An IS auditor discovers an option in a database that allows the administrator to directly modify any table. This option is necessary to overcome bugs in the software, but is rarely used. Changes to tables are automatically logged. The IS auditor's FIRST action should be to:

determine whether the audit trail is secured and reviewed.

recommend that the option to directly modify the database be removed immediately.

recommend that the system require two persons to be involved in modifying the database.

determine whether the log of changes to the tables is backed up.

determine whether the audit trail is secured and reviewed.

An IS auditor finds that a key Internet-facing system is vulnerable to attack and that patches are not available. What should the auditor recommend be done FIRST?

Implement a new system that can be patched.

Implement additional firewalls to protect the system.

A system administrator recently informed the IS auditor about the occurrence of several unsuccessful intrusion attempts from outside the organization. Which of the following is MOST effective in detecting such an intrusion?

Periodically reviewing log files

Configuring the router as a firewall

Using smart cards with one-time passwords

Installing biometrics-based authentication

The PRIMARY advantage of object-oriented technology is enhanced:

efficiency due to the re-use of elements of logic.

management of sequential program execution for data access.

grouping of objects into methods for data access.

management of a restricted variety of data types for a data object.

From an IS auditor's perspective, which of the following would be the GREATEST risk associated with an incomplete inventory of deployed software in an organization?

Inability to deploy updated security patches

Inability to close unused ports on critical servers

Inability to identify unused licenses within the organization

Inability to deploy updated security patches

Inability to determine the cost of deployed software

Which of the following BEST minimizes performance degradation of servers used to authenticate users of an e-commerce website?

Configure each authentication server as belonging to a cluster of authentication servers.

Configure a single server as a primary authentication server and a second server as a secondary authentication server.

Configure each authentication server as belonging to a cluster of authentication servers.

Configure each authentication server and ensure that each disk of its RAID is attached to the primary controller.

Configure each authentication server and ensure that the disks of each server form part of a duplex.

During an audit of a reciprocal disaster recovery agreement between two companies, the IS auditor would be MOST concerned with the:

allocation of resources during an emergency.

differences in IS policies and procedures.

maintenance of hardware and software compatibility.

Which of the following attack techniques will succeed because of an inherent security weakness in an Internet firewall?

Flooding the site with an excessive number of packets

Using a dictionary attack of encrypted passwords

Intercepting packets and viewing passwords

Flooding the site with an excessive number of packets

Which of the following is an executive management concern that could be addressed by the implementation of a security metrics dashboard?

Effectiveness of the security program

Security incidents vs. industry benchmarks

Total number of hours budgeted to security

Total number of false positives

One benefit of return on investment (ROI) analysts in IT decision making is that it provides the:

basis for allocating financial resources.

basis for allocating indirect costs.

basis for allocating financial resources.

Which of the following is an audit reviewer's PRIMARY role with regard to evidence?

Ensuring evidence is sufficient to support audit conclusions

Ensuring unauthorized individuals do not tamper with evidence after it has been captured

Ensuring evidence is sufficient to support audit conclusions

Ensuring appropriate statistical sampling methods were used

Ensuring evidence is labeled to show it was obtained from an approved source

Which of the following is the MOST important benefit of involving IS audit when implementing governance of enterprise IT?

Providing independent and objective feedback to facilitate improvement of IT processes

Identifying relevant roles for an enterprise IT governance framework

Making decisions regarding risk response and monitoring of residual risk

Verifying that legal, regulatory, and contractual requirements are being met

Providing independent and objective feedback to facilitate improvement of IT processes

Which of the following is MOST important for an effective control self-assessment (CSA) program?

Understanding the business process

Determining the scope of the assessment

Performing detailed test procedures

Evaluating changes to the risk environment

Understanding the business process

What should be the PRIMARY basis for selecting which IS audits to perform in the coming year?

Previous audit coverage and scope

Which of the following is the MOST important prerequisite for the protection of physical information assets in a data center?

Complete and accurate list of information assets that have been deployed

Segregation of duties between staff ordering and staff receiving information assets

Complete and accurate list of information assets that have been deployed

Availability and testing of onsite backup generators

Knowledge of the IT staff regarding data protection requirements

Which of the following would be a result of utilizing a top-down maturity model process?

Identification of processes with the most improvement opportunities

A means of benchmarking the effectiveness of similar processes with peers

A means of comparing the effectiveness of other processes within the enterprise

Identification of older, more established processes to ensure timely review

Identification of processes with the most improvement opportunities

Which of the following is the MOST effective control to mitigate unintentional misuse of authorized access?

Annual sign-off of acceptable use policy

Regular monitoring of user access logs

A system development project is experiencing delays due to ongoing staff shortages. Which of the following strategies would provide the GREATEST assurance of system quality at implementation?

Deliver only the core functionality on the initial target date.

Implement overtime pay and bonuses for all development staff.

Utilize new system development tools to improve productivity.

Recruit IS staff to expedite system development.

Deliver only the core functionality on the initial target date.

Which of the following should be done FIRST when planning a penetration test?

Obtain management consent for the testing.

Execute nondisclosure agreements (NDAs).

Determine reporting requirements for vulnerabilities.

Obtain management consent for the testing.

Due to limited storage capacity, an organization has decided to reduce the actual retention period for media containing completed low-value transactions. Which of the following is MOST important for the organization to ensure?

The retention period complies with data owner responsibilities.

The policy includes a strong risk-based approach.

The retention period allows for review during the year-end audit.

The total transaction amount has no impact on financial reporting.

The retention period complies with data owner responsibilities.

During the implementation of an upgraded enterprise resource planning (ERP) system, which of the following is the MOST important consideration for a go-live decision?

Post-implementation review objectives

During a disaster recovery audit, an IS auditor finds that a business impact analysis (BIA) has not been performed. The auditor should FIRST

evaluate the impact on current disaster recovery capability.

perform a business impact analysis (BIA).

issue an intermediate report to management.

evaluate the impact on current disaster recovery capability.

conduct additional compliance testing.

Which of the following is the MOST effective control for protecting the confidentiality and integrity of data stored unencrypted on virtual machines?

Monitor access to stored images and snapshots of virtual machines.

Restrict access to images and snapshots of virtual machines.

Limit creation of virtual machine images and snapshots.

Review logical access controls on virtual machines regularly.

An IS auditor is examining a front-end subledger and a main ledger. Which of the following would be the GREATEST concern if there are flaws in the mapping of accounts between the two systems?

Inaccuracy of financial reporting

Double-posting of a single journal entry

Inability to support new business transactions

Unauthorized alteration of account attributes

Inaccuracy of financial reporting

What is MOST important to verify during an external assessment of network vulnerability?

Completeness of network asset inventory

Update of security information event management (SIEM) rules

Regular review of the network security policy

Completeness of network asset inventory

Location of intrusion detection systems (IDS)

A data breach has occurred due lo malware. Which of the following should be the FIRST course of action?

Quarantine the impacted systems.

Notify the cyber insurance company.

Shut down the affected systems.

Quarantine the impacted systems.

Notify customers of the breach.

Which of the following should an IS auditor be MOST concerned with during a post-implementation review?

The system does not have a maintenance plan.

The system contains several minor defects.

The system deployment was delayed by three weeks.

The system was over budget by 15%.

Which of the following is the BEST way to mitigate the impact of ransomware attacks?

Invoking the disaster recovery plan (DRP)

Requiring password changes for administrative accounts

Malicious program code was found in an application and corrected prior to release into production. After the release, the same issue was reported. Which of the following is the IS auditor's BEST recommendation?

Ensure programmers cannot access code after the completion of program edits.

Ensure corrected program code is compiled in a dedicated server.

Ensure change management reports are independently reviewed.

Ensure programmers cannot access code after the completion of program edits.

Ensure the business signs off on end-to-end user acceptance test (UAT) results.

Documentation of workaround processes to keep a business function operational during recovery of IT systems is a core part of a:

business continuity plan (BCP).

business impact analysis (BIA).

business continuity plan (BCP).

Which of the following strategies BEST optimizes data storage without compromising data retention practices?

Limiting the size of file attachments being sent via email

Automatically deleting emails older than one year

Moving emails to a virtual email vault after 30 days

Allowing employees to store large emails on flash drives

Which of the following should an IS auditor recommend as a PRIMARY area of focus when an organization decides to outsource technical support for its external customers?

Align service level agreements (SLAs) with current needs.

Monitor customer satisfaction with the change.

Minimize costs related to the third-party agreement.

Ensure right to audit is included within the contract.

To confirm integrity for a hashed message, the receiver should use:

the same hashing algorithm as the sender's to create a binary image of the file.

a different hashing algorithm from the sender's to create a binary image of the file.

the same hashing algorithm as the sender's to create a numerical representation of the file.

a different hashing algorithm from the sender's to create a numerical representation of the file.

Isaca CISA Practice Test 2 - Free Online Exam Prep & Questions

Question 1 / 40

During an external review, an IS auditor observes an inconsistent approach in classifying system criticality within the organization. Which of the following should be recommended as the PRIMARY factor to determine system criticality?

Key performance indicators (KPIs)

Maximum allowable downtime (MAD)

Recovery point objective (RPO)

Mean time to restore (MTTR)

Comment (0)

Isaca CISA Practice Test 2

Question

Isaca CISA Practice Tests

Practice Tests