Audit frameworks can assist the IS audit function by:

providing direction and information regarding the performance of audits.

providing details on how to execute the audit program.

outlining the specific steps needed to complete audits.

providing direction and information regarding the performance of audits.

defining the authority and responsibility of the IS audit function.

Which of the following is the GREATEST advantage of maintaining an internal IS audit function within an organization?

Better understanding of the business and processes

Increased independence and impartiality of recommendations

Better understanding of the business and processes

Ability to negotiate recommendations with management

Increased IS audit staff visibility and availability throughout the year

An IS auditor is reviewing processes for importing market price data from external data providers. Which of the following findings should the auditor consider MOST critical?

The transfer protocol does not require authentication.

The quality of the data is not monitored.

Imported data is not disposed of frequently.

The transfer protocol is not encrypted.

Data from a system of sensors located outside of a network is received by the open ports on a server. Which of the following is the BEST way to ensure the integrity of the data being collected from the sensor system?

Hash the data that is transmitted from the sensor system.

Route the traffic from the sensor system through a proxy server.

Hash the data that is transmitted from the sensor system.

Implement network address translation on the sensor system.

Transmit the sensor data via a virtual private network (VPN) to the server.

An IS audit manager was temporarily tasked with supervising a project manager assigned to the organization's payroll application upgrade. Upon returning to the audit department, the audit manager has been asked to perform an audit to validate the implementation of the payroll application. The audit manager is the only one in the audit department with IT project management experience. What is the BEST course of action?

Outsource the audit to independent and qualified resources.

Transfer the assignment to a different audit manager despite lack of IT project management experience.

Outsource the audit to independent and qualified resources.

Manage the audit since there is no one else with the appropriate experience.

Have a senior IS auditor manage the project with the IS audit manager performing final review.

During an external review, an IS auditor observes an inconsistent approach in classifying system criticality within the organization. Which of the following should be recommended as the PRIMARY factor to determine system criticality?

Maximum allowable downtime (MAD)

Key performance indicators (KPIs)

Maximum allowable downtime (MAD)

An organization's sensitive data is stored in a cloud computing environment and is encrypted. Which of the following findings should be of GREATEST concern to an IS auditor?

Data encryption keys are accessible to the service provider.

The encryption keys are not kept under dual control.

The cloud vendor does not have multi-regional presence.

Symmetric keys are used for encryption.

Data encryption keys are accessible to the service provider.

The process of applying a hash function to a message and obtaining and ciphering a digest refers to:

public key infrastructure (PKI).

An IS auditor observes that a business-critical application does not currently have any level of fault tolerance. Which of the following is the GREATEST concern with this situation?

Decreased mean time between failures (MTBF)

An IS auditor is performing a follow-up audit for findings identified in an organization's user provisioning process. Which of the following is the MOST appropriate population to sample from when testing for remediation?

All users provisioned after management resolved the audit issue

All users provisioned after the final audit report was issued

All users who have followed user provisioning processes provided by management

All users provisioned after management resolved the audit issue

All users provisioned after the finding was originally identified

An organization has both an IT strategy committee and an IT steering committee. When reviewing the minutes of the IT steering committee, an IS auditor would expect to find that the committee:

acquired and assigned appropriate resources for projects.

assessed the contribution of IT to the business.

acquired and assigned appropriate resources for projects.

compared the risk and return of IT investments.

reviewed the achievement of the strategic IT objective.

An IS audit team is evaluating documentation of the most recent application user access review. It is determined that the user list was not system generated. Which of the following should be ofMOST concern?

Confidentiality of the user list

Timeliness of the user list review

An incident response team has been notified of a virus outbreak in a network subnet. Which of the following should be the NEXT step?

Remove and restore the affected systems.

Verify that the compromised systems are fully functional.

Which of the following should be the GREATEST concern to an IS auditor reviewing an organization's job scheduling practices?

Job dependencies are undefined.

Jobs are executed during working hours.

Job dependencies are undefined.

Job processing procedures are missing.

Which of the following is the GREATEST impact as a result of the ongoing deterioration of a detective control?

Increased number of false negatives in security logs

Decreased effectiveness of root cause analysis

Decreased overall recovery time

Increased number of false negatives in security logs

Increased demand for storage space for logs

Which of the following is the BEST way to ensure a vendor complies with system security requirements?

Require a compliance clause in the vendor contract.

Require security training for vendor staff.

Review past incidents reported by the vendor.

Review past audits on the vendor's security compliance.

Require a compliance clause in the vendor contract.

What is the PRIMARY reason to adopt a risk-based IS audit strategy?

To prioritize available resources and focus on areas with significant risk

To achieve synergy between audit and other risk management functions

To prioritize available resources and focus on areas with significant risk

To reduce the time and effort needed to perform a full audit cycle

To identify key threats, risks, and controls for the organization

Which of the following constitutes an effective detective control in a distributed processing environment?

A log of privileged account use is reviewed.

A disaster recovery plan (DRP)4% in place for the entire system.

User IDs are suspended after three incorrect passwords have been entered.

Users are required to request additional access via an electronic mail system.

During a follow-up engagement, an IS auditor confirms evidence of a problem that was not an issue in the original audit. Which of the following is the auditor's BEST course of action?

Report the risk to management in the follow-up report.

Include the evidence as part of a future audit.

Report only on the areas within the scope of the follow-up.

Report the risk to management in the follow-up report.

Expand the follow-up scope to include examining the evidence.

Which of the following is MOST important to the effectiveness of smoke detectors installed in a data processing facility?

Detectors trigger audible alarms when activated.

Detectors have the correct industry certification.

Detectors are linked to dry pipe fire suppression systems.

Detectors are linked to wet pipe fire suppression systems.

Which of the following BEST indicates a need to review an organization's information security policy?

Increasing exceptions approved by management

High number of low-risk findings in the audit report

Increasing exceptions approved by management

Increasing complexity of business transactions

Completion of annual IT risk assessment

An IS auditor is evaluating the log management system for an organization with devices and systems in multiple geographic locations. Which of the following is MOST important for the auditor to verify?

Log files are encrypted and digitally signed.

Log files are reviewed in multiple locations.

Log files are concurrently updated.

Log files are encrypted and digitally signed.

Log files of the servers are synchronized.

An organization is ready to implement a new IT solution consisting of multiple modules. The last module updates the processed data into the database. Which of the following findings should be of MOST concern to the IS auditor?

Absence of a formal change approval process

Which of the following observations regarding change management should be considered the MOST serious risk by an IS auditor?

The change is not approved by the business owners.

There is no software used to track change management.

The change is not approved by the business owners.

The change is deployed two weeks after approval.

The development of the change is not cost-effective.

Which of the following is MOST important when creating a forensic image of a hard drive?

Generating a content hash of the hard drive

Requiring an independent third party be present while imaging

Securing a backup copy of the hard drive

Generating a content hash of the hard drive

Choosing an industry-leading forensics software tool

Which of the following is the MOST efficient control to reduce the risk associated with a systems administrator having network administrator responsibilities?

The administrator will need to request additional approval for critical changes.

The administrator must obtain temporary access to make critical changes.

The administrator will need to request additional approval for critical changes.

The administrator must sign a due diligence agreement.

The administrator will be subject to unannounced audits.

A web application is developed in-house by an organization. Which of the following would provide the BEST evidence to an IS auditor that the application is secure from external attack?

Web application firewall (WAF) implementation

Database application monitoring logs

Which of the following is the GREATEST benefit of adopting an Agile audit methodology?

Better ability to address key risks

Less frequent client interaction

Reduced documentation requirements

The PRIMARY objective of a follow-up audit is to:

determine adequacy of actions taken on recommendations.

assess the appropriateness of recommendations.

verify compliance with policies.

evaluate whether the risk profile has changed.

determine adequacy of actions taken on recommendations.

An IS auditor can BEST evaluate the business impact of system failures by:

assessing user satisfaction levels.

interviewing the security administrator.

analyzing equipment maintenance logs.

reviewing system-generated logs.

Which of the following is a threat to IS auditor independence?

Internal auditors design remediation plans to address control gaps identified by internal audit.

Internal auditors share the audit plan and control test plans with management prior to audit commencement.

Internal auditors design remediation plans to address control gaps identified by internal audit.

Internal auditors attend IT steering committee meetings.

Internal auditors recommend appropriate controls for systems in development.

Which of the following findings related to segregation of duties should be of GREATEST concern to an IS auditor?

The person who edits source code also has write access to production.

The person who tests source code also approves changes.

The person who administers servers is also part of the infrastructure management team.

The person who creates new user accounts also modifies user access levels.

The person who edits source code also has write access to production.

When reviewing hard disk utilization reports, an IS auditor observes that utilization is routinely above 95%. Which of the following should be the GREATEST concern to the IS auditor?

Denial of service (DoS) attacks

Which of the following would be of GREATEST concern to an IS auditor reviewing an IT-related customer service project?

The project risk exceeds the organization's risk appetite.

Executing the project will require additional investments.

Expected business value is expressed in qualitative terms.

The organization will be the first to offer the proposed services.

Isaca CISA Practice Test 22 - Free Online Exam Prep & Questions

Management is concerned about sensitive information being intentionally or unintentionally emailed as attachments outside the organization by employees. What is the MOST important task before implementing any associated email controls?

Become a Premium Member for full access

Unlock Premium Member

Isaca CISA Practice Test 22

Question

Isaca CISA Practice Tests

Practice Tests