Which of the following is the MOST reliable way for an IS auditor to evaluate the operational effectiveness of an organization's data loss prevention (DLP) controls?

Verify that confidential files cannot be transmitted to a personal USB device.

Review data classification levels based on industry best practice

Verify that current DLP software is installed on all computer systems.

Conduct interviews to identify possible data protection vulnerabilities.

Verify that confidential files cannot be transmitted to a personal USB device.

Which of the following is the PRIMARY reason an IS auditor should discuss observations with management before delivering a final report?

Validate the audit observations_

Identify business risks associated with the observations.

Assist the management with control enhancements.

Record the proposed course of corrective action.

An organization plans to replace its nightly batch processing backup to magnetic tape with real-time replication to a second data center. Which of the following is the GREATEST risk associated with this change?

Inability to recover from cybersecurity attacks

When developing customer-facing IT applications, in which stage of the system development life cycle (SDLC) is it MOST beneficial to consider data privacy principles?

Systems design and architecture

Software selection and acquisition

An IS auditor reviewing incident response management processes notices that resolution times for reoccurring incidents have not shown improvement. Which of the following is the auditor's BEST recommendation?

Introduce problem management into incident response.

Harden IT system and application components based on best practices.

Incorporate a security information and event management (SIEM) system into incident response

Implement a survey to determine future incident response training needs.

Introduce problem management into incident response.

An organization's security team created a simulated production environment with multiple vulnerable applications. What would be the PRIMARY purpose of creating such an environment?

To attract attackers in order to study their behavior

To test the intrusion detection system (IDS)

To provide training to security managers

To collect digital evidence of cyberattacks

To attract attackers in order to study their behavior

The use of which of the following would BEST enhance a process improvement program?

Project management methodologies

Which of the following should be the FIRST step when developing a data loss prevention (DLP) solution for a large organization?

Conduct a data inventory and classification exercise.

Identify approved data workflows across the enterprise_

Conduct a threat analysis against sensitive data usage.

Create the DLP policies and templates

Which of the following approaches would utilize data analytics to facilitate the testing of a new account creation process?

Review new account applications submitted in the past month for invalid dates of birth.

Attempt to submit new account applications with invalid dates of birth.

Review the business requirements document for date of birth field requirements.

Review new account applications submitted in the past month for invalid dates of birth.

Evaluate configuration settings for the date of birth field requirements

Which of the following BEST describes the role of a document owner when implementing a data classification policy in an organization?

Classifies documents to correctly reflect the level of sensitivity of information they contain

Defines the conditions under which documents containing sensitive information may be transmitted

Classifies documents in accordance with industry standards and best practices

Ensures documents are handled in accordance With the sensitivity of information they contain

Which of the following observations should be of GREATEST concern to an IS auditor performing an audit of change and release management controls for a new complex system developed by a small in-house IT team?

Post-implementation testing is not conducted for all system releases.

Access to change testing strategy and results is not restricted to staff outside the IT team.

Some user acceptance testing (IJAT) was completed by members of the IT team.

IT administrators have access to the production and development environment

Post-implementation testing is not conducted for all system releases.

Which of the following BEST enables a benefits realization process for a system development project?

Metrics for the project have been selected before the project begins.

Project budget includes costs to execute the project and costs associated with the solution.

Estimates of business benefits are backed by similar previously completed projects.

Metrics are evaluated immediately after the project has been implemented.

Which of the following approaches will ensure recovery time objectives (RTOs) are met for an organization's disaster recovery plan (DRP)?

Performing a full interruption test

Performing a cyber resilience test

Performing a full interruption test

Which of the following is the PRIMARY reason for an IS auditor to perform a risk assessment?

It helps to identify areas with a relatively high probability of material problems.

It provides a basis for the formulation of corrective action plans.

It increases awareness of the types of management actions that may be inappropriate

It helps to identify areas that are most sensitive to fraudulent or inaccurate practices

An IS auditor is reviewing a contract for the outsourcing of IT facilities. If missing, which of the following should present the GREATEST concern to the auditor?

Perimeter network security diagram

Which of the following is the MOST effective control over visitor access to highly secured areas?

Visitors are required to be escorted by authorized personnel.

Visitors are required to use biometric authentication.

Visitors are monitored online by security cameras

Visitors are required to enter through dead-man doors.

Which of the following provides the BE ST method for maintaining the security of corporate applications pushed to employee-owned mobile devices?

Implementing mobile device management (MDM)

Enabling remote data destruction capabilities

Implementing mobile device management (MDM)

Disabling unnecessary network connectivity options

Requiring security awareness training for mobile users

Which of the following is the MOST significant risk when an application uses individual end-user accounts to access the underlying database?

Users may be able to circumvent application controls.

Multiple connects to the database are used and slow the process_

User accounts may remain active after a termination.

Users may be able to circumvent application controls.

Application may not capture a complete audit trail.

Which of the following would minimize the risk of losing transactions as a result of a disaster?

Sending a copy of the transaction logs to offsite storage on a daily basis

Storing a copy of the transaction logs onsite in a fireproof vault

Encrypting a copy of the transaction logs and store on a local server

Signing a copy of the transaction logs and store on a local server

Which of the following is the MOST important consideration when establishing vulnerability scanning on critical IT infrastructure?

The scanning will not degrade system performance.

The scanning will be performed during non-peak hours.

The scanning will be followed by penetration testing.

The scanning will be cost-effective.

The scanning will not degrade system performance.

Which of the following is the BEST way to identify whether the IT help desk is meeting service level agreements (SLAS)?

Conduct IT management interviews

When reviewing a business case for a proposed implementation of a third-party system, which of the following should be an IS auditor's GREATEST concern?

Lack of ongoing maintenance costs

Lack of plan for pilot implementation

Lack of detailed work breakdown structure

Which of the following would be MOST effective in detecting the presence of an unauthorized wireless access point on an internal network?

Periodic network vulnerability assessments

Review of electronic access logs

An organization has partnered with a third party to transport backup drives to an offsite storage facility. Which of the following is MOST important before sending the drives?

Encrypting the drive with strong protection standards

Creating a chain of custody to accompany the drive in transit

Ensuring data protection is aligned with the data classification policy

Encrypting the drive with strong protection standards

Ensuring the drive is placed in a tamper-evident mechanism

Aligning IT strategy with business strategy PRIMARILY helps an organization to:

create risk awareness across business units.

increase involvement of senior management in IT.

monitor the effectiveness of IT.

Which of the following is the MOST important advantage of participating in beta testing of software products?

It enables an organization to gain familiarity with new products and their functionality.

It increases an organization's ability to retain staff who prefer to work with new technology.

It improves vendor support and training.

It enhances security and confidentiality.

It enables an organization to gain familiarity with new products and their functionality.

Which of the following is the MOST important prerequisite for implementing a data loss prevention (DLP) tool?

Identifying where existing data resides and establishing a data classification matrix

Requiring users to save files in secured folders instead of a company-wide shared drive

Reviewing data transfer logs to determine historical patterns of data flow

Developing a DLP policy and requiring signed acknowledgment by users

Identifying where existing data resides and establishing a data classification matrix

Which of the following is the BEST way to ensure an organization's data classification policies are preserved during the process of data transformation?

Implement classification labels in metadata during data creation.

Map data classification controls to data sets.

Control access to extract, transform, and load (ETL) tools.

Conduct a data discovery exercise across all business applications.

Implement classification labels in metadata during data creation.

Isaca CISA Practice Test 26 - Free Online Exam Prep & Questions

Which of the following physical controls provides the GREATEST assurance that only authorized individuals can access a data center?

Become a Premium Member for full access

Unlock Premium Member

Isaca CISA Practice Test 26

Question

Isaca CISA Practice Tests

Practice Tests