Which of the following would be an IS auditor's BEST recommendation to senior management when several IT initiatives are found to be misaligned with the organization's strategy?

Reassess IT initiatives that do not map to business strategies.

Modify IT initiatives that do not map to business strategies.

Reassess IT initiatives that do not map to business strategies.

Define key performance indicators (KPIs) for IT.

Reassess the return on investment (ROI) for the IT initiatives.

During the planning phase of a data loss prevention (DLP) audit, management expresses a concern about mobile computing. Which of the following should the IS auditor identify as the associated risk?

Increased vulnerability due to anytime, anywhere accessibility

Increased need for user awareness training

The use of the cloud negatively impacting IT availability

Lack of governance and oversight for IT infrastructure and applications

Which of the following is the BEST way to prevent social engineering incidents?

Maintain an onboarding and annual security awareness program.

Ensure user workstations are running the most recent version of antivirus software.

Maintain an onboarding and annual security awareness program.

Include security responsibilities in job descriptions and require signed acknowledgment.

Enforce strict email security gateway controls.

Which of the following is the PRIMARY advantage of using an automated security log monitoring tool instead of conducting a manual review to monitor the use of privileged access?

Increased likelihood of detecting suspicious activity

Reduced costs associated with automating the review

Increased likelihood of detecting suspicious activity

Ease of storing and maintaining log file

Ease of log retrieval for audit purposes

Which of the following is the PRIMARY reason an IS auditor would recommend offsite backups although critical data is already on a redundant array of inexpensive disks (RAID)?

The array cannot recover from a natural disaster.

Disks of the array cannot be hot-swapped for quick recovery.

The array cannot offer protection against disk corruption.

The array relies on proper maintenance.

The array cannot recover from a natural disaster.

The waterfall life cycle model of software development is BEST suited for which of the following situations?

The project requirements are well understood.

The project will involve the use of new technology.

The project intends to apply an object-oriented design approach.

The project requirements are well understood.

The project is subject to time pressures.

Which of the following is the GREATEST risk related to the use of virtualized environments?

The host may be a potential single point of failure within the system.

There may be insufficient processing capacity to assign to guests.

There may be increased potential for session hijacking.

Ability to change operating systems may be limited.

Which of the following is the MAIN risk associated with adding a new system functionality during the development phase without following a project change management process?

The new functionality may not meet requirements.

The project may go over budget.

The added functionality has not been documented.

The project may fail to meet the established deadline.

The new functionality may not meet requirements.

Which of the following is the PRIMARY purpose of a rollback plan for a system change?

To ensure steps exist to remove the change if necessary

To ensure testing can be re-performed if required

To ensure a backup exists before implementing a change

To ensure the system change is effective

An IS auditor reviewing the system development life cycle (SDLC) finds there is no requirement for business cases. Which of the following should be offGREATEST concern to the organization?

Business resources have not been optimally assigned.

Vendor selection criteria are not sufficiently evaluated.

Business resources have not been optimally assigned.

Business impacts of projects are not adequately analyzed.

Project costs exceed established budgets.

Which of the following will provide the GREATEST assurance to IT management that a quality management system (QMS) is effective?

A high percentage of stakeholders satisfied with the quality of IT

A high percentage of IT processes reviewed by quality assurance (QA)

A high percentage of incidents being quickly resolved

A high percentage of IT employees attending quality training

Which of the following is the MOST important factor when an organization is developing information security policies and procedures?

Compliance with relevant regulations

Alignment with an information security framework

Compliance with relevant regulations

Inclusion of mission and objectives

Consultation with security staff

An IS auditor is reviewing a data conversion project. Which of the following is the auditor's BEST recommendation prior to go-live?

Conduct a mock conversion test.

Review test procedures and scenarios.

Establish a configuration baseline.

During a review, an IS auditor discovers that corporate users are able to access cloud-based applications and data from any Internet-connected web browser. Which of the following is the auditor's BEST recommendation to help prevent unauthorized access?

Implement multi-factor authentication.

Utilize strong anti-malware controls on all computing devices.

Update security policies and procedures.

Implement an intrusion detection system (IDS).

Implement multi-factor authentication.

Which of the following BEST indicates that an incident management process is effective?

Decreased time for incident resolution

Decreased number of calls to the help desk

Decreased time for incident resolution

Increased number of incidents reviewed by IT management

Increased number of reported critical incidents

Which of the following BEST reflects a mature strategic planning process?

An IT strategic plan that supports the corporate strategy

Action plans with IT requirements built into all projects

An IT strategic plan with specifications of controls and safeguards

An IT strategic plan that supports the corporate strategy

IT projects from the strategic plan are approved by management

Which of the following should be of GREATEST concern to an IS auditor reviewing an organization's business continuity plan (BCP)?

The BCP has not been tested since it was first issued.

The BCP's contact information needs to be updated.

The BCP is not version-controlled.

The BCP has not been approved by senior management.

The BCP has not been tested since it was first issued.

Which of the following is the PRIMARY objective of enterprise architecture (EA)?

Managing and planning for IT investments

Maintaining detailed system documentation

Managing and planning for IT investments

Executing customized development and delivery of projects

Enforcing the IT policy across the organization

Which of the following should be an IS auditor's GREATEST concern when reviewing an organization's security controls for policy compliance?

Security policy documents are available on a public domain website.

The security policy has not been reviewed within the past year.

Security policy documents are available on a public domain website.

Security policies are not applicable across all business units.

End users are not required to acknowledge security policy training.

An IT governance body wants to determine whether IT service delivery is based on consistently effective processes. Which of the following is the BEST approach?

Evaluate key performance indicators (KPIs).

Implement a control self-assessment (CSA).

Which of the following is an analytical review procedure for a payroll system?

Performing reasonableness tests by multiplying the number of employees by the average wage rate

Evaluating the performance of the payroll system using benchmarking software

Performing penetration attempts on the payroll system

Testing hours reported on time sheets

Which of the following provides the BEST evidence that system requirements are met when evaluating a project before implementation?

User acceptance testing (UAT) results

Sign-off from senior management

User acceptance testing (UAT) results

Which of the following should be of GREATEST concern to an IS auditor assessing an organization's patch management program?

There is no process in place to scan the network to identify missing patches.

Patches are deployed from multiple deployment servers.

There is no process in place to scan the network to identify missing patches.

Patches for medium- and low-risk vulnerabilities are omitted.

There is no process in place to quarantine servers that have not been patched.

Which of the following should be done FIRST when creating a data protection program?

Perform classification based on standards.

Implement data loss prevention (DLP) controls.

Perform classification based on standards.

Deploy intrusion detection systems (IDS).

Test logical access controls for effectiveness.

Isaca CISA Practice Test 21 - Free Online Exam Prep & Questions

Which of the following is MOST important to define within a disaster recovery plan (DRP)?

Become a Premium Member for full access

Unlock Premium Member

Isaca CISA Practice Test 21

Question

Isaca CISA Practice Tests

Practice Tests