An IS auditor finds that the cost of developing an application is now projected to significantly exceed the budget. Which of the following is the GREATEST risk to communicate to senior management?

Inability to achieve expected benefits

Noncompliance with project methodology

Inability to achieve expected benefits

Which of the following is the PRIMARY reason to involve IS auditors in the software acquisition process?

To help ensure hardware and operating system requirements are considered

To help ensure proposed contracts and service level agreements (SLAs) address key elements

To help ensure the project management process complies with policies and procedures

To help ensure adequate controls to address common threats and risks are considered

Which of the following BEST indicates to an IS auditor that an organization handles emergency changes appropriately and transparently?

The application operations manual contains procedures to ensure emergency fixes do not compromise system integrity.

Special logon IDs are used to grant programmers permanent access to the production environment.

Change management controls are retroactively applied.

Emergency changes are applied to production libraries immediately.

An organization produces control reports with a desktop application that accesses data in the central production database. Which of the following would give an IS auditor concern about the reliability of these reports?

The report definitions can be modified by end users.

The reports are printed by the same person who reviews them.

The reports are available to all end users.

The report definitions file is not included in routine backups.

The report definitions can be modified by end users.

During a pre-implementation review, an IS auditor notes that some scenarios have not been tested. Management has indicated that the project is critical and cannot be postponed. Which of the following is the auditor's BEST course of action?

Determine whether the tested scenarios covered the most significant project risks.

Help management complete remaining scenario testing before implementation.

Recommend project implementation be postponed until all scenarios have been tested.

Perform remaining scenario testing in the production environment post implementation.

During the course of fieldwork, an internal IS auditor observes a critical vulnerability within a newly deployed application. What is the auditor's BEST course of action?

Document the finding in the report.

Identify other potential vulnerabilities.

Report the finding to the external auditors.

Which of the following should be an IS auditor's GREATEST concern when assessing an IT service configuration database?

The database is write-accessible for all users.

The database is read-accessible for all users.

The database is write-accessible for all users.

The database is not encrypted at rest.

The database is executable for all users.

Which of the following is the MOST important privacy consideration for an organization that uses a cloud service provider to process customer data?

Customer data transferred to the service provider must be reported to the regulatory authority.

Data privacy must be managed in accordance with the regulations applicable to the organization.

Data privacy must be monitored in accordance with industry standards and best practices.

No personal information may be transferred to the service provider without notifying the customer.

Customer data transferred to the service provider must be reported to the regulatory authority.

Which of the following findings would be of GREATEST concern when reviewing project risk management practices?

Ongoing issues are not formally tracked.

There are no formal milestone sign-offs.

Qualitative risk analyses have not been updated.

Ongoing issues are not formally tracked.

Project management software is not being used.

An IS auditor finds that a new network connection allows communication between the Internet and the internal enterprise resource planning (ERP) system. Which of the following is the PRIMARY business impact to include when presenting this observation to management?

An increase to the threat landscape

A decrease in data quality in the ERP system

A decrease in network performance

An increase in potential fines from regulators

Which of the following is the PRIMARY benefit of effective implementation of appropriate data classification?

Management of business risk to sensitive data

Ability to meet business requirements

Assurance that sensitive data is encrypted

Increased accuracy of sensitive data

Management of business risk to sensitive data

A network analyst is monitoring the network after hours and detects activity that appears to be a brute-force attempt to compromise a critical server. After reviewing the alerts to ensure their accuracy, what should be done NEXT?

Invoke the incident response plan.

Document all steps taken in a written report.

Invoke the incident response plan.

During an IS audit of a data center, it was found that programmers are allowed to make emergency fixes to operational programs. Which of the following should be the IS auditor's PRIMARY recommendation?

Emergency program changes should be subject to program migration and testing procedures before they are applied to operational systems.

Programmers should be allowed to implement emergency fixes only after obtaining verbal agreement from the application owner.

Emergency program changes should be subject to program migration and testing procedures before they are applied to operational systems.

Bypass user ID procedures should be put in place to ensure that the changes are subject to after-the-event approval and testing.

What should be an IS auditor's PRIMARY focus when reviewing a patch management procedure in an environment where availability is a top priority?

Comprehensive testing prior to deployment

Deployment automation to all servers

Technical skills of the deployment team

Comprehensive testing prior to deployment

Validity certification prior to deployment

Which of the following observations should be of GREATEST concern to an IS auditor assessing access controls for the accounts payable module of a finance system?

Accounts payable staff have access to update vendor bank account details.

Payment files are stored on a shared drive in a writable format prior to processing.

Accounts payable staff have access to update vendor bank account details.

The IS auditor was granted access to create purchase orders.

Configured delegation limits do not align to the organization's delegation's policy.

To help determine whether a controls-reliant approach to auditing financial systems in a company should be used, which sequence of IS audit work is MOST appropriate?

Review of the general IS controls followed by a review of the application controls

Detailed examination of financial transactions followed by review of the general ledger

Review of major financial applications followed by a review of IT governance processes

Review of application controls followed by a test of key business process controls

While reviewing the effectiveness of an incident response program, an IS auditor notices a high number of reported incidents involving malware originating from removable media found by employees. Which of the following is the MOST appropriate recommendation to management?

Implement an organization-wide removable media policy.

Restrict access to removable media ports on company devices.

Install an additional antivirus program to increase protection.

Ensure the antivirus program contains up-to-date signature files for all company devices.

Implement an organization-wide removable media policy.

An IS auditor is reviewing a network diagram. Which of the following would be the BEST location for placement of a firewall?

At borders of network segments with different security levels

Between each host and the local network switch/hub

Between virtual local area networks (VLANs)

Inside the demilitarized zone (DMZ)

At borders of network segments with different security levels

When auditing the adequacy of a cooling system for a data center, which of the following is MOST important for the IS auditor to review?

Environmental performance metrics

Geographical location of the data center

Disaster recovery plan (DRP) testing results

Which of the following BEST enables an IS auditor to prioritize financial reporting spreadsheets for an end-user computing (EUC) audit?

Understanding the purpose of each spreadsheet

Identifying the spreadsheets with built-in macros

Reviewing spreadsheets based on file size

Ascertaining which spreadsheets are most frequently used

Which of the following is the BEST recommendation to drive accountability for achieving the desired outcomes specified in a benefits realization plan for an IT project?

Assign responsibilities, measures, and timelines for each identified benefit within the plan.

Document the dependencies between the project and other projects within the same program.

Ensure that IT takes ownership for the delivery and tracking of all aspects of the benefits realization plan.

Ensure that the project manager has formal authority for managing the benefits realization plan.

Assign responsibilities, measures, and timelines for each identified benefit within the plan.

Which of the following should be the PRIMARY objective of conducting an audit follow-up of management action plans?

To verify that risks listed in the audit report have been properly mitigated

To identify new risks and controls for the organization

To ensure senior management is aware of the audit findings

To align the management action plans with business requirements

An organization has decided to purchase a web-based email service from a third-party vendor and eliminate its own email server infrastructure. What type of cloud computing environment would BEST meet the organization's objective?

Infrastructure as a Service (laaS)

An IS auditor is reviewing an artificial intelligence (Al) and expert system application. The system has produced several critical errors with severe impact. Which of the following should the IS auditor do NEXT to understand the cause of the errors?

Review the decision-making logic built into the system.

Understand the purpose and functionality of the system.

Verify system adherence to corporate policy.

Which of the following will BEST ensure that archived electronic information of permanent importance remains accessible over time?

Regularly migrating data to current technology

Performing preventive maintenance on old hardware

Acquiring applications that emulate old software

Regularly migrating data to current technology

Periodically backing up archived data

An organization has decided to build a data warehouse using source data from several disparate systems to support strategic decision-making.Which of the following is the BEST way to ensure the accuracy and completeness of the data used to support business decisions?

The source data is standardized and cleansed before loading into the data warehouse.

The source data is pre-selected so that it already supports senior management's desired business decision outcome.

The source data is from the current year of operations so that irrelevant data from prior years is not included.

The source data is modified in the data warehouse to remove confidential or sensitive information.

The source data is standardized and cleansed before loading into the data warehouse.

Which of the following poses the GREATEST risk to an organization related to system interfaces?

There is no reliable inventory of system interfaces.

There is no process documentation for some system interfaces.

Notifications of data transfers through the interfaces are not retained.

Parts of the data transfer process are performed manually.

There is no reliable inventory of system interfaces.

Which of the following would be MOST helpful to an IS auditor performing a risk assessment of an application programming interface (API) that feeds credit scores from a well-known commercial credit agency into an organizational system?

A technical design document for the interface configuration

A data dictionary of the transferred data

A technical design document for the interface configuration

The most recent audit report from the credit agency

The approved business case for the API

IT management has accepted the risk associated with an IS auditor's finding due to the cost and complexity of the corrective actions. Which of the following should be the auditor's NEXT course of action?

Document and inform the audit committee.

Perform a cost-benefit analysis.

Document and inform the audit committee.

Report the finding to external regulators.

The MOST important measure of the effectiveness of an organization's security program is the:

adverse impact of incidents on critical business activities.

comparison with critical incidents experienced by competitors.

number of vulnerability alerts escalated to senior management.

number of new vulnerabilities reported.

adverse impact of incidents on critical business activities.

Isaca CISA Practice Test 30 - Free Online Exam Prep & Questions

An IS auditor is evaluating an enterprise resource planning (ERP) migration from local systems to the cloud. Who should be responsible for the data classification in this project?

Become a Premium Member for full access

Unlock Premium Member

Isaca CISA Practice Test 30

Question

Isaca CISA Practice Tests

Practice Tests