Audit frameworks can assist the IS audit function by:

providing direction and information regarding the performance of audits.

defining the authority and responsibility of the IS audit function.

providing direction and information regarding the performance of audits.

outlining the specific steps needed to complete audits.

providing details on how to execute the audit program.

An IS auditor reviewing an information processing environment decides to conduct external penetration testing. Which of the following is MOST appropriate to include in the audit scope for the organization to distinguish between the auditor's penetration attacks and actual attacks?

Source IP addresses of simulated attacks

Restricted host IP addresses of simulated attacks

Testing techniques of simulated attacks

Source IP addresses of simulated attacks

The PRIMARY role of an IS auditor in the remediation of problems found during an audit engagement is to:

explain the findings and provide general advice.

help auditee management by providing the solution.

explain the findings and provide general advice.

present updated policies to management for approval.

take ownership of the problems and oversee remediation efforts.

An IS auditor has been asked to review the quality of data in a general ledger system. Which of the following would provide the auditor with the MOST meaningful results?

Integrity checks against source documentation

Discussion of the largest account values with business owners

Integrity checks against source documentation

System vulnerability assessment

Interviews with system owners and operators

An organization is establishing a steering committee for the implementation of a new enterprise resource planning (ERP) system that uses Agile project management methodology. What is the MOST important criterion for the makeup of this committee?

Agile project management experience

Senior management representation

Ability to meet the time commitment required

Agile project management experience

Following a merger, a review of an international organization determines the IT steering committee's decisions do not extend to regional offices as required in the consolidated IT operating model. Which of the following is the IS auditor's BEST recommendation?

Update the IT steering committee's formal charter.

Create regional centers of excellence.

Engage an IT governance consultant.

Create regional IT steering committees.

Update the IT steering committee's formal charter.

While conducting a follow-up on an asset management audit, the IS auditor finds paid invoices for IT devices not recorded in the organization's inventory. Which of the following is the auditor's BEST course of action?

Alert both audit and operations management about the discrepancy.

Ask the asset management staff where the devices are.

Alert both audit and operations management about the discrepancy.

Ignore the invoices since they are not part of the follow-up.

Make a note of the evidence to include it in the scope of a future audit.

An IS auditor is reviewing processes for importing market price data from external data providers. Which of the following findings should the auditor consider MOST critical?

The quality of the data is not monitored.

Imported data is not disposed of frequently.

The transfer protocol is not encrypted.

The transfer protocol does not require authentication.

The quality of the data is not monitored.

Which of the following would be an IS auditor's BEST recommendation to senior management when several IT initiatives are found to be misaligned with the organization's strategy?

Reassess IT initiatives that do not map to business strategies.

Define key performance indicators (KPIs) for IT.

Modify IT initiatives that do not map to business strategies.

Reassess the return on investment (ROI) for the IT initiatives.

Reassess IT initiatives that do not map to business strategies.

Which of the following is the MOST effective way to evaluate the physical security of a data center?

Review data center access logs.

Interview data center stakeholders.

Review camera footage from the data center.

Which of the following user actions poses the GREATEST risk for inadvertently introducing malware into a local network?

Opening an email attachment from an external account

Uploading a file onto an internal server

Viewing a hypertext markup language (HTML) document

Downloading a file from an enterprise file share

Opening an email attachment from an external account

Which of the following is the GREATEST concern related to an organization's data classification processes?

Users responsible for managing records are unaware of the data classification processes.

Systems used to manage the data classification processes are not synchronized.

The data classification processes have not been updated in the last year.

The data classification processes are not aligned with industry standards.

An IS auditor learns that a business owner violated the organization's security policy by creating a web page with access to production data. The auditor's NEXT step should be to:

determine if sufficient access controls exist.

assess the sensitivity of the production data.

Which of the following should be the PRIMARY focus when communicating an IS audit issue to management?

The risk to which the organization is exposed due to the issue

The nature, extent, and timing of subsequent audit follow-up

How the issue was found and who bears responsibility

A detailed solution for resolving the issue

When building or upgrading enterprise cryptographic infrastructure, which of the following is the MOST critical requirement for growing business environments?

Scalable architectures and systems

Backup and restoration capabilities

Scalable architectures and systems

Which of the following is the PRIMARY reason an IS auditor would recommend offsite backups although critical data is already on a redundant array of inexpensive disks (RAID)?

The array cannot recover from a natural disaster.

The array cannot offer protection against disk corruption.

The array cannot recover from a natural disaster.

The array relies on proper maintenance.

Disks of the array cannot be hot-swapped for quick recovery.

Management has requested a post-implementation review of a newly implemented purchasing package to determine the extent that business requirements are being met. Which of the following is MOST likely to be assessed?

Purchasing guidelines and policies

A review of IT interface controls finds an organization does not have a process to identify and correct records that do not get transferred to the receiving system. Which of the following is the ISauditor's BEST recommendation?

Implement software to perform automatic reconciliations of data between systems.

Enable automatic encryption, decryption, and electronic signing of data files.

Automate the transfer of data between systems as much as is feasible.

Have coders perform manual reconciliation of data between systems.D

Implement software to perform automatic reconciliations of data between systems.

Which of the following should be of GREATEST concern to an IS auditor assessing the effectiveness of an organization's information security governance?

The information security policy does not extend to service providers.

Risk assessments of information assets are not periodically performed.

The information security policy does not extend to service providers.

There is no process to measure information security performance.

The information security policy is not reviewed by executive management.

Which of the following findings would be of GREATEST concern when auditing an organization's end-user computing (EUC)?

Inconsistency of patching processes being followed

Errors flowed through to financial statements

Reduced oversight by the IT department

Inconsistency of patching processes being followed

Inability to monitor EUC audit logs and activities

Which of the following security measures will reduce the risk of propagation when a cyberattack occurs?

Data loss prevention (DLP) system

Which of the following is an effective way to ensure the integrity of file transfers in a peer-to-peer (P2P) computing environment?

Associate a message authentication code with each file transferred.

Ensure the files are transferred through an intrusion detection system (IDS).

Encrypt the packets shared between peers within the environment.

Connect the client computers in the environment to a jump server.

Which of the following criteria is MOST important for the successful delivery of benefits from an IT project?

Involving key stakeholders during the development and execution phases of the project

Assessing the impact of changes to individuals and business units within the organization

Involving key stakeholders during the development and execution phases of the project

Ensuring that IT project managers have sign-off authority on the business case

Quantifying the size of the software development effort required by the project

Which of the following tasks would cause the GREATEST segregation of duties (SoD) concern if performed by the person who reconciles the organization's device inventory?

Tracking devices used for spare parts

Approving the issuing of devices

An organization allows programmers to change production systems in emergency situations without seeking prior approval. Which of the following controls should an IS auditor consider MOSTimportant?

Programmers' subsequent reports

An IS auditor is reviewing documentation from a change that was applied to an application. Which of the following findings would be the GREATEST concern?

Testing documentation is approved prior to completion of user acceptance testing (UAT).

Testing documentation does not show manager approval.

Testing documentation is dated three weeks before the system implementation date.

Testing documentation is approved prior to completion of user acceptance testing (UAT).

Testing documentation is kept in hard copy format.

A new system development project is running late against a critical implementation deadline. Which of the following is the MOST important activity?

Perform user acceptance testing (UAT).

Ensure that code has been reviewed.

Perform user acceptance testing (UAT).

Document last-minute enhancements.

Perform a pre-implementation audit.

Which of the following BEST addresses the availability of an online store?

A mirrored site at another location

In order for a firewall to effectively protect a network against external attacks, what fundamental practice must be followed?

Only essential external services should be permitted.

The firewall must be placed in the demilitarized zone (DMZ).

Only essential external services should be permitted.

Filters for external information must be defined.

All external communication must be via the firewall.

What is the MOST effective way to manage contractors' access to a data center?

Escort requirement for visitor access

Badge identification worn by visitors

Escort requirement for visitor access

Management approval of visitor access

Verification of visitor identification

Which of the following is the BEST way to strengthen the security of smart devices to prevent data leakage?

Enforce strong security settings on smart devices.

Require employees to formally acknowledge security procedures.

Review access logs to the organization's sensitive data in a timely manner.

Include usage restrictions in bring your own device (BYOD) security procedures.

Isaca CISA Practice Test 20 - Free Online Exam Prep & Questions

Which of the following is MOST likely to be reduced when implementing optimal risk management strategies?

Become a Premium Member for full access

Unlock Premium Member

Isaca CISA Practice Test 20

Question

Isaca CISA Practice Tests

Practice Tests