In a large organization, IT deadlines on important projects have been missed because IT resources are not prioritized properly. Which of the following is the BEST recommendation to address this problem?

Implement project portfolio management.

Implement an integrated resource management system.

Implement a comprehensive project scorecard.

Which of the following would provide management with the MOST reasonable assurance that a new data warehouse will meet the needs of the organization?

Integrating data requirements into the system development life cycle (SDLC)

Appointing data stewards to provide effective data governance

Classifying data quality issues by the severity of their impact to the organization

Facilitating effective communication between management and developers

During audit planning, the IS audit manager is considering whether to budget for audits of entities regarded by the business as having low risk. Which of the following is the BEST course of action in this situation?

Validate the low-risk entity ratings and apply professional judgment.

Outsource low-risk audits to external audit service providers.

Conduct limited-scope audits of low-risk business entities.

Validate the low-risk entity ratings and apply professional judgment.

Challenge the risk rating and include the low-risk entities in the plan.

Which of the following would be an IS auditor's GREATEST concern when reviewing the organization's business continuity plan (BCP)?

The recovery plan does not contain the process and application dependencies.

The duration of tabletop exercises is longer than the recovery point objective (RPO).

The duration of tabletop exercises is longer than the recovery time objective (RTO).

The recovery point objective (RPO) and recovery time objective (R TO) are not the same.

Which of the following would present the GREATEST concern during a review of internal audit quality assurance (QA) and continuous improvement processes?

The audit program does not involve periodic engagement with external assessors.

Quarterly reports are not distributed to the audit committee.

Results of corrective actions are not tracked consistently.

Substantive testing is not performed during the assessment phase of some audits.

Which of the following is the BEST security control to validate the integrity of data communicated between production databases and a big data analytics system?

Running and comparing the count function within the in-scope data sets

Hosting a digital certificate for in-scope data sets

Which of the following findings would be of GREATEST concern to an IS auditor assessing an organization's patch management process?

The organization's software inventory is not complete.

Applications frequently need to be rebooted for patches to take effect.

Software vendors are bundling patches.

Testing patches takes significant time.

Which of the following should be the FIRST step in a data migration project?

Understanding the new system's data structure

Reviewing decisions on how business processes should be conducted in the new system

Completing data cleanup in the current database to eliminate inconsistencies

Understanding the new system's data structure

Creating data conversion scripts

An organization's senior management thinks current security controls may be excessive and requests an IS auditor's advice on how to assess the adequacy of current measures. What is the auditor's BEST recommendation to management?

Re-evaluate the organization's risk and control framework.

Perform correlation analysis between incidents and investments.

Downgrade security controls on low-risk systems.

Introduce automated security monitoring tools.

Re-evaluate the organization's risk and control framework.

An IS audit review identifies inconsistencies in privacy requirements across third-party service provider contracts. Which of the following is the BESTrecommendation to address this situation?

Prioritize contract amendments for third-party providers.

Suspend contracts with third-party providers that handle sensitive data.

Prioritize contract amendments for third-party providers.

Review privacy requirements when contracts come up for renewal.

Require third-party providers to sign nondisclosure agreements (NDAs).

Which of the following BEST facilitates strategic program management?

Aligning projects with business portfolios

Establishing a quality assurance (QA) process

Aligning projects with business portfolios

Tracking key project milestones

Which of the following is the MAIN risk associated with adding a new system functionality during the development phase without following a project change management process?

The new functionality may not meet requirements.

The added functionality has not been documented.

The new functionality may not meet requirements.

The project may fail to meet the established deadline.

The project may go over budget.

In an environment where data virtualization is used, which of the following provides the BEST disaster recovery solution?

Onsite disk-based backup systems

Redundant array of independent disks (RAID)

Which of the following presents the GREATEST risk of data leakage in the cloud environment?

Multi-tenancy within the same database

Expiration of security certificate

During the walk-through procedures for an upcoming audit, an IS auditor notes that the key application in scope is part of a Software as a Service (SaaS)agreement. What should the auditor do NEXT?

Verify whether a right-to-audit clause exists.

Verify whether IT management monitors the effectiveness of the environment.

Verify whether a right-to-audit clause exists.

Verify whether a third-party security attestation exists.

Verify whether service level agreements (SLAs) are defined and monitored.

What would be the PRIMARY reason an IS auditor would recommend replacing universal PIN codes with an RFID access card system at a data center?

To implement multi-factor authentication

What is the FIRST step when creating a data classification program?

Categorize and prioritize data.

Categorize information by owner.

Which of the following is the MOST important reason for an IS auditor to examine the results of a post-incident review performed after a security incident?

To evaluate the effectiveness of continuous improvement efforts

To compare incident response metrics with industry benchmarks

To re-analyze the incident to identify any hidden backdoors planted by the attacker

To evaluate the effectiveness of the network firewall against future security breaches

In a high-volume, real-time system, the MOST effective technique by which to continuously monitor and analyze transaction processing is:

integrated test facility (ITF).

Which of the following would BEST guide an IS auditor when determining an appropriate time to schedule the follow-up of agreed corrective actions for reported audit issues?

Sufficient time has elapsed since implementation to provide evidence of control operation.

Progress updates indicate that the implementation of agreed actions is on track.

Sufficient time has elapsed since implementation to provide evidence of control operation.

Business management has completed the implementation of agreed actions on schedule.

Regulators have announced a timeline for an inspection visit.

An IS audit reveals that an organization operating in business continuity mode during a pandemic situation has not performed a simulation test of the business continuity plan (BCP). Which of the following is the auditor's BEST course of action?

Review the effectiveness of the business response.

Confirm the BCP has been recently updated.

Review the effectiveness of the business response.

Raise an audit issue for the lack of simulated testing.

Interview staff members to obtain commentary on the BCP's effectiveness.

Which of the following is the MAIN responsibility of the IT steering committee?

Reviewing and assisting with IT strategy integration efforts

Developing and assessing the IT security strategy

Implementing processes to integrate security with business objectives

Developing and implementing the secure system development framework

An IS auditor is providing input to an RFP to acquire a financial application system. Which of the following is MOST important for the auditor to recommend?

Audit trails should be included in the design.

The application should meet the organization's requirements.

Audit trails should be included in the design.

Potential suppliers should have experience in the relevant area.

Vendor employee background checks should be conducted regularly.

An IS auditor is reviewing an organization's business intelligence infrastructure. The BEST recommendation to help the organization achieve a reasonable level of data quality would be to:

analyze the data against predefined specifications.

review data against data classification standards.

outsource data cleansing to skilled service providers.

consolidate data stored across separate databases into a warehouse.

analyze the data against predefined specifications.

Which of the following is the PRIMARY benefit of a tabletop exercise for an incident response plan?

It increases confidence in the team's response readiness.

It demonstrates the maturity of the incident response program.

It reduces the likelihood of an incident occurring.

It identifies deficiencies in the operating environment.

It increases confidence in the team's response readiness.

An IS auditor discovers that validation controls in a web application have been moved from the server side into the browser to boost performance. This would MOST likely increase the risk of a successful attack by:

structured query language (SQL) injection

An IT strategic plan that BEST leverages IT in achieving organizational goals will include:

enterprise architecture (EA) impacts.

a comparison of future needs against current capabilities.

a risk-based ranking of projects.

enterprise architecture (EA) impacts.

IT budgets linked to the organization's budget.

An organization's security team created a simulated production environment with multiple vulnerable applications. What would be the PRIMARY purpose of creating such an environment?

To attract attackers in order to study their behavior

To collect digital evidence of cyberattacks

To attract attackers in order to study their behavior

To provide training to security managers

To test the intrusion detection system (IDS)

The PRIMARY objective of a control self-assessment (CSA) is to:

educate functional areas on risks and controls.

ensure appropriate access controls are implemented.

eliminate the audit risk by leveraging management's analysis.

gain assurance for business functions that cannot be audited.

If a source code is not recompiled when program changes are implemented, which of the following is a compensating control to ensure synchronization of source and object?

Comparison of date stamping of source and object code

Comparison of object and executable code

Review of audit trail of compile dates

Comparison of date stamping of source and object code

Review of developer comments in executable code

Which of the following is the MOST important consideration for a contingency facility?

The contingency facility is located a sufficient distance away from the primary site.

The contingency facility has the same badge access controls as the primary site.

Both the contingency facility and the primary site have the same number of business assets in their inventory.

The contingency facility is located a sufficient distance away from the primary site.

Both the contingency facility and the primary site are easily identifiable.

A transaction processing system interfaces with the general ledger. Data analytics has identified that some transactions are being recorded twice in the general ledger. While management states a system fix has been implemented, what should the IS auditor recommend to validate the interface is working in the future?

Perform periodic reconciliations.

Ensure system owner sign-off for the system fix.

Improve user acceptance testing (UAT).

Which of the following is the GREATEST risk when relying on reports generated by end-user computing (EUC)?

Reports may not work efficiently.

Historical data may not be available.

Isaca CISA Practice Test 27 - Free Online Exam Prep & Questions

Which of the following should an IS auditor be MOST concerned with when a system uses RFID?

Become a Premium Member for full access

Unlock Premium Member

Isaca CISA Practice Test 27

Question

Isaca CISA Practice Tests

Practice Tests