How is nonrepudiation supported within a public key infrastructure (PKI) environment?

Through the use of a certificate issued by a certificate authority (CA)

Through the use of elliptical curve cryptography on transmitted messages

Through the use of a certificate issued by a certificate authority (CA)

Through the use of private keys to decrypt data received by a user

Through the use of enterprise key management systems

Which of the following is the GREATEST risk of project dashboards being set without sufficiently defined criteria?

Inadequate decision-making and prioritization

Adverse findings from internal and external auditors

Lack of project portfolio status oversight

Lack of alignment of project status reports

Inadequate decision-making and prioritization

Which of the following should an IS auditor recommend be done FIRST when an organization is planning to implement an IT compliance program?

Identify applicable laws, regulations, and standards.

Identify staff training needs related to compliance requirements.

Analyze historical compliance-related audit findings.

Research and purchase an industry-recognized IT compliance tool

Identify applicable laws, regulations, and standards.

An IS auditor has been asked to provide support to the control self-assessment (CSA) program. Which of the following BEST represents the scope of the auditor's role in the program?

The auditor should act as a program facilitator.

The auditor should focus on improving process productivity

The auditor should perform detailed audit procedures

The auditor's presence replaces the audit responsibilities of other team members.

Which of the following is a PRIMARY function of an intrusion detection system (IDS)?

Warning when executable programs are modified

Predicting an attack before it occurs

Alerting when a scheduled backup job fails

Blocking malicious network traffic

Warning when executable programs are modified

An IS auditor is reviewing database fields updated in real-time and displayed through other applications in multiple organizational functions. When validating business approval for these various use cases, which of the following sources of information would be the BEST starting point?

Business process flow from management

Network map from the network administrator

Historical database change log records

List of integrations from the database administrator (DBA)

Business process flow from management

Which of the following is the MOST important success factor for implementing a data loss prevention (DLP) tool?

Defining and configuring policies and tool rule sets to monitor sensitive data movement

Implementing the tool in monitor mode to avoid unnecessary blocking of communication

Defining and configuring policies and tool rule sets to monitor sensitive data movement

Testing the tool in a test environment before moving to the production environment

Assigning responsibilities for maintaining the tool to applicable data owners and stakeholders

An external audit firm was engaged to perform a validation and verification review for a systems implementation project. The IS auditor identifies that regression testing is not part of the project plan and was not performed by the systems implementation team. According to the team, the parallel testing being performed is sufficient, making regression testing unnecessary. What should be the auditor's NEXT step?

Recommend regression testing be conducted by the systems implementation team

Evaluate the extent of the parallel testing being performed

Recommend integration and stress testing be conducted by the systems implementation team

Conclude that parallel testing is sufficient and regression testing is not needed

Recommend regression testing be conducted by the systems implementation team

An organization is implementing a new data loss prevention (DLP) tool. Which of the following will BEST enable the organization to reduce false positive alerts?

Configuring a limited set of rules

Using the default policy and tool rule sets

Configuring a limited set of rules

Deploying the tool in monitor mode

Reducing the number of detection points

Which of the following network communication protocols is used by network devices such as routers to send error messages and operational information indicating success or failure when communicating with another IP address?

Internet Control Message Protocol

Transmission Control Protocol/Internet Protocol (TCP/IP)

Internet Control Message Protocol

Multipurpose Transaction Protocol

Point-to-Point Tunneling Protocol

An IS auditor reviewing an organization's IT systems finds that the organization frequently purchases systems that are incompatible with the technologies already in the organization. Which of the following is the MOST likely reason?

Lack of enterprise architecture (EA)

Ineffective risk management policy

Lack of enterprise architecture (EA)

Outdated enterprise resource planning (ERP) system

An IS auditor discovers that backups of critical systems are not being performed in accordance with the recovery point objective (RPO) established in the business continuity plan (BCP). What should the auditor do NEXT?

Request an immediate backup be performed.

Include the observation in the report.

An IS auditor wants to gain a better understanding of an organization's selected IT operating system software. Which of the following would be MOST helpful to review?

Service level agreements (SLAs)

Project steering committee charter

Which of the following should be the PRIMARY consideration when validating a data analytic algorithm that has never been used before?

Confirming completeness and accuracy

Enhancing the design of data visualization

Increasing speed and efficiency of audit procedures

Confirming completeness and accuracy

Decreasing the time for data analytics execution

Which of the following findings would be of GREATEST concern to an IS auditor reviewing the security architecture of an organization that has just implemented a Zero Trust solution?

An increase in user identification errors

An increase in security-related costs

User complaints about the new mode of working

An increase in user identification errors

A noticeable drop in the performance of IT systems

A mission-critical application utilizes a one-node database server. On multiple occasions, the database service has been stopped to perform routine patching, causing application outages. Which of the following should be the IS auditor's GREATEST concern?

The presence of a single point of failure

Revenue lost due to application outages

Patching performed by the vendor

A large number of scheduled database changes

The presence of a single point of failure

A system performance dashboard indicates several application servers are reaching the defined threshold for maximum CPU allocation. Which of the following would be the IS auditor's BEST recommendation for the IT department?

Validate the processing capacity of these servers is adequate to complete computing tasks.

Increase the defined processing threshold to reflect capacity consumption during normal operations.

Notify end users of potential disruptions caused by degradation of servers.

Terminate both ingress and egress connections of these servers to avoid overload.

Validate the processing capacity of these servers is adequate to complete computing tasks.

Which of the following controls helps to ensure that data extraction queries run by the database administrator (DBA) are monitored?

Reviewing activity logs of the DBA

Restricting access to DBA activities

Performing periodic access reviews

Storing logs of database access

Reviewing activity logs of the DBA

When protecting the confidentiality of information assets, the MOST effective control practice is the:

Enforcement of a need-to-know access control philosophy

Awareness training of personnel on regulatory requirements

Utilization of a dual-factor authentication mechanism

Configuration of read-only access to all users

Enforcement of a need-to-know access control philosophy

An IS auditor is reviewing a machine learning model that predicts the likelihood that a user will watch a certain movie. Which of the following would be of GREATEST concern to the auditor?

The data set for training the model was obtained from an unreliable source.

When the model was tested with data drawn from a different population, the accuracy decreased.

The data set for training the model was obtained from an unreliable source.

An open-source programming language was used to develop the model.

The model was tested with data drawn from the same population as the training data.

Which of the following should be of MOST concern to an IS auditor reviewing an organization's operational log management?

Data formats have not been standardized across all logs.

Log file size has grown year over year.

Critical events are being logged to immutable log files.

Applications are logging events into multiple log files.

Data formats have not been standardized across all logs.

An IS auditor is reviewing a medical device that is attached to a patient's body, which automatically takes and uploads measurements to a cloud server. Treatment may be updated based on the measurements. Which of the following should be the auditor's PRIMARY focus?

Security and quality certification of the device

Physical access controls on the device

Security and quality certification of the device

Device identification and authentication

Confirmation that the device is regularly updated

Which of the following should be an IS auditor's PRIMARY focus when auditing the implementation of a new IT operations performance monitoring system?

Validating whether baselines have been established

Reviewing whether all changes have been implemented

Validating whether baselines have been established

Confirming whether multi-factor authentication (MFA) is deployed as part of the operational enhancements

Determining whether there is a process for annual review of the maintenance manual

Which of the following is the PRIMARY benefit of monitoring IT operational logs?

Detecting processing errors in a timely manner

Identifying configuration flaws in operating systems

Managing the usability and capacity of IT resources

Generating exception reports to assess security compliance

Isaca CISA Practice Test 24 - Free Online Exam Prep & Questions

Which of the following would be of GREATEST concern to an IS auditor reviewing the resiliency of an organizational network that has two internet connections?

Become a Premium Member for full access

Unlock Premium Member

Isaca CISA Practice Test 24

Question

Isaca CISA Practice Tests

Practice Tests