Which of the following measures BEST mitigates the risk of data exfiltration during a cyberattack?

Data loss prevention (DLP) system

Having knowledge in which of the following areas is MOST relevant for an IS auditor reviewing public key infrastructure (PKI)?

Technology and process life cycle for digital certificates and key pairs

Design and application of key controls in public audit

Security strategy in public cloud Infrastructure as a Service (IaaS)

Modern encoding methods for digital communications

Technology and process life cycle for digital certificates and key pairs

A small business unit is implementing a control self-assessment (CSA) program and leveraging the internal audit function to test its internal controls annually. Which of the following is the MOST significant benefit of this approach?

Business owners can focus more on their core roles.

Line management is more motivated to avoid control exceptions.

Which of the following is an IS auditor's BEST recommendation to mitigate the risk of eavesdropping associated with an application programming interface (API) integration implementation?

Implement Transport Layer Security (TLS).

Encrypt the extensible markup language (XML) file.

Implement Transport Layer Security (TLS).

Implement Simple Object Access Protocol (SOAP).

Which of the following is MOST critical to the success of an information security program?

Management's commitment to information security

User accountability for information security

Alignment of information security with IT objectives

Integration of business and information security

Several unattended laptops containing sensitive customer data were stolen from personnel offices Which of the following would be an IS auditor's BEST recommendation to protect data in case of recurrence?

Require two-factor authentication

Which of the following should be done FIRST when planning to conduct internal and external penetration testing for a client?

Establish the rules of engagement.

Establish the timing of testing.

Establish the rules of engagement.

When planning an internal penetration test, which of the following is the MOST important step prior to finalizing the scope of testing?

Obtaining management's consent to the testing scope in writing

Ensuring the scope of penetration testing is restricted to the test environment

Obtaining management's consent to the testing scope in writing

Notifying the IT security department regarding the testing scope

Agreeing on systems to be excluded from the testing scope with the IT department

Which of the following responsibilities of an organization's quality assurance (QA) function should raise concern for an IS auditor?

Implementing solutions to correct defects

Ensuring standards are adhered to within the development process

nsuring the test work supports observations

Updating development methodology

Implementing solutions to correct defects

Which of the following is MOST critical to the success of an information security program?

Management's commitment to information security

User accountability for information security

Management's commitment to information security

Integration of business and information security

Alignment of information security with IT objectives

Which of the following provides the MOST protection against emerging threats?

Heuristic intrusion detection system (IDS)

Real-time updating of antivirus software

Signature-based intrusion detection system (IDS)

During an external review, an IS auditor observes an inconsistent approach in classifying system criticality within the organization. Which of the following should be recommended as the PRIMARY factor to determine system criticality?

Maximum allowable downtime (MAD)

Key performance indicators (KPls)

Which of the following would provide the BEST evidence that a cloud provider's change management process is effective?

The results of a third-party review provided by the vendor

Minutes from regular change management meetings with the vendor

Written assurances from the vendor's CEO and CIO

The results of a third-party review provided by the vendor

A copy of change management policies provided by the vendor

An IS audit reveals an IT application is experiencing poor performance including data inconsistency and integrity issues. What is the MOST likely cause?

Reindexing of the database table

Which of the following is the MOST significant impact to an organization that does not use an IT governance framework?

Inadequate alignment of IT plans and business objectives

adequate measurement of key risk indicators (KRIS)

Inadequate alignment of IT plans and business objectives

Inadequate business impact analysis (BIA) results and predictions

Inadequate measurement of key performance indicators (KPls)

During the review of a system disruption incident, an IS auditor notes that IT support staff were put in a position to make decisions beyond their level of authority.Which of the following is the BEST recommendation to help prevent this situation in the future?

Introduce escalation protocols.

Which of the following is the BEST reason to implement a data retention policy?

To limit the liability associated with storing and protecting information

To establish a recovery point objective (RPO) for disaster recovery procedures

To limit the liability associated with storing and protecting information

To document business objectives for processing data within the organization

To assign responsibility and ownership for data protection outside IT

An IS auditor finds that periodic reviews of read-only users for a reporting system are not being performed. Which of the following should be the IS auditor's NEXT course of action?

Report this control process weakness to senior management.

Review the list of end users and evaluate for authorization.

Report this control process weakness to senior management.

Verify managements approval for this exemption

Obtain a verbal confirmation from IT for this exemption.

An organization has assigned two new IS auditors to audit a new system implementation. One of the auditors has an IT-related degree, and one has a business degree. Which of the following is MOST important to meet the IS audit standard for proficiency?

Team member assignments must be based on individual competencies

Technical co-sourcing must be used to help the new staff

The standard is met as long as one member has a globally recognized audit certification.

The standard is met as long as a supervisor reviews the new auditors' work

Which of the following BEST describes a digital signature?

It is unique to the sender using it.

It is under control of the receiver.

It is capable of authorization.

It dynamically validates modifications of data.

It is unique to the sender using it.

An IS auditor is reviewing enterprise governance and finds there is no defined organizational structure for technology risk governance. Which of the following is the GREATEST concern with this lack of structure?

Key decision-making entities for technology risk have not been identified

Software developers may adopt inappropriate technology.

Project managers may accept technology risks exceeding the organization's risk appetite.

Key decision-making entities for technology risk have not been identified

There is no clear approval entity for organizational security standards.

An IS auditor has been asked to advise on measures to improve IT governance within the organization. Which of the following IS the BEST recommendation?

Require executive management to draft IT strategy

Benchmark organizational performance against industry peers

Implement key performance indicators (KPIs).

Require executive management to draft IT strategy

Implement annual third-party audits.

During an audit, the IS auditor finds that in many cases excessive rights were not removed from a system. Which of the following is the auditor's BEST recommendation?

Line management should regularly review and request modification of access rights

System administrators should ensure consistency of assigned rights.

IT security should regularly revoke excessive system rights.

Human resources (HR) should delete access rights of terminated employees.

Line management should regularly review and request modification of access rights

Which of the following is MOST critical to the success of an information security program?

Management's commitment to information security

Alignment of information security with IT objectives

Management's commitment to information security

Integration of business and information security

User accountability for information security

A small IT department has embraced DevOps, which allows members of this group to deploy code to production and maintain some development access to automate releases. Which of the following is the MOST effective control?

Enforce approval prior to deployment by a member of the team who has not taken part in the development.

The DevOps team provides an annual policy acknowledgment that they did not develop and deploy the same code.

Annual training reinforces the need to maintain segregation between developers and deployers of code

The IT compliance manager performs weekly reviews to ensure the same person did not develop and deploy code.

An IS auditor determines that the vendor's deliverables do not include the source code for a newly acquired product. To address this issue, which of the following should the auditor recommend be included in the contract?

Confidentiality and data protection clauses

An IS auditor is assigned to perform a post-implementation review of an application system. Which of the following would impair the auditor's independence?

The auditor implemented a specific control during the development of the system.

The auditor provided advice concerning best practices.

The auditor participated as a member of the project team without operational responsibilities The auditor designed an embedded audit module exclusively for audit

The auditor implemented a specific control during the development of the system.

Which of the following is the MOST important consideration for patching mission critical business application servers against known vulnerabilities?

Patches are implemented in a test environment prior to rollout into production.

Network vulnerability scans are conducted after patches are implemented.

Vulnerability assessments are periodically conducted according to defined schedules.

Roles and responsibilities for implementing patches are defined

An IS auditor is conducting a physical security audit of a healthcare facility and finds closed-circuit television (CCTV) systems located in a patient care area. Which of the following is the GREATEST concern?

There are no notices indicating recording IS in progress.

Cameras are not monitored 24/7.

There are no notices indicating recording IS in progress.

The retention period for video recordings is undefined

There are no backups of the videos.

During an audit, an IT finding is agreed upon by all IT teams involved, but no team wants to be responsible for remediation or considers the finding within Its area of responsibility Which of the following is the IS auditor's BEST course of action?

Escalate to IT management for resolution.

Issue the finding without identifying an owner

Assign shared responsibility to all IT teams.

Determine the most appropriate team and assign accordingly.

Which of the following is MOST useful when planning to audit an organization's compliance with cybersecurity regulations in foreign countries?

Map the different regulatory requirements to the organization's IT governance framework

Prioritize the audit to focus on the country presenting the greatest amount of operational risk.

Follow the cybersecurity regulations of the country with the most stringent requirements.

Develop a template that standardizes the reporting of findings from each country's audit team

Map the different regulatory requirements to the organization's IT governance framework

A security administrator is called in the middle of the night by the on-call programmer A number of programs have failed, and the programmer has asked for access to the live system. What IS the BEST course of action?

Give the programmer an emergency ID for temporary access and review the activity

Require that a change request be completed and approved

Give the programmer an emergency ID for temporary access and review the activity

Give the programmer read-only access to investigate the problem

Review activity logs the following day and investigate any suspicious activity

Which of the following is MOST important to ensure when developing an effective security awareness program?

Outcome metrics for the program are established.

Training personnel are information security professionals.

Outcome metrics for the program are established.

Security threat scenarios are included in the program content.

Phishing exercises are conducted post-training

When reviewing an IT strategic plan, the GREATEST concern would be that

the plan does not support relevant organizational goals.

an IT strategy committee has not been created

the plan does not support relevant organizational goals.

there are no key performance indicators (KPls).

the plan was not formally approved by the board of directors

The record-locking option of a database management system (DBMS) serves to.

eliminate the risk of concurrent updates to a record

allow database administrators (DBAs) to record the activities of users.

restrict users from changing certain values within records.

allow users to lock others out of their files.

Isaca CISA Practice Test 25 - Free Online Exam Prep & Questions

External audits have identified recurring exceptions in the user termination process, despite similar internal audits having reported no exceptions in the past. Which of the following is the IS auditor's BEST course of action to improve the internal audit process in the future?

Become a Premium Member for full access

Unlock Premium Member

Isaca CISA Practice Test 25

Question

Isaca CISA Practice Tests

Practice Tests