During an operational audit on the procurement department, the audit team encounters a key system that uses an artificial intelligence (Al) algorithm. The audit team does not have the necessary knowledge to proceed with the audit. Which of the following is the BEST way to handle this situation?

Engage external consultants who have audit experience and knowledge of Al.

Perform a skills assessment to identify members from other business units with knowledge of Al.

Remove the Al portion from the audit scope and proceed with the audit.

Delay the audit until the team receives training on Al.

Engage external consultants who have audit experience and knowledge of Al.

An IS auditor discovers a box of hard drives in a secured location that are overdue for physical destruction. The vendor responsible for this task was never made aware of these hard drives.Which of the following is the BEST course of action to address this issue?

Examine the workflow to identify gaps in asset-handling responsibilities.

Escalate the finding to the asset owner for remediation.

Recommend the drives be sent to the vendor for destruction.

Evaluate the corporate asset-handling policy for potential gaps.

During planning for a cloud service audit, audit management becomes aware that the assigned IS auditor is unfamiliar with the technologies in use and their associated risks to the business. To ensure audit quality, which of the following actions should audit management consider FIRST?

Reassign the audit to an internal audit subject matter expert.

Conduct a follow-up audit after a suitable period has elapsed.

Reschedule the audit assignment for the next financial year.

Reassign the audit to an internal audit subject matter expert.

Extend the duration of the audit to give the auditor more time.

Stress testing should ideally be carried out under a:

test environment with production workloads.

test environment with test data.

production environment with production workloads.

production environment with test data.

Which of the following is the BEST way for management to ensure the effectiveness of the cybersecurity incident response process?

Periodic tabletop exercises involving key stakeholders

Periodic reporting of cybersecurity incidents to key stakeholders

Periodic update of incident response process documentation

Periodic cybersecurity training for staff involved in incident response

Periodic tabletop exercises involving key stakeholders

An organization's IT department and internal IS audit function all report to the chief information officer (CIO). Which of the following is the GREATEST concern associated with this reporting structure?

Compromise of IS audit independence

Potential for inaccurate audit findings

Compromise of IS audit independence

IS audit resources being shared with other IT functions

IS audit being isolated from other audit functions

Which of the following BEST contributes to the quality of an audit of a business-critical application?

Involving the application owner early in the audit planning process

Assigning the audit to independent external auditors

Reviewing previous findings reported by the application owner

Identifying common coding errors made by the development team

Involving the application owner early in the audit planning process

Which of the following methods would BEST help detect unauthorized disclosure of confidential documents sent over corporate email?

Monitoring all emails based on pre-defined criteria

Requiring all users to encrypt documents before sending

Installing firewalls on the corporate network

Reporting all outgoing emails that are marked as confidential

Monitoring all emails based on pre-defined criteria

An IS auditor reviewing the database controls for a new e-commerce system discovers a security weakness in the database configuration. Which of the following should be the IS auditor's NEXT course of action?

Identify existing mitigating controls.

Disclose the findings to senior management.

Assist in drafting corrective actions.

Attempt to exploit the weakness.

When planning a follow-up, the IS auditor is informed by operational management that recent organizational changes have addressed the previously identified risk and implementing the action plan is no longer necessary. What should the auditor do NEXT?

Accept management's assertion and report that the risks have been addressed.

Report that the changes make it impractical to determine whether the risks have been addressed.

Accept management's assertion and report that the risks have been addressed.

Determine whether the changes have introduced new risks that need to be addressed.

Review the changes and determine whether the risks have been addressed.

Which of the following would BEST indicate the effectiveness of a security awareness training program?

Reduced unintentional violations

Results of third-party social engineering tests

Employee satisfaction with training

Increased number of employees completing training

Reduced unintentional violations

Which of the following would be an auditor's GREATEST concern when reviewing data inputs from spreadsheets into the core finance system?

Undocumented code formats data and transmits directly to the database.

There is not a complete inventory of spreadsheets, and file naming is inconsistent.

The department data protection policy has not been reviewed or updated for two years.

Spreadsheets are accessible by all members of the finance department.

An IS audit manager is reviewing workpapers for a recently completed audit of the corporate disaster recovery test. Which of the following should the IS audit manager specifically review to substantiate the conclusions?

Detailed evidence of the successes and weaknesses of all contingency testing

Overviews of interviews between data center personnel and the auditor

Prior audit reports involving other corporate disaster recovery audits

Summary memos reflecting audit opinions regarding noted weaknesses

Detailed evidence of the successes and weaknesses of all contingency testing

Which of the following BEST enables an organization to improve the effectiveness of its incident response team?

Conducting periodic testing and incorporating lessons learned

Increasing the mean resolution time and publishing key performance indicator (KPI) metrics

Disseminating incident response procedures and requiring signed acknowledgment by team members

Ensuring all team members understand information systems technology

Which of the following BEST supports the effectiveness of a compliance program?

Assessing and tracking all compliance audit findings

Implementing an awareness plan regarding compliance regulation requirements

Implementing a governance, risk, and compliance (GRC) tool to track compliance to regulations

Assessing and tracking all compliance audit findings

Monitoring which compliance regulations apply to the organization

When reviewing past results of a recurring annual audit, an IS auditor notes that findings may not have been reported and independence may not have been maintained. Which of the following is the auditor's BEST course of action?

Re-perform past audits to ensure independence.

Which of the following is MOST important to consider when assessing the scope of privacy concerns for an IT project?

Applicable laws and regulations

Business requirements and data flows

A secure server room has a badge reader system that records name, date, and time information whenever a staff member uses a badge to enter or exit. When reviewing the system logs, an IS auditor notices records for some employees entering, but not exiting, the room. Which of the following would be the MOST effective compensating control to recommend?

Implementing a monitored mantrap at entrance and exit points

Installing security cameras at the doors

Changing to a biometric access control system

Implementing a monitored mantrap at entrance and exit points

Requiring two-factor authentication at entrance and exit points

An IS auditor learns that an organization's business continuity plan (BCP) has not been updated in the last 18 months and that the organization recently closed a production plant. Which of the following is the auditor's BEST course of action?

Determine whether the business impact analysis (BIA) is current with the organization's structure and context.

Determine the types of technologies used at the plant and how they may affect the BCP.

Perform testing to determine the impact to the recovery time objective (R TO).

Assess the risk to operations from the closing of the plant.

An IS auditor has been tasked with auditing the inventory control process for a large organization that processes millions of data transactions. Which of the following is the BEST testing strategy to adopt?

Control self-assessments (CSAs)

Which of the following is the BEST method to maintain an audit trail of changes made to the source code of a program?

Utilize automated version control.

Embed details within source code.

Standardize file naming conventions.

Utilize automated version control.

Document details on a change register.

An IS auditor Is reviewing a recent security incident and is seeking information about me approval of a recent modification to a database system's security settings Where would the auditor MOST likely find this information?

System event correlation report

Security incident and event management (SIEM) report

An internal audit team is deciding whether to use an audit management application hosted by a third party in a different country.What should be the MOST important consideration related to the uploading of payroll audit documentation in the hosted application?

Privacy regulations affecting the organization

Financial regulations affecting the organization

Data center physical access controls whore the application is hosted

Privacy regulations affecting the organization

Per-unit cost charged by the hosting services provider for storage

Data from a system of sensors located outside of a network is received by the open ports on a server. Which of the following is the BEST way to ensure the integrity of the data being collected from the sensor system?

Hash the data that is transmitted from the sensor system.

Route the traffic from the sensor system through a proxy server.

Hash the data that is transmitted from the sensor system.

Implement network address translation on the sensor system.

Transmit the sensor data via a virtual private network (VPN) to the server.

Which of the following is the GREATEST advantage of outsourcing the development of an e-banking solution when in-house technical expertise is not available?

Reduced risk of system downtime

Increased ability to adapt the system

Which of the following BEST demonstrates to senior management and the board that an audit function is compliant with standards and the code of ethics?

Control self-assessments (CSAs)

Which of the following is found in an audit charter?

The authority given to the audit function

The process of developing the annual audit plan

The authority given to the audit function

Required training for audit staff

Using swipe cards to limit employee access to restricted areas requires implementing which additional control?

Periodic review of access profiles by management

Physical sign-in of all employees for access to restricted areas

Implementation of additional PIN pads

Periodic review of access profiles by management

Installation of closed-circuit television (CCTV)

Which of the following audit procedures would provide the BEST assurance that an application program is functioning as designed?

Using a continuous auditing module

Interviewing business management

Reviewing program documentation

Which of the following is the MOST important responsibility of data owners when implementing a data classification process?

Determining appropriate user access levels

Reviewing emergency changes to data

Authorizing application code changes

Determining appropriate user access levels

Implementing access rules over database tables

Isaca CISA Practice Test 29 - Free Online Exam Prep & Questions

Which of the following would be the GREATEST concern to an IS auditor when reviewing the outsourcing contract for an organization's cloud service provider?

Become a Premium Member for full access

Unlock Premium Member

Isaca CISA Practice Test 29

Question

Isaca CISA Practice Tests

Practice Tests