an adequately segregated IT environment?

Changing existing configurations for applications

Ensuring transmission protocols are functioning correctly

An IS auditor is reviewing the security of a web-based customer relationship management (CRM) system that is directly accessed by customers via the Internet, which of the following should be a concern for the auditor?

The system is hosted within an internal segment of a corporate network.

The system is hosted on an external third-party service provider's server.

The system is hosted in a hybrid-cloud platform managed by a service provider.

The system is hosted within a demilitarized zone (DMZ) of a corporate network.

The system is hosted within an internal segment of a corporate network.

As part of the architecture of virtualized environments, in a bare metal or native visualization the hypervisor runs without:

any applications on the guest operating system.

any applications on the host operating system.

Which of the following should an IS auditor recommend be done FIRST when an organization is made aware of a new regulation that is likely to impact IT security requirements?

Determine which systems and IT-related processes may be impacted.

Update security policies based on the new regulation.

Determine which systems and IT-related processes may be impacted.

Evaluate how security awareness and training content may be impacted.

Review the design and effectiveness of existing IT controls.

Which of the following should an IS auditor recommend be done FIRST when an organization is made aware of a new regulation that is likely to impact IT security requirements?

Determine which systems and IT-related processes may be impacted.

Update security policies based on the new regulation.

Determine which systems and IT-related processes may be impacted.

Evaluate how security awareness and training content may be impacted.

Review the design and effectiveness of existing IT controls.

An IS auditor learns that an in-house system development life cycle (SDLC) project has not met user specifications. The auditor should FIRST examine requirements from which of the following phases?

Development phase The quality assurance (QA) phase is the phase where the IS auditor should first examine requirements from an in-house SDLC project that has not met user specifications. This is because the QA phase is the phase where the system is tested and verified against the user specifications and the design specifications to ensure that it meets the functional and non-functional requirements, as well as the quality standards and expectations.The QA phase involves various testing activities, such as unit testing, integration testing, system testing, acceptance testing, performance testing, security testing, etc., to identify and resolve any defects, errors, or deviations from the specifications12. The configuration phase is not the phase where the IS auditor should first examine requirements from an in-house SDLC project that has not met user specifications. The configuration phase is the phase where the system is installed and configured on the target environment, such as hardware, software, network, etc., to prepare it for deployment and operation.The configuration phase may involve activities such as installation, customization, migration, integration, etc., to ensure that the system is compatible and interoperable with the existing infrastructure and systems34. The user training phase is not the phase where the IS auditor should first examine requirements from an in-house SDLC project that has not met user specifications. The user training phase is the phase where the end-users are trained and educated on how to use the system effectively and efficiently.The user training phase may involve activities such as developing training materials, conducting training sessions, providing feedback and support, etc., to ensure that the users are familiar and comfortable with the system features and functions56. The development phase is not the phase where the IS auditor should first examine requirements from an in-house SDLC project that has not met user specifications. The development phase is the phase where the system is coded and built based on the design specifications and the user specifications.The development phase may involve activities such as programming, debugging, documenting, etc., to create a working prototype or a final product of the system

What should an IS auditor do FIRST when a follow-up audit reveals some management action plans have not been initiated?

Escalate the lack of plan completion to executive management.

Confirm whether the identified risks are still valid.

Provide a report to the audit committee.

Escalate the lack of plan completion to executive management.

Request an additional action plan review to confirm the findings.

Transaction records from a business database were inadvertently deleted, and system operators decided to restore from a snapshot copy. Which of the following provides assurance that the BEST transactions were recovered successfully?

Recount the transaction records to ensure no records are missing.

Review transaction recovery logs to ensure no errors were recorded.

Recount the transaction records to ensure no records are missing.

Rerun the process on a backup machine to verify the results are the same.

Compare transaction values against external statements to verify accuracy.

Which of the following should be of MOST concern to an IS auditor reviewing the information systems acquisition, development, and implementation process?

There is no system documentation available for review.

Data owners are not trained on the use of data conversion tools.

A post-implementation lessons-learned exercise was not conducted.

There is no system documentation available for review.

System deployment is routinely performed by contractors.

An IS auditor is asked to review an organization's technology relationships, interfaces, and data. Which of the following enterprise architecture (EA) areas is MOST appropriate this review? (Choose Correct answer and give explanation from CISA Certification - Information Systems Auditor official book)

Information security architecture

Which of the following is the BEST way to detect unauthorized copies of licensed software on systems?

Conduct periodic software scanning.

Implement controls to prohibit downloads of unauthorized software.

Conduct periodic software scanning.

Perform periodic counting of licenses.

Require senior management approval when installing licenses.

Which of the following is a method to prevent disclosure of classified documents printed on a shared printer?

Requiring a key code to be entered on the printer to produce hard copy

Using passwords to allow authorized users to send documents to the printer

Requiring a key code to be entered on the printer to produce hard copy

Encrypting the data stream between the user's computer and the printer

Producing a header page with classification level for printed documents

During a follow-up audit, an IS auditor finds that senior management has implemented a different remediation action plan than what was previously agreed upon. Which of the following is the auditor's BEST course of action?

Evaluate the implemented control to ensure it mitigates the risk to an acceptable level.

Report the deviation by the control owner in the audit report.

Evaluate the implemented control to ensure it mitigates the risk to an acceptable level.

Cancel the follow-up audit and reschedule for the next audit period.

Request justification from management for not implementing the recommended control.

An IS auditor is concerned that unauthorized access to a highly sensitive data center might be gained by piggybacking or tailgating. Which of the following is the BEST recommendation? (Choose Correct answer and give explanation from CISA Certification - Information Systems Auditor official book)

Procedures for escorting visitors

Which of the following is the PRIMARY purpose of obtaining a baseline image during an operating system audit?

To identify atypical running processes

To verify antivirus definitions

To identify local administrator account access

To verify the integrity of operating system backups

Which of the following is the PRIMARY purpose of obtaining a baseline image during an operating system audit?

To identify atypical running processes

To verify antivirus definitions

To identify local administrator account access

To verify the integrity of operating system backups

Isaca CISA Practice Test 16 - Free Online Exam Prep & Questions

Which of the following is the BEST way to help ensure new IT implementations align with enterprise architecture (EA) principles and requirements?

Become a Premium Member for full access

Unlock Premium Member

Isaca CISA Practice Test 16

Question

Isaca CISA Practice Tests

Practice Tests