Which of the following is the BEST indicator for measuring performance of IT help desk function?

Percentage of problems raised from incidents

Mean time to categorize tickets

Which of the following is MOST important to determine when conducting an audit Of an organization's data privacy practices?

Whether the systems inventory containing personal data is maintained

Whether a disciplinary process is established for data privacy violations

Whether strong encryption algorithms are deployed for personal data protection

Whether privacy technologies are implemented for personal data protection

Whether the systems inventory containing personal data is maintained

Which of the following is MOST useful to an IS auditor performing a review of access controls for a document management system?

A system-generated list of staff and their project assignments. roles, and responsibilities

Policies and procedures for managing documents provided by department heads

A system-generated list of staff and their project assignments. roles, and responsibilities

Previous audit reports related to other departments' use of the same system

Information provided by the audit team lead an the authentication systems used by the department

Which of the following is the MOST efficient solution for a multi-location healthcare organization that wants to be able to access patient data wherever patients present themselves for care?

Software as a Service (SaaS) provider

Infrastructure as a Service (laaS) provider

Software as a Service (SaaS) provider

An IS auditor evaluating the change management process must select a sample from the change log. What is the BEST way to the auditor to confirm the change log is complete?

Take the last change from the system and trace it back to the log.

Interview change management personnel about completeness.

Take an item from the log and trace it back to the system.

Obtain management attestation of completeness.

Take the last change from the system and trace it back to the log.

Which of the following should be an IS auditor's GREATEST concern when a data owner assigns an incorrect classification level to data?

Controls to adequately safeguard the data may not be applied.

Data may not be encrypted by the system administrator.

Competitors may be able to view the data.

Control costs may exceed the intrinsic value of the IT asset.

During a review, an IS auditor discovers that corporate users are able to access cloud-based applications and data any Internet-connected web browser. Which Of the following is the auditor's BEST recommendation to prevent unauthorized access?

Implement multi-factor authentication.

Implement an intrusion detection system (IDS),

Update security policies and procedures.

Implement multi-factor authentication.

Utilize strong anti-malware controls on all computing devices.

An organization is concerned with meeting new regulations for protecting data confidentiality and asks an IS auditor to evaluate their procedures for transporting data. Which of the following would BEST support the organization's objectives?

Virtual local area network (VLAN)

Which of the following provides an IS auditor assurance that the interface between a point-of-sale (POS) system and the general ledger is transferring sales data completely and accurately?

Electronic copies of customer sales receipts are maintained.

Monthly bank statements are reconciled without exception.

Nightly batch processing has been replaced with real-time processing.

The data transferred over the POS interface is encrypted.

What is the PRIMARY purpose of performing a parallel run of a now system?

To validate the new system against its predecessor

To train the end users and supporting staff on the new system

To verify the new system provides required business functionality

To reduce the need for additional testing

To validate the new system against its predecessor

During which phase of the software development life cycle is it BEST to initiate the discussion of application controls?

Application design phase process functionalities are finalized

Business case development phase when stakeholders are identified

Application design phase process functionalities are finalized

User acceptance testing (UAT) phase when test scenarios are designed

Application coding phase when algorithms are developed to solve business problems

When testing the accuracy of transaction data, which of the following situations BEST justifies the use of a smaller sample size?

It is expected that the population is error-free.

The IS audit staff has a high level of experience.

It is expected that the population is error-free.

Proper segregation of duties is in place.

The data can be directly changed by users.

Which of following areas is MOST important for an IS auditor to focus on when reviewing the maturity model for a technology organization?

Roles and responsibility matrix

Service level agreements (SLAs)

Roles and responsibility matrix

The charging method that effectively encourages the MOST efficient use of IS resources is:

specific charges that can be tied back to specific usage.

total utilization to achieve full operating capacity.

residual income in excess of actual incurred costs.

allocations based on the ability to absorb charges.

Which of the following should an IS auditor review when evaluating information systems governance for a large organization?

Approval processes for new system implementations

Procedures for adding a new user to the invoice processing system

Approval processes for updating the corporate website

Procedures for regression testing system changes

Which of the following is an IS auditor's BEST recommendation to protect an organization from attacks when its file server needs to be accessible to external users?

Set up a demilitarized zone (DMZ).

Enforce a secure tunnel connection.

Set up a demilitarized zone (DMZ).

Which of the following concerns is MOST effectively addressed by implementing an IT framework for alignment between IT and business objectives?

Inadequate IT portfolio management

Inaccurate business impact analysis (BIA)

Inadequate IT change management practices

Inadequate IT portfolio management

When assessing a proposed project for the two-way replication of a customer database with a remote call center, the IS auditor should ensure that:

database conflicts are managed during replication.

end users are trained in the replication process.

the source database is backed up on both sites.

user rights are identical on both databases.

Which of the following is MOST important to consider when reviewing an organization's defined data backup and restoration procedures?

Mean time between failures (MTBF)

Which of the following should be an IS auditor's PRIMARY focus when evaluating the response process for cybercrimes?

Communication with law enforcement

Which of the following is the MOST important control for virtualized environments?

Hardening for the hypervisor and guest machines

Regular updates of policies for the operation of the virtualized environment

Hardening for the hypervisor and guest machines

Redundancy of hardware resources and network components

Monitoring utilization of resources at the guest operating system level

A bank wants to outsource a system to a cloud provider residing in another country. Which of the following would be the MOST appropriate IS audit recommendation?

Proceed as intended, as the provider has to observe all laws of the clients' countries.

Find an alternative provider in the bank's home country.

Ensure the provider's internal control system meets bank requirements.

Proceed as intended, as the provider has to observe all laws of the clients' countries.

Ensure the provider has disaster recovery capability.

The following findings are the result of an IS auditor's post-implementation review of a newly implemented system. Which of the following findings is of GREATEST significance?

Measurable benefits were not defined.

A lessons-learned session was never conducted.

The projects 10% budget overrun was not reported to senior management.

Measurable benefits were not defined.

Monthly dashboards did not always contain deliverables.

An IS auditor is reviewing the service agreement with a technology company that provides IT help desk services to the organization. Which of the following monthly performance metrics is the BEST indicator of service quality?

The percent of issues resolved by the first contact

The total number of users requesting help desk services

The average call waiting time on each request

The percent of issues resolved by the first contact

The average turnaround time spent on each reported issue

Which of the following should be done FIRST to minimize the risk of unstructured data?

Identify repositories of unstructured data.

Purchase tools to analyze unstructured data.

Implement strong encryption for unstructured data.

Implement user access controls to unstructured data.

Which of the following should be done FIRST to minimize the risk of unstructured data?

Identify repositories of unstructured data.

Purchase tools to analyze unstructured data.

Implement strong encryption for unstructured data.

Implement user access controls to unstructured data.

An organization has an acceptable use policy in place, but users do not formally acknowledge the policy. Which of the following is the MOST significant risk from this finding?

Lack of data for measuring compliance

Violation of industry standards

Noncompliance with documentation requirements

An organization has recently become aware of a pervasive chip-level security vulnerability that affects all of its processors. Which of the following is the BEST way to prevent this vulnerability from being exploited?

Implement security awareness training.

Review hardware vendor contracts.

Which of the following should be the GREATEST concern to an IS auditor reviewing an organization's method to transport sensitive data between offices?

The method relies exclusively on the use of asymmetric encryption algorithms.

The method relies exclusively on the use of public key infrastructure (PKI).

The method relies exclusively on the use of digital signatures.

The method relies exclusively on the use of asymmetric encryption algorithms.

The method relies exclusively on the use of 128-bit encryption.

Which of the following is the BEST point in time to conduct a post-implementation review?

Prior to the annual performance review

During a project audit, an IS auditor notes that project reporting does not accurately reflect current progress. Which of the following is the GREATEST resulting impact?

The project steering committee cannot provide effective governance.

The project manager will have to be replaced.

The project reporting to the board of directors will be incomplete.

The project steering committee cannot provide effective governance.

The project will not withstand a quality assurance (QA) review.

Isaca CISA Practice Test 17 - Free Online Exam Prep & Questions

Which of the following be of GREATEST concern to an IS auditor reviewing on-site preventive maintenance for an organization's business-critical server hardware?

Become a Premium Member for full access

Unlock Premium Member

Isaca CISA Practice Test 17

Question

Isaca CISA Practice Tests

Practice Tests