An IS auditor has identified deficiencies within the organization's software development life cycle policies. Which of the following should be done NEXT?

Communicate the observation to the auditee.

Document the findings in the audit report.

Identify who approved the policies.

Escalate the situation to the lead auditor.

Communicate the observation to the auditee.

An organization relies on an external vendor that uses a cloud-based Software as a Service (SaaS) model to back up its data. Which of the following is the GREATEST risk to the organization related to data backup and retrieval?

The vendor may be unable to restore critical data.

The organization may be locked into an unfavorable contract with the vendor.

The vendor may be unable to restore critical data.

The vendor may be unable to restore data by recovery time objective (RTO) requirements.

The organization may not be allowed to inspect the vendor's data center.

Which of the following is a PRIMARY responsibility of a quality assurance (QA) team?

Implementing procedures to facilitate adoption of quality management best practices

Creating test data to facilitate the user acceptance testing (IJAT) process

Managing employee onboarding processes and background checks

Advising the steering committee on quality management issues and remediation efforts

Implementing procedures to facilitate adoption of quality management best practices

The BEST way to provide assurance that a project is adhering to the project plan is to:

conduct compliance audits at major system milestones.

require design reviews at appropriate points in the life cycle.

have an IS auditor participate on the steering committee.

have an IS auditor participate on the quality assurance (QA) team.

conduct compliance audits at major system milestones.

What should an IS auditor recommend to management as the MOST important action before selecting a Software as a Service (SaaS) vendor?

Determine service level requirements.

Perform a business impact analysis (BIA)

The PRIMARY responsibility of a project steering committee is to:

provide regular project updates and oversight.

sign off on the final build document.

ensure that each project deadline is met.

ensure that developed systems meet business needs.

provide regular project updates and oversight.

During a pre-deployment assessment, what is the BEST indication that a business case will lead to the achievement of business objectives?

The business case reflects stakeholder requirements.

The business case is based on a proven methodology.

The business case passed a quality review by an independent party.

The business case identifies specific plans for cost allocation.

An organization is disposing of removable onsite media which contains sensitive information. Which of the following is the MOST effective method to prevent disclosure of sensitive data?

Wiping and rewriting three times

Which of the following is MOST important for the successful establishment of a security vulnerability management program?

A comprehensive asset inventory

A robust tabletop exercise plan

A comprehensive asset inventory

A tested incident response plan

An IS auditor is reviewing a client's outsourced payroll system to assess whether the financial audit team can rely on the application. Which of the following findings would be the auditor'sGREATEST concern?

The third-party contract has not been reviewed by the legal department.

User access rights have not been periodically reviewed by the client.

Payroll processing costs have not been included in the IT budget.

The third-party contract has not been reviewed by the legal department.

The third-party contract does not comply with the vendor management policy.

Which of the following is the BEST way for an IS auditor to assess the design of an automated application control?

Review the application implementation documents.

Interview the application developer.

Obtain management attestation and sign-off.

Review the application implementation documents.

Review system configuration parameters and output.

The PRIMARY purpose of an incident response plan is to:

reduce the impact of an adverse event on information assets.

increase the effectiveness of preventive controls.

reduce the maximum tolerable downtime (MTD) of impacted systems.

increase awareness of impacts from adverse events to IT systems.

An IS audit manager was temporarily tasked with supervising a project manager assigned to the organization's payroll application upgrade. Upon returning to the audit department, the audit manager has been asked to perform an audit to validate the implementation of the payroll application. The audit manager is the only one in the audit department with IT project management experience. What is the BEST course of action?

Outsource the audit to independent and qualified resources.

Transfer the assignment to a different audit manager despite lack of IT project management experience.

Outsource the audit to independent and qualified resources.

Manage the audit since there is no one else with the appropriate experience.

Have a senior IS auditor manage the project with the IS audit manager performing final review.

To reduce operational costs, IT management plans to reduce the number of servers currently used to run business applications. Which of the following is MOST helpful to review when identifying which servers are no longer required?

Performance feedback from the user community

Contract with the server vendor

Mean time between failure (MTBF) of each server

During a review of system access, an IS auditor notes that an employee who has recently changed roles within the organization still has previous access rights. The auditor's NEXT step should be to:

determine the reason why access rights have not been revoked.

recommend a control to automatically update access rights.

determine the reason why access rights have not been revoked.

direct management to revoke current access rights.

determine if access rights are in violation of software licenses.

Which of the following statements appearing in an organization's acceptable use policy BEST demonstrates alignment with data classification standards related to the protection of information assets?

All information assets will be assigned a clearly defined level to facilitate proper employee handling.

Any information assets transmitted over a public network must be approved by executive management.

All information assets must be encrypted when stored on the organization's systems.

Information assets should only be accessed by persons with a justified need.

All information assets will be assigned a clearly defined level to facilitate proper employee handling.

Which of the following is the MOST effective accuracy control for entry of a valid numeric part number?

Comparison to historical order pattern

Which of the following is the BEST compensating control against segregation of duties conflicts in new code development?

Post-implementation change review

Adding the developers to the change approval board

A small number of people have access to deploy code

Post-implementation change review

Creation of staging environments

Which of the following areas of responsibility would cause the GREATEST segregation of duties conflict if the individual who performs the related tasks also has approval authority?

Purchase requisitions and purchase orders

Vendor selection and statements of work

An IS auditor reviewing a job scheduling tool notices performance and reliability problems. Which of the following is MOST likely affecting the tool?

Maintenance patches and the latest enhancement upgrades are missing.

Administrator passwords do not meet organizational security and complexity requirements.

The number of support staff responsible for job scheduling has been reduced.

The scheduling tool was not classified as business-critical by the IT department.

Maintenance patches and the latest enhancement upgrades are missing.

An IS auditor found that a company executive is encouraging employee use of social networking sites for business purposes. Which of the following recommendations would BEST help to reduce the risk of data leakage?

Providing education and guidelines to employees on use of social networking sites

Requiring policy acknowledgment and nondisclosure agreements signed by employees

Providing education and guidelines to employees on use of social networking sites

Establishing strong access controls on confidential data

Monitoring employees' social networking usage

A bank performed minor changes to the interest calculation computer program. Which of the following techniques would provide the STRONGEST evidence to determine whether the interest calculations are correct?

Parallel simulation using audit software

Manual verification of a sample of the results

Review of the quality assurance (QA) test results

What is the PRIMARY reason for an organization to classify the data stored on its internal networks?

To implement data protection requirements

To determine data retention policy

To implement data protection requirements

To comply with the organization's data policies

To follow industry best practices

An organization uses public key infrastructure (PKI) to provide email security. Which of the following would be the MOST efficient method to determine whether email messages have been modified in transit?

The message is sent along with an encrypted hash of the message.

The message is encrypted using a symmetric algorithm.

The message is sent using Transport Layer Security (TLS) protocol.

The message is sent along with an encrypted hash of the message.

The message is encrypted using the private key of the sender.

Which of the following findings from a database security audit presents the GREATEST risk of critical security exposures?

Admin account passwords are not set to expire.

Legacy data has not been purged.

Admin account passwords are not set to expire.

Default settings have not been changed.

Database activity logging is not complete.

The FIRST step in an incident response plan is to:

notify the head of the IT department.

isolate systems impacted by the incident.

Which of the following is the BEST indication of effective governance over IT infrastructure?

The ability to deliver continuous, reliable performance

A requirement for annual security awareness programs

An increase in the number of IT infrastructure servers

A decrease in the number of information security incidents

In an organization's feasibility study to acquire hardware to support a new web server, omission of which of the following would be of MOST concern?

Cost-benefit analysis of available products

Alternatives for financing the acquisition

Financial stability of potential vendors

Reputation of potential vendors

Cost-benefit analysis of available products

Which of the following is MOST likely to be a project deliverable of an agile software development methodology?

Rapidly created working prototypes

Strictly managed software requirements baselines

Extensive project documentation

Automated software programming routines

Rapidly created working prototypes

Isaca CISA Practice Test 28 - Free Online Exam Prep & Questions

Spam

Selling illegal goods, money scams etc.

Hate Speech

Serious attack on a group.

Harassment and bullying

Harassing an individual (including doxing)

Harmful activities

Threatening or glorifying violence or serious harm, including self-harm

Adult content (Consensual)

Nudity/Sexual content

Sexual exploitation and abuse (child safety)

Sexually explicit or suggestive imagery or writing involving minors

Sexual exploitation and abuse (adults and animals)

Sexually explicit or suggestive imagery or writing involving non-consenting adults or non-humans

Plagiarism

Reusing content without attribution (link and blockquotes)

Poorly written

Not in English or has very bad formatting, grammar, and spelling

Inappropriate credential

Author's credential is offensive, spam, or impersonation

Other

Ex. Illegal content, incomplete question...

Isaca CISA Practice Test 28

Question

Isaca CISA Practice Tests

Practice Tests